File name:

NOTIFICACIÓN FALLO No 99807-40806-2022.pdf

Full analysis: https://app.any.run/tasks/8ec66bfb-82a3-467f-9393-321ca683ef43
Verdict: Malicious activity
Analysis date: January 24, 2022, 22:25:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/pdf
File info: PDF document, version 1.5
MD5:

0BAE5157B11366D2FE37D8880F851F3F

SHA1:

05C5CD0D926873A72B75859710D018233B592CBE

SHA256:

680E2AF5983D9FBE23C6777EB285B206627C9933AA82C40B002C6D65BADF0155

SSDEEP:

1536:G9ecVGpKHpYGKvl+WYTXj4tIljuo2XWP12RjQsjjlqLi3Cx5Lhtm8ib9KLk46QJX:ieUGkPKAXOIj52WuoLig88gkT9VFcpY1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe (PID: 3364)
      • Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe (PID: 3412)
      • Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe (PID: 2372)
      • DriiveUpdate.exe (PID: 2736)
      • Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe (PID: 1512)
      • DriiveUpdate.exe (PID: 3260)
      • DriiveUpdate.exe (PID: 3896)

    • Changes the autorun value in the registry

      • Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe (PID: 2372)
      • Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe (PID: 1512)

  • SUSPICIOUS

    • Starts Internet Explorer

      • AcroRd32.exe (PID: 1704)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 4020)

    • Checks supported languages

      • AdobeARM.exe (PID: 2756)
      • Reader_sl.exe (PID: 2964)
      • WinRAR.exe (PID: 3540)
      • cmd.exe (PID: 2960)
      • Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe (PID: 3412)
      • Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe (PID: 2372)
      • DriiveUpdate.exe (PID: 2736)
      • Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe (PID: 3364)
      • Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe (PID: 1512)
      • DriiveUpdate.exe (PID: 3260)
      • cmd.exe (PID: 4016)
      • DriiveUpdate.exe (PID: 3896)

    • Reads the computer name

      • AdobeARM.exe (PID: 2756)
      • WinRAR.exe (PID: 3540)
      • Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe (PID: 3364)
      • Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe (PID: 3412)
      • Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe (PID: 2372)
      • DriiveUpdate.exe (PID: 2736)
      • Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe (PID: 1512)
      • DriiveUpdate.exe (PID: 3260)
      • DriiveUpdate.exe (PID: 3896)

    • Executable content was dropped or overwritten

      • AdobeARM.exe (PID: 2756)
      • WinRAR.exe (PID: 3540)
      • Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe (PID: 2372)
      • Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe (PID: 1512)

    • Creates files in the program directory

      • AdobeARM.exe (PID: 2756)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 3540)
      • Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe (PID: 2372)
      • Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe (PID: 1512)

    • Application launched itself

      • Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe (PID: 3364)
      • Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe (PID: 3412)
      • DriiveUpdate.exe (PID: 3260)

    • Starts CMD.EXE for commands execution

      • Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe (PID: 2372)
      • Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe (PID: 1512)

    • Creates files in the user directory

      • Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe (PID: 2372)
      • Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe (PID: 1512)

  • INFO

    • Checks supported languages

      • AcroRd32.exe (PID: 1704)
      • RdrCEF.exe (PID: 2412)
      • RdrCEF.exe (PID: 2424)
      • RdrCEF.exe (PID: 3352)
      • RdrCEF.exe (PID: 4032)
      • RdrCEF.exe (PID: 1800)
      • AcroRd32.exe (PID: 2536)
      • RdrCEF.exe (PID: 1372)
      • RdrCEF.exe (PID: 3400)
      • RdrCEF.exe (PID: 2524)
      • iexplore.exe (PID: 3532)
      • iexplore.exe (PID: 4020)
      • explorer.exe (PID: 872)
      • timeout.exe (PID: 3504)
      • timeout.exe (PID: 744)

    • Application launched itself

      • AcroRd32.exe (PID: 1704)
      • RdrCEF.exe (PID: 3400)
      • iexplore.exe (PID: 3532)

    • Reads the computer name

      • AcroRd32.exe (PID: 2536)
      • RdrCEF.exe (PID: 3400)
      • AcroRd32.exe (PID: 1704)
      • iexplore.exe (PID: 3532)
      • iexplore.exe (PID: 4020)
      • explorer.exe (PID: 872)

    • Reads CPU info

      • AcroRd32.exe (PID: 2536)

    • Reads the hosts file

      • RdrCEF.exe (PID: 3400)

    • Reads settings of System Certificates

      • AcroRd32.exe (PID: 1704)
      • RdrCEF.exe (PID: 3400)
      • iexplore.exe (PID: 4020)
      • iexplore.exe (PID: 3532)
      • AdobeARM.exe (PID: 2756)

    • Searches for installed software

      • AcroRd32.exe (PID: 1704)
      • AcroRd32.exe (PID: 2536)

    • Checks Windows Trust Settings

      • AcroRd32.exe (PID: 1704)
      • iexplore.exe (PID: 4020)
      • iexplore.exe (PID: 3532)
      • AdobeARM.exe (PID: 2756)

    • Changes internet zones settings

      • iexplore.exe (PID: 3532)

    • Creates files in the user directory

      • iexplore.exe (PID: 4020)
      • iexplore.exe (PID: 3532)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3532)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 3532)

    • Manual execution by user

      • explorer.exe (PID: 872)
      • Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe (PID: 3364)
      • WinRAR.exe (PID: 3540)
      • Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe (PID: 3412)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3532)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3532)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.pdf | Adobe Portable Document Format (100)

EXIF

PDF

Producer: Microsoft® Word 2010
ModifyDate: 2022:01:19 09:49:30-05:00
CreateDate: 2022:01:19 09:49:30-05:00
Creator: Microsoft® Word 2010
Author: PC
TaggedPDF: Yes
Language: es-CO
PageCount: 1
Linearized: No
PDFVersion: 1.5
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
73
Monitored processes
27
Malicious processes
4
Suspicious processes
4

Behavior graph

Click at the process to see the details
start acrord32.exe acrord32.exe no specs rdrcef.exe rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs iexplore.exe iexplore.exe adobearm.exe reader_sl.exe no specs explorer.exe no specs winrar.exe documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionpdf.exe no specs documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionpdf.exe no specs documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionpdf.exe cmd.exe no specs timeout.exe no specs driiveupdate.exe no specs documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionpdf.exe cmd.exe no specs timeout.exe no specs driiveupdate.exe no specs driiveupdate.exe

Process information

PID
CMD
Path
Indicators
Parent process
744timeout 3 C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
872"C:\Windows\explorer.exe" C:\Windows\explorer.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\lpk.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
1372"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --field-trial-handle=1060,16914995589285139108,7038503479931496002,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --service-request-channel-token=12543626554247896666 --mojo-platform-channel-handle=1364 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
1
Version:
20.13.20064.405839
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\adobe\acrobat reader dc\reader\acrocef\rdrcef.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\advapi32.dll
1512"C:\Users\admin\Downloads\Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf\Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe"C:\Users\admin\Downloads\Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf\Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Calculator Interpreter
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\downloads\documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionpdf\documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionpdf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1704"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\AppData\Local\Temp\NOTIFICACI�N FALLO No 99807-40806-2022.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Explorer.EXE
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat Reader DC
Exit code:
0
Version:
20.13.20064.405839
Modules
Images
c:\program files\adobe\acrobat reader dc\reader\acrord32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
1800"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1060,16914995589285139108,7038503479931496002,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-gpu-compositing --lang=en-US --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=8949663711883561048 --renderer-client-id=7 --mojo-platform-channel-handle=1556 --allow-no-sandbox-job /prefetch:1C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
0
Version:
20.13.20064.405839
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\adobe\acrobat reader dc\reader\acrocef\rdrcef.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
2372"C:\Users\admin\Downloads\Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf\Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe"C:\Users\admin\Downloads\Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf\Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Calculator Interpreter
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\downloads\documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionpdf\documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionpdf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2412"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1060,16914995589285139108,7038503479931496002,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-gpu-compositing --lang=en-US --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=16558619589054991393 --renderer-client-id=2 --mojo-platform-channel-handle=1168 --allow-no-sandbox-job /prefetch:1C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
0
Version:
20.13.20064.405839
Modules
Images
c:\program files\adobe\acrobat reader dc\reader\acrocef\rdrcef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2424"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --field-trial-handle=1060,16914995589285139108,7038503479931496002,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --service-request-channel-token=16908894213465944243 --mojo-platform-channel-handle=1188 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
1
Version:
20.13.20064.405839
Modules
Images
c:\program files\adobe\acrobat reader dc\reader\acrocef\rdrcef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2524"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1060,16914995589285139108,7038503479931496002,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-gpu-compositing --lang=en-US --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=3898572092300772972 --renderer-client-id=8 --mojo-platform-channel-handle=1636 --allow-no-sandbox-job /prefetch:1C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
0
Version:
20.13.20064.405839
Modules
Images
c:\program files\adobe\acrobat reader dc\reader\acrocef\rdrcef.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
31 767
Read events
31 479
Write events
280
Delete events
8

Modification events

(PID) Process:(2536) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\ExitSection
Operation:writeName:bLastExitNormal
Value:
0
(PID) Process:(2536) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\AVGeneral
Operation:writeName:iNumReaderLaunches
Value:
2
(PID) Process:(2536) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\FTEDialog
Operation:writeName:bShowUpdateFTE
Value:
1
(PID) Process:(2536) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\HomeWelcome
Operation:writeName:bIsAcrobatUpdated
Value:
1
(PID) Process:(2536) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\HomeWelcomeFirstMileReader
Operation:writeName:iCardCountShown
Value:
2
(PID) Process:(2536) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\FTEDialog
Operation:delete valueName:iLastCardShown
Value:
0
(PID) Process:(1704) AcroRd32.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2536) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\SessionManagement
Operation:writeName:bNormalExit
Value:
0
(PID) Process:(2536) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\SessionManagement\cWindowsCurrent\cWin0
Operation:writeName:iTabCount
Value:
0
(PID) Process:(2536) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\SessionManagement\cWindowsCurrent
Operation:writeName:iWinCount
Value:
1
Executable files
5
Suspicious files
148
Text files
27
Unknown types
18

Dropped files

PID
Process
Filename
Type
3400RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0binary
MD5:—
SHA256:—
3400RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0binary
MD5:—
SHA256:—
3400RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0binary
MD5:—
SHA256:—
3400RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0binary
MD5:—
SHA256:—
3400RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\72d9f526d2e2e7c8_0binary
MD5:—
SHA256:—
3400RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0binary
MD5:—
SHA256:—
3400RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0binary
MD5:—
SHA256:—
3400RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0binary
MD5:—
SHA256:—
3400RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0binary
MD5:—
SHA256:—
3400RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0binary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
45
DNS requests
25
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4020
iexplore.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
4020
iexplore.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
4020
iexplore.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC04WHG3wyS9QoAAAABK3x8
US
der
472 b
whitelisted
4020
iexplore.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEA9%2FdKivN6zeCgAAAAErf8I%3D
US
der
471 b
whitelisted
1704
AcroRd32.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
der
471 b
whitelisted
3532
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
3532
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
US
der
471 b
whitelisted
3532
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
4020
iexplore.exe
GET
200
23.32.238.201:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e73fa9a2af513eb3
US
compressed
4.70 Kb
whitelisted
4020
iexplore.exe
GET
200
23.32.238.201:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?7f416443cc65c53b
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3400
RdrCEF.exe
2.18.233.74:443
geo2.adobe.com
Akamai International B.V.
—
whitelisted
1704
AcroRd32.exe
2.16.107.24:443
acroipm2.adobe.com
Akamai International B.V.
—
malicious
4020
iexplore.exe
142.250.185.174:443
drive.google.com
Google Inc.
US
whitelisted
4020
iexplore.exe
23.32.238.201:80
ctldl.windowsupdate.com
XO Communications
US
suspicious
4020
iexplore.exe
172.217.18.99:80
ocsp.pki.goog
Google Inc.
US
whitelisted
4020
iexplore.exe
142.250.186.97:443
doc-10-4g-docs.googleusercontent.com
Google Inc.
US
whitelisted
3532
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
924
svchost.exe
2.16.107.65:443
ardownload3.adobe.com
Akamai International B.V.
—
whitelisted
3532
iexplore.exe
152.199.19.161:443
r20swj13mr.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
—
—
2.16.107.65:443
ardownload3.adobe.com
Akamai International B.V.
—
whitelisted

DNS requests

Domain
IP
Reputation
www.microsoft.com
  • —
whitelisted
geo2.adobe.com
  • 2.18.233.74
whitelisted
p13n.adobe.io
  • 107.22.247.231
  • 18.207.85.246
  • 34.193.227.236
  • 54.144.73.197
whitelisted
armmf.adobe.com
  • 2.18.233.74
whitelisted
acroipm2.adobe.com
  • 2.16.107.24
  • 2.16.107.49
whitelisted
drive.google.com
  • 142.250.185.174
shared
ctldl.windowsupdate.com
  • 23.32.238.201
  • 23.32.238.178
whitelisted
ocsp.pki.goog
  • 172.217.18.99
whitelisted
api.bing.com
  • 13.107.13.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted

Threats

PID
Process
Class
Message
924
svchost.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
NOTIFICACIÓN FALLO No 99807-40806-2022.pdf