Analysis
-
max time kernel
75s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
28/10/2022, 19:38
Static task
static1
Behavioral task
behavioral1
Sample
362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe
Resource
win7-20220812-en
windows7-x64
15 signatures
150 seconds
General
-
Target
362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe
-
Size
406KB
-
MD5
0c2108ea7ab11435814ac85a31bbb840
-
SHA1
3fe24fdb348c62e93e85f8c22dbdca20e4f27b12
-
SHA256
362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465
-
SHA512
787dcf792acd787e9ab1a00dd7815a23ecaf3483f7f71205b4e28f79e5d27bd335f727cc052d6554943446453904d82c4ff663655e3bd64b4fc818f5b6ad1b78
-
SSDEEP
6144:L2EGyyn8t8qgCJsuIrELgoNPrpO7LIyPLldmbvuXMjR1y9lZpOaZU+gsOLs:LYqgNuIrEkoNk7L6zSZpORTs
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
http://klkjwre77638dfqwieuoi888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe -
Disables Task Manager via registry modification
-
resource yara_rule behavioral2/memory/2556-133-0x0000000002EB0000-0x0000000003F3E000-memory.dmp upx behavioral2/memory/2556-135-0x0000000002EB0000-0x0000000003F3E000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Temp AdobeARM.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Backup AdobeARM.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe Token: SeDebugPrivilege 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2240 AdobeARM.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2556 wrote to memory of 780 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe 8 PID 2556 wrote to memory of 788 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe 13 PID 2556 wrote to memory of 1016 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe 10 PID 2556 wrote to memory of 2336 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe 23 PID 2556 wrote to memory of 2376 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe 60 PID 2556 wrote to memory of 2608 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe 25 PID 2556 wrote to memory of 2724 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe 51 PID 2556 wrote to memory of 3096 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe 50 PID 2556 wrote to memory of 3292 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe 49 PID 2556 wrote to memory of 3444 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe 47 PID 2556 wrote to memory of 3524 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe 26 PID 2556 wrote to memory of 3608 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe 46 PID 2556 wrote to memory of 3888 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe 45 PID 2556 wrote to memory of 4852 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe 27 PID 2556 wrote to memory of 2012 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe 29 PID 2556 wrote to memory of 2128 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe 81 PID 2556 wrote to memory of 2240 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe 82 PID 2556 wrote to memory of 2240 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe 82 PID 2556 wrote to memory of 2240 2556 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe 82 PID 2240 wrote to memory of 4660 2240 AdobeARM.exe 90 PID 2240 wrote to memory of 4660 2240 AdobeARM.exe 90 PID 2240 wrote to memory of 4660 2240 AdobeARM.exe 90 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1016
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2336
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2608
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3524
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4852
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2012
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3888
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3608
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3444
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3292
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3096
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe"C:\Users\Admin\AppData\Local\Temp\362b2faba4d4a49b94d0616464512aa46284d1304224e10569a72f6d2975a465.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2556 -
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"3⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"4⤵PID:4660
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2376
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2128
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
358B
MD535030e8b3a29acc1ed66c81d59819687
SHA12e434c8e0e1c2e1a5874800b811167e65eb13f99
SHA256bb2ec14e754d04ae05468b356a7b2670814b86888343c7bbe0942afd872a6d64
SHA5125a2bb6472dce7f037ef3239746dc27a18304000738108559d2322ebeee0289fdc20cb44e391dfd5561adb9300a7dea9769181983503f13b69420ac056ba7fee7