Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
4Static
static
4AIR FORCE/...FP.pdf
windows7-x64
1AIR FORCE/...FP.pdf
windows10-2004-x64
1AIR FORCE/...ed.pdf
windows7-x64
1AIR FORCE/...ed.pdf
windows10-2004-x64
1AIR FORCE/...T).pdf
windows7-x64
1AIR FORCE/...T).pdf
windows10-2004-x64
1AIR FORCE/... 1.pdf
windows7-x64
1AIR FORCE/... 1.pdf
windows10-2004-x64
1AIR FORCE/...22.pdf
windows7-x64
1AIR FORCE/...22.pdf
windows10-2004-x64
1AIR FORCE/...ce.pdf
windows7-x64
1AIR FORCE/...ce.pdf
windows10-2004-x64
1AIR FORCE/...02.pdf
windows7-x64
1AIR FORCE/...02.pdf
windows10-2004-x64
1AIR FORCE/...05.pdf
windows7-x64
1AIR FORCE/...05.pdf
windows10-2004-x64
1AIR FORCE/...1 .pdf
windows7-x64
1AIR FORCE/...1 .pdf
windows10-2004-x64
1AIR FORCE/...ed.pdf
windows7-x64
1AIR FORCE/...ed.pdf
windows10-2004-x64
1AIR FORCE/...19.pdf
windows7-x64
1AIR FORCE/...19.pdf
windows10-2004-x64
1AIR FORCE/...AL.pdf
windows7-x64
1AIR FORCE/...AL.pdf
windows10-2004-x64
1AIR FORCE/...17.pdf
windows7-x64
1AIR FORCE/...17.pdf
windows10-2004-x64
1AIR FORCE/...20.pdf
windows7-x64
1AIR FORCE/...20.pdf
windows10-2004-x64
1AIR FORCE/...ts.pdf
windows7-x64
1AIR FORCE/...ts.pdf
windows10-2004-x64
1AIR FORCE/...30.pdf
windows7-x64
1AIR FORCE/...30.pdf
windows10-2004-x64
1Analysis
-
max time kernel
147s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 15:46
Behavioral task
behavioral1
Sample
AIR FORCE/3. TMQ53 CLS PWS-RFP.pdf
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
AIR FORCE/3. TMQ53 CLS PWS-RFP.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
AIR FORCE/Attachment 0013g - D-IBCS-0471_Delta2_Suppl_PE_redacted.pdf
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
AIR FORCE/Attachment 0013g - D-IBCS-0471_Delta2_Suppl_PE_redacted.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
AIR FORCE/Attachment_7_-_Compliance_and_Reference_Documents_(DRAFT).pdf
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
AIR FORCE/Attachment_7_-_Compliance_and_Reference_Documents_(DRAFT).pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
AIR FORCE/DRAFT JNWC-IV-IDIQ Work Statement v. 1.pdf
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
AIR FORCE/DRAFT JNWC-IV-IDIQ Work Statement v. 1.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
AIR FORCE/Draft GRIM SOW 7 Nov 2022.pdf
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
AIR FORCE/Draft GRIM SOW 7 Nov 2022.pdf
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
AIR FORCE/FTUAS Applicable Documents for Reference.pdf
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
AIR FORCE/FTUAS Applicable Documents for Reference.pdf
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
AIR FORCE/GEN-12-AMAM-02.pdf
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
AIR FORCE/GEN-12-AMAM-02.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
AIR FORCE/HSIP_FY21_SOW_BusinessPoints_20210105.pdf
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
AIR FORCE/HSIP_FY21_SOW_BusinessPoints_20210105.pdf
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
AIR FORCE/HYDRA PWS_Draft_RFI V1 .pdf
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
AIR FORCE/HYDRA PWS_Draft_RFI V1 .pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
AIR FORCE/LCMP-IDE_Follow-on_Exception_to_Fair_Opportunity_Justification_(004)_Redacted.pdf
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
AIR FORCE/LCMP-IDE_Follow-on_Exception_to_Fair_Opportunity_Justification_(004)_Redacted.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
AIR FORCE/PBL_PWS_-_DRAFT_02212019.pdf
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
AIR FORCE/PBL_PWS_-_DRAFT_02212019.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
AIR FORCE/PSIR-APC-01 Industry Day 4_21_2021 FINAL.pdf
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
AIR FORCE/PSIR-APC-01 Industry Day 4_21_2021 FINAL.pdf
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
AIR FORCE/Polaris_Draft_SOW_1_Jun_2017.pdf
Resource
win7-20240220-en
Behavioral task
behavioral26
Sample
AIR FORCE/Polaris_Draft_SOW_1_Jun_2017.pdf
Resource
win10v2004-20240426-en
Behavioral task
behavioral27
Sample
AIR FORCE/RFI_FMI_11192020.pdf
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
AIR FORCE/RFI_FMI_11192020.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
AIR FORCE/Site Visit Sign In Sheets.pdf
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
AIR FORCE/Site Visit Sign In Sheets.pdf
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
AIR FORCE/VoICE Industry Day Presentation 20200930.pdf
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
AIR FORCE/VoICE Industry Day Presentation 20200930.pdf
Resource
win10v2004-20240508-en
General
-
Target
AIR FORCE/3. TMQ53 CLS PWS-RFP.pdf
-
Size
767KB
-
MD5
b7c30145c5493721dfdd6f0a4f15ae6e
-
SHA1
4ae0509ff15e2a848e06f98419a8a616ec41aaba
-
SHA256
0ee6e9a57b5bc92321caa60cd6f060a6de0d85f8f741ef96be818730f94d5c6a
-
SHA512
7f33cf8f9e6420080f5a292673d5bd12f45bd590b788c4117ba6f26426278579b132f9eabdcf91883fec75195a0487dadc4bdbeb026e9d258bd2e01c82a915d9
-
SSDEEP
12288:X6ri13c02xO4sXCoDoRfs6fajcrFhLfBH5BxdlsRwcJ2fGkp6Vcv1Z6YNZd91YBq:X6+1WOVvDodCjcrZXlsqK2jMVcvz6qZF
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1716 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1716 AcroRd32.exe 1716 AcroRd32.exe 1716 AcroRd32.exe 1716 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1716 wrote to memory of 2368 1716 AcroRd32.exe 90 PID 1716 wrote to memory of 2368 1716 AcroRd32.exe 90 PID 1716 wrote to memory of 2368 1716 AcroRd32.exe 90 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 3044 2368 RdrCEF.exe 91 PID 2368 wrote to memory of 2500 2368 RdrCEF.exe 92 PID 2368 wrote to memory of 2500 2368 RdrCEF.exe 92 PID 2368 wrote to memory of 2500 2368 RdrCEF.exe 92 PID 2368 wrote to memory of 2500 2368 RdrCEF.exe 92 PID 2368 wrote to memory of 2500 2368 RdrCEF.exe 92 PID 2368 wrote to memory of 2500 2368 RdrCEF.exe 92 PID 2368 wrote to memory of 2500 2368 RdrCEF.exe 92 PID 2368 wrote to memory of 2500 2368 RdrCEF.exe 92 PID 2368 wrote to memory of 2500 2368 RdrCEF.exe 92 PID 2368 wrote to memory of 2500 2368 RdrCEF.exe 92 PID 2368 wrote to memory of 2500 2368 RdrCEF.exe 92 PID 2368 wrote to memory of 2500 2368 RdrCEF.exe 92 PID 2368 wrote to memory of 2500 2368 RdrCEF.exe 92 PID 2368 wrote to memory of 2500 2368 RdrCEF.exe 92 PID 2368 wrote to memory of 2500 2368 RdrCEF.exe 92 PID 2368 wrote to memory of 2500 2368 RdrCEF.exe 92 PID 2368 wrote to memory of 2500 2368 RdrCEF.exe 92 PID 2368 wrote to memory of 2500 2368 RdrCEF.exe 92 PID 2368 wrote to memory of 2500 2368 RdrCEF.exe 92 PID 2368 wrote to memory of 2500 2368 RdrCEF.exe 92
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\AIR FORCE\3. TMQ53 CLS PWS-RFP.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=17069017D2C294C0605C8953B5224E98 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3044
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=634928B596E95CAFE1657AFE9C4F9F74 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=634928B596E95CAFE1657AFE9C4F9F74 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:13⤵PID:2500
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A4AD790E229260509066FA88AEF21082 --mojo-platform-channel-handle=2324 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1664
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1E231D8CF82FFC400FC4494CF36661D3 --mojo-platform-channel-handle=2464 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2948
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9842F115C48FFFBEE2CC831D916CB51A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9842F115C48FFFBEE2CC831D916CB51A --renderer-client-id=6 --mojo-platform-channel-handle=2516 --allow-no-sandbox-job /prefetch:13⤵PID:4044
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1A9AAE29942DD1540EDB39C4D447FE70 --mojo-platform-channel-handle=2344 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:552
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD595af3181a378ae485be3e8835d0902ef
SHA1e20d28c587266f24ea26e869fbcea7772c63b28a
SHA2563d43b8b38fd3ab0bb5c0154abb814e4fc0c339be2116cc86f5aaada7d2ccdd68
SHA512557a6a76555cddcd324b0eede91a3e97dab59f290f3e87ba0f53fb3034c7734ff1215a64ff2f8c849c5c47b000a228d68906b74e6aa19d241a6f9388f4b5a95d
-
Filesize
64KB
MD508c02fd13fe3d8bbe6e791cfd5303e3b
SHA1836a9e82d7b703b68bec38eec86720ea88760176
SHA256c9d97be85b6ed0709add5364c26cf830a38283a8c42b366f4f171411bd3618e7
SHA512df24d6966450608cd8d3551ce18af008b4fa0fed3c6286359bf90e5692e5b10645184fe621c006dfaca7b14a6e6bcabf971f9f133754704e8dd3829fcefcdf36