d9f48d9650dffedf255bed649a2932c222f605640ccf784ab6e72b9dd6ad8027

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17/03/2024, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d9f48d9650dffedf255bed649a2932c222f605640ccf784ab6e72b9dd6ad8027.pdf
Size 689KB
Sample240317-kdc6fsag4y
SHA256 d9f48d9650dffedf255bed649a2932c222f605640ccf784ab6e72b9dd6ad8027
MD5 dcb8faaf9efa5a8027fbeffe76d0c061
SHA1 5082b14b4aeb146e6a5ff55563b85c3c8260380e
SHA512 16fdf0b32178ac5601f2fde9ed4c3a7e90ec4378e32b79890acc812255cc58cb8bf1a8aa609eb8214510cbfad392297673b81f700fd7d340ea9223eaa617c854
SSDEEP 12288:QLMe+7yX0aSogYOy64/moo7A3uYj0c0xgCEmrFr3LXVBir:k++1SNYOy64eoRxjf0xgCT3LXVO
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\MuiCache	AdobeCollabSync.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3628	AcroRd32.exe
3628	AcroRd32.exe
3628	AcroRd32.exe
3628	AcroRd32.exe
3628	AcroRd32.exe
3628	AcroRd32.exe
3628	AcroRd32.exe
3628	AcroRd32.exe
3628	AcroRd32.exe
3628	AcroRd32.exe
3628	AcroRd32.exe
3628	AcroRd32.exe
3628	AcroRd32.exe
3628	AcroRd32.exe
3628	AcroRd32.exe
3628	AcroRd32.exe
3628	AcroRd32.exe
3628	AcroRd32.exe
3628	AcroRd32.exe
3628	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3628	AcroRd32.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3628	AcroRd32.exe
3628	AcroRd32.exe
3628	AcroRd32.exe
3628	AcroRd32.exe
3628	AcroRd32.exe
3628	AcroRd32.exe
3628	AcroRd32.exe
3628	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 3624	3628	AcroRd32.exe	91
PID 3628 wrote to memory of 3624	3628	AcroRd32.exe	91
PID 3628 wrote to memory of 3624	3628	AcroRd32.exe	91
PID 3624 wrote to memory of 612	3624	AdobeCollabSync.exe	92
PID 3624 wrote to memory of 612	3624	AdobeCollabSync.exe	92
PID 3624 wrote to memory of 612	3624	AdobeCollabSync.exe	92
PID 3628 wrote to memory of 4680	3628	AcroRd32.exe	94
PID 3628 wrote to memory of 4680	3628	AcroRd32.exe	94
PID 3628 wrote to memory of 4680	3628	AcroRd32.exe	94
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 1768	4680	RdrCEF.exe	95
PID 4680 wrote to memory of 4316	4680	RdrCEF.exe	96
PID 4680 wrote to memory of 4316	4680	RdrCEF.exe	96
PID 4680 wrote to memory of 4316	4680	RdrCEF.exe	96
PID 4680 wrote to memory of 4316	4680	RdrCEF.exe	96
PID 4680 wrote to memory of 4316	4680	RdrCEF.exe	96
PID 4680 wrote to memory of 4316	4680	RdrCEF.exe	96
PID 4680 wrote to memory of 4316	4680	RdrCEF.exe	96
PID 4680 wrote to memory of 4316	4680	RdrCEF.exe	96
PID 4680 wrote to memory of 4316	4680	RdrCEF.exe	96
PID 4680 wrote to memory of 4316	4680	RdrCEF.exe	96
PID 4680 wrote to memory of 4316	4680	RdrCEF.exe	96
PID 4680 wrote to memory of 4316	4680	RdrCEF.exe	96
PID 4680 wrote to memory of 4316	4680	RdrCEF.exe	96
PID 4680 wrote to memory of 4316	4680	RdrCEF.exe	96

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d9f48d9650dffedf255bed649a2932c222f605640ccf784ab6e72b9dd6ad8027.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c --type=collab-renderer --proc=3624
    3⤵
    - Modifies registry class
    PID:612
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" GetChannelUri
      4⤵
      PID:2680
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F5A700FFCA700D9FF25D90851959604A --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1768
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9AB4482989B1812048CF26A2BDA2878F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9AB4482989B1812048CF26A2BDA2878F --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4316
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=134A58A3CAE3149606462389F668B5A3 --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1860
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=39DCB7950A90B96F14C3419497BC743E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=39DCB7950A90B96F14C3419497BC743E --renderer-client-id=5 --mojo-platform-channel-handle=2408 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4164
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DE066CAF9DD929A7B8B781854C6243DD --mojo-platform-channel-handle=2668 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2772
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C48AAC056EC791E18F2901053588FAEE --mojo-platform-channel-handle=2912 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4384
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1BA5EE2FB2B0E032DDDDCEBC1FAD65E3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1BA5EE2FB2B0E032DDDDCEBC1FAD65E3 --renderer-client-id=10 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 e82007f692c5b8a9a37826bfc3992d2a976095e9a15c4788bad9a9de04a2d82b
MD5 df9c067ef0fbc875c9fc58af48d4e1a2
SHA1 4db689a44634181435cb4f6fb0ecd187a4b85af2
SHA512 a9740bb693c023c62b75a1dec9c1bf4bdf76ac41c4da3376223c5a27b8037962a12529ad95539f48b0f9181fcb4911074a4cd96c6faa2bef16b9a9a7b54da77b
SSDEEP 384:yexdThatELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:Y+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

notificationsDB

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\DesktopNotification\NotificationsDB\notificationsDB
Size 24KB
SHA256 4901703febb24c665059d25ae6d0769c55051bcdc1b7a72b600252d4c3b0eca0
MD5 4fe2b64a2631d0d6eb30b8f42b49bcf5
SHA1 10c931554e79c2f4280a65ef2ad57ff61a2429ec
SHA512 8ad48178aa8d835e0c2028688e41f575e50e21b6b4b59161d08984c300911fda1a4614738bfa5557c3f2d254373a61497b491cbc7fb163afea2dbe08fcb67004
SSDEEP 24:TLD8fS8stZLNoz4zCQe8stZL+tCAConWZA2sZkgkxzcpS:TXF1K+CAWZA2skgkFcpS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 a027cf12f2055635a3020f08e0448b2f0314791260ccd25570426088c5b0e307
MD5 245950c48f668cf2fcb3c64778e64089
SHA1 3a5a14c820f58e35a3fc6f5de29669f0840587d8
SHA512 4fc8448536663b551cc716d78715f06d4ed217fbdf755924f0b30aebbb6212798a61c6638f919d5c14bdb6998d6a12f0ca37281f3c7f484c1821fbfc98d4a24d
SSDEEP 192:K+oGsTzoU27NTaUxma1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklN7UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 87aa4c64348b534771f03919b5bdca09596e89f6e0cca0a992bb3d290ec4155a
MD5 aebe0d2eb7a2077a55e57a955e62406a
SHA1 3f811b8148f12220f4b45699135e6d21c9847d8a
SHA512 efa1b082925a4e478fcea74764bbacb91d43da8c01c4b360a34e6f7402af23f91c93b5e91c6266120e144b5300e8dae73a62a7b6d7c4328410128f6a72a7baed
SSDEEP 192:t+oGsTzoU27NTaUxmYeMb1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:tklNveMbUNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 43ca54dc0daba3dcf09c800a0e2764df3b54695c5502db4bee1a97d95888e3ee
MD5 5ff5cfa14cd0e68fe5d6d5bcc50121b5
SHA1 27626c0ef8f492481837e660fcd56d0b63481db8
SHA512 c6172bd21642ecf750216d29dff62bbb96f4f6d6a55b5a639e587d5089626fa1e1bd7ec65ce85e6c258a04e865b95a7a9d456c623912c84d01a0ec6fd3637993
SSDEEP 192:K+oGsTzoU27NTaUxm2X441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklNhX44UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 d2f2e3bb8f77a7d6d0455022c199afa0e2b75570c7d8a9897b7db219b0e0aced
MD5 311d6645e15ccfa2b8a383303d86bf8d
SHA1 34378ca676a812e8f3e20e6436d3f9644d450360
SHA512 2b0981766781c5eadc8fb063bc659560cc0e812323a3d01d86dcb327f4710d6d62aad5c2716818bd639fbe57d67ea5a863c97dd8e07687c3dac55d4ad044d10d
SSDEEP 192:a+oGsTzoU27NTaUxmG/ra8441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:aklNPza844UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

resource-18

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\resources\resource-18
Size 3.6MB
SHA256 152951ea34b49de148c3d4f11fa81875193576c8aa4a49abc5fa756cd3e12f42
MD5 a8c8361b7f2302396e258a3409e8371c
SHA1 cd84724e89830994e8b958a0c0a9db2b5fd3db08
SHA512 29d08b72d345cc95e0ce998bde0967f63cb72bf3a8316ff49f009aadeab3872f99f0a3bb5230f5f3f2655cf6e1dc04ffcc716dcc7f6050814339b25a0824e60b
SSDEEP 49152:ELWuHSQeNu5GB3mAs8f7b9ugh1F9fj6dixJns6E5p0QfE7+xbKZh4Djdi6W7wjV:hOsmAzXkgHF3J9E5y9+2h43dAwJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Size 471B
SHA256 67fb6ae535f0064605cae7bbc6f1eba0b408e0be4a401d262bb9be38401e4063
MD5 d71224e622ecfaa3af2616d644ec3a3a
SHA1 d53af2d311f0a05c20af93f217be7e39819e8d2b
SHA512 878fcd7dd1041a65d978859ccfc18639122655f814c146093aba1f3f7377f7659e591c528da10aaa0444cacb2418034aaea62602aee1c855c7dd2dbae261cb57
MD5 SHA1 SHA512

Submit Download

B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Size 400B
SHA256 ceefed4fdde8f41dcad5f46d7155f61fed1904b92d14a90ff19582fbbec6599b
MD5 c3e2c6725e7154a8617d318da215075c
SHA1 397067e3b02cd401999dc32461d36c143c42dd41
SHA512 9a9a59a6056f06f5d4cdf30047f46310ced0d27732010d6a88bb02a84023a121e555162becdfda789da8828b8ce86bb963e8a7e1a5ade3268fd78c3d585c03a4
MD5 SHA1 SHA512

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 90cdac32f552e00b0af210d0e16f5e24fb6d1cc41b42b138c6bd7c01a124267c
MD5 6b7193fe01e427cae2a3891e3fc3281b
SHA1 eaef8dce2b6208f0bfd100ee99ee2eab15d76497
SHA512 04968413c018ea00c1aad0da0d8e2dc4cda984442b15a8a491d98a8e767e82fe869873b687d2dcb0b95202838ff93f4b19f4e2b441022ac7d5d0076588463bd7
SSDEEP 12:TLAQkctO9OiyopOz2VVXet3aQK+GyMFO+rlhurs7qllhaw+AbPxcBALjlALjy+:TLaNx/XYKQvGJF7ursClUtQPsAjlAjb
MD5 SHA1 SHA512 SSDEEP

Submit Download

addressbook.acrodata

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
Size 14KB
SHA256 06a576fc14e995c437b26c0d150b4e84cd745e7cedfd972a84b42b51c842fc9b
MD5 947f93fe0eed44767626846f28cfde05
SHA1 f6276d2a2b4a9d8a8e23c84019cd3961e9d60e88
SHA512 f97739eb0d22a99b06ef340aefb0d5a5b45b679d28accff3de2565166392c7d2fabaa33f945696f7d456ba2ef323f48e43eb26578f71c8b2e8ed32fb4dc69bc9
SSDEEP 192:gcPqYV/saFlwwR+kMqe8TlZMX1sgUVa3ddMVsuNeMcGdSD9obOUAVlcMudM/Y14W:g7Q/X4kMb0lZ6mgtdHOelGdWaolvsTh
MD5 SHA1 SHA512 SSDEEP

Submit Download

addressbook.acrodata

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
Size 5.3MB
SHA256 793125c5420b86d763c7c3fd5191d0448480732551b1e5dc10f09eefb05b3380
MD5 97f2aebb4c3cb058995441277db99da3
SHA1 eaef8a3e37740115632646e64eb2810dc2eec1e6
SHA512 fa325d799ff464718a4073946c7b7b2d43c1ebd34904726bb0f030c9cecef1a5f1988fc4eae5b1388110cd1b93b1e427501e95d96ddd21a3ffdbf7c49c2e466a
SSDEEP 24576:oWPZCFFJWXDceo49xsDpBLsIMvH0OLs34nQPIV0MQxnRWJ6Uw0e2qDGvN73TUtvH:o
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3628-259-0x0000000012F30000-0x0000000012F51000-memory.dmp

Download