Overview
overview
10Static
static
854678013c8...e6.pdf
windows7-x64
354678013c8...e6.pdf
windows10-2004-x64
3Плате...ь.url
windows7-x64
1Плате...ь.url
windows10-2004-x64
1Плате...df.wsf
windows7-x64
10Плате...df.wsf
windows10-2004-x64
10Сопро...df.wsf
windows7-x64
10Сопро...df.wsf
windows10-2004-x64
10Акт_з�...19.scr
windows7-x64
10Акт_з�...19.scr
windows10-2004-x64
10a059d671d9...a2.exe
windows7-x64
10a059d671d9...a2.exe
windows10-2004-x64
10Плате...df.wsf
windows7-x64
10Плате...df.wsf
windows10-2004-x64
10Сопро...df.wsf
windows7-x64
10Сопро...df.wsf
windows10-2004-x64
10cd123c288f...f8c.js
windows7-x64
6cd123c288f...f8c.js
windows10-2004-x64
7d6d722ae73...21.doc
windows7-x64
10d6d722ae73...21.doc
windows10-2004-x64
10fdfbdd4294...44.exe
windows7-x64
10fdfbdd4294...44.exe
windows10-2004-x64
10Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-02-2025 05:14
Behavioral task
behavioral1
Sample
54678013c8741db3340960e54ba93001c27619ead5cf5cc2eafd4c0fcf797ae6.pdf
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
54678013c8741db3340960e54ba93001c27619ead5cf5cc2eafd4c0fcf797ae6.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Платежное Поручение в iнозеной валюте та сопроводiтель.url
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Платежное Поручение в iнозеной валюте та сопроводiтель.url
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Платежное Поручение в iнозеной валюте.pdf.wsf
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Платежное Поручение в iнозеной валюте.pdf.wsf
Resource
win10v2004-20250129-en
Behavioral task
behavioral7
Sample
Сопроводiтельни документи вiд 23.09.2024p.pdf.wsf
Resource
win7-20241023-en
Behavioral task
behavioral8
Sample
Сопроводiтельни документи вiд 23.09.2024p.pdf.wsf
Resource
win10v2004-20250129-en
Behavioral task
behavioral9
Sample
Акт_звiрки_№180924_вiд_26_09_2024р_зг_рах_UA973248410000000026006263319.scr
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Акт_звiрки_№180924_вiд_26_09_2024р_зг_рах_UA973248410000000026006263319.scr
Resource
win10v2004-20250129-en
Behavioral task
behavioral11
Sample
a059d671d950abee93ef78a170d58a3839c2a465914ab3bd5411e39c89ae55a2.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
a059d671d950abee93ef78a170d58a3839c2a465914ab3bd5411e39c89ae55a2.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral13
Sample
Платежное Поручение в iнозеной валюте.pdf.wsf
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
Платежное Поручение в iнозеной валюте.pdf.wsf
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Сопроводiтельни документи вiд 23.09.2024p.pdf.wsf
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
Сопроводiтельни документи вiд 23.09.2024p.pdf.wsf
Resource
win10v2004-20250129-en
Behavioral task
behavioral17
Sample
cd123c288f623878218be31125000441bb8c5447375af67bc3c1d27d16eb5f8c.js
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
cd123c288f623878218be31125000441bb8c5447375af67bc3c1d27d16eb5f8c.js
Resource
win10v2004-20250129-en
Behavioral task
behavioral19
Sample
d6d722ae73ddff1ad7c468feca882b159a2a6e267df8b219482b514cdab74c21.doc
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
d6d722ae73ddff1ad7c468feca882b159a2a6e267df8b219482b514cdab74c21.doc
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
fdfbdd42944c9e3b9697a8d8375e4e5cfd45c86941aa3f8f6dd0d08607b73144.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
fdfbdd42944c9e3b9697a8d8375e4e5cfd45c86941aa3f8f6dd0d08607b73144.exe
Resource
win10v2004-20250129-en
General
-
Target
54678013c8741db3340960e54ba93001c27619ead5cf5cc2eafd4c0fcf797ae6.pdf
-
Size
161KB
-
MD5
e75185a22cdf243af1a5f41fd53d9a0d
-
SHA1
b800205252362b86b10a8e8f56e21143cadab40f
-
SHA256
54678013c8741db3340960e54ba93001c27619ead5cf5cc2eafd4c0fcf797ae6
-
SHA512
2d24005c1cb99dcda4ee42e6dee07e312f54359a33a73f64d11321d9fb7a661ebfc722dc12745d0bc30ca4577642bf676fc7748923f24a74eaee6283097cc2f8
-
SSDEEP
3072:Gnbp8yo1TxQ09Qq0AlutdCZpE0pxfyBPY02AGWeAR:+gxQoSdCZpEafqQ09GWeAR
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 64 AcroRd32.exe 64 AcroRd32.exe 64 AcroRd32.exe 64 AcroRd32.exe 64 AcroRd32.exe 64 AcroRd32.exe 64 AcroRd32.exe 64 AcroRd32.exe 64 AcroRd32.exe 64 AcroRd32.exe 64 AcroRd32.exe 64 AcroRd32.exe 64 AcroRd32.exe 64 AcroRd32.exe 64 AcroRd32.exe 64 AcroRd32.exe 64 AcroRd32.exe 64 AcroRd32.exe 64 AcroRd32.exe 64 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 64 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 64 AcroRd32.exe 64 AcroRd32.exe 64 AcroRd32.exe 64 AcroRd32.exe 64 AcroRd32.exe 64 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 64 wrote to memory of 4288 64 AcroRd32.exe 82 PID 64 wrote to memory of 4288 64 AcroRd32.exe 82 PID 64 wrote to memory of 4288 64 AcroRd32.exe 82 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 2060 4288 RdrCEF.exe 83 PID 4288 wrote to memory of 4792 4288 RdrCEF.exe 84 PID 4288 wrote to memory of 4792 4288 RdrCEF.exe 84 PID 4288 wrote to memory of 4792 4288 RdrCEF.exe 84 PID 4288 wrote to memory of 4792 4288 RdrCEF.exe 84 PID 4288 wrote to memory of 4792 4288 RdrCEF.exe 84 PID 4288 wrote to memory of 4792 4288 RdrCEF.exe 84 PID 4288 wrote to memory of 4792 4288 RdrCEF.exe 84 PID 4288 wrote to memory of 4792 4288 RdrCEF.exe 84 PID 4288 wrote to memory of 4792 4288 RdrCEF.exe 84 PID 4288 wrote to memory of 4792 4288 RdrCEF.exe 84 PID 4288 wrote to memory of 4792 4288 RdrCEF.exe 84 PID 4288 wrote to memory of 4792 4288 RdrCEF.exe 84 PID 4288 wrote to memory of 4792 4288 RdrCEF.exe 84 PID 4288 wrote to memory of 4792 4288 RdrCEF.exe 84 PID 4288 wrote to memory of 4792 4288 RdrCEF.exe 84 PID 4288 wrote to memory of 4792 4288 RdrCEF.exe 84 PID 4288 wrote to memory of 4792 4288 RdrCEF.exe 84 PID 4288 wrote to memory of 4792 4288 RdrCEF.exe 84 PID 4288 wrote to memory of 4792 4288 RdrCEF.exe 84 PID 4288 wrote to memory of 4792 4288 RdrCEF.exe 84
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\54678013c8741db3340960e54ba93001c27619ead5cf5cc2eafd4c0fcf797ae6.pdf"1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3826690C25CBA900EED0FD653229A6AA --mojo-platform-channel-handle=1760 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
- System Location Discovery: System Language Discovery
PID:2060
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=93C3E5FBC9CDB6BD402335BAAE15A8D5 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=93C3E5FBC9CDB6BD402335BAAE15A8D5 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:13⤵
- System Location Discovery: System Language Discovery
PID:4792
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0BE943A555E29D2A5F9B00C455F88AF7 --mojo-platform-channel-handle=2152 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
- System Location Discovery: System Language Discovery
PID:4912
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A26AE136DABE4CA72008B8972A2CD903 --mojo-platform-channel-handle=2416 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
- System Location Discovery: System Language Discovery
PID:1472
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3842F36F6C3B0ED07CFF5474DB4BDDD4 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3842F36F6C3B0ED07CFF5474DB4BDDD4 --renderer-client-id=6 --mojo-platform-channel-handle=2352 --allow-no-sandbox-job /prefetch:13⤵
- System Location Discovery: System Language Discovery
PID:1728
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3D729CF935E680B001CB18741F9EB155 --mojo-platform-channel-handle=2544 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
- System Location Discovery: System Language Discovery
PID:3332
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2120
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD52c15e00e11ec270ed6c7622c5f714bf6
SHA1fdb0fd0a40c15e78951d10a2bdf1cd4170b66509
SHA256196f90ed6fa856e5570d11da7516c31c5a5397826853a0e3034bb8408fd0c289
SHA5122e834ce12d8ab9eb88ba1da1f4de46e7413d80a98e0b1b408fc0ebd41bb87e50144a42eb560b8ffd3966226aa8b85787e8cc07c6954a38f3758c279e653f7e58
-
Filesize
36KB
MD5b30d3becc8731792523d599d949e63f5
SHA119350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
-
Filesize
56KB
MD5752a1f26b18748311b691c7d8fc20633
SHA1c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5