Overview
overview
3Static
static
3証拠/gon...er.pdf
windows7-x64
1証拠/gon...er.pdf
windows10-2004-x64
1証拠/gon...er.pdf
windows7-x64
1証拠/gon...er.pdf
windows10-2004-x64
1証拠/gon...er.pdf
windows7-x64
1証拠/gon...er.pdf
windows10-2004-x64
1証拠/gon...er.pdf
windows7-x64
1証拠/gon...er.pdf
windows10-2004-x64
1証拠/mor...��.pdf
windows7-x64
1証拠/mor...��.pdf
windows10-2004-x64
1証拠/mor...er.pdf
windows7-x64
1証拠/mor...er.pdf
windows10-2004-x64
1証拠/mor...er.pdf
windows7-x64
1証拠/mor...er.pdf
windows10-2004-x64
1証拠/mor...��.pdf
windows7-x64
1証拠/mor...��.pdf
windows10-2004-x64
1証拠/mor...er.pdf
windows7-x64
1証拠/mor...er.pdf
windows10-2004-x64
1証拠/mor...er.pdf
windows7-x64
1証拠/mor...er.pdf
windows10-2004-x64
1証拠/mor...er.pdf
windows7-x64
1証拠/mor...er.pdf
windows10-2004-x64
1証拠/mor...��.pdf
windows7-x64
1証拠/mor...��.pdf
windows10-2004-x64
1証拠/mor...er.pdf
windows7-x64
1証拠/mor...er.pdf
windows10-2004-x64
1証拠/mor...er.pdf
windows7-x64
1証拠/mor...er.pdf
windows10-2004-x64
1証拠/mor...er.pdf
windows7-x64
1証拠/mor...er.pdf
windows10-2004-x64
1証拠/mor...er.pdf
windows7-x64
1証拠/mor...er.pdf
windows10-2004-x64
1Analysis
-
max time kernel
78s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-10-2022 16:50
Behavioral task
behavioral1
Sample
証拠/gontamorin/もるごん (@gontamorin) _ Twitter.pdf
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
証拠/gontamorin/もるごん (@gontamorin) _ Twitter.pdf
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
証拠/gontamorin/もるごんさんはTwitterを使っています_ 「こいつ頭悪すぎ」 _ Twitter.pdf
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
証拠/gontamorin/もるごんさんはTwitterを使っています_ 「こいつ頭悪すぎ」 _ Twitter.pdf
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
証拠/gontamorin/もるごんさんはTwitterを使っています_ 「こいつ頭悪すぎだろ」 _ Twitter.pdf
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
証拠/gontamorin/もるごんさんはTwitterを使っています_ 「こいつ頭悪すぎだろ」 _ Twitter.pdf
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
証拠/gontamorin/もるごんさんはTwitterを使っています_ 「無能発見」 _ Twitter.pdf
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
証拠/gontamorin/もるごんさんはTwitterを使っています_ 「無能発見」 _ Twitter.pdf
Resource
win10v2004-20220901-en
Behavioral task
behavioral9
Sample
証拠/morigoooo2/ごんもり on Twitter_ _いやこいつ普通見たら予想つくだろ。頭��.pdf
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
証拠/morigoooo2/ごんもり on Twitter_ _いやこいつ普通見たら予想つくだろ。頭��.pdf
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
証拠/morigoooo2/ごんもり on Twitter_ _こいつガイジだわ。_ _ Twitter.pdf
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
証拠/morigoooo2/ごんもり on Twitter_ _こいつガイジだわ。_ _ Twitter.pdf
Resource
win10v2004-20220901-en
Behavioral task
behavioral13
Sample
証拠/morigoooo2/ごんもり on Twitter_ _こいつサイコパスやん_ _ Twitter.pdf
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
証拠/morigoooo2/ごんもり on Twitter_ _こいつサイコパスやん_ _ Twitter.pdf
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
証拠/morigoooo2/ごんもり on Twitter_ _こいつ結局野球見たいだけやん。 人間と�.pdf
Resource
win7-20220901-en
Behavioral task
behavioral16
Sample
証拠/morigoooo2/ごんもり on Twitter_ _こいつ結局野球見たいだけやん。 人間と�.pdf
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
証拠/morigoooo2/ごんもり on Twitter_ _こいつ頭悪そうやなwww_ _ Twitter.pdf
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
証拠/morigoooo2/ごんもり on Twitter_ _こいつ頭悪そうやなwww_ _ Twitter.pdf
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
証拠/morigoooo2/ごんもり on Twitter_ _こういう奴がいつか人とか轢くんだろうな〜_ _ Twitter.pdf
Resource
win7-20220901-en
Behavioral task
behavioral20
Sample
証拠/morigoooo2/ごんもり on Twitter_ _こういう奴がいつか人とか轢くんだろうな〜_ _ Twitter.pdf
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
証拠/morigoooo2/ごんもり on Twitter_ _こういう奴が犯罪犯すんだよな〜_ _ Twitter.pdf
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
証拠/morigoooo2/ごんもり on Twitter_ _こういう奴が犯罪犯すんだよな〜_ _ Twitter.pdf
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
証拠/morigoooo2/ごんもり on Twitter_ _すぐ離婚する奴って人間性に問題がある��.pdf
Resource
win7-20220901-en
Behavioral task
behavioral24
Sample
証拠/morigoooo2/ごんもり on Twitter_ _すぐ離婚する奴って人間性に問題がある��.pdf
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
証拠/morigoooo2/ごんもり on Twitter_ _ほんまに雑魚やな https___t.co_NruQ9p4L2U_ _ Twitter.pdf
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
証拠/morigoooo2/ごんもり on Twitter_ _ほんまに雑魚やな https___t.co_NruQ9p4L2U_ _ Twitter.pdf
Resource
win10v2004-20220901-en
Behavioral task
behavioral27
Sample
証拠/morigoooo2/ごんもり on Twitter_ _また被害妄想ですか......_ _ Twitter.pdf
Resource
win7-20220812-en
Behavioral task
behavioral28
Sample
証拠/morigoooo2/ごんもり on Twitter_ _また被害妄想ですか......_ _ Twitter.pdf
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
証拠/morigoooo2/ごんもり on Twitter_ _やったぜ_ _ Twitter.pdf
Resource
win7-20220901-en
Behavioral task
behavioral30
Sample
証拠/morigoooo2/ごんもり on Twitter_ _やったぜ_ _ Twitter.pdf
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
証拠/morigoooo2/ごんもり on Twitter_ _リプ制限のクソ野郎_ _ Twitter.pdf
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
証拠/morigoooo2/ごんもり on Twitter_ _リプ制限のクソ野郎_ _ Twitter.pdf
Resource
win10v2004-20220812-en
General
-
Target
証拠/morigoooo2/ごんもり on Twitter_ _すぐ離婚する奴って人間性に問題がある��.pdf
-
Size
356KB
-
MD5
bc1440aa7d426a59d4a1861b59e97ab7
-
SHA1
7ec0d502ac0c38460a9c9a71e85a9bb6f1a9a290
-
SHA256
45d2ea4c89a9941190a8f1dc8f46ab718f67e356bf566e950970fed3eb95fb5c
-
SHA512
1a0d67b95dba40211d3f67570bbaefe822e875445a52b0c9007c5f815023da6889a2df7700c8c0950113e900de904a1f3f38a523b68aa35799ead04f1b1db25d
-
SSDEEP
6144:d7xvbW9rpvNSSNXcGGZIoIMKKVUrXZ4qUks:d7xjW9rLSSNX6iVPprJs
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
AcroRd32.exepid process 1696 AcroRd32.exe 1696 AcroRd32.exe 1696 AcroRd32.exe 1696 AcroRd32.exe 1696 AcroRd32.exe 1696 AcroRd32.exe 1696 AcroRd32.exe 1696 AcroRd32.exe 1696 AcroRd32.exe 1696 AcroRd32.exe 1696 AcroRd32.exe 1696 AcroRd32.exe 1696 AcroRd32.exe 1696 AcroRd32.exe 1696 AcroRd32.exe 1696 AcroRd32.exe 1696 AcroRd32.exe 1696 AcroRd32.exe 1696 AcroRd32.exe 1696 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 1696 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
AcroRd32.exepid process 1696 AcroRd32.exe 1696 AcroRd32.exe 1696 AcroRd32.exe 1696 AcroRd32.exe 1696 AcroRd32.exe 1696 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 1696 wrote to memory of 1248 1696 AcroRd32.exe RdrCEF.exe PID 1696 wrote to memory of 1248 1696 AcroRd32.exe RdrCEF.exe PID 1696 wrote to memory of 1248 1696 AcroRd32.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 220 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 3936 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 3936 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 3936 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 3936 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 3936 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 3936 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 3936 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 3936 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 3936 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 3936 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 3936 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 3936 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 3936 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 3936 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 3936 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 3936 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 3936 1248 RdrCEF.exe RdrCEF.exe PID 1248 wrote to memory of 3936 1248 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\証拠\morigoooo2\ごんもり on Twitter_ _すぐ離婚する奴って人間性に問題がある��.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8931831CF11B3E049F4E7859A34308D3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8931831CF11B3E049F4E7859A34308D3 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F91C04EACC5EB0B6B35CBD0900FD2915 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=55DB9D15884D236459BB9250DC295006 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=55DB9D15884D236459BB9250DC295006 --renderer-client-id=4 --mojo-platform-channel-handle=2332 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AA15FF506327E1C86615421CCC999A73 --mojo-platform-channel-handle=2676 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A528FF1D1DB65E9DCEFEB9A26E7C207A --mojo-platform-channel-handle=2788 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=32DB14F1521B99F68DA5D629A6FE782B --mojo-platform-channel-handle=2668 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/220-134-0x0000000000000000-mapping.dmp
-
memory/1204-147-0x0000000000000000-mapping.dmp
-
memory/1248-132-0x0000000000000000-mapping.dmp
-
memory/1560-153-0x0000000000000000-mapping.dmp
-
memory/2504-150-0x0000000000000000-mapping.dmp
-
memory/3604-142-0x0000000000000000-mapping.dmp
-
memory/3936-137-0x0000000000000000-mapping.dmp