Overview
overview
3Static
static
311600kg/60...02.pdf
windows7-x64
111600kg/60...02.pdf
windows10-2004-x64
111600kg/CO...LE.pdf
windows7-x64
111600kg/CO...LE.pdf
windows10-2004-x64
111600kg/GM...ES.pdf
windows7-x64
111600kg/GM...ES.pdf
windows10-2004-x64
111600kg/GM...ES.pdf
windows7-x64
111600kg/GM...ES.pdf
windows10-2004-x64
111600kg/IC...ST.pdf
windows7-x64
111600kg/IC...ST.pdf
windows10-2004-x64
111600kg/IC...68.pdf
windows7-x64
111600kg/IC...68.pdf
windows10-2004-x64
111600kg/IC...63.pdf
windows7-x64
111600kg/IC...63.pdf
windows10-2004-x64
111600kg/SA...24.pdf
windows7-x64
111600kg/SA...24.pdf
windows10-2004-x64
111600kg/SA...24.pdf
windows7-x64
111600kg/SA...24.pdf
windows10-2004-x64
111600kg/SA...26.pdf
windows7-x64
111600kg/SA...26.pdf
windows10-2004-x64
111600kg/SA...37.pdf
windows7-x64
111600kg/SA...37.pdf
windows10-2004-x64
111600kg/SA...S).pdf
windows7-x64
111600kg/SA...S).pdf
windows10-2004-x64
111600kg/SA...LC.pdf
windows7-x64
111600kg/SA...LC.pdf
windows10-2004-x64
111600kg/TC...TC.pdf
windows7-x64
111600kg/TC...TC.pdf
windows10-2004-x64
111600kg/YA...RM.pdf
windows7-x64
111600kg/YA...RM.pdf
windows10-2004-x64
111600kg/YA...RM.pdf
windows7-x64
111600kg/YA...RM.pdf
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
22-04-2024 09:06
Behavioral task
behavioral1
Sample
11600kg/605. tc_cb-gss_GSS-OCS-119202_20240402.pdf
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
11600kg/605. tc_cb-gss_GSS-OCS-119202_20240402.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
11600kg/COMMERCIAL INVOICE FOR SATURN TEXTILE.pdf
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
11600kg/COMMERCIAL INVOICE FOR SATURN TEXTILE.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
11600kg/GMO TEST REPORT. 1-FOR THE CONSIGNMENT-2210 BALES.pdf
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
11600kg/GMO TEST REPORT. 1-FOR THE CONSIGNMENT-2210 BALES.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
11600kg/GMO TEST REPORT. 2-FOR THE CONSIGNMENT-2210 BALES.pdf
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
11600kg/GMO TEST REPORT. 2-FOR THE CONSIGNMENT-2210 BALES.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
11600kg/IC2 COTTON LOT PATIDAR_2210 PACKING LIST.pdf
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
11600kg/IC2 COTTON LOT PATIDAR_2210 PACKING LIST.pdf
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
11600kg/IC2 Patidar Consignment Bale 2210, BL no.GOSURQL6247568.pdf
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
11600kg/IC2 Patidar Consignment Bale 2210, BL no.GOSURQL6247568.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
11600kg/IC2 Patidar Consignment Bale 2210, Invoice no.COT28A TO C2021-22, TC No.822705-01682263.pdf
Resource
win7-20240215-en
Behavioral task
behavioral14
Sample
11600kg/IC2 Patidar Consignment Bale 2210, Invoice no.COT28A TO C2021-22, TC No.822705-01682263.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
11600kg/SATURN TEXTILE DC NO 0126 DATE 17.03.24.pdf
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
11600kg/SATURN TEXTILE DC NO 0126 DATE 17.03.24.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
11600kg/SATURN TEXTILE DC NO 0137 DATE 18.03.24.pdf
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
11600kg/SATURN TEXTILE DC NO 0137 DATE 18.03.24.pdf
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
11600kg/SATURN TEXTILE PACKING LIST 277 FOR DC NO 0126.pdf
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
11600kg/SATURN TEXTILE PACKING LIST 277 FOR DC NO 0126.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral21
Sample
11600kg/SATURN TEXTILE PACKING LIST NO 278 & 279 FOR DC NO 0137.pdf
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
11600kg/SATURN TEXTILE PACKING LIST NO 278 & 279 FOR DC NO 0137.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral23
Sample
11600kg/SATURN TEXTILE PI NO 0116 DATE 02.03.24 (OCS).pdf
Resource
win7-20240220-en
Behavioral task
behavioral24
Sample
11600kg/SATURN TEXTILE PI NO 0116 DATE 02.03.24 (OCS).pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral25
Sample
11600kg/SATURN TEXTILE_LC.pdf
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
11600kg/SATURN TEXTILE_LC.pdf
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
11600kg/TC_822705_01682263_2022-04-01 - FINAL TC.pdf
Resource
win7-20240215-en
Behavioral task
behavioral28
Sample
11600kg/TC_822705_01682263_2022-04-01 - FINAL TC.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral29
Sample
11600kg/YARN AFFIDAVIT FORM.pdf
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
11600kg/YARN AFFIDAVIT FORM.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral31
Sample
11600kg/YARN SUPPLY FORM.pdf
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
11600kg/YARN SUPPLY FORM.pdf
Resource
win10v2004-20240412-en
General
-
Target
11600kg/YARN SUPPLY FORM.pdf
-
Size
794KB
-
MD5
630c248a9f086a4420212984184fe113
-
SHA1
1543a5cbcdbc1b2d4a5fdf12cc51c6912476b393
-
SHA256
52bd5ca6a6b0491a227f42a549cdd3f3272d21fed98affb4757fff093dd90d6d
-
SHA512
1fe3861493763bcc5a2aff35f774f48bf08c2ba299ff156c976b60f29e580fdaac88cc96d73ae7a06abc3614c4582c92717e12b9df11bc65d293bbca3b7b65dd
-
SSDEEP
24576:3aN6KM/SLDE1nNfqOVY7Ky0QjIznTb/JGu+fQv:3LKMakNiOOF8zT7JGFfQv
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
AcroRd32.exepid process 2900 AcroRd32.exe 2900 AcroRd32.exe 2900 AcroRd32.exe 2900 AcroRd32.exe 2900 AcroRd32.exe 2900 AcroRd32.exe 2900 AcroRd32.exe 2900 AcroRd32.exe 2900 AcroRd32.exe 2900 AcroRd32.exe 2900 AcroRd32.exe 2900 AcroRd32.exe 2900 AcroRd32.exe 2900 AcroRd32.exe 2900 AcroRd32.exe 2900 AcroRd32.exe 2900 AcroRd32.exe 2900 AcroRd32.exe 2900 AcroRd32.exe 2900 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 2900 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
AcroRd32.exepid process 2900 AcroRd32.exe 2900 AcroRd32.exe 2900 AcroRd32.exe 2900 AcroRd32.exe 2900 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 2900 wrote to memory of 4256 2900 AcroRd32.exe RdrCEF.exe PID 2900 wrote to memory of 4256 2900 AcroRd32.exe RdrCEF.exe PID 2900 wrote to memory of 4256 2900 AcroRd32.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2352 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2176 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2176 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2176 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2176 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2176 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2176 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2176 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2176 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2176 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2176 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2176 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2176 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2176 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2176 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2176 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2176 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2176 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2176 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2176 4256 RdrCEF.exe RdrCEF.exe PID 4256 wrote to memory of 2176 4256 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\11600kg\YARN SUPPLY FORM.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8A88E14A5427DAB5D611CC06FD07C540 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0290A1730C6EBF3579E4C8754D0CA9CA --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0290A1730C6EBF3579E4C8754D0CA9CA --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=09F358841883D67C031C20479608D2F6 --mojo-platform-channel-handle=2168 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6D915B7DA0F0DFDDDB24E5ABF0E667B6 --mojo-platform-channel-handle=2416 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B189598413152C61E8BF5165D0E4BD31 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B189598413152C61E8BF5165D0E4BD31 --renderer-client-id=6 --mojo-platform-channel-handle=2500 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=42DF6327A1EE565F70648ADD46F05EEF --mojo-platform-channel-handle=2660 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagesFilesize
64KB
MD568ce147f4546bfccd9912efbb6fd08ef
SHA135ac2ea7457885d4d9e7745c56e36ef78830b168
SHA256460e6d4ada4b433d457a8888b6de5184a1db300d0f69f9a8480ada28e69444c6
SHA5125d55cd2f7b8a06cbe52bf6864b874c0e9ab6388ad93c6b8c0ef39d9372c404ac07deee7202dc2af269594868503a37262ef1d5c1dc5066ae8d53ee76c3d6b8ab
-
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagesFilesize
36KB
MD5b30d3becc8731792523d599d949e63f5
SHA119350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
-
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagesFilesize
56KB
MD5752a1f26b18748311b691c7d8fc20633
SHA1c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
-
memory/2900-28-0x000000000AAF0000-0x000000000AB11000-memory.dmpFilesize
132KB
-
memory/2900-133-0x000000000CBC0000-0x000000000CE6B000-memory.dmpFilesize
2.7MB