File name:

19001dd441e50233d7f0addb4fcd405a70ac3d5e310ff20b331d6f1a29c634f0.pdf

Full analysis: https://app.any.run/tasks/2c0ffc87-4059-4d6f-8306-1258cf33aa54
Verdict: Malicious activity
Analysis date: July 21, 2024, 17:12:42
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
evasion
telegram
Indicators:
MIME: application/pdf
File info: PDF document, version 1.7, 1 pages
MD5:

22E9135A650CD674EB330CBB4A7329C3

SHA1:

CDFA4966D7A859B09A411F0D90EFBF822B2D6671

SHA256:

19001DD441E50233D7F0ADDB4FCD405A70AC3D5E310FF20B331D6F1A29C634F0

SSDEEP:

3072:0acAmbHcWJZ6HjAndhEsWfJnOmsXfrRkPBKkeR8H80znno1pFpQcM:0acAmbHKAnXDqPBKks8H3ToLrBM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • CrowdStrike.exe (PID: 8936)
      • cmd.exe (PID: 9092)
      • Champion.pif (PID: 6396)
      • RegAsm.exe (PID: 8896)

    • Antivirus name has been found in the command line (generic signature)

      • findstr.exe (PID: 8976)
      • findstr.exe (PID: 9060)
      • findstr.exe (PID: 9052)
      • findstr.exe (PID: 8504)

    • Actions looks like stealing of personal data

      • RegAsm.exe (PID: 8896)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 8604)
      • CrowdStrike.exe (PID: 8936)
      • Champion.pif (PID: 8380)
      • CrowdStrike.exe (PID: 5244)

    • Executing commands from ".cmd" file

      • CrowdStrike.exe (PID: 8936)
      • CrowdStrike.exe (PID: 5244)

    • Reads the date of Windows installation

      • CrowdStrike.exe (PID: 8936)
      • Champion.pif (PID: 8380)
      • CrowdStrike.exe (PID: 5244)

    • Starts CMD.EXE for commands execution

      • CrowdStrike.exe (PID: 8936)
      • cmd.exe (PID: 9092)
      • Champion.pif (PID: 8380)
      • CrowdStrike.exe (PID: 5244)
      • cmd.exe (PID: 9004)

    • Get information on the list of running processes

      • cmd.exe (PID: 9092)
      • cmd.exe (PID: 9004)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 9092)
      • cmd.exe (PID: 9004)

    • Application launched itself

      • cmd.exe (PID: 9092)
      • cmd.exe (PID: 9004)

    • Drops a file with a rarely used extension (PIF)

      • cmd.exe (PID: 9092)

    • Suspicious file concatenation

      • cmd.exe (PID: 1164)
      • cmd.exe (PID: 9168)

    • Executable content was dropped or overwritten

      • cmd.exe (PID: 9092)
      • Champion.pif (PID: 6396)
      • RegAsm.exe (PID: 8896)

    • Starts application with an unusual extension

      • cmd.exe (PID: 9092)
      • cmd.exe (PID: 9004)

    • The executable file from the user directory is run by the CMD process

      • Champion.pif (PID: 8380)
      • CrowdStrike.exe (PID: 5244)
      • Champion.pif (PID: 6396)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 9092)
      • cmd.exe (PID: 9004)

    • Starts a Microsoft application from unusual location

      • RegAsm.exe (PID: 8896)
      • RegAsm.exe (PID: 7232)

    • Process drops legitimate windows executable

      • Champion.pif (PID: 6396)

    • The process creates files with name similar to system file names

      • Champion.pif (PID: 6396)

    • Drops a system driver (possible attempt to evade defenses)

      • RegAsm.exe (PID: 8896)

    • Checks for external IP

      • RegAsm.exe (PID: 8896)

    • Executes application which crashes

      • Taskmgr.exe (PID: 2204)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • RegAsm.exe (PID: 8896)

  • INFO

    • Application launched itself

      • Acrobat.exe (PID: 7628)
      • msedge.exe (PID: 7972)
      • AcroCEF.exe (PID: 7608)
      • msedge.exe (PID: 8832)

    • An automatically generated document

      • Acrobat.exe (PID: 7628)

    • Drops the executable file immediately after the start

      • msedge.exe (PID: 7972)
      • msedge.exe (PID: 5848)
      • WinRAR.exe (PID: 8604)
      • AdobeARM.exe (PID: 8124)

    • Reads Microsoft Office registry keys

      • Acrobat.exe (PID: 7628)
      • msedge.exe (PID: 7972)
      • msedge.exe (PID: 8832)

    • Checks supported languages

      • identity_helper.exe (PID: 8844)
      • acrobat_sl.exe (PID: 7336)
      • CrowdStrike.exe (PID: 8936)
      • Champion.pif (PID: 8380)
      • CrowdStrike.exe (PID: 5244)
      • Champion.pif (PID: 6396)
      • RegAsm.exe (PID: 8896)
      • identity_helper.exe (PID: 9196)

    • Reads the computer name

      • identity_helper.exe (PID: 8844)
      • Champion.pif (PID: 8380)
      • CrowdStrike.exe (PID: 5244)
      • Champion.pif (PID: 6396)
      • RegAsm.exe (PID: 8896)
      • identity_helper.exe (PID: 9196)
      • CrowdStrike.exe (PID: 8936)

    • Executable content was dropped or overwritten

      • AdobeARM.exe (PID: 8124)
      • WinRAR.exe (PID: 8604)

    • The process uses the downloaded file

      • msedge.exe (PID: 7972)
      • msedge.exe (PID: 9188)
      • WinRAR.exe (PID: 8604)

    • Create files in a temporary directory

      • CrowdStrike.exe (PID: 8936)
      • CrowdStrike.exe (PID: 5244)
      • Champion.pif (PID: 6396)
      • RegAsm.exe (PID: 8896)

    • Process checks computer location settings

      • CrowdStrike.exe (PID: 8936)
      • Champion.pif (PID: 8380)
      • CrowdStrike.exe (PID: 5244)

    • Reads mouse settings

      • Champion.pif (PID: 8380)
      • Champion.pif (PID: 6396)

    • Reads the machine GUID from the registry

      • RegAsm.exe (PID: 8896)

    • Reads Environment values

      • RegAsm.exe (PID: 8896)

    • Disables trace logs

      • RegAsm.exe (PID: 8896)

    • Checks proxy server information

      • RegAsm.exe (PID: 8896)

    • Manual execution by a user

      • Taskmgr.exe (PID: 5312)
      • Taskmgr.exe (PID: 2204)
      • RegAsm.exe (PID: 7232)
      • notepad++.exe (PID: 3672)
      • WerFault.exe (PID: 7520)
      • Taskmgr.exe (PID: 968)
      • Taskmgr.exe (PID: 6780)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 2204)

    • Reads the software policy settings

      • RegAsm.exe (PID: 8896)

    • Attempting to use instant messaging service

      • RegAsm.exe (PID: 8896)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.pdf | Adobe Portable Document Format (100)

EXIF

PDF

PDFVersion: 1.7
Linearized: No
PageCount: 1
Language: en
TaggedPDF: Yes
Author: Eliza
Creator: Microsoft® Word LTSC
CreateDate: 2024:07:20 11:35:24+03:30
ModifyDate: 2024:07:20 11:35:24+03:30
Producer: Microsoft® Word LTSC

XMP

XMPToolkit: 3.1-701
Producer: Microsoft® Word LTSC
Creator: Eliza
CreatorTool: Microsoft® Word LTSC
CreateDate: 2024:07:20 11:35:24+03:30
ModifyDate: 2024:07:20 11:35:24+03:30
DocumentID: uuid:B47B247B-A057-44E2-B84D-C9DB82B7E26A
InstanceID: uuid:B47B247B-A057-44E2-B84D-C9DB82B7E26A
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
275
Monitored processes
105
Malicious processes
7
Suspicious processes
2

Behavior graph

Click at the process to see the details
start acrobat.exe acrobat.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs adobearm.exe acrobat_sl.exe no specs slui.exe no specs acrocef.exe no specs slui.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe crowdstrike.exe no specs cmd.exe conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs champion.pif no specs timeout.exe no specs cmd.exe conhost.exe no specs crowdstrike.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs champion.pif timeout.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs regasm.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs taskmgr.exe no specs taskmgr.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rundll32.exe no specs msedge.exe no specs regasm.exe conhost.exe no specs notepad++.exe no specs werfault.exe no specs werfault.exe no specs startmenuexperiencehost.exe no specs textinputhost.exe no specs tiworker.exe no specs searchapp.exe no specs mobsync.exe no specs msedge.exe no specs taskmgr.exe no specs taskmgr.exe

Process information

PID
CMD
Path
Indicators
Parent process
684"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=gpu-process --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --lang=en-US --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2516 --field-trial-handle=1600,i,4431285975096472131,570738573696107412,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Exit code:
0
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
764"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=gpu-process --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --lang=en-US --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2504 --field-trial-handle=1600,i,4431285975096472131,570738573696107412,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Exit code:
0
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
796"C:\WINDOWS\SysWOW64\cmd.exe" /c C:\Users\admin\AppData\Local\Temp\Rar$EXa8604.31388\update\CrowdStrike.exeC:\Windows\SysWOW64\cmd.exe
Champion.pif
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
968"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Manager
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
1068"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6704 --field-trial-handle=2388,i,12835060206259354787,14366823388722948944,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1164cmd /c copy /b Treating + Viagra + Vision + Jul + Str 564784\L C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2204"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Exit code:
3221225477
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
2748C:\WINDOWS\system32\WerFault.exe -u -p 2204 -s 1776C:\Windows\System32\WerFault.exe—Taskmgr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
3128"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1600,i,4431285975096472131,570738573696107412,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Exit code:
0
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3548C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
58 170
Read events
57 658
Write events
498
Delete events
14

Modification events

(PID) Process:(7628) Acrobat.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2034283098-2252572593-1072577386-2659511007-3245387615-27016815-3920691934
Operation:writeName:DisplayName
Value:
Adobe Acrobat Reader Protected Mode
(PID) Process:(4372) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\ExitSection
Operation:writeName:bLastExitNormal
Value:
0
(PID) Process:(4372) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement
Operation:writeName:bSynchronizeOPL
Value:
0
(PID) Process:(4372) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral
Operation:writeName:aDefaultRHPViewMode_L
Value:
Expanded
(PID) Process:(4372) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral
Operation:writeName:bExpandRHPInViewer
Value:
1
(PID) Process:(4372) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral
Operation:writeName:uLastAppLaunchTimeStamp
Value:
(PID) Process:(4372) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral
Operation:writeName:iNumAcrobatLaunches
Value:
3
(PID) Process:(4372) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral
Operation:writeName:iNumUserDockUndockHUD
Value:
0
(PID) Process:(4372) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\NoTimeOut
Operation:writeName:smailto
Value:
5900
(PID) Process:(4372) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\ToolsSearch
Operation:writeName:iSearchHintIndex
Value:
0
Executable files
14
Suspicious files
1 177
Text files
320
Unknown types
125

Dropped files

PID
Process
Filename
Type
7608AcroCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0binary
MD5:878FC48D0B73FC54739A65A74A572EDC
SHA256:ECDA65E12C1117B96CFEEB27103C65B74B77B528819A80F1805B1CE80A60BE7B
7608AcroCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0binary
MD5:6894162069E758321B7EA361EC3F15DE
SHA256:FCB3D6E792B5487B105710333488CEA123BE9D3718F647FBD9B453D745467A7D
4372Acrobat.exeC:\USERS\ADMIN\APPDATA\LOCAL\ADOBE\ACROBAT\DC\SHAREDDATAEVENTSsqlite
MD5:7A20E912425C633790FECD4A11984054
SHA256:FF30026C6ACA0428F72D96B6C2174E19BF0CD8EF2A79F28F4830E1CCEA8C2D75
4372Acrobat.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journalbinary
MD5:F13B952936DE53DF468091ED6AD60FE1
SHA256:566B2245B258E0A8C2B215BCA68933A5229B7B62978F12F381B8F98700311A06
7608AcroCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.oldtext
MD5:43D1F53B48631F8B32E040219417874B
SHA256:AA4C99C362EB18EB8B91EEB8821960807F725E7C5DE1FBABBA7B910BDA3EEEB8
8124AdobeARM.exeC:\Users\admin\AppData\Local\Temp\ArmUI.initext
MD5:B0DF20BAA9DEE27BDBC3285C7D6D4C57
SHA256:76362509A8CA3E4A9FDC854C56674083EF77CA2C53628CE0ACF4BB4C42D73894
7608AcroCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old~RF42b8df.TMPtext
MD5:E26AF4B6A1AD62E54D67510EEFE20B2C
SHA256:BF001234CF5F261254DEA1EA459BBFD4A35D15166C765CA3ED9B56D49A04BE1B
4372Acrobat.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTINGbinary
MD5:DC84B0D741E5BEAE8070013ADDCC8C28
SHA256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
7608AcroCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0binary
MD5:F86E69868896469F0549A0111177F12B
SHA256:688B2301A4105E60FAC60B2F1CF6285D29C66A231FD0F105ADD495C4F2771866
7608AcroCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.oldtext
MD5:002CE9F1C8E638C89460289DFF260E3B
SHA256:710FF791CABA4771BFB6DBAFAF141DA47E1F041BC4040CBB7E7F82C69E15AF0C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
83
DNS requests
72
Threats
13

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8124
AdobeARM.exe
GET
404
2.19.126.143:80
http://acroipm2.adobe.com/assets/Owner/arm/2024/7/OwnerAPI/Rdr.txt
unknown
—
—
whitelisted
8124
AdobeARM.exe
GET
304
2.19.126.143:80
http://acroipm2.adobe.com/assets/Owner/arm/ReportOwner.txt
unknown
—
—
whitelisted
8124
AdobeARM.exe
GET
404
2.19.126.143:80
http://acroipm2.adobe.com/assets/Owner/arm/2024/7/UC/Other.txt
unknown
—
—
whitelisted
8124
AdobeARM.exe
GET
304
2.19.126.143:80
http://acroipm2.adobe.com/assets/Owner/arm/ProcessMAU.txt
unknown
—
—
whitelisted
8124
AdobeARM.exe
GET
404
2.19.126.143:80
http://acroipm2.adobe.com/assets/Owner/arm/29/adnme/NoValidReasonForAdnme.txt
unknown
—
—
whitelisted
8124
AdobeARM.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
8124
AdobeARM.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
8896
RegAsm.exe
GET
200
104.16.185.241:80
http://icanhazip.com/
unknown
—
—
shared
8124
AdobeARM.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEA0aNA9419AA4In9uq1lIt8%3D
unknown
—
—
whitelisted
7628
Acrobat.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4716
svchost.exe
40.126.31.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
5620
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7856
svchost.exe
4.209.33.156:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2760
svchost.exe
40.113.103.199:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4984
AcroCEF.exe
184.28.88.176:443
geo2.adobe.com
AKAMAI-AS
US
unknown
8124
AdobeARM.exe
2.19.126.143:80
acroipm2.adobe.com
Akamai International B.V.
DE
unknown
7108
svchost.exe
88.221.168.141:443
armmf.adobe.com
AKAMAI-AS
DE
unknown
4984
AcroCEF.exe
34.237.241.83:443
p13n.adobe.io
AMAZON-AES
US
unknown

DNS requests

Domain
IP
Reputation
login.live.com
  • 40.126.31.73
  • 20.190.159.2
  • 20.190.159.23
  • 20.190.159.64
  • 40.126.31.67
  • 20.190.159.0
  • 20.190.159.73
  • 20.190.159.71
  • 40.126.31.71
  • 20.190.159.4
  • 20.190.159.68
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 216.58.206.78
whitelisted
geo2.adobe.com
  • 184.28.88.176
whitelisted
acroipm2.adobe.com
  • 2.19.126.143
  • 2.19.126.149
whitelisted
armmf.adobe.com
  • 88.221.168.141
  • 72.246.168.142
whitelisted
p13n.adobe.io
  • 34.237.241.83
  • 18.213.11.84
  • 50.16.47.176
  • 54.224.241.105
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
licensing.mp.microsoft.com
  • 4.208.221.206
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

PID
Process
Class
Message
2168
svchost.exe
Potentially Bad Traffic
ET INFO File Sharing Service Domain in DNS Lookup (link .storjshare .io)
5848
msedge.exe
Potentially Bad Traffic
ET INFO File Sharing Service Domain in DNS Lookup (link .storjshare .io)
5848
msedge.exe
Potentially Bad Traffic
ET INFO Observed File Sharing Service Domain (link .storjshare .io in TLS SNI)
5848
msedge.exe
Potentially Bad Traffic
ET INFO File Sharing Service Domain in DNS Lookup (link .storjshare .io)
8896
RegAsm.exe
Attempted Information Leak
ET POLICY IP Check Domain (icanhazip. com in HTTP Host)
2168
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (icanhazip .com)
8896
RegAsm.exe
Device Retrieving External IP Address Detected
SUSPICIOUS [ANY.RUN] An IP address was received from the server as a result of an HTTP request
2168
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
8896
RegAsm.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
8896
RegAsm.exe
Misc activity
ET HUNTING Telegram API Certificate Observed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
19001dd441e50233d7f0addb4fcd405a70ac3d5e310ff20b331d6f1a29c634f0.pdf