Overview
overview
3Static
static
311600kg/60...02.pdf
windows7-x64
111600kg/60...02.pdf
windows10-2004-x64
111600kg/CO...LE.pdf
windows7-x64
111600kg/CO...LE.pdf
windows10-2004-x64
111600kg/GM...ES.pdf
windows7-x64
111600kg/GM...ES.pdf
windows10-2004-x64
111600kg/GM...ES.pdf
windows7-x64
111600kg/GM...ES.pdf
windows10-2004-x64
111600kg/IC...ST.pdf
windows7-x64
111600kg/IC...ST.pdf
windows10-2004-x64
111600kg/IC...68.pdf
windows7-x64
111600kg/IC...68.pdf
windows10-2004-x64
111600kg/IC...63.pdf
windows7-x64
111600kg/IC...63.pdf
windows10-2004-x64
111600kg/SA...24.pdf
windows7-x64
111600kg/SA...24.pdf
windows10-2004-x64
111600kg/SA...24.pdf
windows7-x64
111600kg/SA...24.pdf
windows10-2004-x64
111600kg/SA...26.pdf
windows7-x64
111600kg/SA...26.pdf
windows10-2004-x64
111600kg/SA...37.pdf
windows7-x64
111600kg/SA...37.pdf
windows10-2004-x64
111600kg/SA...S).pdf
windows7-x64
111600kg/SA...S).pdf
windows10-2004-x64
111600kg/SA...LC.pdf
windows7-x64
111600kg/SA...LC.pdf
windows10-2004-x64
111600kg/TC...TC.pdf
windows7-x64
111600kg/TC...TC.pdf
windows10-2004-x64
111600kg/YA...RM.pdf
windows7-x64
111600kg/YA...RM.pdf
windows10-2004-x64
111600kg/YA...RM.pdf
windows7-x64
111600kg/YA...RM.pdf
windows10-2004-x64
1Analysis
-
max time kernel
144s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
22-04-2024 09:06
Behavioral task
behavioral1
Sample
11600kg/605. tc_cb-gss_GSS-OCS-119202_20240402.pdf
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
11600kg/605. tc_cb-gss_GSS-OCS-119202_20240402.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
11600kg/COMMERCIAL INVOICE FOR SATURN TEXTILE.pdf
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
11600kg/COMMERCIAL INVOICE FOR SATURN TEXTILE.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
11600kg/GMO TEST REPORT. 1-FOR THE CONSIGNMENT-2210 BALES.pdf
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
11600kg/GMO TEST REPORT. 1-FOR THE CONSIGNMENT-2210 BALES.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
11600kg/GMO TEST REPORT. 2-FOR THE CONSIGNMENT-2210 BALES.pdf
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
11600kg/GMO TEST REPORT. 2-FOR THE CONSIGNMENT-2210 BALES.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
11600kg/IC2 COTTON LOT PATIDAR_2210 PACKING LIST.pdf
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
11600kg/IC2 COTTON LOT PATIDAR_2210 PACKING LIST.pdf
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
11600kg/IC2 Patidar Consignment Bale 2210, BL no.GOSURQL6247568.pdf
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
11600kg/IC2 Patidar Consignment Bale 2210, BL no.GOSURQL6247568.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
11600kg/IC2 Patidar Consignment Bale 2210, Invoice no.COT28A TO C2021-22, TC No.822705-01682263.pdf
Resource
win7-20240215-en
Behavioral task
behavioral14
Sample
11600kg/IC2 Patidar Consignment Bale 2210, Invoice no.COT28A TO C2021-22, TC No.822705-01682263.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
11600kg/SATURN TEXTILE DC NO 0126 DATE 17.03.24.pdf
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
11600kg/SATURN TEXTILE DC NO 0126 DATE 17.03.24.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
11600kg/SATURN TEXTILE DC NO 0137 DATE 18.03.24.pdf
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
11600kg/SATURN TEXTILE DC NO 0137 DATE 18.03.24.pdf
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
11600kg/SATURN TEXTILE PACKING LIST 277 FOR DC NO 0126.pdf
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
11600kg/SATURN TEXTILE PACKING LIST 277 FOR DC NO 0126.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral21
Sample
11600kg/SATURN TEXTILE PACKING LIST NO 278 & 279 FOR DC NO 0137.pdf
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
11600kg/SATURN TEXTILE PACKING LIST NO 278 & 279 FOR DC NO 0137.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral23
Sample
11600kg/SATURN TEXTILE PI NO 0116 DATE 02.03.24 (OCS).pdf
Resource
win7-20240220-en
Behavioral task
behavioral24
Sample
11600kg/SATURN TEXTILE PI NO 0116 DATE 02.03.24 (OCS).pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral25
Sample
11600kg/SATURN TEXTILE_LC.pdf
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
11600kg/SATURN TEXTILE_LC.pdf
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
11600kg/TC_822705_01682263_2022-04-01 - FINAL TC.pdf
Resource
win7-20240215-en
Behavioral task
behavioral28
Sample
11600kg/TC_822705_01682263_2022-04-01 - FINAL TC.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral29
Sample
11600kg/YARN AFFIDAVIT FORM.pdf
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
11600kg/YARN AFFIDAVIT FORM.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral31
Sample
11600kg/YARN SUPPLY FORM.pdf
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
11600kg/YARN SUPPLY FORM.pdf
Resource
win10v2004-20240412-en
General
-
Target
11600kg/SATURN TEXTILE_LC.pdf
-
Size
85KB
-
MD5
b78d0bffad3e76bf79a14f17d1f16519
-
SHA1
7a4b76457617d033db73fa49e5f1013e0ecf9faa
-
SHA256
20f1973afd38664f7b6188d0247b51b534ce478647b275361f533208169ede32
-
SHA512
5b0a198a1374c05238186c6f8c8a51a1bb3786a4edcc75ff3475eec7b0432f1655923b16a845c9f93c5b5b72e2aee5395114efc173867f499ae3838bc4991fa2
-
SSDEEP
1536:lIyepxCo4HOd7dsaOsqAynVJlKehmpmehLLBlgu2lC0bI8eWK:uyevXd7Oa1yFhMJh2PbI8Q
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
AcroRd32.exepid process 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 4000 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
AcroRd32.exepid process 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe 4000 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 4000 wrote to memory of 3468 4000 AcroRd32.exe RdrCEF.exe PID 4000 wrote to memory of 3468 4000 AcroRd32.exe RdrCEF.exe PID 4000 wrote to memory of 3468 4000 AcroRd32.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 4040 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 2472 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 2472 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 2472 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 2472 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 2472 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 2472 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 2472 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 2472 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 2472 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 2472 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 2472 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 2472 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 2472 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 2472 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 2472 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 2472 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 2472 3468 RdrCEF.exe RdrCEF.exe PID 3468 wrote to memory of 2472 3468 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\11600kg\SATURN TEXTILE_LC.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7F5E92EC7CA5F67D0BF6FB1FFF951173 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7F5E92EC7CA5F67D0BF6FB1FFF951173 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:13⤵PID:4040
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9548B7BAD14F8FC69BDDA8503886D0DA --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2472
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6F45577D0045563B5DF9A1DBD0344CA6 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6F45577D0045563B5DF9A1DBD0344CA6 --renderer-client-id=4 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job /prefetch:13⤵PID:2128
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5E2DA4CCF3B175176934D5B479F0553E --mojo-platform-channel-handle=2344 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1876
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2B5FEA2AAABD116C8F653F3968694DAC --mojo-platform-channel-handle=2560 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3588
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BC63898BFBFDF789FB82293A9E945365 --mojo-platform-channel-handle=2676 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3952
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵PID:416
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1548
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:81⤵PID:3716
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagesFilesize
64KB
MD5c6526a0771a18991fc7e4d0ffcb6ae15
SHA168be5279ffc8ffc1e98a5c73c5ddb5a2bf7703e0
SHA256ae42b114b4ee15d21bb33718b4e7dde2e1d7047e81d5b502ab6e84baab57e558
SHA51211baf5b7f471456f7c0a6d8d7b5fd468d6c5b691daec7dbb861da94856b1151f09cacf0968d831208664dac7fc9e519f6dc71e759296099f37021fd00a3f4f65
-
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagesFilesize
36KB
MD5b30d3becc8731792523d599d949e63f5
SHA119350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
-
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagesFilesize
56KB
MD5752a1f26b18748311b691c7d8fc20633
SHA1c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5