075732ee66b56a7ba49a790ebf53a99bbd236572afd148953ee9a4c99a6045f3

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 05:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

075732ee66b56a7ba49a790ebf53a99bbd236572afd148953ee9a4c99a6045f3N.exe
Size

92KB
MD5

e17c510837714971ae56bd5dd23f5570
SHA1

d681e4255575a2e9a80857466730d368c8002f44
SHA256

075732ee66b56a7ba49a790ebf53a99bbd236572afd148953ee9a4c99a6045f3
SHA512

0819caa0987e320b831d1fc7973ad95bf29eb2f8879e10feb0c11604c1ae997750e2722403e4fc48b732b6432bde561391f15a46bbcb2f221ba806f052ae6d92
SSDEEP

1536:1WEhM021xdKDx3DcEuNIU9/lhAHPUcgMeWp8ANkMgB1iQdbiiSKL:1WEhMTq3DcEHU3yPUpMeDANkMgXiQdbF

Score

7^/10

discovery link pdf

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	075732ee66b56a7ba49a790ebf53a99bbd236572afd148953ee9a4c99a6045f3N.exe

Executes dropped EXE 1 IoCs

pid	Process
1768	154.exe

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
behavioral2/files/0x000700000002341c-16.dat	pdf_with_link_action

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	075732ee66b56a7ba49a790ebf53a99bbd236572afd148953ee9a4c99a6045f3N.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4672	AcroRd32.exe
4672	AcroRd32.exe
4672	AcroRd32.exe
4672	AcroRd32.exe
4672	AcroRd32.exe
4672	AcroRd32.exe
4672	AcroRd32.exe
4672	AcroRd32.exe
4672	AcroRd32.exe
4672	AcroRd32.exe
4672	AcroRd32.exe
4672	AcroRd32.exe
4672	AcroRd32.exe
4672	AcroRd32.exe
4672	AcroRd32.exe
4672	AcroRd32.exe
4672	AcroRd32.exe
4672	AcroRd32.exe
4672	AcroRd32.exe
4672	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4672	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4672	AcroRd32.exe
4672	AcroRd32.exe
4672	AcroRd32.exe
4672	AcroRd32.exe
4672	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 1768	3656	075732ee66b56a7ba49a790ebf53a99bbd236572afd148953ee9a4c99a6045f3N.exe	82
PID 3656 wrote to memory of 1768	3656	075732ee66b56a7ba49a790ebf53a99bbd236572afd148953ee9a4c99a6045f3N.exe	82
PID 3656 wrote to memory of 1768	3656	075732ee66b56a7ba49a790ebf53a99bbd236572afd148953ee9a4c99a6045f3N.exe	82
PID 3656 wrote to memory of 4672	3656	075732ee66b56a7ba49a790ebf53a99bbd236572afd148953ee9a4c99a6045f3N.exe	83
PID 3656 wrote to memory of 4672	3656	075732ee66b56a7ba49a790ebf53a99bbd236572afd148953ee9a4c99a6045f3N.exe	83
PID 3656 wrote to memory of 4672	3656	075732ee66b56a7ba49a790ebf53a99bbd236572afd148953ee9a4c99a6045f3N.exe	83
PID 4672 wrote to memory of 4708	4672	AcroRd32.exe	88
PID 4672 wrote to memory of 4708	4672	AcroRd32.exe	88
PID 4672 wrote to memory of 4708	4672	AcroRd32.exe	88
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 4032	4708	RdrCEF.exe	89
PID 4708 wrote to memory of 2724	4708	RdrCEF.exe	90
PID 4708 wrote to memory of 2724	4708	RdrCEF.exe	90
PID 4708 wrote to memory of 2724	4708	RdrCEF.exe	90
PID 4708 wrote to memory of 2724	4708	RdrCEF.exe	90
PID 4708 wrote to memory of 2724	4708	RdrCEF.exe	90
PID 4708 wrote to memory of 2724	4708	RdrCEF.exe	90
PID 4708 wrote to memory of 2724	4708	RdrCEF.exe	90
PID 4708 wrote to memory of 2724	4708	RdrCEF.exe	90
PID 4708 wrote to memory of 2724	4708	RdrCEF.exe	90
PID 4708 wrote to memory of 2724	4708	RdrCEF.exe	90
PID 4708 wrote to memory of 2724	4708	RdrCEF.exe	90
PID 4708 wrote to memory of 2724	4708	RdrCEF.exe	90
PID 4708 wrote to memory of 2724	4708	RdrCEF.exe	90
PID 4708 wrote to memory of 2724	4708	RdrCEF.exe	90

C:\Users\Admin\AppData\Local\Temp\075732ee66b56a7ba49a790ebf53a99bbd236572afd148953ee9a4c99a6045f3N.exe
"C:\Users\Admin\AppData\Local\Temp\075732ee66b56a7ba49a790ebf53a99bbd236572afd148953ee9a4c99a6045f3N.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Users\Admin\AppData\Local\Temp\154.exe
  "C:\Users\Admin\AppData\Local\Temp\154.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1768
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\KPSS HAZIRLIK KAYNAK LİSTESİ.pdf"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FB5E0997208BD60E8D7B0B8A4E5467E4 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:4032
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=FF061283A980D733C8EE2B644982B691 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=FF061283A980D733C8EE2B644982B691 --renderer-client-id=2 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:2724
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=156E77179BDC01DCB6B7D77CBBB2D301 --mojo-platform-channel-handle=2324 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:5044
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=292B35164D65681F3AE9E8C3138F1846 --mojo-platform-channel-handle=1852 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1260
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=039ED4D9E0639A59B420E273AEDD1097 --mojo-platform-channel-handle=2388 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:4136
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4684081D9879F163DF6AEC3CC25D6A7A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4684081D9879F163DF6AEC3CC25D6A7A --renderer-client-id=7 --mojo-platform-channel-handle=2536 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
282fbb88e431e24d7c2419d69c17b7f3

SHA1
3fe6f809547841d7d01b861af375334e5cde9ba8

SHA256
38442de6ff7f1a6d560c7f9365d6498c01fb7da32786d3b2b21839a6b64b8f6c

SHA512
0f92225f6d7d898ea1c898de8812dd85df50c0950612fbbcdc8dc19eb22a48d6cd7f7a7801396121eca0c386fbc49431fb0e64fb860df5bcc4b65a3fb1eeeb47

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\154.exe

Filesize
3KB

MD5
8a1343a147c5a257de0a5d8ca5098c2a

SHA1
210ffb3647434c05cbc95c12a7f8fbcf924c5fd4

SHA256
de4ef54cdde49c897203985f49a07d52c9909f671d66d9b861066056ef20f47b

SHA512
ef993a60cd15b90c04c34f7bfe852e16691975902ab8f24239a972097c33db94ff1759584d5e1af2e0a852c7bc08ebb509bfac3c9a34b5a8dda3711294078d4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\KPSS HAZIRLIK KAYNAK LİSTESİ.pdf

Filesize
51KB

MD5
656ec9e216b73a5f14904bce0f814bc8

SHA1
6308069f9a03b64320301389f76efce9b1654b43

SHA256
0b594ff40f2165dac3a1d051f2917d8ab7d6dbc759b2d241af2c672d928c9aa3

SHA512
724ccd3c2f3be60134792605564fb4c8025bb39a2f640c6c3c8450cdf91b99d20bd22b039962c582b7a9ea8984dbad48cce2e09bf13b7155c8c3dac6ea59dad9

Download Submit
memory/1768-44-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/3656-0-0x00007FFD1F5F5000-0x00007FFD1F5F6000-memory.dmp

Filesize
4KB

Download
memory/3656-1-0x000000001BF90000-0x000000001C036000-memory.dmp

Filesize
664KB

Download
memory/3656-2-0x00007FFD1F340000-0x00007FFD1FCE1000-memory.dmp

Filesize
9.6MB

Download
memory/3656-4-0x00007FFD1F340000-0x00007FFD1FCE1000-memory.dmp

Filesize
9.6MB

Download
memory/3656-15-0x00007FFD1F340000-0x00007FFD1FCE1000-memory.dmp

Filesize
9.6MB

Download