7f94117a8ea174dc4a21167b4de1338356369063bc039cd049cb4f1cbe72098a

Analysis

max time kernel
155s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2024, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7f94117a8ea174dc4a21167b4de1338356369063bc039cd049cb4f1cbe72098a.pdf
Size 339KB
Sample240331-29lk5seh7z
SHA256 7f94117a8ea174dc4a21167b4de1338356369063bc039cd049cb4f1cbe72098a
MD5 c16c426baf86c0c8ab41c1ef5d756178
SHA1 15f75eeb4fbd05ab435083d5c5abd94c8faa84ba
SHA512 244c92ffd173cfe5618b2fb66c9fc11e8ea2d3c1c8e52cf9c70f1416f73ed97c406890d6dcc923c6523bf8c66b8e622fcca702748720e3db7e85955ee6fb6d14
SSDEEP 6144:EuXfTU80Q0+Lzw9LrDev2pYtJ5cwqNha4buj/E6HOa2nacWyjr:TXfTQ+w9Lr6v0Uwuj/DHTkacWAr
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\MuiCache	AdobeCollabSync.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4552	AcroRd32.exe
4552	AcroRd32.exe
4552	AcroRd32.exe
4552	AcroRd32.exe
4552	AcroRd32.exe
4552	AcroRd32.exe
4552	AcroRd32.exe
4552	AcroRd32.exe
4552	AcroRd32.exe
4552	AcroRd32.exe
4552	AcroRd32.exe
4552	AcroRd32.exe
4552	AcroRd32.exe
4552	AcroRd32.exe
4552	AcroRd32.exe
4552	AcroRd32.exe
4552	AcroRd32.exe
4552	AcroRd32.exe
4552	AcroRd32.exe
4552	AcroRd32.exe
4552	AcroRd32.exe
4552	AcroRd32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4816	AdobeCollabSync.exe
4552	AcroRd32.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4816	AdobeCollabSync.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4552	AcroRd32.exe
4552	AcroRd32.exe
4552	AcroRd32.exe
4552	AcroRd32.exe
4552	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 1200	4552	AcroRd32.exe	95
PID 4552 wrote to memory of 1200	4552	AcroRd32.exe	95
PID 4552 wrote to memory of 1200	4552	AcroRd32.exe	95
PID 1200 wrote to memory of 3888	1200	AdobeCollabSync.exe	96
PID 1200 wrote to memory of 3888	1200	AdobeCollabSync.exe	96
PID 1200 wrote to memory of 3888	1200	AdobeCollabSync.exe	96
PID 4552 wrote to memory of 4816	4552	AcroRd32.exe	99
PID 4552 wrote to memory of 4816	4552	AcroRd32.exe	99
PID 4552 wrote to memory of 4816	4552	AcroRd32.exe	99
PID 4816 wrote to memory of 4284	4816	AdobeCollabSync.exe	100
PID 4816 wrote to memory of 4284	4816	AdobeCollabSync.exe	100
PID 4816 wrote to memory of 4284	4816	AdobeCollabSync.exe	100
PID 3888 wrote to memory of 1604	3888	AdobeCollabSync.exe	105
PID 3888 wrote to memory of 1604	3888	AdobeCollabSync.exe	105
PID 3888 wrote to memory of 1604	3888	AdobeCollabSync.exe	105
PID 4552 wrote to memory of 2348	4552	AcroRd32.exe	109
PID 4552 wrote to memory of 2348	4552	AcroRd32.exe	109
PID 4552 wrote to memory of 2348	4552	AcroRd32.exe	109
PID 4552 wrote to memory of 3304	4552	AcroRd32.exe	110
PID 4552 wrote to memory of 3304	4552	AcroRd32.exe	110
PID 4552 wrote to memory of 3304	4552	AcroRd32.exe	110
PID 4552 wrote to memory of 4136	4552	AcroRd32.exe	111
PID 4552 wrote to memory of 4136	4552	AcroRd32.exe	111
PID 4552 wrote to memory of 4136	4552	AcroRd32.exe	111
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112
PID 4136 wrote to memory of 4556	4136	RdrCEF.exe	112

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\7f94117a8ea174dc4a21167b4de1338356369063bc039cd049cb4f1cbe72098a.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c --type=collab-renderer --proc=1200
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3888
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" GetChannelUri
      4⤵
      PID:1604
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c --type=collab-renderer --proc=4816
    3⤵
    PID:4284
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  PID:2348
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  PID:3304
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=46A1EF856DB83498637D915F9623CFE2 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4556
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4803281FCE9663A40B65D6E429E1F02B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4803281FCE9663A40B65D6E429E1F02B --renderer-client-id=2 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1876
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=584981CC8AC6D64A28E23404DF89D389 --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:444
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EB3233F63D9DD9982FF58D3FF48877CF --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EB3233F63D9DD9982FF58D3FF48877CF --renderer-client-id=5 --mojo-platform-channel-handle=1896 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1496
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C085A1C97485FEB1F49B7F2BDB980DB9 --mojo-platform-channel-handle=2128 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2452
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A425F6F5A9217DD5033362096BA99618 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3720 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:4424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 4e40608e446c98ffe995254c644f9683fcf4dda8f693f7d45250b29c9a741d61
MD5 07af3558ecee199febcb7f4f6e8d2d2e
SHA1 024cbf530ec50c068b95b5a37f18ea7a0f75bb5d
SHA512 e79d7a95b07e0badf4167290caf9b8c09d06cf1dee6ea0c97141b8f28ee98acd0104c6b050d49a0f8cf98eb1d238ff6d29f8b5eb54a4d2677e69a348c1fe4404
SSDEEP 384:yeBdThatELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:A+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

eac4cf9da8b4acca06ece00ca75105a1.db

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Eureka\AcroCoreSync\Adobe\CoreSync\EntitySync\eac4cf9da8b4acca06ece00ca75105a1.db
Size 4KB
SHA256 647d621210c2a281180a1e678b7be08962610a0e1754bd310c5c6c558a8c5c98
MD5 db094082d4f0575ec4b04cb4c4ed7b2f
SHA1 acbf2301b40ac443be9f5af638c7164d3d326a31
SHA512 48e2889a52fbcae6e7c3004e4feb3f4b1ce32c4e441ba05e24f79c869561bbbcb95ecc0ba1e9743595ecd1f9a6480ae5b2f78af20790f037e39e58902b0db2b4
MD5 SHA1 SHA512

Submit Download

eac4cf9da8b4acca06ece00ca75105a1.db-wal

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Eureka\AcroCoreSync\Adobe\CoreSync\EntitySync\eac4cf9da8b4acca06ece00ca75105a1.db-wal
Size 128KB
SHA256 8a4534ae9b3655e1eae1b8d63799f1896a2d31e887045acd5a02733b103fb2b4
MD5 01475788a379ba662126089486f329ae
SHA1 85618341c217cdf406368bcf25d8c03cd5995bfc
SHA512 2406dd4ccedac5248982613f74d260c9d8a5fd006bbabc8b8a45a5baba3eb7194f5f7f6496a78f47ce8a72ed58ce49f0715b04f132f176c3fb8350b858b3d23b
SSDEEP 192:LS4TaQ3SiQsTG4N7aQ3SiBpt4mH4q4WiIaQ3:u4BA34NZxpKU4K
MD5 SHA1 SHA512 SSDEEP

Submit Download

EntitySync-2024-03-31.log

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Eureka\AcroCoreSync\CreativeCloud\CoreSync\EntitySync-2024-03-31.log
Size 2KB
SHA256 5978dac37ac3a80c59b4219ece246dbc09ed1e4330f3f47616339f520a454c0c
MD5 dc271a9bf8f8dc04ddafb2e3c4d7cb9c
SHA1 f0b54590953e774ba90af50ac75949d95020ab36
SHA512 10ae1f213e3537f60b1fb73a192d7041fd03cd867a331c43d44bcdade89831f191fb5c0495a06318682ed647cbc91d350b60c3677c48ae8cdb3caa0c090de9ff
MD5 SHA1 SHA512

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 87aa4c64348b534771f03919b5bdca09596e89f6e0cca0a992bb3d290ec4155a
MD5 aebe0d2eb7a2077a55e57a955e62406a
SHA1 3f811b8148f12220f4b45699135e6d21c9847d8a
SHA512 efa1b082925a4e478fcea74764bbacb91d43da8c01c4b360a34e6f7402af23f91c93b5e91c6266120e144b5300e8dae73a62a7b6d7c4328410128f6a72a7baed
SSDEEP 192:t+oGsTzoU27NTaUxmYeMb1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:tklNveMbUNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 7294abb5a28234175d81efb8ab7867f616d54496355ad505d78d76583b2420b6
MD5 ee508924ad80433113c8b0274d48a0b4
SHA1 6bef6c55d7ca743858dc148dfcbeb004cca53eb0
SHA512 e5032c935a9afbec8b1576eed97fbeecb35bad5765702a2de2fece330568c47a82c4bf4a1a371fa5e8577d32e2dd8b04c6c4a17cbc004f54c7b1cb05c2563ccb
SSDEEP 192:K+oGsTzoU27NTaUxm9X441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklNCX44UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 3282fc25cf4770a9b2c9a746941666d2ddc31ddb8b17171f66686aa5cdda1354
MD5 7a633e4459ab3c56bdea283a47d54e58
SHA1 5859db63d0cb615009d7a696f4987981cf53bc37
SHA512 6df6d64becf0bbc229200fd0ccdf244d95090b4f440979b2e358defeb8d0d0712a3bdf4454a77cf038f835b12b5738c19178b88e110f733e521fe0f7e42e55e5
SSDEEP 192:a+oGsTzoU27NTaUxmG90a1441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:aklNPaa144UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 a027cf12f2055635a3020f08e0448b2f0314791260ccd25570426088c5b0e307
MD5 245950c48f668cf2fcb3c64778e64089
SHA1 3a5a14c820f58e35a3fc6f5de29669f0840587d8
SHA512 4fc8448536663b551cc716d78715f06d4ed217fbdf755924f0b30aebbb6212798a61c6638f919d5c14bdb6998d6a12f0ca37281f3c7f484c1821fbfc98d4a24d
SSDEEP 192:K+oGsTzoU27NTaUxma1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklN7UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

resource-18

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\resources\resource-18
Size 3.6MB
SHA256 152951ea34b49de148c3d4f11fa81875193576c8aa4a49abc5fa756cd3e12f42
MD5 a8c8361b7f2302396e258a3409e8371c
SHA1 cd84724e89830994e8b958a0c0a9db2b5fd3db08
SHA512 29d08b72d345cc95e0ce998bde0967f63cb72bf3a8316ff49f009aadeab3872f99f0a3bb5230f5f3f2655cf6e1dc04ffcc716dcc7f6050814339b25a0824e60b
SSDEEP 49152:ELWuHSQeNu5GB3mAs8f7b9ugh1F9fj6dixJns6E5p0QfE7+xbKZh4Djdi6W7wjV:hOsmAzXkgHF3J9E5y9+2h43dAwJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Size 471B
SHA256 28e674a0f773a6ac5451230d9e5aeb4d1bf6095a213654b0a2b9d3049571b693
MD5 1f174d070e5c49712f71e3613cb58849
SHA1 07daabe8b7efbc9a4f98be48e9746c8f6f3534d8
SHA512 4b44be09c7d15397fa743eba9781931e59cbc24512d9c8e46c8a7c056237db19677254083f3d43b3015bb1569b4e8c9898719e15ea1c75d51c28037abc5eaf93
MD5 SHA1 SHA512

Submit Download

B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Size 400B
SHA256 bbb6b146d9bc3178088f5209d0729e2837fe2905e21cf32fa05f41a61181d61f
MD5 00947fb0b24f8ebcaee073fe6291a8d9
SHA1 8f92aed5afda09e7f164907fcee35b92bb6eab7c
SHA512 155c5b07d05b09f44d9dee633eff80fd1be8bc3aa965c73057d3e93868828fda82028b063138490d0bc16010d8af62950f12ef9606ce6bac016de2b243664742
MD5 SHA1 SHA512

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 f662a516eb1a8f04b19d624d655deb9f5b255cd10aabcdbe53b3bb0c4eacbb60
MD5 0082099a2e23a0720b4fa491c30292b3
SHA1 028ac12006ff70b1f6835ff6d66023b45997adc8
SHA512 78f18cec76ad80fd3dd238bc1581169019e6bd5aa920469bd26b72a7021be81efc27f068e3fe070f7146c09f69bc6b6f99885f22b30ed92f7ab19b521914e0f9
SSDEEP 48:Tul2GL7mstlQrmNNmamPmnxkunrJm+3cxdcvcmICmJFy:MVmsAiNMNuw+2zG
MD5 SHA1 SHA512 SSDEEP

Submit Download

addressbook.acrodata

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
Size 5.3MB
SHA256 793125c5420b86d763c7c3fd5191d0448480732551b1e5dc10f09eefb05b3380
MD5 97f2aebb4c3cb058995441277db99da3
SHA1 eaef8a3e37740115632646e64eb2810dc2eec1e6
SHA512 fa325d799ff464718a4073946c7b7b2d43c1ebd34904726bb0f030c9cecef1a5f1988fc4eae5b1388110cd1b93b1e427501e95d96ddd21a3ffdbf7c49c2e466a
SSDEEP 24576:oWPZCFFJWXDceo49xsDpBLsIMvH0OLs34nQPIV0MQxnRWJ6Uw0e2qDGvN73TUtvH:o
MD5 SHA1 SHA512 SSDEEP

Submit Download

addressbook.acrodata

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
Size 14KB
SHA256 06a576fc14e995c437b26c0d150b4e84cd745e7cedfd972a84b42b51c842fc9b
MD5 947f93fe0eed44767626846f28cfde05
SHA1 f6276d2a2b4a9d8a8e23c84019cd3961e9d60e88
SHA512 f97739eb0d22a99b06ef340aefb0d5a5b45b679d28accff3de2565166392c7d2fabaa33f945696f7d456ba2ef323f48e43eb26578f71c8b2e8ed32fb4dc69bc9
SSDEEP 192:gcPqYV/saFlwwR+kMqe8TlZMX1sgUVa3ddMVsuNeMcGdSD9obOUAVlcMudM/Y14W:g7Q/X4kMb0lZ6mgtdHOelGdWaolvsTh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4552-250-0x0000000010E20000-0x0000000010E4A000-memory.dmp

Download