Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/01/2024, 21:41
Behavioral task
behavioral1
Sample
NEW QUOTATION REQUEST. ORDER DETAILS ATTACHED.pdf
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
NEW QUOTATION REQUEST. ORDER DETAILS ATTACHED.pdf
Resource
win10v2004-20231215-en
General
-
Target
NEW QUOTATION REQUEST. ORDER DETAILS ATTACHED.pdf
-
Size
228KB
-
MD5
daad54f6040f4a6821fc4dc53ca25b5e
-
SHA1
81c4d50c5a17314ee452ff65d3a2ea339045267d
-
SHA256
be4e6f3c8c247671941397a707e7c8ecd0d091632ea350a04d85cf6c44d7fa92
-
SHA512
d0cf5ff135ca441f8c5ff323f594a8b905983e0f6f88d9f95fa3ba95613b2e74b0e53f838142d6eb854104ce6231e5ef3f1482eac6f67ea4f28ddab4d334dd1c
-
SSDEEP
6144:iTiuYNuSCPCHyPOO8RUZiV7PsHZTi4TxcO5bfGYMc6H2U:wiuYNuvCH5OUU0VrSZTiGxcwbuZc6H5
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 4528 AcroRd32.exe 4528 AcroRd32.exe 4528 AcroRd32.exe 4528 AcroRd32.exe 4528 AcroRd32.exe 4528 AcroRd32.exe 4528 AcroRd32.exe 4528 AcroRd32.exe 4528 AcroRd32.exe 4528 AcroRd32.exe 4528 AcroRd32.exe 4528 AcroRd32.exe 4528 AcroRd32.exe 4528 AcroRd32.exe 4528 AcroRd32.exe 4528 AcroRd32.exe 4528 AcroRd32.exe 4528 AcroRd32.exe 4528 AcroRd32.exe 4528 AcroRd32.exe 1524 msedge.exe 1524 msedge.exe 4212 msedge.exe 4212 msedge.exe 2556 identity_helper.exe 2556 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4528 AcroRd32.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4528 AcroRd32.exe 4528 AcroRd32.exe 4528 AcroRd32.exe 4528 AcroRd32.exe 4528 AcroRd32.exe 4528 AcroRd32.exe 4528 AcroRd32.exe 4528 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4528 wrote to memory of 116 4528 AcroRd32.exe 92 PID 4528 wrote to memory of 116 4528 AcroRd32.exe 92 PID 4528 wrote to memory of 116 4528 AcroRd32.exe 92 PID 4528 wrote to memory of 4492 4528 AcroRd32.exe 94 PID 4528 wrote to memory of 4492 4528 AcroRd32.exe 94 PID 4528 wrote to memory of 4492 4528 AcroRd32.exe 94 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 3796 116 RdrCEF.exe 95 PID 116 wrote to memory of 4076 116 RdrCEF.exe 96 PID 116 wrote to memory of 4076 116 RdrCEF.exe 96 PID 116 wrote to memory of 4076 116 RdrCEF.exe 96 PID 116 wrote to memory of 4076 116 RdrCEF.exe 96 PID 116 wrote to memory of 4076 116 RdrCEF.exe 96 PID 116 wrote to memory of 4076 116 RdrCEF.exe 96 PID 116 wrote to memory of 4076 116 RdrCEF.exe 96 PID 116 wrote to memory of 4076 116 RdrCEF.exe 96 PID 116 wrote to memory of 4076 116 RdrCEF.exe 96 PID 116 wrote to memory of 4076 116 RdrCEF.exe 96 PID 116 wrote to memory of 4076 116 RdrCEF.exe 96 PID 116 wrote to memory of 4076 116 RdrCEF.exe 96 PID 116 wrote to memory of 4076 116 RdrCEF.exe 96 PID 116 wrote to memory of 4076 116 RdrCEF.exe 96 PID 116 wrote to memory of 4076 116 RdrCEF.exe 96 PID 116 wrote to memory of 4076 116 RdrCEF.exe 96 PID 116 wrote to memory of 4076 116 RdrCEF.exe 96
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\NEW QUOTATION REQUEST. ORDER DETAILS ATTACHED.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F5C9EEB96C30B8079FE9B8711CECF2CB --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3796
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=77230476BEC1D3428B6E7B8B2CD1C22F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=77230476BEC1D3428B6E7B8B2CD1C22F --renderer-client-id=2 --mojo-platform-channel-handle=1788 --allow-no-sandbox-job /prefetch:13⤵PID:4076
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E5E41F4325E4E2FBDE9D906A22BF2582 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E5E41F4325E4E2FBDE9D906A22BF2582 --renderer-client-id=4 --mojo-platform-channel-handle=2176 --allow-no-sandbox-job /prefetch:13⤵PID:1932
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=245D8EBCE8160DF2CEEAEC56F653A128 --mojo-platform-channel-handle=2580 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:932
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E4788509F0656F252D63520EC95E0FC8 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E4788509F0656F252D63520EC95E0FC8 --renderer-client-id=6 --mojo-platform-channel-handle=1820 --allow-no-sandbox-job /prefetch:13⤵PID:1092
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AF17E465D65049C441B5B5DCBE325F03 --mojo-platform-channel-handle=1968 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3192
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=86D571EE42CF8B589B441810EFF8E513 --mojo-platform-channel-handle=2608 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4264
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵PID:4492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://asset.cloudinary.com/dg1h13s49/79a2a0393df1fa5934d0c006e517751b2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4212 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc727d46f8,0x7ffc727d4708,0x7ffc727d47183⤵PID:2064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,414389369992375900,8387126671037519216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,414389369992375900,8387126671037519216,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:23⤵PID:848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,414389369992375900,8387126671037519216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:83⤵PID:1248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,414389369992375900,8387126671037519216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:13⤵PID:4360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,414389369992375900,8387126671037519216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:13⤵PID:2812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,414389369992375900,8387126671037519216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:83⤵PID:3224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,414389369992375900,8387126671037519216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:2556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,414389369992375900,8387126671037519216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:13⤵PID:4776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,414389369992375900,8387126671037519216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:13⤵PID:388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,414389369992375900,8387126671037519216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:13⤵PID:5200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,414389369992375900,8387126671037519216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:13⤵PID:5208
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1992
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5c2f951dbb4b98be71a618f3175178fc4
SHA1d7bfd37a777e40020e44aa36be2673da99ad4e9b
SHA256ad679814eae830d02a98353f6ba9532b4db79cb9f80e6caa4f51f489aa77e41a
SHA5123b7e9974c99155bfd89d3ae8c19182df36d60b3752b79ce1b23ea65aa50c9202b189f1ae1c29ff5e58c998408da61679b4229a6607b38ba4784abe377f1a828a
-
Filesize
64KB
MD54b759cdf7bf2babb673ff2698d0fb064
SHA1a2f6b95baa7b949f66dc681c982280700dbf969d
SHA256a398ea23e1f879e8ffe31f1b7c154feb7ac9ea90442c14302283371a86563451
SHA5124670dc539bf69b1d856ea561332dc2e44c1676d380a2143fbe6a3a357c9a7cfd630719e8e22390f8380c8616a26f621ebc2c25e2342613e73ff3b229b1dfaaca
-
Filesize
36KB
MD5b30d3becc8731792523d599d949e63f5
SHA119350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
-
Filesize
56KB
MD5752a1f26b18748311b691c7d8fc20633
SHA1c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
-
Filesize
152B
MD5efc9c7501d0a6db520763baad1e05ce8
SHA160b5e190124b54ff7234bb2e36071d9c8db8545f
SHA2567af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a
SHA512bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD5ab5eda4f0b2a24b82fd10a6bc0212781
SHA1b1ef93286dbed91b70adf6f11eda0307f53947df
SHA25694a5f7e7a163620ace22a71f3ccd42af33ec569a4f060ec2355a8ab01a190382
SHA512b77b8c0be6b3c04f24b63eb1d5570be12e79d07df6263dd3ba681d930bd73831f0ba41678a3cecac5ce29e30e148c2d395f52c458a7b11ba52739780d340c1d8
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
741B
MD5c2521db2cd2cccd0ff9751d04ef40d18
SHA1e1ea4ca541fe731051addf0fae82cbc04fce5bbc
SHA256411fa63e30931ba8545b55b2e7da35c7c10a892b3245b331bf5c05afd5094ca3
SHA51298bf07e33553578ecc7703c6207a2bb172a9583cc19a190d58606802953345a145e628943c895b86f00bcb5a93e41ce77be3454244fb753b2e8d18ae46f6ac0e
-
Filesize
5KB
MD54a494dd3b3ace395aa58acb80e17e562
SHA114a450e2fd9ba1d858404aab4af72da68ba4db36
SHA256a915303272334847c72fe6cf80dfbaec10fd947ac7f28c837bfb0e820e99f598
SHA5125ccea149595fbc116797dc60e571f2752429cd6cf4a2ae508b56f80488fbc51e278c2bfa1d42aab40608b8d2ea5cd88c8224daa9f8e42a30361e1d06ff87f74f
-
Filesize
5KB
MD597fff1cd34a2fdbf99ea9cb3461c53a2
SHA172ec5974318f31e820f2127b7fe15ea5e6e49a31
SHA256f669704fbf44bb50cfde3755aa6e85b9fb33bf349a41f4f4a417d9027db2e520
SHA512500170852fe429651f636db37af71aec6f8126f99c42701b672568f647532846a84cea72c5622bd540ec15d741a0f30f1e291c8e40aaac9defc498ffc0c3486f
-
Filesize
24KB
MD5121510c1483c9de9fdb590c20526ec0a
SHA196443a812fe4d3c522cfdbc9c95155e11939f4e2
SHA256cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c
SHA512b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5ad21d5bc24f5eb87272416d968058d81
SHA1b6e52a0cd99b4972d513035fc81b787bc1b7f329
SHA256ecd2cd79330df31eba414a3cb349f2e6dce612b4e8928262bfd4346363c5aa24
SHA512917805b4ca887601c4499082f78ed2abe4b418fb615258a78ff706c06aceabd6cc3cf54456b97cc25ae2bca1e11f68631b4bcd836b5a115151c0b3582714dd27