601be79b7f934bfa16fd8cfc17ff55434391a6d96b99b867305cf4dca30b95df

Analysis

max time kernel
141s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2024, 22:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
601be79b7f934bfa16fd8cfc17ff55434391a6d96b99b867305cf4dca30b95df.pdf
Size 41KB
Sample240331-1527nadf5z
SHA256 601be79b7f934bfa16fd8cfc17ff55434391a6d96b99b867305cf4dca30b95df
MD5 abd1b782a16c62aca9ba975f31668512
SHA1 925c9810863ebfcd5217bb4117db8e9ccaabeb5f
SHA512 a4f3f535da86aee267ec4a994a1ac7e9c390317cf5101d4d7145031294e549a1c749dfa0ad9e8c56375e7defd106805031b8b66af1540a133caf73501cdbbafb
SSDEEP 768:x4BMa028JQojtk/uhI9Jp+WeQfwunAamuZlVwsJZuG7wcf:PMLWkwunAamuZlVws/57bf
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\MuiCache	AdobeCollabSync.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1476	AcroRd32.exe
1476	AcroRd32.exe
1476	AcroRd32.exe
1476	AcroRd32.exe
1476	AcroRd32.exe
1476	AcroRd32.exe
1476	AcroRd32.exe
1476	AcroRd32.exe
1476	AcroRd32.exe
1476	AcroRd32.exe
1476	AcroRd32.exe
1476	AcroRd32.exe
1476	AcroRd32.exe
1476	AcroRd32.exe
1476	AcroRd32.exe
1476	AcroRd32.exe
1476	AcroRd32.exe
1476	AcroRd32.exe
1476	AcroRd32.exe
1476	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1476	AcroRd32.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1476	AcroRd32.exe
1476	AcroRd32.exe
1476	AcroRd32.exe
1476	AcroRd32.exe
1476	AcroRd32.exe
1476	AcroRd32.exe
1476	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 4460	1476	AcroRd32.exe	89
PID 1476 wrote to memory of 4460	1476	AcroRd32.exe	89
PID 1476 wrote to memory of 4460	1476	AcroRd32.exe	89
PID 4460 wrote to memory of 1228	4460	AdobeCollabSync.exe	90
PID 4460 wrote to memory of 1228	4460	AdobeCollabSync.exe	90
PID 4460 wrote to memory of 1228	4460	AdobeCollabSync.exe	90
PID 1228 wrote to memory of 3836	1228	AdobeCollabSync.exe	95
PID 1228 wrote to memory of 3836	1228	AdobeCollabSync.exe	95
PID 1228 wrote to memory of 3836	1228	AdobeCollabSync.exe	95
PID 1476 wrote to memory of 956	1476	AcroRd32.exe	99
PID 1476 wrote to memory of 956	1476	AcroRd32.exe	99
PID 1476 wrote to memory of 956	1476	AcroRd32.exe	99
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 4404	956	RdrCEF.exe	100
PID 956 wrote to memory of 2612	956	RdrCEF.exe	101
PID 956 wrote to memory of 2612	956	RdrCEF.exe	101
PID 956 wrote to memory of 2612	956	RdrCEF.exe	101
PID 956 wrote to memory of 2612	956	RdrCEF.exe	101
PID 956 wrote to memory of 2612	956	RdrCEF.exe	101
PID 956 wrote to memory of 2612	956	RdrCEF.exe	101
PID 956 wrote to memory of 2612	956	RdrCEF.exe	101
PID 956 wrote to memory of 2612	956	RdrCEF.exe	101
PID 956 wrote to memory of 2612	956	RdrCEF.exe	101
PID 956 wrote to memory of 2612	956	RdrCEF.exe	101
PID 956 wrote to memory of 2612	956	RdrCEF.exe	101

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\601be79b7f934bfa16fd8cfc17ff55434391a6d96b99b867305cf4dca30b95df.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c --type=collab-renderer --proc=4460
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1228
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" GetChannelUri
      4⤵
      PID:3836
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F07EB0931C97FD668270161DCB890DA1 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4404
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=FDC23160EDC2260F6C9A5AEA76FA8437 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=FDC23160EDC2260F6C9A5AEA76FA8437 --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2612
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6B66321DB7D8F7DF2D471194B8DE754B --mojo-platform-channel-handle=2168 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3288
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F3A93A741B72A8C9ED682B850EA2C577 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2448
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F2F4C71BF49D905A3952C9966C5E945B --mojo-platform-channel-handle=2412 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2628
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5640A9D5648D00062B766558043B9A9A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5640A9D5648D00062B766558043B9A9A --renderer-client-id=7 --mojo-platform-channel-handle=2540 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1252
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=CA78F312D64B7FDAE00AD9624E3B5DD8 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=CA78F312D64B7FDAE00AD9624E3B5DD8 --renderer-client-id=10 --mojo-platform-channel-handle=2416 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 e10b5ef1152a04fd17a03cd46bad0f86434998310aea62c336bc5591b49b1ebe
MD5 f94e6fc16c122ef98b353943f4b5782e
SHA1 5f0d2e1aab0eeac15036299745d895156bc41710
SHA512 7428426cc1e0b416823674ae6d175f1a7e73038a32ec93c46e7fae8fed2dd82a949e7360bf7a771b9ad344b081a2bef97654e92fe13f6189d7d785b42d7d6e8a
SSDEEP 384:yeTdThatELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:e+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

notificationsDB

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\DesktopNotification\NotificationsDB\notificationsDB
Size 24KB
SHA256 4901703febb24c665059d25ae6d0769c55051bcdc1b7a72b600252d4c3b0eca0
MD5 4fe2b64a2631d0d6eb30b8f42b49bcf5
SHA1 10c931554e79c2f4280a65ef2ad57ff61a2429ec
SHA512 8ad48178aa8d835e0c2028688e41f575e50e21b6b4b59161d08984c300911fda1a4614738bfa5557c3f2d254373a61497b491cbc7fb163afea2dbe08fcb67004
SSDEEP 24:TLD8fS8stZLNoz4zCQe8stZL+tCAConWZA2sZkgkxzcpS:TXF1K+CAWZA2skgkFcpS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 a027cf12f2055635a3020f08e0448b2f0314791260ccd25570426088c5b0e307
MD5 245950c48f668cf2fcb3c64778e64089
SHA1 3a5a14c820f58e35a3fc6f5de29669f0840587d8
SHA512 4fc8448536663b551cc716d78715f06d4ed217fbdf755924f0b30aebbb6212798a61c6638f919d5c14bdb6998d6a12f0ca37281f3c7f484c1821fbfc98d4a24d
SSDEEP 192:K+oGsTzoU27NTaUxma1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklN7UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 87aa4c64348b534771f03919b5bdca09596e89f6e0cca0a992bb3d290ec4155a
MD5 aebe0d2eb7a2077a55e57a955e62406a
SHA1 3f811b8148f12220f4b45699135e6d21c9847d8a
SHA512 efa1b082925a4e478fcea74764bbacb91d43da8c01c4b360a34e6f7402af23f91c93b5e91c6266120e144b5300e8dae73a62a7b6d7c4328410128f6a72a7baed
SSDEEP 192:t+oGsTzoU27NTaUxmYeMb1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:tklNveMbUNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 c91e69d01d73af49d71412f7a0383a9718136fa09fc54f68f649a21fa25ddd94
MD5 0afc7ca6654c0d32148bdf7b8abe9e4e
SHA1 b31fd2e22cdf0480544d364b82ec0397a797f175
SHA512 bf4f5805b3cf2835099111fc4f028afd54c2e751242342b853942473448bfda1a882d15c40450043b7a99cae9a21f0e6845ab14d71cc212752f8e7dde5cf03af
SSDEEP 192:K+oGsTzoU27NTaUxm8lX441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklNBX44UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 6c3d4f9ac72f753a1efbe69a0cf705341a8bcc09a675e5b7104341314af4526e
MD5 41345bd62c12543afb009765700ac029
SHA1 e702c735c17a5f56bdc8eefa3cba4b0e1c516b02
SHA512 6e21d9425fa683cb4b6e70acfcf91a97de0ad870b92f618811275cdbc43d6ba814a082a891325b63c6db63f516d2dd7a2dde9ca29f80f922a1b228fb55fab509
SSDEEP 192:a+oGsTzoU27NTaUxmGtKag441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:aklNPAag44UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

resource-18

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\resources\resource-18
Size 3.6MB
SHA256 152951ea34b49de148c3d4f11fa81875193576c8aa4a49abc5fa756cd3e12f42
MD5 a8c8361b7f2302396e258a3409e8371c
SHA1 cd84724e89830994e8b958a0c0a9db2b5fd3db08
SHA512 29d08b72d345cc95e0ce998bde0967f63cb72bf3a8316ff49f009aadeab3872f99f0a3bb5230f5f3f2655cf6e1dc04ffcc716dcc7f6050814339b25a0824e60b
SSDEEP 49152:ELWuHSQeNu5GB3mAs8f7b9ugh1F9fj6dixJns6E5p0QfE7+xbKZh4Djdi6W7wjV:hOsmAzXkgHF3J9E5y9+2h43dAwJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Size 471B
SHA256 28e674a0f773a6ac5451230d9e5aeb4d1bf6095a213654b0a2b9d3049571b693
MD5 1f174d070e5c49712f71e3613cb58849
SHA1 07daabe8b7efbc9a4f98be48e9746c8f6f3534d8
SHA512 4b44be09c7d15397fa743eba9781931e59cbc24512d9c8e46c8a7c056237db19677254083f3d43b3015bb1569b4e8c9898719e15ea1c75d51c28037abc5eaf93
MD5 SHA1 SHA512

Submit Download

B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Size 400B
SHA256 9414dbd3ffa8e185e60541716eb9e43f0f1a3742d07939961eed022e9c234cde
MD5 8486e24ccd3ccc89bc6adf1b08a79370
SHA1 35dbf403bac25c3feee20a4189e21b270ff8c912
SHA512 720a2c1de736b3a444666fc822b1122e7590f5671947dd908cf8c5346603088166295fb972ab43593d2eb46d9d3f232b582807d6c4429ac00202902cd76b9dd8
MD5 SHA1 SHA512

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 b66fa160e728ccd5221ac99ab39c525f5f97512be96096c6a1060844fab897ce
MD5 d6ce49f7b10770b155057a4350685c83
SHA1 0f9f811482e50c1727ccdb896e69abad534ef2a3
SHA512 52057874b59a4b52a227bfc2214a5b1cf5dc2dfd27aa2ce1bab5838a4688fbf7ac87fe482185a358e0cbd125728c6e1aac1902edb8ac559a9e717dcee3071dfc
SSDEEP 48:T+l2GL7msCZPbPAPcP60LrJz/PI0sWUONPERH:8VmsKjmC60LrJz3I0sWUOJERH
MD5 SHA1 SHA512 SSDEEP

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 588473a6cc0102eddad02c654ffe3301d8ccb16e002f4d030fa9f13e71557aaf
MD5 7b14d5a55bd8b6b2ca3f819e89cdb4b1
SHA1 0cf583f4c22041e53fa0a06177218b4f71a55566
SHA512 0f105072a7fdc8afeda4f03274eb77298b9877387b8fd003e1eaa8a9ddef512fb8d91af9dc41e56e9e521a117e9b4fac7324ec4f373de9328f20ca5481b5b352
SSDEEP 12:TLgotO9OiyopOz2VVXet3aQK+GyMFO+rlhurs7qllGUeUe2+:TLCx/XYKQvGJF7ursClGRRH
MD5 SHA1 SHA512 SSDEEP

Submit Download

addressbook.acrodata

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
Size 5.3MB
SHA256 793125c5420b86d763c7c3fd5191d0448480732551b1e5dc10f09eefb05b3380
MD5 97f2aebb4c3cb058995441277db99da3
SHA1 eaef8a3e37740115632646e64eb2810dc2eec1e6
SHA512 fa325d799ff464718a4073946c7b7b2d43c1ebd34904726bb0f030c9cecef1a5f1988fc4eae5b1388110cd1b93b1e427501e95d96ddd21a3ffdbf7c49c2e466a
SSDEEP 24576:oWPZCFFJWXDceo49xsDpBLsIMvH0OLs34nQPIV0MQxnRWJ6Uw0e2qDGvN73TUtvH:o
MD5 SHA1 SHA512 SSDEEP

Submit Download

addressbook.acrodata

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
Size 14KB
SHA256 06a576fc14e995c437b26c0d150b4e84cd745e7cedfd972a84b42b51c842fc9b
MD5 947f93fe0eed44767626846f28cfde05
SHA1 f6276d2a2b4a9d8a8e23c84019cd3961e9d60e88
SHA512 f97739eb0d22a99b06ef340aefb0d5a5b45b679d28accff3de2565166392c7d2fabaa33f945696f7d456ba2ef323f48e43eb26578f71c8b2e8ed32fb4dc69bc9
SSDEEP 192:gcPqYV/saFlwwR+kMqe8TlZMX1sgUVa3ddMVsuNeMcGdSD9obOUAVlcMudM/Y14W:g7Q/X4kMb0lZ6mgtdHOelGdWaolvsTh
MD5 SHA1 SHA512 SSDEEP

Submit Download