hxxps://drive[.]google[.]com/uc?id=1MNbLr8b3Pe7gF2bOn3knAbZZRDwt_6LQ&export=download&authuser=0

Analysis

max time kernel
299s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
29-07-2024 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/uc?id=1MNbLr8b3Pe7gF2bOn3knAbZZRDwt_6LQ&export=download&authuser=0

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1292	DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf.exe
5644	DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf.exe
5944	DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yjutq = "C:\\Users\\Admin\\AppData\\Roaming\\Yjutq.exe"	DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yjutq = "C:\\Users\\Admin\\AppData\\Roaming\\Yjutq.exe"	DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
7	drive.google.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1292 set thread context of 6132	1292	DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf.exe	132
PID 5644 set thread context of 4740	5644	DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf.exe	145
PID 5944 set thread context of 5276	5944	DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf.exe	147

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2664	msedge.exe
2664	msedge.exe
2916	msedge.exe
2916	msedge.exe
748	msedge.exe
748	msedge.exe
956	identity_helper.exe
956	identity_helper.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4248	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeRestorePrivilege	5780	7zG.exe
Token: 35	5780	7zG.exe
Token: SeSecurityPrivilege	5780	7zG.exe
Token: SeSecurityPrivilege	5780	7zG.exe
Token: SeDebugPrivilege	1292	DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf.exe
Token: SeDebugPrivilege	4248	taskmgr.exe
Token: SeSystemProfilePrivilege	4248	taskmgr.exe
Token: SeCreateGlobalPrivilege	4248	taskmgr.exe
Token: SeDebugPrivilege	5644	DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf.exe
Token: SeDebugPrivilege	1292	DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf.exe
Token: SeDebugPrivilege	5944	DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf.exe
Token: SeDebugPrivilege	6132	aspnet_compiler.exe
Token: SeDebugPrivilege	5644	DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf.exe
Token: SeDebugPrivilege	5944	DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf.exe
Token: SeBackupPrivilege	1544	svchost.exe
Token: SeRestorePrivilege	1544	svchost.exe
Token: SeSecurityPrivilege	1544	svchost.exe
Token: SeTakeOwnershipPrivilege	1544	svchost.exe
Token: 35	1544	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
5780	7zG.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe
4248	taskmgr.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4820	AcroRd32.exe
4820	AcroRd32.exe
4820	AcroRd32.exe
4820	AcroRd32.exe
1196	AcroRd32.exe
1196	AcroRd32.exe
1196	AcroRd32.exe
1196	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2892	2916	msedge.exe	86
PID 2916 wrote to memory of 2892	2916	msedge.exe	86
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 3500	2916	msedge.exe	87
PID 2916 wrote to memory of 2664	2916	msedge.exe	88
PID 2916 wrote to memory of 2664	2916	msedge.exe	88
PID 2916 wrote to memory of 3840	2916	msedge.exe	89
PID 2916 wrote to memory of 3840	2916	msedge.exe	89
PID 2916 wrote to memory of 3840	2916	msedge.exe	89
PID 2916 wrote to memory of 3840	2916	msedge.exe	89
PID 2916 wrote to memory of 3840	2916	msedge.exe	89
PID 2916 wrote to memory of 3840	2916	msedge.exe	89
PID 2916 wrote to memory of 3840	2916	msedge.exe	89
PID 2916 wrote to memory of 3840	2916	msedge.exe	89
PID 2916 wrote to memory of 3840	2916	msedge.exe	89
PID 2916 wrote to memory of 3840	2916	msedge.exe	89
PID 2916 wrote to memory of 3840	2916	msedge.exe	89
PID 2916 wrote to memory of 3840	2916	msedge.exe	89
PID 2916 wrote to memory of 3840	2916	msedge.exe	89
PID 2916 wrote to memory of 3840	2916	msedge.exe	89
PID 2916 wrote to memory of 3840	2916	msedge.exe	89
PID 2916 wrote to memory of 3840	2916	msedge.exe	89
PID 2916 wrote to memory of 3840	2916	msedge.exe	89
PID 2916 wrote to memory of 3840	2916	msedge.exe	89
PID 2916 wrote to memory of 3840	2916	msedge.exe	89
PID 2916 wrote to memory of 3840	2916	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/uc?id=1MNbLr8b3Pe7gF2bOn3knAbZZRDwt_6LQ&export=download&authuser=0
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa52e346f8,0x7ffa52e34708,0x7ffa52e34718
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,4867152963877223583,4169903251507597089,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,4867152963877223583,4169903251507597089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,4867152963877223583,4169903251507597089,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1976 /prefetch:8
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4867152963877223583,4169903251507597089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4867152963877223583,4169903251507597089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,4867152963877223583,4169903251507597089,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4867152963877223583,4169903251507597089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4867152963877223583,4169903251507597089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4867152963877223583,4169903251507597089,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,4867152963877223583,4169903251507597089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,4867152963877223583,4169903251507597089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,4867152963877223583,4169903251507597089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4867152963877223583,4169903251507597089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4867152963877223583,4169903251507597089,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,4867152963877223583,4169903251507597089,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3936 /prefetch:2
  2⤵
  PID:4384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4796

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5548

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf\" -spe -an -ai#7zMap14398:146:7zEvent3535
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5780

C:\Users\Admin\Downloads\DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf\DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf.exe
"C:\Users\Admin\Downloads\DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf\DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1292
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:6132

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4248

C:\Users\Admin\Downloads\DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf\DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf.exe
"C:\Users\Admin\Downloads\DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf\DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5644
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4740

C:\Users\Admin\Downloads\DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf\DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf.exe
"C:\Users\Admin\Downloads\DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf\DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5944
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5276

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf\DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4820
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5968
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=45BCD1B06A3AA6FA910F0DA6153C8320 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1300
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C4DE5F2DFEBEC10EA6266512786357C0 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C4DE5F2DFEBEC10EA6266512786357C0 --renderer-client-id=2 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5128
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=46F29C39CC2E6000072FB85777E773B6 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5892
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=092BF6AD3ACD16A90688A0D9470FC1A2 --mojo-platform-channel-handle=2460 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2088
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=ED658F58823AF2F161DB9F5A88DB23FE --mojo-platform-channel-handle=2396 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5932

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf\DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1196
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4020
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=110E81A8B384437EEBF4C7A2F137ED03 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=110E81A8B384437EEBF4C7A2F137ED03 --renderer-client-id=2 --mojo-platform-channel-handle=1700 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1624
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D057E17CB91394560861B40866797DDC --mojo-platform-channel-handle=1820 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3884
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A8489715DB2F10C43A76E97CB61E9414 --mojo-platform-channel-handle=2388 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_1

Filesize
264KB

MD5
29bf7239da655995ea4c8889ef8eb7c1

SHA1
25312e1de9295e5213d991fc7704454dd98d1aa3

SHA256
f84bca140c83f8461c091a8d5d6cd38435c9245af56c9bc90946e69ce816bfea

SHA512
2cdc6c7680f0b9909a55925cfcc3dfbdc1556476bb7d31922a8a3b85dd048d71582c87faf9c4ab7b96e3dc9f2356a565cf7268be32f6f9cd4292953eb3bc5f43

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Filesize
292B

MD5
e28708632cd569a581f9aa31a5354009

SHA1
98664a6f5fd6c23384a60deb939638f3c4b9d2d2

SHA256
f59b2740d34a09b5c43755488d87930d71a0dbdff131ecfae57dd7f9c654fb01

SHA512
daa70ef259a86933e03fbcf48786ee66c315a1288ce840ec8a1e3f5e1b2700e6595da9f45ed081b6544ec0517325a12a5c81f467ec44ff83d9ebc6d501749247

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links

Filesize
128KB

MD5
a727d99393ec2b3eb9bab44433602101

SHA1
43bc1084e8ac665b3184cb60c4399954a3bc619d

SHA256
338b7d89804be9c56b799eb9a2b9649edbcf61a39dcd2074612eac6f2079521e

SHA512
43fb9b14de0e398fc79b89b759976c4a50acca0e60599fd2dd22796fa5d1c04eaeaf55895a33cc5dd91d1a48a45431c0f7f6f3c7e9232d5d1022cc093ba20ab3

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat

Filesize
145KB

MD5
0ca92e00a9ce4375a3638046691b4bc9

SHA1
5a157e36bc4f2d9e92603360272114bdc0c05a6f

SHA256
d4438f7c878c75f83cb468efcf7c34f76c7db8e04a90a40314785addf2227151

SHA512
bf22570e1899f239c117a4e3bd1f46f6e656ee3615490c45157c8dfc18bc3021f6b7a75afba908c2c31850c4f5db7fb56e08059eeb36552720a7aa5d9f7c23c7

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\UserCache.bin

Filesize
39KB

MD5
aba27888e209a85c57e7d8298ab2dbe3

SHA1
16fa484526731a1565b38a52ad408252575a4ee9

SHA256
8699d13670f35485f91f4b5920f51c822d6c307f146bf0dccb5e5f84066cc4e8

SHA512
2adda1344b84c0efacc112a9b772edeb46f5f69a8ed87f6107b2009f02588c7a2634f20a96b1548728b3f4adb428c258b4da258afd7c4c2ee6390deea1625e3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf.exe.log

Filesize
805B

MD5
4b74e933d78bd5e8fb1cc4653fb2133c

SHA1
f6e931eec700fa325bd40c3adc6f1c0eba806066

SHA256
fd99bed17853f5ad196ca6d4a62f5e2405fbdf5b98cbf45af8b7cef83e4bcec3

SHA512
b56ff89eff1a757a87dcb875206ae92d39ffdb5adf638600c21bc7c76ff4cc25502ae1060716488c7ed1641f8cdfad2a320443b7b4d9f09808eb86eb87f351ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\aspnet_compiler.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
75c9f57baeefeecd6c184627de951c1e

SHA1
52e0468e13cbfc9f15fc62cc27ce14367a996cff

SHA256
648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f

SHA512
c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
10fa19df148444a77ceec60cabd2ce21

SHA1
685b599c497668166ede4945d8885d204fd8d70f

SHA256
c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b

SHA512
3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
512B

MD5
babccd59936638eb259f39a0b24f1c32

SHA1
865aa45c3cd367c5d939bb2aa51c8189236c0f53

SHA256
9077994a2e2337710c19be90d501103299eca8c1271807e558e94978c5738fd6

SHA512
f649cd23295c17851c2fd4d36b15533a5c4a7cbad0faa7c4ff6d2ce8034883c2ff4f9f0afb1004c5cc3e34df5e80f16e748b306dd5ad47c61d530d1f3df03f8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d94f4ef6a790ac66116841947529cbfd

SHA1
6a6e3f5cc2ffbb2f8b0cb2ab249f40bb10def572

SHA256
3418cb98b2c951bd517f9a760019ccddc516e170510bd774fe96b58c0563ff5c

SHA512
e65b9cf797e2f70826eb989e5f37009bfc77459fcc6be20ce1780f80cff40d9086f55b607999028b6c518f0b5fe161c7387abfcd8f546ebea8635d1921a4f72b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
03540f1bb4d63eb8bb9c00f91cefde30

SHA1
e82480ada14234f2ae24516d5b50020a0cc0b975

SHA256
f10356ccb3dc297e4bfb5208c7739793065fc5fa6f7185ff03558bf5e6f324d3

SHA512
7c88e7e5cef1192bc1c5ae3e445228f3eff40a06e8dfa7d398cc7714087f147e7bf077e5e606245080611d89a93ddc4fa9dfe513aa2a5980474ac56aa8859ffc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2086fcd3e51e189a1ba0ede840516440

SHA1
b84ad961f25e3b891c289e76081ca9ea3fa67f05

SHA256
ef97f3d7c468386433f72efa8129aa9a3d8cbbdbdd0b5f53a2002386de46dd9a

SHA512
30a55737f51642346d91f5af61e88b4675dc88851147b494afa3d16e1bb8be7cf2c5aa6bff3e82bdf1aeafdf5711c2ec25fc46a6727d5a1a3b1d5d22cb1f81c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b1968302c1b6f669f6a4d0fb97687c3d

SHA1
4709df317e685dee38151189c518bc3fefddce27

SHA256
637177e8121ff8b6e5eec22e4e57842cd34c031c236649086c20ab0bd7ca69c9

SHA512
4fc137333692fc118f6b7a4917d0dac01a956206ca580e20c1637978f193b89d5bb4f53aae3c3a741a518194ee0b31abef0642bbc175b741ca5d3b997384fab6

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store

Filesize
10KB

MD5
5eead73a63b92e2e5b75a1d2183cb615

SHA1
e2a72b7ff7a6fc4d927b46625851abdec671104e

SHA256
d3d4747457f863ad1bb443fc3e85d6f86e004deb04926b8557a7c6fadb577900

SHA512
e82f9c804aa39bdf4dee4c34cd32ff710fa464bbaf0a3263bc232e2c610f06b8ab2a3f1c0a11a72fc250c6f9c6763a160917239a6973564a47a7d43c42625dc5

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei

Filesize
23KB

MD5
9f07520d93aaeea3807e62d8a0c34905

SHA1
64faeb73b48ab8062db0873711b743e33970aec9

SHA256
6db9ce59e9ea66f8e6ccd7f1dba965ae40c7780fdc4bb58db7beee6a76be4534

SHA512
7c4c27a208f19b854c8a7da70b7927f416d5b5cc8bccfb6c8119fb3ad25e1d81c9ec6ade974425e01c35bb2fa2cb630f3449ab0f1b415574cbf8212cfbbdcc84

Download Submit
C:\Users\Admin\Downloads\DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf\DOC - DEMANDA POR INCUMPLIENTO DE PAGO.pdf.exe

Filesize
2.8MB

MD5
290495c89883668b16d25d018ec05317

SHA1
806721058a8342bc119bc0f2a01e7171b32c802e

SHA256
a103b2158e798b6a640fd2720aeb1b554a6339bfb6832311eac03cf0fee2da95

SHA512
3a06f62670613a062092c8a5476f6a27413ebac0dd4d4182609ffddde72d09b1dc1c947e9f936757cb4b7f8a3d1f2ed4e639556595bf158c6a3908f10a9fd646

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 959082.crdownload

Filesize
2.3MB

MD5
e7f839e34488afd1f8c049cd1ba4e71a

SHA1
d4374f7f0d19d95ea2dca88b7b62fc3ebff3d692

SHA256
451d960f8c0456a14c8dc0860ef2c05eb5a1f38c061e42190483c0a53127b4cb

SHA512
079f538d96b23b6289ec828d9e0997a06200424ba43a4bd6855b501c4f7606d3ec5602732067b59cb0d1a41b271183b599cc314d31ba1137a5b3fd6ab72b484a

Download Submit
memory/1292-136-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-154-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-134-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-152-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-150-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-148-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-146-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-144-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-142-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-140-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-128-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-138-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-130-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-124-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-126-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-118-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-116-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-114-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-112-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-109-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-105-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-132-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-169-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-167-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-164-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-162-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-158-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-156-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-160-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-5003-0x00000000059E0000-0x0000000005A40000-memory.dmp

Filesize
384KB

Download
memory/1292-5004-0x0000000006180000-0x00000000061CC000-memory.dmp

Filesize
304KB

Download
memory/1292-8687-0x0000000001230000-0x0000000001284000-memory.dmp

Filesize
336KB

Download
memory/1292-101-0x0000000000620000-0x00000000008E2000-memory.dmp

Filesize
2.8MB

Download
memory/1292-102-0x0000000005400000-0x0000000005624000-memory.dmp

Filesize
2.1MB

Download
memory/1292-103-0x0000000005BD0000-0x0000000006174000-memory.dmp

Filesize
5.6MB

Download
memory/1292-104-0x00000000056E0000-0x0000000005772000-memory.dmp

Filesize
584KB

Download
memory/1292-123-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-120-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-110-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/1292-106-0x0000000005400000-0x000000000561D000-memory.dmp

Filesize
2.1MB

Download
memory/6132-11128-0x0000000005490000-0x00000000054F6000-memory.dmp

Filesize
408KB

Download
memory/6132-10983-0x00000000028E0000-0x00000000028EA000-memory.dmp

Filesize
40KB

Download
memory/6132-10984-0x0000000005380000-0x000000000541C000-memory.dmp

Filesize
624KB

Download
memory/6132-8793-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download