8f70ba0810eb678e4c2e78f73af65dcdf3d665ce21b5486364ad74a8a7f753ae

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8f70ba0810eb678e4c2e78f73af65dcdf3d665ce21b5486364ad74a8a7f753ae.pdf
Size 399KB
Sample240313-3dfwfsee34
SHA256 8f70ba0810eb678e4c2e78f73af65dcdf3d665ce21b5486364ad74a8a7f753ae
MD5 3da30bea627055ee8b073ab089bd77f1
SHA1 2d9ae9d4051844cb6e279becdd34cb2dc38fcf1e
SHA512 968b39fb069e27bc89b9e6a3834631a169d96b995dfbce79b86407cfdd4ff8ab41142ef78395f60231f8ae28b870b4cceb13bb889c7617c2e54def050bcbf96a
SSDEEP 6144:T/HNLdh+R/DVLud3JAhY3ftzDEwsuQ0WtrZaY+kmfPuAIuNgnhksbflTeLII:T/Ths7Vid3yEDZdQJtrrL6wGclTeMI
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\MuiCache	AdobeCollabSync.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
876	AcroRd32.exe
876	AcroRd32.exe
876	AcroRd32.exe
876	AcroRd32.exe
876	AcroRd32.exe
876	AcroRd32.exe
876	AcroRd32.exe
876	AcroRd32.exe
876	AcroRd32.exe
876	AcroRd32.exe
876	AcroRd32.exe
876	AcroRd32.exe
876	AcroRd32.exe
876	AcroRd32.exe
876	AcroRd32.exe
876	AcroRd32.exe
876	AcroRd32.exe
876	AcroRd32.exe
876	AcroRd32.exe
876	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
876	AcroRd32.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
876	AcroRd32.exe
876	AcroRd32.exe
876	AcroRd32.exe
876	AcroRd32.exe
876	AcroRd32.exe
876	AcroRd32.exe
876	AcroRd32.exe
876	AcroRd32.exe
876	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 4504	876	AcroRd32.exe	92
PID 876 wrote to memory of 4504	876	AcroRd32.exe	92
PID 876 wrote to memory of 4504	876	AcroRd32.exe	92
PID 4504 wrote to memory of 4860	4504	AdobeCollabSync.exe	93
PID 4504 wrote to memory of 4860	4504	AdobeCollabSync.exe	93
PID 4504 wrote to memory of 4860	4504	AdobeCollabSync.exe	93
PID 4860 wrote to memory of 1692	4860	AdobeCollabSync.exe	98
PID 4860 wrote to memory of 1692	4860	AdobeCollabSync.exe	98
PID 4860 wrote to memory of 1692	4860	AdobeCollabSync.exe	98
PID 876 wrote to memory of 3972	876	AcroRd32.exe	102
PID 876 wrote to memory of 3972	876	AcroRd32.exe	102
PID 876 wrote to memory of 3972	876	AcroRd32.exe	102
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 1096	3972	RdrCEF.exe	103
PID 3972 wrote to memory of 4080	3972	RdrCEF.exe	104
PID 3972 wrote to memory of 4080	3972	RdrCEF.exe	104
PID 3972 wrote to memory of 4080	3972	RdrCEF.exe	104
PID 3972 wrote to memory of 4080	3972	RdrCEF.exe	104
PID 3972 wrote to memory of 4080	3972	RdrCEF.exe	104
PID 3972 wrote to memory of 4080	3972	RdrCEF.exe	104
PID 3972 wrote to memory of 4080	3972	RdrCEF.exe	104
PID 3972 wrote to memory of 4080	3972	RdrCEF.exe	104
PID 3972 wrote to memory of 4080	3972	RdrCEF.exe	104
PID 3972 wrote to memory of 4080	3972	RdrCEF.exe	104
PID 3972 wrote to memory of 4080	3972	RdrCEF.exe	104

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\8f70ba0810eb678e4c2e78f73af65dcdf3d665ce21b5486364ad74a8a7f753ae.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:876
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c --type=collab-renderer --proc=4504
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" GetChannelUri
      4⤵
      PID:1692
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7D4CC88547867B82F8562701BA72523E --mojo-platform-channel-handle=1716 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1096
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0188A29B722CB92809C0D5B2E6A4798F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0188A29B722CB92809C0D5B2E6A4798F --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4080
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=190880FFCA654DF137692EDFF3881726 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4224
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D8DFF6D368A8B5678A4F57464965F1BD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D8DFF6D368A8B5678A4F57464965F1BD --renderer-client-id=5 --mojo-platform-channel-handle=2332 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:460
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FB6C9B1A2862E4D9474C7CE558AE677B --mojo-platform-channel-handle=2684 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1396
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=653CADD97C277F36D7564585033B60D9 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4020
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A5173D79710C37BD608BA484F02B4903 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A5173D79710C37BD608BA484F02B4903 --renderer-client-id=10 --mojo-platform-channel-handle=1716 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 25e2a7cedaafde56bb54b1731dfceccb4bc5fba304dbec142a90857af4c7f879
MD5 1f7bf4eaa6f77b880bc92f14f3cb53fa
SHA1 c74ec73432919a07998da2d574091c74bc956573
SHA512 2d6b30ddf10664c0f73ad62e805b80525100e6cb0d2c68940d08957e1ade2f0c78511db5aba9b49030be0c4ae83e4109ff6be15aadffe9ce77311461e97ffd77
SSDEEP 384:yeedThatELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:d+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

notificationsDB

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\DesktopNotification\NotificationsDB\notificationsDB
Size 24KB
SHA256 4901703febb24c665059d25ae6d0769c55051bcdc1b7a72b600252d4c3b0eca0
MD5 4fe2b64a2631d0d6eb30b8f42b49bcf5
SHA1 10c931554e79c2f4280a65ef2ad57ff61a2429ec
SHA512 8ad48178aa8d835e0c2028688e41f575e50e21b6b4b59161d08984c300911fda1a4614738bfa5557c3f2d254373a61497b491cbc7fb163afea2dbe08fcb67004
SSDEEP 24:TLD8fS8stZLNoz4zCQe8stZL+tCAConWZA2sZkgkxzcpS:TXF1K+CAWZA2skgkFcpS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 a027cf12f2055635a3020f08e0448b2f0314791260ccd25570426088c5b0e307
MD5 245950c48f668cf2fcb3c64778e64089
SHA1 3a5a14c820f58e35a3fc6f5de29669f0840587d8
SHA512 4fc8448536663b551cc716d78715f06d4ed217fbdf755924f0b30aebbb6212798a61c6638f919d5c14bdb6998d6a12f0ca37281f3c7f484c1821fbfc98d4a24d
SSDEEP 192:K+oGsTzoU27NTaUxma1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklN7UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 87aa4c64348b534771f03919b5bdca09596e89f6e0cca0a992bb3d290ec4155a
MD5 aebe0d2eb7a2077a55e57a955e62406a
SHA1 3f811b8148f12220f4b45699135e6d21c9847d8a
SHA512 efa1b082925a4e478fcea74764bbacb91d43da8c01c4b360a34e6f7402af23f91c93b5e91c6266120e144b5300e8dae73a62a7b6d7c4328410128f6a72a7baed
SSDEEP 192:t+oGsTzoU27NTaUxmYeMb1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:tklNveMbUNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 cf4d59448406a8002ea1dc98b3a647c7393fb1bdc3819338fcbb3f60f9f36739
MD5 3a0a4da5022d75ab40af89c9d7183860
SHA1 1852d9d65f1d9d3c5e6df62368b74d85920c6566
SHA512 0877d5bdfb8bfe507dc1a41c71e9d5bd6d25d38a6bd931373de873a1325bc208480fc735e53899f41f44e07537929be312d892e717ffc97ce7ef8e0c338f7734
SSDEEP 192:K+oGsTzoU27NTaUxmOX441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklNJX44UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 856ebb0a24a0a14c2230edd8a4a21289cbe784cd78a83352cf615eeb3908811b
MD5 bc9b52ce97ee05d2d633fd85331e3a01
SHA1 3a12039a8a6e15a3f9dd9e9b126a9af289865623
SHA512 f30b24c4dd79be3bb3ae77ce57cc1de90b93da8397303bfef20c294e83d9848d8fd15dad861794947e87d6a52bd2bccbaf1f60715246257925abb768aceda55c
SSDEEP 192:a+oGsTzoU27NTaUxmG6ZaZH441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGW:aklNPeaZH44UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

resource-18

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\resources\resource-18
Size 3.6MB
SHA256 152951ea34b49de148c3d4f11fa81875193576c8aa4a49abc5fa756cd3e12f42
MD5 a8c8361b7f2302396e258a3409e8371c
SHA1 cd84724e89830994e8b958a0c0a9db2b5fd3db08
SHA512 29d08b72d345cc95e0ce998bde0967f63cb72bf3a8316ff49f009aadeab3872f99f0a3bb5230f5f3f2655cf6e1dc04ffcc716dcc7f6050814339b25a0824e60b
SSDEEP 49152:ELWuHSQeNu5GB3mAs8f7b9ugh1F9fj6dixJns6E5p0QfE7+xbKZh4Djdi6W7wjV:hOsmAzXkgHF3J9E5y9+2h43dAwJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

resource-18

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\resources\resource-18
Size 2.9MB
SHA256 a180cc7dc6cabd67cf1cd8fb78a8c1d9633653f4cfc453582eeee87796ca7f6f
MD5 e3684248ebf4b9f8ea378a168e5c322d
SHA1 88a0d62968902b9e65a538031df57843ea238938
SHA512 ba5e63ee2b470fc8da1f0f4fd744630d6aae66debe899250d080f6d51e8c748389c6cc2befa2110ff5f3943c084b1481796f91f33013b21c3cb697dce8c9aa67
SSDEEP 49152:ELWuHSQeNu5GB3mAs8f7b9ugh1F9fj6dixJns6E5p0QfE7+xb:hOsmAzXkgHF3J9E5y9+9
MD5 SHA1 SHA512 SSDEEP

Submit Download

B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Size 471B
SHA256 3a2fa7214f0d5b9451a8e1fe1ac080c4281fea28ec7f384de15b365a59cfef15
MD5 c5f458e04632f12727c3d9cb1eda59ab
SHA1 2bf868e367304cfa02b52a012d2574fe0653e429
SHA512 b0fe9ecb1dfdeaef8ea404645c084855297f879567671d065260fef70abcf9af8bdc3e8e31e27e2dfb14ac43285ce46818fdda04ffc7644467109043a7ce8307
MD5 SHA1 SHA512

Submit Download

B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Size 400B
SHA256 38def698bf841f3e6b5369b71b7e764c0b5d3c77d48a5b7ec58294ab7717d362
MD5 452fe84089aa381a20de6105f9d37916
SHA1 933b6dfc0a296a1bbfde41aa74f7a3b540ba7f7f
SHA512 2a1882ed076b1febe4d522d20501e2dd93a86fdfe2888a2b5d54b8ab6a2878331e6030eed104227b6d69d107bd24b4ae93bbcb1e9c59a5b1bb1343a5afd335cc
MD5 SHA1 SHA512

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 ea58d4ad546b66afa2743db6287ac42ebbf511cc6e77b17a44a863ae6fc61fa1
MD5 dd8dc4398817d1430d89ff8775335e14
SHA1 fdf2fcd445e7ec38e18c47a59871cb978f3aa464
SHA512 1dcf9a50c0ce5d74d0c55602d769b1f17240775e23f4b65c55f90107b94316189de0e620f616c50b4f204404df8512543f326808340092858625b557107eda53
SSDEEP 24:TLSx/XYKQvGJF7ursClV/TLoLuCL5LLSKSXSJR6rk2pNLPLasKlDgmSYaSUt6:T+l2GL7msCrctxoDC
MD5 SHA1 SHA512 SSDEEP

Submit Download

addressbook.acrodata

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
Size 14KB
SHA256 06a576fc14e995c437b26c0d150b4e84cd745e7cedfd972a84b42b51c842fc9b
MD5 947f93fe0eed44767626846f28cfde05
SHA1 f6276d2a2b4a9d8a8e23c84019cd3961e9d60e88
SHA512 f97739eb0d22a99b06ef340aefb0d5a5b45b679d28accff3de2565166392c7d2fabaa33f945696f7d456ba2ef323f48e43eb26578f71c8b2e8ed32fb4dc69bc9
SSDEEP 192:gcPqYV/saFlwwR+kMqe8TlZMX1sgUVa3ddMVsuNeMcGdSD9obOUAVlcMudM/Y14W:g7Q/X4kMb0lZ6mgtdHOelGdWaolvsTh
MD5 SHA1 SHA512 SSDEEP

Submit Download

addressbook.acrodata

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
Size 5.3MB
SHA256 793125c5420b86d763c7c3fd5191d0448480732551b1e5dc10f09eefb05b3380
MD5 97f2aebb4c3cb058995441277db99da3
SHA1 eaef8a3e37740115632646e64eb2810dc2eec1e6
SHA512 fa325d799ff464718a4073946c7b7b2d43c1ebd34904726bb0f030c9cecef1a5f1988fc4eae5b1388110cd1b93b1e427501e95d96ddd21a3ffdbf7c49c2e466a
SSDEEP 24576:oWPZCFFJWXDceo49xsDpBLsIMvH0OLs34nQPIV0MQxnRWJ6Uw0e2qDGvN73TUtvH:o
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/876-170-0x0000000011560000-0x0000000011581000-memory.dmp

Download