Malware Analysis Report

2024-11-30 05:46

Sample ID 240619-cxtzbasckh
Target afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977
SHA256 afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977
Tags
agenttesla keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977

Threat Level: Known bad

The file afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977 was found to be: Known bad.

Malicious Activity Summary

agenttesla keylogger persistence spyware stealer trojan

AgentTesla

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Modifies registry class

Checks processor information in registry

Runs ping.exe

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-19 02:27

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-19 02:27

Reported

2024-06-19 02:30

Platform

win7-20240611-en

Max time kernel

137s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\vexpoob.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\vexpob = "C:\\Users\\Admin\\AppData\\Roaming\\vexpoob.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1948 set thread context of 1908 N/A C:\Users\Admin\AppData\Roaming\vexpoob.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Enumerates physical storage devices

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\vexpoob.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2844 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe C:\Windows\SysWOW64\cmd.exe
PID 2844 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe C:\Windows\SysWOW64\cmd.exe
PID 2844 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe C:\Windows\SysWOW64\cmd.exe
PID 2844 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe C:\Windows\SysWOW64\cmd.exe
PID 3008 wrote to memory of 2396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3008 wrote to memory of 2396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3008 wrote to memory of 2396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3008 wrote to memory of 2396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2844 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe C:\Windows\SysWOW64\cmd.exe
PID 2844 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe C:\Windows\SysWOW64\cmd.exe
PID 2844 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe C:\Windows\SysWOW64\cmd.exe
PID 2844 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe C:\Windows\SysWOW64\cmd.exe
PID 2696 wrote to memory of 2728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2696 wrote to memory of 2728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2696 wrote to memory of 2728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2696 wrote to memory of 2728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3008 wrote to memory of 2800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3008 wrote to memory of 2800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3008 wrote to memory of 2800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3008 wrote to memory of 2800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2696 wrote to memory of 2516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2696 wrote to memory of 2516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2696 wrote to memory of 2516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2696 wrote to memory of 2516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2696 wrote to memory of 1948 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\vexpoob.exe
PID 2696 wrote to memory of 1948 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\vexpoob.exe
PID 2696 wrote to memory of 1948 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\vexpoob.exe
PID 2696 wrote to memory of 1948 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\vexpoob.exe
PID 1948 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Roaming\vexpoob.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
PID 1948 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Roaming\vexpoob.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
PID 1948 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Roaming\vexpoob.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
PID 1948 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Roaming\vexpoob.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
PID 1948 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Roaming\vexpoob.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1948 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Roaming\vexpoob.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1948 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Roaming\vexpoob.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1948 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Roaming\vexpoob.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1948 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Roaming\vexpoob.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1948 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Roaming\vexpoob.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1948 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Roaming\vexpoob.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1948 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Roaming\vexpoob.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1948 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Roaming\vexpoob.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1948 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Roaming\vexpoob.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1948 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Roaming\vexpoob.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1948 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Roaming\vexpoob.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Processes

C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe

"C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd" /c ping 127.0.0.1 -n 26 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "vexpob" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\vexpoob.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 26

C:\Windows\SysWOW64\cmd.exe

"cmd" /c ping 127.0.0.1 -n 28 > nul && copy "C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe" "C:\Users\Admin\AppData\Roaming\vexpoob.exe" && ping 127.0.0.1 -n 28 > nul && "C:\Users\Admin\AppData\Roaming\vexpoob.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 28

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "vexpob" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\vexpoob.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 28

C:\Users\Admin\AppData\Roaming\vexpoob.exe

"C:\Users\Admin\AppData\Roaming\vexpoob.exe"

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\PABILOS MOTORES #5 Y 6.pdf"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"

Network

N/A

Files

memory/2844-0-0x000000007462E000-0x000000007462F000-memory.dmp

memory/2844-1-0x00000000003D0000-0x0000000000502000-memory.dmp

memory/2844-2-0x0000000074620000-0x0000000074D0E000-memory.dmp

memory/2844-3-0x0000000005210000-0x0000000005254000-memory.dmp

memory/2844-4-0x000000007462E000-0x000000007462F000-memory.dmp

memory/2844-5-0x0000000074620000-0x0000000074D0E000-memory.dmp

memory/2844-6-0x0000000074620000-0x0000000074D0E000-memory.dmp

\Users\Admin\AppData\Roaming\vexpoob.exe

MD5 f58362efd1e0550977db29a3ff4bed49
SHA1 bd239b22805c2d9ead09712ab9060e4869564326
SHA256 afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977
SHA512 c14399acb2ee2efbe9487f3f3e18e28b2f97e3c7df0a77c124be12629c1646a21f75749168bdf13b1365756e80a91a77cde4443dd7611353115c7578d62c71b7

memory/1948-17-0x0000000000A80000-0x0000000000BB2000-memory.dmp

C:\Users\Admin\AppData\Roaming\PABILOS MOTORES #5 Y 6.pdf

MD5 9cf473b9b836b8811841bef458bd5474
SHA1 f46e568c480c692f218f28c5066472d9affda54d
SHA256 6b1411273cc92be9697db4c28034c98802e947563849fd441d71e6c768cc72c3
SHA512 8b2d4f7515f9f28c30c83d0bcc4ba119f2cc7f3f9c203e0e69fa3c1bf0e105cf0b36f6895917a0385174efb659780211c620268e5cbec59c36dd51d468ecf68b

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 a837cf1d5e4e90aa7539afec411c9616
SHA1 b7eac8a5f1d7cc3ac9d7b6bb523391e9a9d270e7
SHA256 01b83aa6ffd6c90c1308031ab21c12847e890f209bf2776d5ef93b7b70d178d6
SHA512 ad1620adb4f57cdfde011e47a2ebf8944a61712751e5af9e97cceef659792bfb786054120ada86b7acd56463d04622bc611a34456f2d49c334e1dc5b4ed8e1ec

memory/1948-37-0x0000000004670000-0x000000000468A000-memory.dmp

memory/1948-38-0x0000000002130000-0x0000000002136000-memory.dmp

memory/1908-39-0x0000000000400000-0x0000000000440000-memory.dmp

memory/1908-47-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1908-45-0x0000000000400000-0x0000000000440000-memory.dmp

memory/1908-43-0x0000000000400000-0x0000000000440000-memory.dmp

memory/1908-41-0x0000000000400000-0x0000000000440000-memory.dmp

memory/1908-48-0x0000000000400000-0x0000000000440000-memory.dmp

memory/1908-50-0x0000000000400000-0x0000000000440000-memory.dmp

memory/1908-49-0x0000000000400000-0x0000000000440000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-19 02:27

Reported

2024-06-19 02:30

Platform

win10v2004-20240508-en

Max time kernel

140s

Max time network

101s

Command Line

"C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\vexpoob.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\vexpoob.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vexpob = "C:\\Users\\Admin\\AppData\\Roaming\\vexpoob.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1428 set thread context of 5024 N/A C:\Users\Admin\AppData\Roaming\vexpoob.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\vexpoob.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\vexpoob.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\vexpoob.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\vexpoob.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 956 wrote to memory of 4636 N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe C:\Windows\SysWOW64\cmd.exe
PID 956 wrote to memory of 4636 N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe C:\Windows\SysWOW64\cmd.exe
PID 956 wrote to memory of 4636 N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe C:\Windows\SysWOW64\cmd.exe
PID 4636 wrote to memory of 3904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4636 wrote to memory of 3904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4636 wrote to memory of 3904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 956 wrote to memory of 3208 N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe C:\Windows\SysWOW64\cmd.exe
PID 956 wrote to memory of 3208 N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe C:\Windows\SysWOW64\cmd.exe
PID 956 wrote to memory of 3208 N/A C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe C:\Windows\SysWOW64\cmd.exe
PID 3208 wrote to memory of 1156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3208 wrote to memory of 1156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3208 wrote to memory of 1156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4636 wrote to memory of 2288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4636 wrote to memory of 2288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4636 wrote to memory of 2288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3208 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3208 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3208 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3208 wrote to memory of 1428 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\vexpoob.exe
PID 3208 wrote to memory of 1428 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\vexpoob.exe
PID 3208 wrote to memory of 1428 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\vexpoob.exe
PID 1428 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Roaming\vexpoob.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
PID 1428 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Roaming\vexpoob.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
PID 1428 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Roaming\vexpoob.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
PID 3768 wrote to memory of 4992 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3768 wrote to memory of 4992 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3768 wrote to memory of 4992 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4992 wrote to memory of 4192 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

Processes

C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe

"C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd" /c ping 127.0.0.1 -n 25 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "vexpob" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\vexpoob.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 25

C:\Windows\SysWOW64\cmd.exe

"cmd" /c ping 127.0.0.1 -n 28 > nul && copy "C:\Users\Admin\AppData\Local\Temp\afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977.exe" "C:\Users\Admin\AppData\Roaming\vexpoob.exe" && ping 127.0.0.1 -n 28 > nul && "C:\Users\Admin\AppData\Roaming\vexpoob.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 28

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "vexpob" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\vexpoob.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 28

C:\Users\Admin\AppData\Roaming\vexpoob.exe

"C:\Users\Admin\AppData\Roaming\vexpoob.exe"

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\PABILOS MOTORES #5 Y 6.pdf"

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D40147BDA1B4856EE607B35CE655D501 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=956FF7B4AF13419ABEF53A8774224FA8 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=956FF7B4AF13419ABEF53A8774224FA8 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5C52BC4CB6E2B213BAF6B3C7A460ECA3 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=52D2BF6F64FE258D64C18CB21AA5EF9A --mojo-platform-channel-handle=1888 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2287113520F63A245452952863880A59 --mojo-platform-channel-handle=2108 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F167F04BF5CA45589BDB1156A25E9F02 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F167F04BF5CA45589BDB1156A25E9F02 --renderer-client-id=7 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job /prefetch:1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 95.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 144.96.55.23.in-addr.arpa udp

Files

memory/956-0-0x000000007503E000-0x000000007503F000-memory.dmp

memory/956-1-0x00000000000F0000-0x0000000000222000-memory.dmp

memory/956-2-0x00000000055B0000-0x000000000564C000-memory.dmp

memory/956-3-0x0000000005C00000-0x00000000061A4000-memory.dmp

memory/956-4-0x0000000005650000-0x00000000056E2000-memory.dmp

memory/956-5-0x0000000075030000-0x00000000757E0000-memory.dmp

memory/956-6-0x00000000067B0000-0x00000000067F4000-memory.dmp

memory/956-7-0x0000000006A90000-0x0000000006A9A000-memory.dmp

memory/956-8-0x0000000075030000-0x00000000757E0000-memory.dmp

memory/956-9-0x000000007503E000-0x000000007503F000-memory.dmp

memory/956-10-0x0000000075030000-0x00000000757E0000-memory.dmp

memory/956-12-0x0000000075030000-0x00000000757E0000-memory.dmp

C:\Users\Admin\AppData\Roaming\vexpoob.exe

MD5 f58362efd1e0550977db29a3ff4bed49
SHA1 bd239b22805c2d9ead09712ab9060e4869564326
SHA256 afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977
SHA512 c14399acb2ee2efbe9487f3f3e18e28b2f97e3c7df0a77c124be12629c1646a21f75749168bdf13b1365756e80a91a77cde4443dd7611353115c7578d62c71b7

memory/1428-18-0x0000000075000000-0x00000000757B0000-memory.dmp

memory/1428-19-0x0000000000040000-0x0000000000172000-memory.dmp

memory/1428-20-0x0000000075000000-0x00000000757B0000-memory.dmp

C:\Users\Admin\AppData\Roaming\PABILOS MOTORES #5 Y 6.pdf

MD5 9cf473b9b836b8811841bef458bd5474
SHA1 f46e568c480c692f218f28c5066472d9affda54d
SHA256 6b1411273cc92be9697db4c28034c98802e947563849fd441d71e6c768cc72c3
SHA512 8b2d4f7515f9f28c30c83d0bcc4ba119f2cc7f3f9c203e0e69fa3c1bf0e105cf0b36f6895917a0385174efb659780211c620268e5cbec59c36dd51d468ecf68b

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 5669ae6ee0561175e161554b43ef3f38
SHA1 8464b7b86eff0ddd5ef84731540b5dd001724da2
SHA256 61d17b311afae60a9e10c9026e98105c0db437220e124f554912da555ed12e5e
SHA512 0ce033b5ef90cfe8ec0f74ebf0ef2d124540210fda87031d7211224cb74483173817c7c337812db97c1cc3936ba476c6df0590e82ab127f51c2ca0388366bd0d

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 c1de0b86cc88b46daa83f593f3d953d0
SHA1 2752bb6d8822f5abc9b2ec8fa7df5be7c435ac9c
SHA256 ab0113b73f0e77b78dd4e35dafdcb76cf1c017572ec3df0f392159bb607f5950
SHA512 4cd6786214fbff95f013ab7434e783d3db8941151c9c23dbd1a5cc81b2ec108fc22db38fb90ff7c41a3a0cc7fb60d877c02c48e7fdeefc390c94b64f7df1b81c

memory/1428-110-0x0000000075000000-0x00000000757B0000-memory.dmp

memory/1428-111-0x0000000006030000-0x000000000604A000-memory.dmp

memory/1428-112-0x0000000075000000-0x00000000757B0000-memory.dmp

memory/1428-113-0x0000000006050000-0x0000000006056000-memory.dmp

memory/5024-114-0x0000000000400000-0x0000000000440000-memory.dmp

memory/1428-116-0x0000000075000000-0x00000000757B0000-memory.dmp

memory/5024-117-0x0000000005220000-0x0000000005286000-memory.dmp

memory/5024-118-0x00000000060D0000-0x0000000006120000-memory.dmp