8ed0c9391e135195769a6af53cb8160e9a28cc2d5afbe829a0a108219fb72b83

Resubmissions

29/03/2024, 01:18

240329-bn94hadf8x 3

29/03/2024, 01:17

240329-bnwacaec43 5

29/03/2024, 01:16

240329-bmzalsdf5v 3

Analysis

max time kernel
459s
max time network
449s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

testestestestetw/jasdasdasdasd - Copy (16).exe
Size

1.2MB
MD5

d56d4b12a8d0f7d4a5a94c2ebe246513
SHA1

95543e702e65b8fa2a115c9bbd30b2feab11f9c7
SHA256

f290fa5dc611042d27c5bb90f063ea2583053c273b0ff9bc0209533038410991
SHA512

516a94e244e8650ed5eb358c2cd781f0c827dca33db14534570f908d1dc52c83492d8f63fbf0578f15f0db1ee3eb5ed184fc3b784698464184604bec1bf2ac1e
SSDEEP

24576:LdofGAmSIQ177wZ+A7MjiiRDXU/Sat5RgsLSmIOHsU5zMmX1xYwncqKvGqBO:LdofGbSIQ177wZvYjiiRDXASat5RgsLN

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5424	AcroRd32.exe
5424	AcroRd32.exe
5424	AcroRd32.exe
5424	AcroRd32.exe
5424	AcroRd32.exe
5424	AcroRd32.exe
5424	AcroRd32.exe
5424	AcroRd32.exe
5424	AcroRd32.exe
5424	AcroRd32.exe
5424	AcroRd32.exe
5424	AcroRd32.exe
5424	AcroRd32.exe
5424	AcroRd32.exe
5424	AcroRd32.exe
5424	AcroRd32.exe
5424	AcroRd32.exe
5424	AcroRd32.exe
5424	AcroRd32.exe
5424	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1648	jasdasdasdasd - Copy (16).exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2388	firefox.exe
Token: SeDebugPrivilege	2388	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1648	jasdasdasdasd - Copy (16).exe
2388	firefox.exe
2388	firefox.exe
2388	firefox.exe
2388	firefox.exe
1648	jasdasdasdasd - Copy (16).exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
1648	jasdasdasdasd - Copy (16).exe
2388	firefox.exe
2388	firefox.exe
2388	firefox.exe
1648	jasdasdasdasd - Copy (16).exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2388	firefox.exe
5424	AcroRd32.exe
5424	AcroRd32.exe
5424	AcroRd32.exe
5424	AcroRd32.exe
5424	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 2388	4660	firefox.exe	94
PID 4660 wrote to memory of 2388	4660	firefox.exe	94
PID 4660 wrote to memory of 2388	4660	firefox.exe	94
PID 4660 wrote to memory of 2388	4660	firefox.exe	94
PID 4660 wrote to memory of 2388	4660	firefox.exe	94
PID 4660 wrote to memory of 2388	4660	firefox.exe	94
PID 4660 wrote to memory of 2388	4660	firefox.exe	94
PID 4660 wrote to memory of 2388	4660	firefox.exe	94
PID 4660 wrote to memory of 2388	4660	firefox.exe	94
PID 4660 wrote to memory of 2388	4660	firefox.exe	94
PID 4660 wrote to memory of 2388	4660	firefox.exe	94
PID 2388 wrote to memory of 3948	2388	firefox.exe	96
PID 2388 wrote to memory of 3948	2388	firefox.exe	96
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 4072	2388	firefox.exe	97
PID 2388 wrote to memory of 1560	2388	firefox.exe	98
PID 2388 wrote to memory of 1560	2388	firefox.exe	98
PID 2388 wrote to memory of 1560	2388	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\testestestestetw\jasdasdasdasd - Copy (16).exe
"C:\Users\Admin\AppData\Local\Temp\testestestestetw\jasdasdasdasd - Copy (16).exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1648

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2388.0.789891960\736906964" -parentBuildID 20221007134813 -prefsHandle 1880 -prefMapHandle 1868 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {80e3a8b8-ff65-49b7-9f51-d33a42f023ef} 2388 "\\.\pipe\gecko-crash-server-pipe.2388" 1960 22543beee58 gpu
    3⤵
    PID:3948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2388.1.1041374825\1301512661" -parentBuildID 20221007134813 -prefsHandle 2364 -prefMapHandle 2352 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef30eca2-d59d-40e9-a5bb-a5ef67069fe7} 2388 "\\.\pipe\gecko-crash-server-pipe.2388" 2376 22543730b58 socket
    3⤵
    PID:4072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2388.2.1426647393\1015134880" -childID 1 -isForBrowser -prefsHandle 3220 -prefMapHandle 3212 -prefsLen 20823 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {32c72092-6c44-4c98-b994-e3f3bdb79ec8} 2388 "\\.\pipe\gecko-crash-server-pipe.2388" 1672 22547daee58 tab
    3⤵
    PID:1560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2388.3.1015760664\1927089182" -childID 2 -isForBrowser -prefsHandle 2964 -prefMapHandle 2948 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {494c3b73-773b-4228-8a75-26d9b1ec60ea} 2388 "\\.\pipe\gecko-crash-server-pipe.2388" 2748 22547db0958 tab
    3⤵
    PID:4908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2388.4.955622227\831429821" -childID 3 -isForBrowser -prefsHandle 4680 -prefMapHandle 4676 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {560a7b97-053a-4a25-a6e7-98fe32cf16cd} 2388 "\\.\pipe\gecko-crash-server-pipe.2388" 4496 22549ba4358 tab
    3⤵
    PID:4008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2388.5.94293452\312695786" -childID 4 -isForBrowser -prefsHandle 5228 -prefMapHandle 5196 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7fb951e-bdb1-4ca3-9c55-c5bfd6bbcfb4} 2388 "\\.\pipe\gecko-crash-server-pipe.2388" 5244 22549ba4f58 tab
    3⤵
    PID:4340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2388.6.1465421775\1646837169" -childID 5 -isForBrowser -prefsHandle 5392 -prefMapHandle 5396 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28f45d1a-065f-4af3-92ee-d41d6da5b688} 2388 "\\.\pipe\gecko-crash-server-pipe.2388" 5384 2254a21ef58 tab
    3⤵
    PID:2576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2388.7.542111849\29214236" -childID 6 -isForBrowser -prefsHandle 5580 -prefMapHandle 5584 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c55e9f9-e98f-4658-9a72-f5f39ed8394a} 2388 "\\.\pipe\gecko-crash-server-pipe.2388" 5572 2254af2bd58 tab
    3⤵
    PID:656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2388.8.1661264654\1190526192" -childID 7 -isForBrowser -prefsHandle 2744 -prefMapHandle 5900 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {11484e59-8bb8-47d0-8fb1-76e32c799ab0} 2388 "\\.\pipe\gecko-crash-server-pipe.2388" 5636 2254b2cee58 tab
    3⤵
    PID:5364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2388.9.1924827491\1555041139" -parentBuildID 20221007134813 -prefsHandle 3196 -prefMapHandle 2940 -prefsLen 26206 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e40c3b29-4137-4e9f-aa2d-d08f5802fbe7} 2388 "\\.\pipe\gecko-crash-server-pipe.2388" 4824 225498a8858 rdd
    3⤵
    PID:5652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2388.10.1588779796\135913964" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 4824 -prefMapHandle 2980 -prefsLen 26206 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15a05d8c-1c9e-46c0-9c61-e7b88dbd79c9} 2388 "\\.\pipe\gecko-crash-server-pipe.2388" 3564 22549ba2e58 utility
    3⤵
    PID:5668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2388.11.471276144\608041418" -childID 8 -isForBrowser -prefsHandle 6168 -prefMapHandle 6172 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f58afa4f-dd77-4bb6-8e0e-27792e047a2d} 2388 "\\.\pipe\gecko-crash-server-pipe.2388" 6240 2254b5ef558 tab
    3⤵
    PID:6084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2388.12.2114688321\2128803724" -childID 9 -isForBrowser -prefsHandle 6188 -prefMapHandle 4876 -prefsLen 26772 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9dc2811b-00ef-41d4-8a16-967032280eee} 2388 "\\.\pipe\gecko-crash-server-pipe.2388" 6436 2254b888c58 tab
    3⤵
    PID:5952

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\72b8cef5a90340ff86fae300a024e25f /t 760 /p 2388
1⤵
PID:2580

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5424
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  PID:2892
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6E7B3D97670669A71398F2166E1BBEF9 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2076
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5F4E8746DCE35130DE554D3C2D236D6D --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5F4E8746DCE35130DE554D3C2D236D6D --renderer-client-id=2 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3076
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A70C31E527F327EC69F1D0A9028DA567 --mojo-platform-channel-handle=2324 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1108
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=23404E6C4C0F76BDE498F44358F3F1E9 --mojo-platform-channel-handle=2440 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3664
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=623420A7C560394B8AF8A0FE51B370F1 --mojo-platform-channel-handle=2356 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
5582ece9ce463b2b40b12a3c1e41fb0c

SHA1
e122babf166ae1c89843d206eb46de1dc5c8ca0d

SHA256
df5c89ede6b19c4d2ef4202dd51cd3d78fa7995c961206e47ecb8ba420d16ce2

SHA512
0faf4a5b849c37a683e4e65f5c537969f73039453e80ab14c45030905cc4fdbb6fb98500b04100e90e0d61860c5dcb60b3f873f0c34e862efd8c9aaf0b0291c8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0z1r4qkh.default-release\cache2\doomed\9852

Filesize
14KB

MD5
0a688c5d247a7d053238d98d12674d25

SHA1
8cb119b46abecb080268bdd2b16379ef5e81cf2e

SHA256
fd38cd098d7248c909c34e8dd1d02b1b1361793f663567ff42f1c48e55c06d49

SHA512
d657ba44784f87b636d459c1f8c91d12b5f0a71c3b881ef86ea19ab1bce0f12247077257de5456d0195177f3df0dd4fb3f1e5e4e64e35564a5d1612ca8ecf523

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0z1r4qkh.default-release\cache2\entries\D82ED10047F78B4F750CAA390C240BAAC50F3BAE

Filesize
10KB

MD5
02bf309a3215110d9e3bf1a141f13abb

SHA1
e9d7004a71b28d6d31264f3b29aaff18c030cfce

SHA256
9e555bba9ca5dc6bdf0fbb5ba561b3798be5cf23c4a882cabfdccb86061f12db

SHA512
045e831aabbb18ca1603da40011b34957490dc6590289bc2b8fc2d6bf19e5ca6ea07316f2368975c80cfffd1e607f170f94a2ce21a4563f3245f966e39d909a0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0z1r4qkh.default-release\datareporting\glean\db\data.safe.bin

Filesize
9KB

MD5
6fa8a618a09676a0e02717e46c540585

SHA1
d53258b7654cf1ba00857eb99b6f6d857f6f043c

SHA256
7799c8ff6bbbf52c95f023dd104218c053ec24a1b81d981e9765446683f5b6d2

SHA512
d852b31c3698e93c7f6054367b2fc1a92486a85738a118dd2cf63bb7736753e6ae915cb4a3a91be32773cc58962d0c389618d9b6a13905458e2501a1c8d8cf40

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0z1r4qkh.default-release\datareporting\glean\pending_pings\77f6279c-8182-4587-ac91-72001d14a261

Filesize
734B

MD5
954b85c322c740a78216bd048a1642cd

SHA1
34e2ef6de0ef50baad3c8ada094e4ff4f3919188

SHA256
25b2e12c23957c8ff6eceaa226afaf8dcb111170117f6ebd05abca753df45d43

SHA512
b452a4b601280b963eee195c271eb24e66392e19f57340e40154f89afb6d5b1c8e7f9f0af8796dc24824617988b216ed9071837137e682abb68bd98e60af2ccd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0z1r4qkh.default-release\prefs-1.js

Filesize
6KB

MD5
8e0c6b3c7731dd1d753cdee5cb36b17c

SHA1
92f4bf45f9087977d06bcb01047e65194a2aad0f

SHA256
08c982dbd86f9920f40648ac508a8f60fd631884f2e76e3bcad831efc2f11ebe

SHA512
198fde13d4d841ac4b11d64d270a6e829508a7b3cd266419bb33f30fe76c2ac53bc925a6af90e6876b5d92a20607d70a2c4059e92a785f4d02ccc4a8d984981c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0z1r4qkh.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
335a6779ea9fc6a5fa871505b9aa1ba6

SHA1
f0fade470296f734c3439f4302649efaf8392ae5

SHA256
40b97fe6f49b9fbf38ccbe98e4b7589cd44f5fdf7d7623f3e0f3b793d7a9317c

SHA512
7c9a21fefbfffe1b3932020219aebdd9762062224a54d68881a8fea1f8e487233dc018bc5b4b06220f875fa1d4affee3d65b09a82d1e64a61db44df1c6c9a268

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0z1r4qkh.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
a86b6ac0caa3c52b3c90d4616b141f98

SHA1
f31de535ce62961bc22c3f40de65d4f11fa1dda6

SHA256
9831cc2613dd6a99ffb4ceab3f8bd586ad8d88a6f8f9f610ceca82ab663a2ff4

SHA512
0b1696fd365604a04b173ebca8670036ec9b501eaae074b3762866f291d0c44aa7badb27af1fcaa6840de7c7c2384be9bfbbc5bccecab1b8040ea02767bb1205

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0z1r4qkh.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
bf28e4509853444c2e687138f0f200b7

SHA1
56573b6db8b198069f4da02acd154dd0ae8c40d8

SHA256
8a593251979e053a13391b557ce265664b711261db41734d452e6d1266f7ff1d

SHA512
6b37ddefcc979e0ce76af346df55b53b214b806f60f3a1d9dd24eed4f738793ffe9498949030fcd7ad96aeb651a7b8362d0f114a0e8fbeb9747787fd7a4588d8

Download Submit