Overview
overview
6Static
static
3册2 相�...��.url
windows7-x64
1册2 相�...��.url
windows10-2004-x64
1册2 相�...�.html
windows7-x64
1册2 相�...�.html
windows10-2004-x64
1册2 相�...min.js
windows7-x64
1册2 相�...min.js
windows10-2004-x64
1册2 相�...��.url
windows7-x64
1册2 相�...��.url
windows10-2004-x64
1册2 相�...��.pdf
windows7-x64
1册2 相�...��.pdf
windows10-2004-x64
1册2 相�...��.pdf
windows7-x64
1册2 相�...��.pdf
windows10-2004-x64
1册2 相�...�.docx
windows7-x64
6册2 相�...�.docx
windows10-2004-x64
1册2 相�...��.pdf
windows7-x64
1册2 相�...��.pdf
windows10-2004-x64
1册2 相�...7.xlsm
windows7-x64
1册2 相�...7.xlsm
windows10-2004-x64
1册2 相�...�.docx
windows7-x64
4册2 相�...�.docx
windows10-2004-x64
1Analysis
-
max time kernel
95s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-10-2022 03:38
Behavioral task
behavioral1
Sample
册2 相关支持性材料/4-2-1 国内流行病学数据或销量数据等支撑材料/人口增长率.url
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
册2 相关支持性材料/4-2-1 国内流行病学数据或销量数据等支撑材料/人口增长率.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
册2 相关支持性材料/4-2-1 国内流行病学数据或销量数据等支撑材料/人口数.html
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
册2 相关支持性材料/4-2-1 国内流行病学数据或销量数据等支撑材料/人口数.html
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
册2 相关支持性材料/4-2-1 国内流行病学数据或销量数据等支撑材料/人口数_files/allmobilize.min.js
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
册2 相关支持性材料/4-2-1 国内流行病学数据或销量数据等支撑材料/人口数_files/allmobilize.min.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
册2 相关支持性材料/4-2-1 国内流行病学数据或销量数据等支撑材料/医保覆盖率.url
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
册2 相关支持性材料/4-2-1 国内流行病学数据或销量数据等支撑材料/医保覆盖率.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
册2 相关支持性材料/4-2-1 国内流行病学数据或销量数据等支撑材料/年用药时长.pdf
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
册2 相关支持性材料/4-2-1 国内流行病学数据或销量数据等支撑材料/年用药时长.pdf
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
册2 相关支持性材料/4-2-1 国内流行病学数据或销量数据等支撑材料/成年MDD患病率.pdf
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
册2 相关支持性材料/4-2-1 国内流行病学数据或销量数据等支撑材料/成年MDD患病率.pdf
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
册2 相关支持性材料/4-2-1 国内流行病学数据或销量数据等支撑材料/抗抑郁药的销量数据.docx
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
册2 相关支持性材料/4-2-1 国内流行病学数据或销量数据等支撑材料/抗抑郁药的销量数据.docx
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
册2 相关支持性材料/4-2-1 国内流行病学数据或销量数据等支撑材料/诊断率和药物治疗率.pdf
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
册2 相关支持性材料/4-2-1 国内流行病学数据或销量数据等支撑材料/诊断率和药物治疗率.pdf
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
册2 相关支持性材料/4-2-2 国内预算影响分析报告及分析模型电子版/Lee BIA 模型 17.xlsm
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
册2 相关支持性材料/4-2-2 国内预算影响分析报告及分析模型电子版/Lee BIA 模型 17.xlsm
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
册2 相关支持性材料/4-2-2 国内预算影响分析报告及分析模型电子版/盐酸曲唑.docx
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
册2 相关支持性材料/4-2-2 国内预算影响分析报告及分析模型电子版/盐酸曲唑.docx
Resource
win10v2004-20220812-en
General
-
Target
册2 相关支持性材料/4-2-1 国内流行病学数据或销量数据等支撑材料/年用药时长.pdf
-
Size
737KB
-
MD5
010d197c38036295b7c3767f955d39df
-
SHA1
629f479d41957f7557416fbdb058607eb0cae4cf
-
SHA256
2cf511f4c564a19b427c10dfdf0992bbea4b88a9476b206795793c5b2d2b8fc8
-
SHA512
435fd106285ffe4944362fd05d7cc22eae200be18d719e23175e314dd8d0dfd7629f092d1aabf57e69e65106a859a05b3f38b39e0bd0bde1a573142be1e7a06a
-
SSDEEP
12288:AKtfclNlmJRl1jlBlMlGl+l0cSlaSlOllldglOSlBG3l7la/lQlolulfgb3GWjWg:AKthJMjJoUaIbD3oxPRXT3D
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
AcroRd32.exepid process 1692 AcroRd32.exe 1692 AcroRd32.exe 1692 AcroRd32.exe 1692 AcroRd32.exe 1692 AcroRd32.exe 1692 AcroRd32.exe 1692 AcroRd32.exe 1692 AcroRd32.exe 1692 AcroRd32.exe 1692 AcroRd32.exe 1692 AcroRd32.exe 1692 AcroRd32.exe 1692 AcroRd32.exe 1692 AcroRd32.exe 1692 AcroRd32.exe 1692 AcroRd32.exe 1692 AcroRd32.exe 1692 AcroRd32.exe 1692 AcroRd32.exe 1692 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 1692 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
AcroRd32.exepid process 1692 AcroRd32.exe 1692 AcroRd32.exe 1692 AcroRd32.exe 1692 AcroRd32.exe 1692 AcroRd32.exe 1692 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 1692 wrote to memory of 4320 1692 AcroRd32.exe RdrCEF.exe PID 1692 wrote to memory of 4320 1692 AcroRd32.exe RdrCEF.exe PID 1692 wrote to memory of 4320 1692 AcroRd32.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 4388 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 1916 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 1916 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 1916 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 1916 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 1916 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 1916 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 1916 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 1916 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 1916 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 1916 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 1916 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 1916 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 1916 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 1916 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 1916 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 1916 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 1916 4320 RdrCEF.exe RdrCEF.exe PID 4320 wrote to memory of 1916 4320 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\册2 相关支持性材料\4-2-1 国内流行病学数据或销量数据等支撑材料\年用药时长.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2F789A4A8F10C2F50671AE4C4BEAC9FC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2F789A4A8F10C2F50671AE4C4BEAC9FC --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D8066B3281496CCE509E62D4520FC87E --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=363467F9CBDD3355B714F4BFDC980DF0 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EF592BEED17682AF5D168EE1BE116791 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EF592BEED17682AF5D168EE1BE116791 --renderer-client-id=5 --mojo-platform-channel-handle=2128 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=51318FAAA2AD5B5AE9E7792D6CF39473 --mojo-platform-channel-handle=2596 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9690A154D7C591FC2A0DDBC24312939A --mojo-platform-channel-handle=2784 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/612-145-0x0000000000000000-mapping.dmp
-
memory/1772-142-0x0000000000000000-mapping.dmp
-
memory/1916-137-0x0000000000000000-mapping.dmp
-
memory/3420-150-0x0000000000000000-mapping.dmp
-
memory/4320-132-0x0000000000000000-mapping.dmp
-
memory/4388-134-0x0000000000000000-mapping.dmp
-
memory/4404-153-0x0000000000000000-mapping.dmp