Analysis
-
max time kernel
141s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-06-2024 02:10
Behavioral task
behavioral1
Sample
evil.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
evil.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Spreading.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
Spreading.exe
Resource
win10v2004-20240508-en
General
-
Target
evil.pdf
-
Size
144KB
-
MD5
894da0f85f06457707ce5c0707d1987d
-
SHA1
a76ef4c01108f9faa7e1bcaa32a95a57b3cfa638
-
SHA256
44511535438002e9fedf7203018067e3c806e38d9dfffcdbb0e1dd540d97549f
-
SHA512
d42578a77ee8f67bcb3de028ecb5cfa4ff9e92aebf4e428a39b1e3dbcb8faf6cd56e5fd8d783a7619e4d6b0865ce86a329e0e1c55bd1dd3b614c30e1c276e7d5
-
SSDEEP
3072:aiuKqbFks+DtTE+8kGuBz8YtXbSsR/8Wp13zgLNZHjV+4kI7wS:tw4tnGIz8ib9xv18PHjVX7wS
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 20 IoCs
Processes:
AcroRd32.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots AcroRd32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell AcroRd32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU AcroRd32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 AcroRd32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff AcroRd32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings AcroRd32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff AcroRd32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 AcroRd32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 AcroRd32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" AcroRd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 2660 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
AcroRd32.exepid process 2660 AcroRd32.exe 2660 AcroRd32.exe 2660 AcroRd32.exe 2660 AcroRd32.exe 2660 AcroRd32.exe 2660 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 2660 wrote to memory of 4872 2660 AcroRd32.exe RdrCEF.exe PID 2660 wrote to memory of 4872 2660 AcroRd32.exe RdrCEF.exe PID 2660 wrote to memory of 4872 2660 AcroRd32.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 2960 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 772 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 772 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 772 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 772 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 772 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 772 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 772 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 772 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 772 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 772 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 772 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 772 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 772 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 772 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 772 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 772 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 772 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 772 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 772 4872 RdrCEF.exe RdrCEF.exe PID 4872 wrote to memory of 772 4872 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\evil.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=754BEC1AD979E1B8F423D76E4875D4DE --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2960
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=837CEAB97BE4B5971A582EC89B2F766C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=837CEAB97BE4B5971A582EC89B2F766C --renderer-client-id=2 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job /prefetch:13⤵PID:772
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=293A44757962E652A20F053BE2151577 --mojo-platform-channel-handle=2292 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4628
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A8C08157E6C097A3DCCA9AABDEC0CA84 --mojo-platform-channel-handle=2420 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:776
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=102CD84CCF1DD6EC73481DF12162F7A8 --mojo-platform-channel-handle=1712 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3312
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8BD59C6A34DB59D8BB2E67FA397249C9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8BD59C6A34DB59D8BB2E67FA397249C9 --renderer-client-id=7 --mojo-platform-channel-handle=2508 --allow-no-sandbox-job /prefetch:13⤵PID:5040
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:208
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD510e6996f9ddd6bdafceeba5662e9293f
SHA156d6112929b93d74f61eda0174192bd894829d1b
SHA2568fb505eaba2950ea2c677e5487acb6f112821a8bb3d29d8bb2496c1eb9af8ce9
SHA5122902f821f7bc9b43198061d0078a53464cb83650e2035ea62dfad7c98a0c4c2fb934260a51dd4fd57a64bf399935124b2e376f77576538a50ba53d37a34c32fc
-
Filesize
64KB
MD518d47c77fe641d7ea1fc15d0f567d27e
SHA132406efba9cd07c6a98ef45b815ebac9a8daee00
SHA256622c5da97f3d1fdd9ca6ea9e6ca735c8c4a380bb9c742969a08188ae23b97e90
SHA512e8cda9edc8d17b74e0cbb31bd1209afe295074a3f0a43b6c98df43045938f0d780859cfe3105b42a7d0053d8cdfa4ccfc189dbb9b8fd4514cf5d852256a9a66e