Overview
overview
7Static
static
3WX.pdf.lnk
windows7-x64
3WX.pdf.lnk
windows10-2004-x64
7i1v/zN/JI/...qd.pdf
windows7-x64
1i1v/zN/JI/...qd.pdf
windows10-2004-x64
1i1v/zN/JI/...im.exe
windows7-x64
i1v/zN/JI/...im.exe
windows10-2004-x64
1i1v/zN/JI/...Sa.dll
windows7-x64
3i1v/zN/JI/...Sa.dll
windows10-2004-x64
3Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2023 16:15
Behavioral task
behavioral1
Sample
WX.pdf.lnk
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
WX.pdf.lnk
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
i1v/zN/JI/eWJM/MVst/qI/1Q52/uURq/QIPJ/J4Xw/J6V/CO/bOs8/GMV/N53B/Abqd.pdf
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
i1v/zN/JI/eWJM/MVst/qI/1Q52/uURq/QIPJ/J4Xw/J6V/CO/bOs8/GMV/N53B/Abqd.pdf
Resource
win10v2004-20230915-en
Behavioral task
behavioral5
Sample
i1v/zN/JI/eWJM/MVst/qI/1Q52/uURq/QIPJ/J4Xw/J6V/CO/bOs8/GMV/N53B/bootim.exe
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
i1v/zN/JI/eWJM/MVst/qI/1Q52/uURq/QIPJ/J4Xw/J6V/CO/bOs8/GMV/N53B/bootim.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral7
Sample
i1v/zN/JI/eWJM/MVst/qI/1Q52/uURq/QIPJ/J4Xw/J6V/CO/bOs8/GMV/N53B/xSa.dll
Resource
win7-20230831-en
Behavioral task
behavioral8
Sample
i1v/zN/JI/eWJM/MVst/qI/1Q52/uURq/QIPJ/J4Xw/J6V/CO/bOs8/GMV/N53B/xSa.dll
Resource
win10v2004-20230915-en
General
-
Target
WX.pdf.lnk
-
Size
1KB
-
MD5
4081b99306478e563fcb8737ea368029
-
SHA1
49a54cbbd519c1a10835542f704ba174e65d078f
-
SHA256
77dc2c45251101c6967d9368de8750fff2c5981e5452c8539e85dfae2373703b
-
SHA512
6b0e0a44d8cd13af1788c961090a4b6d895f233158917f6c06521081d74cca9509882ff0fe1cc4a1dd64d5c491bced52e5f45eacef0943e993d85b1b8936eefb
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 3692 set thread context of 1740 3692 rundll32.exe SearchProtocolHost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exenetstat.exepid process 2260 ipconfig.exe 4720 netstat.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 1 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Local Settings regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
SearchProtocolHost.exeAcroRd32.exepid process 1740 SearchProtocolHost.exe 1740 SearchProtocolHost.exe 1268 AcroRd32.exe 1268 AcroRd32.exe 1268 AcroRd32.exe 1268 AcroRd32.exe 1268 AcroRd32.exe 1268 AcroRd32.exe 1268 AcroRd32.exe 1268 AcroRd32.exe 1268 AcroRd32.exe 1268 AcroRd32.exe 1268 AcroRd32.exe 1268 AcroRd32.exe 1268 AcroRd32.exe 1268 AcroRd32.exe 1268 AcroRd32.exe 1268 AcroRd32.exe 1268 AcroRd32.exe 1268 AcroRd32.exe 1268 AcroRd32.exe 1268 AcroRd32.exe 1740 SearchProtocolHost.exe 1740 SearchProtocolHost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
rundll32.exepid process 3692 rundll32.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
Processes:
rundll32.exepid process 3692 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
Processes:
whoami.exenetstat.exedescription pid process Token: SeDebugPrivilege 4168 whoami.exe Token: SeDebugPrivilege 4168 whoami.exe Token: SeDebugPrivilege 4168 whoami.exe Token: SeDebugPrivilege 4168 whoami.exe Token: SeDebugPrivilege 4168 whoami.exe Token: SeDebugPrivilege 4168 whoami.exe Token: SeDebugPrivilege 4168 whoami.exe Token: SeDebugPrivilege 4168 whoami.exe Token: SeDebugPrivilege 4168 whoami.exe Token: SeDebugPrivilege 4168 whoami.exe Token: SeDebugPrivilege 4168 whoami.exe Token: SeDebugPrivilege 4168 whoami.exe Token: SeDebugPrivilege 4168 whoami.exe Token: SeDebugPrivilege 4168 whoami.exe Token: SeDebugPrivilege 4168 whoami.exe Token: SeDebugPrivilege 4168 whoami.exe Token: SeDebugPrivilege 4168 whoami.exe Token: SeDebugPrivilege 4168 whoami.exe Token: SeDebugPrivilege 4168 whoami.exe Token: SeDebugPrivilege 4168 whoami.exe Token: SeDebugPrivilege 4168 whoami.exe Token: SeDebugPrivilege 4168 whoami.exe Token: SeDebugPrivilege 4168 whoami.exe Token: SeDebugPrivilege 4168 whoami.exe Token: SeDebugPrivilege 4168 whoami.exe Token: SeDebugPrivilege 4168 whoami.exe Token: SeDebugPrivilege 4168 whoami.exe Token: SeDebugPrivilege 4720 netstat.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 1268 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
AcroRd32.exepid process 1268 AcroRd32.exe 1268 AcroRd32.exe 1268 AcroRd32.exe 1268 AcroRd32.exe 1268 AcroRd32.exe 1268 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exeregsvr32.exerundll32.exerundll32.exedescription pid process target process PID 3556 wrote to memory of 4280 3556 cmd.exe regsvr32.exe PID 3556 wrote to memory of 4280 3556 cmd.exe regsvr32.exe PID 4280 wrote to memory of 3028 4280 regsvr32.exe rundll32.exe PID 4280 wrote to memory of 3028 4280 regsvr32.exe rundll32.exe PID 3028 wrote to memory of 3692 3028 rundll32.exe rundll32.exe PID 3028 wrote to memory of 3692 3028 rundll32.exe rundll32.exe PID 3028 wrote to memory of 3692 3028 rundll32.exe rundll32.exe PID 4280 wrote to memory of 1268 4280 regsvr32.exe AcroRd32.exe PID 4280 wrote to memory of 1268 4280 regsvr32.exe AcroRd32.exe PID 4280 wrote to memory of 1268 4280 regsvr32.exe AcroRd32.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe PID 3692 wrote to memory of 1740 3692 rundll32.exe SearchProtocolHost.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\WX.pdf.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s /u /i:i1v\zN\JI\eWJM\MVst\qI\1Q52\uURq\QIPJ\J4Xw\J6V\CO\bOs8\GMV\N53B\bow.sct scrobj.dll2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" i1v\zN\JI\eWJM\MVst\qI\1Q52\uURq\QIPJ\J4Xw\J6V\CO\bOs8\GMV\N53B\xSa.log, HUF_inc_var3⤵
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" i1v\zN\JI\eWJM\MVst\qI\1Q52\uURq\QIPJ\J4Xw\J6V\CO\bOs8\GMV\N53B\xSa.log, HUF_inc_var4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1740 -
C:\Windows\SysWOW64\whoami.exewhoami.exe /all6⤵
- Suspicious use of AdjustPrivilegeToken
PID:4168 -
C:\Windows\SysWOW64\ipconfig.exeipconfig.exe /all6⤵
- Gathers network information
PID:2260 -
C:\Windows\SysWOW64\netstat.exenetstat.exe -aon6⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:4720 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\i1v\zN\JI\eWJM\MVst\qI\1Q52\uURq\QIPJ\J4Xw\J6V\CO\bOs8\GMV\N53B\Abqd.pdf"3⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1268 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140434⤵PID:4696
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F701B6C083BEB4F0D4BB864581D2F8D3 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:25⤵PID:2840
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=632A56E7975808FD337C1F3B80CF4A2A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=632A56E7975808FD337C1F3B80CF4A2A --renderer-client-id=2 --mojo-platform-channel-handle=1836 --allow-no-sandbox-job /prefetch:15⤵PID:4912
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=894A914DCDDDE9ACB7FCB75FC8BF2012 --mojo-platform-channel-handle=2296 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:25⤵PID:1680
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=330FD45D3B11128C416F8F82546116CD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=330FD45D3B11128C416F8F82546116CD --renderer-client-id=5 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job /prefetch:15⤵PID:1944
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=806AFEAC8B00C8FBF5136A5A2BFA186E --mojo-platform-channel-handle=2664 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:25⤵PID:2184
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=42A434A6D17947E90B37C044408D33AB --mojo-platform-channel-handle=2408 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:25⤵PID:1384
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3224
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagesFilesize
64KB
MD517e64be8adeda4467b8ffc7e9e602c0b
SHA17dc1ffc21f27e46aeb39cc162f66580f445af891
SHA256d943b61fdb3ea5e2c1fec7747b2dadb96a650d482cd27686b2064dce40bf0a00
SHA512982d928ab8f272681a4f0dd0717d6371d916b36a5c24677de0c0f78bd7b52622726b815d1e65add40ea7909ac568c579e06bb8a7de5a0838c1c08ab2eae17c23
-
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagesFilesize
36KB
MD5b30d3becc8731792523d599d949e63f5
SHA119350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
-
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagesFilesize
56KB
MD5752a1f26b18748311b691c7d8fc20633
SHA1c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
-
memory/1268-35-0x000000000A5F0000-0x000000000A611000-memory.dmpFilesize
132KB
-
memory/1268-171-0x000000000B8B0000-0x000000000BB5B000-memory.dmpFilesize
2.7MB
-
memory/1740-5-0x0000000000C20000-0x0000000000C6B000-memory.dmpFilesize
300KB
-
memory/1740-40-0x0000000000C20000-0x0000000000C6B000-memory.dmpFilesize
300KB
-
memory/1740-4-0x0000000000C20000-0x0000000000C6B000-memory.dmpFilesize
300KB
-
memory/1740-2-0x0000000000C20000-0x0000000000C6B000-memory.dmpFilesize
300KB
-
memory/1740-138-0x0000000000C20000-0x0000000000C6B000-memory.dmpFilesize
300KB
-
memory/1740-146-0x0000000000C20000-0x0000000000C6B000-memory.dmpFilesize
300KB
-
memory/1740-153-0x0000000000C20000-0x0000000000C6B000-memory.dmpFilesize
300KB
-
memory/3692-6-0x0000000002E00000-0x0000000002ED1000-memory.dmpFilesize
836KB
-
memory/3692-0-0x0000000002C50000-0x0000000002D13000-memory.dmpFilesize
780KB
-
memory/3692-1-0x0000000002E00000-0x0000000002ED1000-memory.dmpFilesize
836KB