Analysis
- max time kernel
103s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
23/12/2022, 10:41
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://download.cdn.mozilla.net/pub/firefox/releases/72.0.2/update/win64/en-US/firefox-71.0-72.0.2.partial.mar
Resource
win7-20220901-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
http://download.cdn.mozilla.net/pub/firefox/releases/72.0.2/update/win64/en-US/firefox-71.0-72.0.2.partial.mar
Resource
win10v2004-20221111-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target http://download.cdn.mozilla.net/pub/firefox/releases/72.0.2/update/win64/en-US/firefox-71.0-72.0.2.partial.mar
- Sample221223-mq3b8abe4x
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe - Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = ebb3b15315f6d801 iexplore.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2221845101" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e6851ef31fd3cf49b332bbb4721c9748000000000200000000001066000000010000200000001264bc65cd74dc443ce3ce7620d6cdccea41f9eec6c3d889a611e869086916ab000000000e80000000020000200000009659d131413cf9c26c6c73d11d542b010e9ff60b64568fe004fa07c3ed0964f2200000006cab4234a97bbaca837bb0ca9fab4b70bf790d4f4c319588639fbc3668bb4791400000005b371d7345c659fef756bf23e58d581b42285788f9b29286fb6adab4362b86d9465e37d3f7e37c0fe225c2698507d1c302eea232174316cfa3fdbdb59bd13bad iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "378560640" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{AEC50EDD-82B6-11ED-919F-66CD4AA2E676} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2203405137" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31004355" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1075a584c316d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff100100003c000000900300001c020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e6851ef31fd3cf49b332bbb4721c97480000000002000000000010660000000100002000000005491cf7e5875e6b8ed11ad0eea2384c45daa8b8d8430aa601fd8212cddf5c6a000000000e8000000002000020000000a583ce4a20147cd050b7559a6b456858b57e5b6a9332f244201cb717956b128320000000b12ae116a049f4c6caa0ce08729b1cfbee0e39823a0bf839988f9fa4496a5c6640000000596819e31ba6a38bf88c31edfc1f4ff6f3399b288115f2a270503d112532d2d18b65170a2729725626fade775e72e2a23905110cbec66f794f5a6bee728a0297 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f05bb184c316d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\RepId iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{9CC8A8A3-4703-48B2-A22C-93DB61E4CE53}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31004355" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2203405137" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31004355" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe - Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\.mar OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\mar_auto_file OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\mar_auto_file\shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\mar_auto_file\shell\Read\command OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\.mar\ = "mar_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\mar_auto_file\shell\Read OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\mar_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" \"%1\"" OpenWith.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 4444 AcroRd32.exe 4444 AcroRd32.exe 4444 AcroRd32.exe 4444 AcroRd32.exe 4444 AcroRd32.exe 4444 AcroRd32.exe 4444 AcroRd32.exe 4444 AcroRd32.exe 4444 AcroRd32.exe 4444 AcroRd32.exe 4444 AcroRd32.exe 4444 AcroRd32.exe 4444 AcroRd32.exe 4444 AcroRd32.exe 4444 AcroRd32.exe 4444 AcroRd32.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1864 OpenWith.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 5056 iexplore.exe 5056 iexplore.exe 4444 AcroRd32.exe - Suspicious use of SetWindowsHookEx 25 IoCs
pid Process 5056 iexplore.exe 5056 iexplore.exe 4488 IEXPLORE.EXE 4488 IEXPLORE.EXE 1864 OpenWith.exe 1864 OpenWith.exe 1864 OpenWith.exe 1864 OpenWith.exe 1864 OpenWith.exe 1864 OpenWith.exe 1864 OpenWith.exe 1864 OpenWith.exe 1864 OpenWith.exe 1864 OpenWith.exe 1864 OpenWith.exe 1864 OpenWith.exe 1864 OpenWith.exe 1864 OpenWith.exe 1864 OpenWith.exe 4444 AcroRd32.exe 4444 AcroRd32.exe 4444 AcroRd32.exe 4444 AcroRd32.exe 4444 AcroRd32.exe 4444 AcroRd32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5056 wrote to memory of 4488 5056 iexplore.exe 82 PID 5056 wrote to memory of 4488 5056 iexplore.exe 82 PID 5056 wrote to memory of 4488 5056 iexplore.exe 82 PID 1864 wrote to memory of 4444 1864 OpenWith.exe 94 PID 1864 wrote to memory of 4444 1864 OpenWith.exe 94 PID 1864 wrote to memory of 4444 1864 OpenWith.exe 94 PID 4444 wrote to memory of 3996 4444 AcroRd32.exe 97 PID 4444 wrote to memory of 3996 4444 AcroRd32.exe 97 PID 4444 wrote to memory of 3996 4444 AcroRd32.exe 97 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3696 3996 RdrCEF.exe 98 PID 3996 wrote to memory of 3152 3996 RdrCEF.exe 99 PID 3996 wrote to memory of 3152 3996 RdrCEF.exe 99 PID 3996 wrote to memory of 3152 3996 RdrCEF.exe 99 PID 3996 wrote to memory of 3152 3996 RdrCEF.exe 99 PID 3996 wrote to memory of 3152 3996 RdrCEF.exe 99 PID 3996 wrote to memory of 3152 3996 RdrCEF.exe 99 PID 3996 wrote to memory of 3152 3996 RdrCEF.exe 99 PID 3996 wrote to memory of 3152 3996 RdrCEF.exe 99 PID 3996 wrote to memory of 3152 3996 RdrCEF.exe 99 PID 3996 wrote to memory of 3152 3996 RdrCEF.exe 99 PID 3996 wrote to memory of 3152 3996 RdrCEF.exe 99 PID 3996 wrote to memory of 3152 3996 RdrCEF.exe 99 PID 3996 wrote to memory of 3152 3996 RdrCEF.exe 99 PID 3996 wrote to memory of 3152 3996 RdrCEF.exe 99
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://download.cdn.mozilla.net/pub/firefox/releases/72.0.2/update/win64/en-US/firefox-71.0-72.0.2.partial.mar1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5056 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4488
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NMSO4O58\firefox-71.0-72.0.2.partial.mar"2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=12DBC203A6EF3D978BA6E196EBB6A8F2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:3696
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7150F7A365385CE7FC4D4BDB6B7F47FC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7150F7A365385CE7FC4D4BDB6B7F47FC --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:14⤵PID:3152
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=215BCF482846F811B8C00575A3DC7C7E --mojo-platform-channel-handle=2204 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:2352
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A117D5D6907C220276E1098288799DFA --mojo-platform-channel-handle=2352 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:2156
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=216DBAB2B3D49F335F9128B1D460DF26 --mojo-platform-channel-handle=2432 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:3712
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=565D8417F93AD9833DCA489B72B3B67B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=565D8417F93AD9833DCA489B72B3B67B --renderer-client-id=8 --mojo-platform-channel-handle=2444 --allow-no-sandbox-job /prefetch:14⤵PID:4188
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3120
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 471B
- SHA256 94904b4d34cd577e29be5042bb21d65e685047f3591f3051c2c9850681d53ccc
- MD5 35b6b5a1266ffd7f45cb92dc368b2f1f
- SHA1 8c6a245e00c2f517086b7db9a2c24e876cc79f85
- SHA512 bce75bc358fb0bcfba3c071e86634dfefbfbcd9c3cb1057d4e4693b0b19318ca0ec837e8a2d7ec9308042a71f49650cec395bc6a054d12e7da7564af2fccbbae
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 434B
- SHA256 cdbf51f17984e40fea480899cd41d3082506f730c47ff184bc159eb10a50ab33
- MD5 d4396e3fd573161c7fa353d27fc4c097
- SHA1 4576c444dc10910e1b3b54c6fb291b745b5c2ea3
- SHA512 093c16bec76a0a35e95b33b61f62b272d54ff39d27cf692f01a0a5aa8f888bc8aa76c7567f567786bd6fe4aee510eeff9903d0a69f2257492e58d691dfb7bdb3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NMSO4O58\firefox-71.0-72.0.2.partial.mar.nrz09jk.partial
- Size 20.3MB
- SHA256 909812f6cd8c68d016297f479473253edcdaf8728cc047759cf944f0a7c3d1fc
- MD5 cbb5c45b084982f331963e53ce1018d3
- SHA1 790dc9f80884ff2ad88627e29b55cfd8058c94c7
- SHA512 81da0af34c61d61ea0cbe9c1cbfdcbf0a6c6260614b7625a9cce07e3846260b45198967dbd0ad958a27eddbc0d538cfef2e250ace5c25ea3c02eb2bb2010fa06
- SSDEEP 393216:5RKtoeYMy3yLj6wTgFi1Smg/4ecA6TdG8I/xewK6eiEC+mNT0:5RKtk3q6wTAnL6TdGn/xdzSeg
- MD5 SHA1 SHA512 SSDEEP