1a8d6a71efd2c31f649d91dfd98e7f9d470a8d6db52322befa4a8771a806c1ed

Analysis

max time kernel
159s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231215-es
resource tags

arch:x64arch:x86image:win10v2004-20231215-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
16-12-2023 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BOTW.multiplayer 1.0.4 files + setup tutorial/BOTW MULTIPLAYER SETUP JOINING.pdf
Size

5.5MB
MD5

93cdf1accf3d992a36bac52819c3b3a0
SHA1

a1e1e5513f936fbdcd20d1fc018b2ff86471b282
SHA256

7c762c0083881f353de979e2f5bf3bd947f6f9c1601d5085efc2561458e7549b
SHA512

638409904bcfdfeff033ee31bdfe0b8438f4ed1a05882408869d9342f6f09422e67b169af426ba1cc435958eb694318fb8d4e7b61746c200d0ffe75c1f8c3946
SSDEEP

98304:pZ6ZYFhZ+2BkRc903Y2m8kormBuEX7dn+W4rZMY8W+nh7lgrAsJ7ZzGn2TYwD1HC:pQkhZ+pH1m87yjX7d+pD8rlypzGo1Hev

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

AcroRd32.exe

pid	process
564	AcroRd32.exe
564	AcroRd32.exe
564	AcroRd32.exe
564	AcroRd32.exe
564	AcroRd32.exe
564	AcroRd32.exe
564	AcroRd32.exe
564	AcroRd32.exe
564	AcroRd32.exe
564	AcroRd32.exe
564	AcroRd32.exe
564	AcroRd32.exe
564	AcroRd32.exe
564	AcroRd32.exe
564	AcroRd32.exe
564	AcroRd32.exe
564	AcroRd32.exe
564	AcroRd32.exe
564	AcroRd32.exe
564	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

564 AcroRd32.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AcroRd32.exe

description pid process

Token: SeSecurityPrivilege 564 AcroRd32.exe
Token: SeTakeOwnershipPrivilege 564 AcroRd32.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

564 AcroRd32.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

AcroRd32.exe

pid process

564 AcroRd32.exe
564 AcroRd32.exe
564 AcroRd32.exe
564 AcroRd32.exe
564 AcroRd32.exe
564 AcroRd32.exe
564 AcroRd32.exe
564 AcroRd32.exe

description	pid	process
Token: SeSecurityPrivilege	564	AcroRd32.exe
Token: SeTakeOwnershipPrivilege	564	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 564 wrote to memory of 1512	564	AcroRd32.exe	RdrCEF.exe
PID 564 wrote to memory of 1512	564	AcroRd32.exe	RdrCEF.exe
PID 564 wrote to memory of 1512	564	AcroRd32.exe	RdrCEF.exe
PID 564 wrote to memory of 2848	564	AcroRd32.exe	RdrCEF.exe
PID 564 wrote to memory of 2848	564	AcroRd32.exe	RdrCEF.exe
PID 564 wrote to memory of 2848	564	AcroRd32.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 928	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 2436	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 2436	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 2436	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 2436	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 2436	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 2436	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 2436	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 2436	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 2436	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 2436	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 2436	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 2436	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 2436	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 2436	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 2436	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 2436	1512	RdrCEF.exe	RdrCEF.exe
PID 1512 wrote to memory of 2436	1512	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\BOTW.multiplayer 1.0.4 files + setup tutorial\BOTW MULTIPLAYER SETUP JOINING.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:564

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:1512

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7CB0E8FCC79441CF33ABC15965FF92AB --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:928

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EAB3F7E3B120F85D6811493C601013E7 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EAB3F7E3B120F85D6811493C601013E7 --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:1
3⤵
PID:2436

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=34F898615EBFB64E7CA2B7FC396A3D28 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=34F898615EBFB64E7CA2B7FC396A3D28 --renderer-client-id=4 --mojo-platform-channel-handle=2164 --allow-no-sandbox-job /prefetch:1
3⤵
PID:2860

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=47187CB369173C1C0DD730296E28F164 --mojo-platform-channel-handle=2556 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4376

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=83543BBD7DA44F10D3C658D8B33ACB00 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3464

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=951709A95F0966E09FAFDDEA7F58F0EA --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4020

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=FF71333E5D0A2C12C6AC08913D7215C7 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=FF71333E5D0A2C12C6AC08913D7215C7 --renderer-client-id=10 --mojo-platform-channel-handle=1900 --allow-no-sandbox-job /prefetch:1
3⤵
PID:4840

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
95cef8b5f96b56ecf804031feda3bb28

SHA1
76dc25f7ded21c7cd4a4af2abe3040ed5ee4d636

SHA256
f0294ca105b7ae07537d4fb96c64f6e0af92ee521b99360b76dd8d82b3febfe0

SHA512
71651c7257273f35050eedf661d949d0d9c6467beb6d98a20f6e124380e2fbed0c4b23dbae4d80c29b1a9959bbdacec00766af7bad4f927296ef282f30251788

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Filesize
12KB

MD5
c6852a8bad0a91be95f908b661583ae7

SHA1
0ae176c6f65d1fe13ef8de017c6c393e50a2d15d

SHA256
ee761dadb5605c9b7f9eed57e94ececfc6ef350e6693ff09eddd4fba480b76c8

SHA512
afac7ca7a2ae919fa8f7dd92b5fdef034616b545bb8db398467758e22e474d456836e2c43811e5e23b4a026f258cd34877ee33e668e2b443f312df7934e165f4

Download Submit