Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
59s -
max time network
49s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/08/2024, 23:23
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cdn.discordapp.com/attachments/1250485294525059142/1270882924107010108/h5frida-16.0.10.dylib?ex=66b55174&is=66b3fff4&hm=3248820661970f2a808f32895791a75c0f07b6a3f49c3f34f81f328208d11d1e&
Resource
win10v2004-20240802-en
General
-
Target
https://cdn.discordapp.com/attachments/1250485294525059142/1270882924107010108/h5frida-16.0.10.dylib?ex=66b55174&is=66b3fff4&hm=3248820661970f2a808f32895791a75c0f07b6a3f49c3f34f81f328208d11d1e&
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings msedge.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3824 msedge.exe 3824 msedge.exe 5084 msedge.exe 5084 msedge.exe 4504 identity_helper.exe 4504 identity_helper.exe 1960 msedge.exe 1960 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe -
Suspicious use of FindShellTrayWindow 36 IoCs
pid Process 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe -
Suspicious use of SetWindowsHookEx 24 IoCs
pid Process 664 OpenWith.exe 3912 OpenWith.exe 312 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 1276 OpenWith.exe 3944 AcroRd32.exe 3944 AcroRd32.exe 3944 AcroRd32.exe 3944 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5084 wrote to memory of 4876 5084 msedge.exe 83 PID 5084 wrote to memory of 4876 5084 msedge.exe 83 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 1796 5084 msedge.exe 84 PID 5084 wrote to memory of 3824 5084 msedge.exe 85 PID 5084 wrote to memory of 3824 5084 msedge.exe 85 PID 5084 wrote to memory of 3808 5084 msedge.exe 86 PID 5084 wrote to memory of 3808 5084 msedge.exe 86 PID 5084 wrote to memory of 3808 5084 msedge.exe 86 PID 5084 wrote to memory of 3808 5084 msedge.exe 86 PID 5084 wrote to memory of 3808 5084 msedge.exe 86 PID 5084 wrote to memory of 3808 5084 msedge.exe 86 PID 5084 wrote to memory of 3808 5084 msedge.exe 86 PID 5084 wrote to memory of 3808 5084 msedge.exe 86 PID 5084 wrote to memory of 3808 5084 msedge.exe 86 PID 5084 wrote to memory of 3808 5084 msedge.exe 86 PID 5084 wrote to memory of 3808 5084 msedge.exe 86 PID 5084 wrote to memory of 3808 5084 msedge.exe 86 PID 5084 wrote to memory of 3808 5084 msedge.exe 86 PID 5084 wrote to memory of 3808 5084 msedge.exe 86 PID 5084 wrote to memory of 3808 5084 msedge.exe 86 PID 5084 wrote to memory of 3808 5084 msedge.exe 86 PID 5084 wrote to memory of 3808 5084 msedge.exe 86 PID 5084 wrote to memory of 3808 5084 msedge.exe 86 PID 5084 wrote to memory of 3808 5084 msedge.exe 86 PID 5084 wrote to memory of 3808 5084 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1250485294525059142/1270882924107010108/h5frida-16.0.10.dylib?ex=66b55174&is=66b3fff4&hm=3248820661970f2a808f32895791a75c0f07b6a3f49c3f34f81f328208d11d1e&1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8d0f46f8,0x7ffa8d0f4708,0x7ffa8d0f47182⤵PID:4876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,12003187723137690955,8706030437825230131,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵PID:1796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,12003187723137690955,8706030437825230131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,12003187723137690955,8706030437825230131,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:82⤵PID:3808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12003187723137690955,8706030437825230131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:12⤵PID:1460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12003187723137690955,8706030437825230131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵PID:3596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,12003187723137690955,8706030437825230131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:82⤵PID:3372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,12003187723137690955,8706030437825230131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12003187723137690955,8706030437825230131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:12⤵PID:3544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12003187723137690955,8706030437825230131,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:12⤵PID:936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,12003187723137690955,8706030437825230131,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3032 /prefetch:82⤵PID:228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12003187723137690955,8706030437825230131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:12⤵PID:1512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,12003187723137690955,8706030437825230131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12003187723137690955,8706030437825230131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:12⤵PID:4444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12003187723137690955,8706030437825230131,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:12⤵PID:4308
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2984
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3000
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:664
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3912
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:312
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1892
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1276 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\h5frida-16.0.10.dylib"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3944 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- System Location Discovery: System Language Discovery
PID:4768 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D1D8274A65A1EC99CF72117E0EB3DCDB --mojo-platform-channel-handle=1760 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:4660
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2F996E3B1D4D07ADFA0398BFEC4C6C4F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2F996E3B1D4D07ADFA0398BFEC4C6C4F --renderer-client-id=2 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job /prefetch:14⤵
- System Location Discovery: System Language Discovery
PID:388
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C6EC0DFFE8D8F214593419A602E71F12 --mojo-platform-channel-handle=2328 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:1960
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6D38B0215DDFD53BF5A7E01CDED35351 --mojo-platform-channel-handle=1972 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:3484
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A77D5435B8C7B74C17FF93285A15A225 --mojo-platform-channel-handle=2540 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:2424
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD56837505dae817f02bbb549d3910f76ec
SHA14bead1243a3ed4ba876f30031d11b7fcd4052b84
SHA256997f7c6bb1805cb785d5c0ce131c8cb2362e6dc77efb38c3980f69b7a789a649
SHA5124382a76e27e70b6ecc05c14e9a1b915e36ca661cb868042b28d59a7d807ae1ba069aa0e734648225dee2b6dc33626f58ee24df1cc451217fa093f46d5df616d4
-
Filesize
152B
MD5e15f9acde9d56006be268b4025f94b5b
SHA15d36b646b34f0a1d08b6020f12e548db96865906
SHA256045480199f3befc5d2eee18f84e92cc5bf8881b76ac168085a987878da798e0c
SHA51222d43f812391c9fafde0a4e247212e491765e8f049eb56d692f248623b7a52044ceab8e6977675c343d502b460666bd72a4ea970f9aaa7a6b8a6c3a880bcc255
-
Filesize
5KB
MD5524ddcf3045263c8d495f7b3930cc807
SHA18fd8a74c34fa709f84a3c2a583421f8261710aa0
SHA2569c0f740135c9631bcdae37c155d8b794913913ba2e4eb1b8bcf7e786129510f8
SHA5129174eb2c2c12610ab9477f2b843e7b8c6fc688a718fb7a5401a7c16df2be3a606a138482983b011e7e7d319d9da6ece4d8bb00ad017a5cdc3711d82b87125a1a
-
Filesize
5KB
MD561b0dedddd1a9f475a592cd52b124f68
SHA181b0a24f94d8d51307a26cb0ef176b5c61152aff
SHA2566a82b7bb94c9721d366bf7fd5113ca7f67263e6afc2ecb99a68a3d31fcd14238
SHA512304ed20278c30c78063327c05ed667f4af65851399fe9e571b34c787eafe60f7d08d455bc97b4ef4f01c45739e5332057e5cce57e3fe30a995fc2e97d8cd55ad
-
Filesize
24KB
MD5e311e8070a5db17b6cab425cdb01bd27
SHA1ac533db7fa0902f34d02662fd029facbf4b8e8c6
SHA256b9aaa4c71488c3a8769cee7cf502ab93813fd6df60ff2172ba8cb7e1dec86532
SHA51287accdca84a2b2042e2c12381cd1bc0fb2d74bbb0c6a4d18f444212803ebc0b7184317df7f5fb3eac722d5d43d942dd62ee1d760f0b3fd18911df5bd04fa31c6
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD57b7767b87400176e088f5e1a753e9368
SHA1e6635922e70749aae6a3e6f1d693ffbad80bc68e
SHA2562190ce2c28fa9fe5f326ed902e78cc0bd6e7993f11eda9dfc82e71566b2dc98e
SHA512949c31b398b78ec81d6821c81aef5f3462c40165830d135a398453cc4c0f7e5aa1dbd2e54de6b2c886c31e8dc75101910e07673677edc1498cd508daf3caa6bb
-
Filesize
10KB
MD576ec539ba8e41aa9e300b8130784a79f
SHA165e0762136c489827995fd3e7c3c87ae6d6c2700
SHA2564bc04e5fb59f5f166b79198b12f2077f8fb469ba9699d0cd2f5c76cf0ee8054b
SHA51259385efb34f931a37f393372680dae925918e8e9c59de447746c2b5e1c32b2764da746593126d56d040bd32ac6230c095dbbc9c305b496cbd36023dce27de046
-
Filesize
15.6MB
MD5b3a3dd37ec3d1430baac7d2e99954d75
SHA1aadbeff24ffa3c0b404eb9374618eed65fa9caa0
SHA2563b590be77483073e0716bab13dd499dac097ed68b693747983dfbb631e6e2a87
SHA512e8e8ef50e80a20fc17fb174d0db22bcf854adaff4aa1d6bf66922dcec387fd6142f2a5973f8613df51c50102d70ea9dec451ff537511592e29fe91d5d2f663fd