Overview
overview
7Static
static
3ide-eval-r....6.jar
windows7-x64
1ide-eval-r....6.jar
windows10-2004-x64
1JetBrains ...ME.pdf
windows7-x64
1JetBrains ...ME.pdf
windows10-2004-x64
5JetBrains ...er.jar
windows7-x64
1JetBrains ...er.jar
windows10-2004-x64
1JetBrains ...ns.jar
windows7-x64
1JetBrains ...ns.jar
windows10-2004-x64
1JetBrains ...me.jar
windows7-x64
1JetBrains ...me.jar
windows10-2004-x64
1JetBrains ...ap.jar
windows7-x64
1JetBrains ...ap.jar
windows10-2004-x64
1JetBrains ...er.jar
windows7-x64
1JetBrains ...er.jar
windows10-2004-x64
1JetBrains ...rl.jar
windows7-x64
1JetBrains ...rl.jar
windows10-2004-x64
1JetBrains ...rs.vbs
windows7-x64
3JetBrains ...rs.vbs
windows10-2004-x64
7JetBrains ...er.vbs
windows7-x64
1JetBrains ...er.vbs
windows10-2004-x64
1JetBrains ...all.sh
ubuntu-18.04-amd64
5JetBrains ...all.sh
debian-9-armhf
5JetBrains ...all.sh
debian-9-mips
5JetBrains ...all.sh
debian-9-mipsel
5JetBrains ...rs.vbs
windows7-x64
3JetBrains ...rs.vbs
windows10-2004-x64
7JetBrains ...er.vbs
windows7-x64
1JetBrains ...er.vbs
windows10-2004-x64
1JetBrains ...all.sh
ubuntu-18.04-amd64
5JetBrains ...all.sh
debian-9-armhf
5JetBrains ...all.sh
debian-9-mips
5JetBrains ...all.sh
debian-9-mipsel
5Analysis
-
max time kernel
106s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
16-08-2022 02:49
Behavioral task
behavioral1
Sample
ide-eval-resetter/lib/ide-eval-resetter-2.1.6.jar
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ide-eval-resetter/lib/ide-eval-resetter-2.1.6.jar
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/README.pdf
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/README.pdf
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/ja-netfilter.jar
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/ja-netfilter.jar
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/plugins-jetbrains/dns.jar
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/plugins-jetbrains/dns.jar
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/plugins-jetbrains/hideme.jar
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/plugins-jetbrains/hideme.jar
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/plugins-jetbrains/mymap.jar
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/plugins-jetbrains/mymap.jar
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/plugins-jetbrains/power.jar
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/plugins-jetbrains/power.jar
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/plugins-jetbrains/url.jar
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/plugins-jetbrains/url.jar
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/install-all-users.vbs
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/install-all-users.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/install-current-user.vbs
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/install-current-user.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/install.sh
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral22
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/install.sh
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral23
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/install.sh
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral24
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/install.sh
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral25
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/uninstall-all-users.vbs
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/uninstall-all-users.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/uninstall-current-user.vbs
Resource
win7-20220812-en
Behavioral task
behavioral28
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/uninstall-current-user.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/uninstall.sh
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral30
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/uninstall.sh
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral31
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/uninstall.sh
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral32
Sample
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/uninstall.sh
Resource
debian9-mipsel-en-20211208
General
-
Target
JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/README.pdf
-
Size
54KB
-
MD5
8ce55044d4f07f14c10018313ae341f1
-
SHA1
a18cf7130c4e22ac068b3581f558162026884805
-
SHA256
2b6d5f0d5e1ffe4046007ad6cf37dd026d762feac08057a002013efa91ea566f
-
SHA512
fe61ac988375f739c2141e586745268c30a6690884ff2d65b10d7353eba760d46be5929b2efce36b9f80166e3b6e4ade67529ac044658a26ff6ec75750d165f1
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{102D8093-8D5F-4433-91F1-5467405CBE4D}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{5C3A7AD6-39A0-4BA5-9531-DC827C3E5D57}.catalogItem svchost.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exeAcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
AcroRd32.exepid process 1076 AcroRd32.exe 1076 AcroRd32.exe 1076 AcroRd32.exe 1076 AcroRd32.exe 1076 AcroRd32.exe 1076 AcroRd32.exe 1076 AcroRd32.exe 1076 AcroRd32.exe 1076 AcroRd32.exe 1076 AcroRd32.exe 1076 AcroRd32.exe 1076 AcroRd32.exe 1076 AcroRd32.exe 1076 AcroRd32.exe 1076 AcroRd32.exe 1076 AcroRd32.exe 1076 AcroRd32.exe 1076 AcroRd32.exe 1076 AcroRd32.exe 1076 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 1076 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
AcroRd32.exepid process 1076 AcroRd32.exe 1076 AcroRd32.exe 1076 AcroRd32.exe 1076 AcroRd32.exe 1076 AcroRd32.exe 1076 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 1076 wrote to memory of 1900 1076 AcroRd32.exe RdrCEF.exe PID 1076 wrote to memory of 1900 1076 AcroRd32.exe RdrCEF.exe PID 1076 wrote to memory of 1900 1076 AcroRd32.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 4172 1900 RdrCEF.exe RdrCEF.exe PID 1076 wrote to memory of 4604 1076 AcroRd32.exe RdrCEF.exe PID 1076 wrote to memory of 4604 1076 AcroRd32.exe RdrCEF.exe PID 1076 wrote to memory of 4604 1076 AcroRd32.exe RdrCEF.exe PID 1900 wrote to memory of 1644 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 1644 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 1644 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 1644 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 1644 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 1644 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 1644 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 1644 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 1644 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 1644 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 1644 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 1644 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 1644 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 1644 1900 RdrCEF.exe RdrCEF.exe PID 1900 wrote to memory of 1644 1900 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\JetBrains 2022 __\__2____2099____________\ja-netfilter-all\README.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5A7A2C3C7749409CB1DB008189683B24 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5A7A2C3C7749409CB1DB008189683B24 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:13⤵PID:4172
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C9EC30A77A6D8B6A44F630CBE1F023CB --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1644
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5B320B7272D2DBF434A85DFD7A99C95C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5B320B7272D2DBF434A85DFD7A99C95C --renderer-client-id=4 --mojo-platform-channel-handle=2184 --allow-no-sandbox-job /prefetch:13⤵PID:2348
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=922D38855B4B54D640C117BE59DFFFE5 --mojo-platform-channel-handle=2556 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4056
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E16AC577D49B2FB5057BB6FCABA8E1AB --mojo-platform-channel-handle=2676 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3236
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=11523220264F9658EBB13DF92E80A7AC --mojo-platform-channel-handle=2652 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2280
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵PID:4604
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:4220
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:616