628b115adcd68461a1ccc0dfafd79ac3e1830eebc117440176c919d95ec82406

Analysis

max time kernel
141s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14-01-2024 08:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5acb77d36a3f3e9cae7d0513aa35fe34.pdf
Size

86KB
MD5

5acb77d36a3f3e9cae7d0513aa35fe34
SHA1

ddf96a60c52128421ae98400f5765974f49ddded
SHA256

628b115adcd68461a1ccc0dfafd79ac3e1830eebc117440176c919d95ec82406
SHA512

f204c52b17d3d9c37789e4a5db4b4e9381b04ebf79fce206adf0fd7e1c4de2d7c69cc92fd375e9d0c0e3f1197f9068084f3f0aeecace643bcb9ad26fd33d4f39
SSDEEP

1536:czcuPUvey7PIqAOtrmFMmrjRnXJccQWcpOydWaJvo4GbsDvL4gf:QcuPU7w4rmFMmvHcwyPgsTkc

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2988	AcroRd32.exe
2988	AcroRd32.exe
2988	AcroRd32.exe
2988	AcroRd32.exe
2988	AcroRd32.exe
2988	AcroRd32.exe
2988	AcroRd32.exe
2988	AcroRd32.exe
2988	AcroRd32.exe
2988	AcroRd32.exe
2988	AcroRd32.exe
2988	AcroRd32.exe
2988	AcroRd32.exe
2988	AcroRd32.exe
2988	AcroRd32.exe
2988	AcroRd32.exe
2988	AcroRd32.exe
2988	AcroRd32.exe
2988	AcroRd32.exe
2988	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2988	AcroRd32.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2988	AcroRd32.exe
2988	AcroRd32.exe
2988	AcroRd32.exe
2988	AcroRd32.exe
2988	AcroRd32.exe
2988	AcroRd32.exe
2988	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 368	2988	AcroRd32.exe	96
PID 2988 wrote to memory of 368	2988	AcroRd32.exe	96
PID 2988 wrote to memory of 368	2988	AcroRd32.exe	96
PID 2988 wrote to memory of 4888	2988	AcroRd32.exe	98
PID 2988 wrote to memory of 4888	2988	AcroRd32.exe	98
PID 2988 wrote to memory of 4888	2988	AcroRd32.exe	98
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 1972	368	RdrCEF.exe	99
PID 368 wrote to memory of 2804	368	RdrCEF.exe	100
PID 368 wrote to memory of 2804	368	RdrCEF.exe	100
PID 368 wrote to memory of 2804	368	RdrCEF.exe	100
PID 368 wrote to memory of 2804	368	RdrCEF.exe	100
PID 368 wrote to memory of 2804	368	RdrCEF.exe	100
PID 368 wrote to memory of 2804	368	RdrCEF.exe	100
PID 368 wrote to memory of 2804	368	RdrCEF.exe	100
PID 368 wrote to memory of 2804	368	RdrCEF.exe	100
PID 368 wrote to memory of 2804	368	RdrCEF.exe	100
PID 368 wrote to memory of 2804	368	RdrCEF.exe	100
PID 368 wrote to memory of 2804	368	RdrCEF.exe	100
PID 368 wrote to memory of 2804	368	RdrCEF.exe	100
PID 368 wrote to memory of 2804	368	RdrCEF.exe	100
PID 368 wrote to memory of 2804	368	RdrCEF.exe	100
PID 368 wrote to memory of 2804	368	RdrCEF.exe	100

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\5acb77d36a3f3e9cae7d0513aa35fe34.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:368
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EAA1197D231B2EE69DACFF49B89B507D --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EAA1197D231B2EE69DACFF49B89B507D --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1972
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B661510D4479265B47D4051889A97571 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2804
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=DE9531FB8211B281EE0089B2EEE6D522 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=DE9531FB8211B281EE0089B2EEE6D522 --renderer-client-id=4 --mojo-platform-channel-handle=2168 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3288
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AEFB16E37EDF66F0ECB98A9C4D38A3B3 --mojo-platform-channel-handle=2568 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2680
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AF862FEF9654C733994842C2117F97AA --mojo-platform-channel-handle=2676 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4480
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F60C8AF694E119340C0489689632EC6C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F60C8AF694E119340C0489689632EC6C --renderer-client-id=7 --mojo-platform-channel-handle=2684 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2992
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=92F6F1CB0BE1536111E742CD1BFDCE38 --mojo-platform-channel-handle=2996 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:5084
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  PID:4888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
bdb7faaf3f9a1c3f055708bde29ca7ac

SHA1
e20e387633c39c7d00bb12c07ccba6e47b09e1db

SHA256
8bb279b0f8eef5537e29905a6a9d60914b531b4a2f18962fe10510d72a2c8051

SHA512
0846383ca41c50183740c41a78cd4043e4d530737479a6c97a6245a2d4a8712dcaab16c60ac04ccae64be10feefd72b98e831b33e598715b2510b61619b66175

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Filesize
12KB

MD5
80f5d57f0a878d2eca9642fc2ed226fb

SHA1
9e5c65d8d579348eda9089956cfa125908d6b898

SHA256
59e02f5260db0caf09c3b8d16b1ca65dc0620d891d904d2b00144b2be199248c

SHA512
7e58cd637538fb1944acbb7371454375a5b548df9236b6666d0f47d8ce24883e44e51fdb185dbf9ea85fab86f4ee1277d052a68b5c23192e4ea4b7747d998d16

Download Submit