File name:

cb7c86b23fe81bcf2a8fedf7273fe0d7.pdf

Full analysis: https://app.any.run/tasks/bb6fc88b-c504-4589-a31e-8d993ad0dd48
Verdict: Malicious activity
Analysis date: January 24, 2022, 15:53:07
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/pdf
File info: PDF document, version 1.4
MD5:

CB7C86B23FE81BCF2A8FEDF7273FE0D7

SHA1:

C4C22A81B42F1657A8158AC8F98008056511A11C

SHA256:

A82E9297DA902F3E4C68758BD5EEC73E965CD88DB7CB34B1C6AB5C1E84DBD8F6

SSDEEP:

3072:9KCC+9PJfbL9MSStadBsq2aZ1SDuR6diwz/n0:97C+9Pl9jBbrxZUldzc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3836)
      • helper.exe (PID: 3820)

    • Steals credentials from Web Browsers

      • pingsender.exe (PID: 1864)
      • pingsender.exe (PID: 2212)
      • pingsender.exe (PID: 760)
      • pingsender.exe (PID: 2728)
      • pingsender.exe (PID: 3712)
      • pingsender.exe (PID: 3708)
      • pingsender.exe (PID: 1004)
      • pingsender.exe (PID: 3644)

    • Actions looks like stealing of personal data

      • pingsender.exe (PID: 1864)
      • pingsender.exe (PID: 2212)
      • pingsender.exe (PID: 2728)
      • pingsender.exe (PID: 3712)
      • pingsender.exe (PID: 760)
      • pingsender.exe (PID: 3644)
      • pingsender.exe (PID: 3708)
      • pingsender.exe (PID: 1004)

    • Drops executable file immediately after starts

      • helper.exe (PID: 3820)

  • SUSPICIOUS

    • Drops a file that was compiled in debug mode

      • firefox.exe (PID: 1404)

    • Reads the computer name

      • AdobeARM.exe (PID: 3264)
      • pingsender.exe (PID: 1864)
      • pingsender.exe (PID: 2212)
      • helper.exe (PID: 3820)
      • pingsender.exe (PID: 2728)
      • pingsender.exe (PID: 3712)
      • pingsender.exe (PID: 760)
      • pingsender.exe (PID: 3644)
      • pingsender.exe (PID: 3708)
      • pingsender.exe (PID: 1004)

    • Checks supported languages

      • Reader_sl.exe (PID: 2404)
      • AdobeARM.exe (PID: 3264)
      • pingsender.exe (PID: 1864)
      • pingsender.exe (PID: 2212)
      • helper.exe (PID: 3820)
      • pingsender.exe (PID: 2728)
      • pingsender.exe (PID: 3712)
      • pingsender.exe (PID: 760)
      • pingsender.exe (PID: 3644)
      • pingsender.exe (PID: 3708)
      • pingsender.exe (PID: 1004)

    • Loads DLL from Mozilla Firefox

      • pingsender.exe (PID: 1864)
      • pingsender.exe (PID: 2212)
      • pingsender.exe (PID: 3712)
      • pingsender.exe (PID: 760)
      • pingsender.exe (PID: 2728)
      • pingsender.exe (PID: 3644)
      • pingsender.exe (PID: 3708)
      • pingsender.exe (PID: 1004)

    • Drops a file with too old compile date

      • helper.exe (PID: 3820)

    • Executable content was dropped or overwritten

      • helper.exe (PID: 3820)
      • firefox.exe (PID: 1404)
      • AdobeARM.exe (PID: 3264)

    • Creates files in the program directory

      • AdobeARM.exe (PID: 3264)

    • Changes default file association

      • helper.exe (PID: 3820)

  • INFO

    • Checks supported languages

      • AcroRd32.exe (PID: 1324)
      • AcroRd32.exe (PID: 1304)
      • RdrCEF.exe (PID: 3720)
      • RdrCEF.exe (PID: 1632)
      • RdrCEF.exe (PID: 880)
      • RdrCEF.exe (PID: 1444)
      • RdrCEF.exe (PID: 3008)
      • RdrCEF.exe (PID: 2504)
      • RdrCEF.exe (PID: 3228)
      • RdrCEF.exe (PID: 3048)
      • firefox.exe (PID: 2492)
      • firefox.exe (PID: 3544)
      • firefox.exe (PID: 276)
      • firefox.exe (PID: 3068)
      • firefox.exe (PID: 3428)
      • firefox.exe (PID: 2972)
      • firefox.exe (PID: 1292)
      • firefox.exe (PID: 3912)
      • firefox.exe (PID: 1404)
      • firefox.exe (PID: 2508)
      • firefox.exe (PID: 3456)
      • firefox.exe (PID: 2560)
      • firefox.exe (PID: 2252)
      • firefox.exe (PID: 3628)
      • firefox.exe (PID: 2712)
      • firefox.exe (PID: 3988)
      • firefox.exe (PID: 2140)
      • firefox.exe (PID: 3876)
      • firefox.exe (PID: 2508)
      • firefox.exe (PID: 3564)
      • firefox.exe (PID: 1800)
      • firefox.exe (PID: 3244)
      • firefox.exe (PID: 3576)
      • firefox.exe (PID: 2952)
      • firefox.exe (PID: 3160)
      • firefox.exe (PID: 3696)
      • firefox.exe (PID: 1968)
      • firefox.exe (PID: 2608)
      • firefox.exe (PID: 1548)
      • firefox.exe (PID: 2892)
      • firefox.exe (PID: 4092)

    • Reads the computer name

      • AcroRd32.exe (PID: 1324)
      • AcroRd32.exe (PID: 1304)
      • RdrCEF.exe (PID: 3720)
      • firefox.exe (PID: 276)
      • firefox.exe (PID: 3544)
      • firefox.exe (PID: 3068)
      • firefox.exe (PID: 1292)
      • firefox.exe (PID: 3428)
      • firefox.exe (PID: 2972)
      • firefox.exe (PID: 1404)
      • firefox.exe (PID: 2508)
      • firefox.exe (PID: 3456)
      • firefox.exe (PID: 2560)
      • firefox.exe (PID: 3628)
      • firefox.exe (PID: 3988)
      • firefox.exe (PID: 2712)
      • firefox.exe (PID: 2140)
      • firefox.exe (PID: 2508)
      • firefox.exe (PID: 3564)
      • firefox.exe (PID: 1800)
      • firefox.exe (PID: 3244)
      • firefox.exe (PID: 3576)
      • firefox.exe (PID: 2952)
      • firefox.exe (PID: 2252)
      • firefox.exe (PID: 3696)
      • firefox.exe (PID: 2608)
      • firefox.exe (PID: 1548)
      • firefox.exe (PID: 4092)
      • firefox.exe (PID: 2892)
      • firefox.exe (PID: 1968)

    • Application launched itself

      • AcroRd32.exe (PID: 1324)
      • RdrCEF.exe (PID: 3720)
      • firefox.exe (PID: 2492)
      • firefox.exe (PID: 3544)
      • firefox.exe (PID: 1404)
      • firefox.exe (PID: 3912)
      • firefox.exe (PID: 3876)
      • firefox.exe (PID: 2140)
      • firefox.exe (PID: 3696)
      • firefox.exe (PID: 3160)

    • Reads CPU info

      • AcroRd32.exe (PID: 1304)
      • firefox.exe (PID: 3544)
      • firefox.exe (PID: 1404)
      • firefox.exe (PID: 2140)
      • firefox.exe (PID: 3696)

    • Searches for installed software

      • AcroRd32.exe (PID: 1304)
      • AcroRd32.exe (PID: 1324)

    • Reads settings of System Certificates

      • AcroRd32.exe (PID: 1324)
      • RdrCEF.exe (PID: 3720)
      • pingsender.exe (PID: 2212)
      • pingsender.exe (PID: 1864)
      • AdobeARM.exe (PID: 3264)
      • pingsender.exe (PID: 760)
      • pingsender.exe (PID: 2728)
      • pingsender.exe (PID: 3712)
      • pingsender.exe (PID: 3644)
      • pingsender.exe (PID: 3708)
      • pingsender.exe (PID: 1004)

    • Checks Windows Trust Settings

      • AcroRd32.exe (PID: 1324)
      • pingsender.exe (PID: 2212)
      • pingsender.exe (PID: 1864)
      • AdobeARM.exe (PID: 3264)
      • pingsender.exe (PID: 2728)
      • pingsender.exe (PID: 3712)
      • pingsender.exe (PID: 760)
      • pingsender.exe (PID: 3644)
      • pingsender.exe (PID: 3708)
      • pingsender.exe (PID: 1004)

    • Reads the hosts file

      • RdrCEF.exe (PID: 3720)

    • Manual execution by user

      • firefox.exe (PID: 2492)
      • firefox.exe (PID: 3876)

    • Creates files in the user directory

      • firefox.exe (PID: 3544)
      • firefox.exe (PID: 1404)
      • firefox.exe (PID: 2140)
      • firefox.exe (PID: 3696)

    • Creates files in the program directory

      • firefox.exe (PID: 3544)
      • firefox.exe (PID: 1404)
      • firefox.exe (PID: 2140)
      • firefox.exe (PID: 3696)

    • Reads the date of Windows installation

      • firefox.exe (PID: 3544)
      • firefox.exe (PID: 1404)
      • firefox.exe (PID: 2140)
      • firefox.exe (PID: 3696)

    • Dropped object may contain Bitcoin addresses

      • firefox.exe (PID: 1404)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.pdf | Adobe Portable Document Format (100)

EXIF

XMP

Marked:
InstanceID: 36cda9d6-2384-4d85-b73f-c225e147cbc8
DocumentID: eec9757d-ee0b-451f-91a9-0608dfbe2cca
CreatorTool: Inkscape
CreateDate: 2020:02:13 09:55:03
Producer: Inkscape
Title: Božanstvena komedija cijela knjiga pdf
Subject: Božanstvena komedija cijela knjiga pdf. https://dereta.rs/a.aspx?autor_uid=2791ab40-d633-4f85-bd81-da90e858f04d Thank you for interestin
Description: Božanstvena komedija cijela knjiga pdf. https://dereta.rs/a.aspx?autor_uid=2791ab40-d633-4f85-bd81-da90e858f04d Thank you for interestin
Creator: Sotacebu Silefa
Format: application/pdf
XMPToolkit: Inkscape

PDF

PageCount: 4
Subject: Božanstvena komedija cijela knjiga pdf. https://dereta.rs/a.aspx?autor_uid=2791ab40-d633-4f85-bd81-da90e858f04d Thank you for interestin
Author: Sotacebu Silefa
CreateDate: 2020:02:13 09:55:03
Producer: Inkscape
Creator: Inkscape
Title: Božanstvena komedija cijela knjiga pdf
Linearized: No
PDFVersion: 1.4
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
100
Monitored processes
53
Malicious processes
1
Suspicious processes
9

Behavior graph

Click at the process to see the details
start acrord32.exe acrord32.exe no specs rdrcef.exe rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs searchprotocolhost.exe no specs adobearm.exe reader_sl.exe no specs pingsender.exe pingsender.exe firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs helper.exe pingsender.exe pingsender.exe pingsender.exe firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs pingsender.exe pingsender.exe pingsender.exe

Process information

PID
CMD
Path
Indicators
Parent process
276"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3544.0.1639548679\1343125575" -parentBuildID 20201112153044 -prefsHandle 1128 -prefMapHandle 1112 -prefsLen 1 -prefMapSize 238726 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3544 "\\.\pipe\gecko-crash-server-pipe.3544" 1244 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
1
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
760"C:\Program Files\Mozilla Firefox\pingsender.exe" https://incoming.telemetry.mozilla.org/submit/telemetry/67e607c0-86ed-4a75-98f4-6462f73409d3/main/Firefox/83.0/release/20201112153044?v=4 C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\xcq0n7ip.default-1643039611044\saved-telemetry-pings\67e607c0-86ed-4a75-98f4-6462f73409d3C:\Program Files\Mozilla Firefox\pingsender.exe
firefox.exe
User:
admin
Company:
Mozilla Foundation
Integrity Level:
MEDIUM
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\pingsender.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
880"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --field-trial-handle=1072,12114310001360454744,16838138385981954358,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --service-request-channel-token=612659250271828516 --mojo-platform-channel-handle=1220 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
1
Version:
20.13.20064.405839
Modules
Images
c:\program files\adobe\acrobat reader dc\reader\acrocef\rdrcef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1004"C:\Program Files\Mozilla Firefox\pingsender.exe" https://incoming.telemetry.mozilla.org/submit/telemetry/be3a3059-f4f0-47f1-9198-992d8aad4dc8/main/Firefox/83.0/release/20201112153044?v=4 C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\xcq0n7ip.default-1643039611044\saved-telemetry-pings\be3a3059-f4f0-47f1-9198-992d8aad4dc8C:\Program Files\Mozilla Firefox\pingsender.exe
firefox.exe
User:
admin
Company:
Mozilla Foundation
Integrity Level:
MEDIUM
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\pingsender.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
1292"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3544.20.651968369\820754096" -childID 3 -isForBrowser -prefsHandle 3520 -prefMapHandle 3516 -prefsLen 7399 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3544 "\\.\pipe\gecko-crash-server-pipe.3544" 3532 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msasn1.dll
1304"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer "C:\Users\admin\Downloads\cb7c86b23fe81bcf2a8fedf7273fe0d7.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat Reader DC
Exit code:
1
Version:
20.13.20064.405839
Modules
Images
c:\program files\adobe\acrobat reader dc\reader\acrord32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1324"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\Downloads\cb7c86b23fe81bcf2a8fedf7273fe0d7.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Explorer.EXE
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat Reader DC
Exit code:
1
Version:
20.13.20064.405839
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\adobe\acrobat reader dc\reader\acrord32.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1404"C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msasn1.dll
1444"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1072,12114310001360454744,16838138385981954358,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-gpu-compositing --lang=en-US --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4818284746225099426 --renderer-client-id=6 --mojo-platform-channel-handle=1536 --allow-no-sandbox-job /prefetch:1C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
0
Version:
20.13.20064.405839
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\adobe\acrobat reader dc\reader\acrocef\rdrcef.exe
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
1548"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3696.13.402568230\1630309819" -childID 2 -isForBrowser -prefsHandle 2980 -prefMapHandle 2952 -prefsLen 6615 -prefMapSize 234157 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3696 "\\.\pipe\gecko-crash-server-pipe.3696" 3008 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msasn1.dll
Total events
77 662
Read events
76 936
Write events
707
Delete events
19

Modification events

(PID) Process:(1304) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\ExitSection
Operation:writeName:bLastExitNormal
Value:
0
(PID) Process:(1304) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\AVGeneral
Operation:writeName:iNumReaderLaunches
Value:
2
(PID) Process:(1304) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\FTEDialog
Operation:writeName:bShowUpdateFTE
Value:
1
(PID) Process:(1304) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\HomeWelcome
Operation:writeName:bIsAcrobatUpdated
Value:
1
(PID) Process:(1304) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\HomeWelcomeFirstMileReader
Operation:writeName:iCardCountShown
Value:
2
(PID) Process:(1304) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\FTEDialog
Operation:delete valueName:iLastCardShown
Value:
0
(PID) Process:(1324) AcroRd32.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1304) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\SessionManagement
Operation:writeName:bNormalExit
Value:
0
(PID) Process:(1304) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\SessionManagement\cWindowsCurrent\cWin0\cTab0\cPathInfo
Operation:writeName:sDI
Value:
2F432F55736572732F61646D696E2F446F776E6C6F6164732F63623763383662323366653831626366326138666564663732373366653064372E70646600
(PID) Process:(1304) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\SessionManagement\cWindowsCurrent\cWin0\cTab0\cPathInfo
Operation:writeName:tDIText
Value:
/C/Users/admin/Downloads/cb7c86b23fe81bcf2a8fedf7273fe0d7.pdf
Executable files
6
Suspicious files
544
Text files
197
Unknown types
158

Dropped files

PID
Process
Filename
Type
3720RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0binary
MD5:—
SHA256:—
3720RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\72d9f526d2e2e7c8_0binary
MD5:—
SHA256:—
3720RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f941376b2efdd6e6_0binary
MD5:—
SHA256:—
3720RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0binary
MD5:—
SHA256:—
3720RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0binary
MD5:—
SHA256:—
3720RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0binary
MD5:—
SHA256:—
3720RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0binary
MD5:—
SHA256:—
3720RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0binary
MD5:—
SHA256:—
3720RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0binary
MD5:—
SHA256:—
3720RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0binary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
30
TCP/UDP connections
102
DNS requests
137
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2140
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3544
firefox.exe
POST
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3
US
der
472 b
whitelisted
1404
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3544
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
1404
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
1404
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
1324
AcroRd32.exe
GET
—
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
—
—
whitelisted
3544
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
1324
AcroRd32.exe
GET
200
23.32.238.178:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?201d6a80b99b0be9
US
compressed
4.70 Kb
whitelisted
2140
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt
US
text
8 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3720
RdrCEF.exe
23.22.254.206:443
p13n.adobe.io
Amazon.com, Inc.
US
suspicious
3720
RdrCEF.exe
104.108.144.144:443
geo2.adobe.com
TOT Public Company Limited
US
unknown
3544
firefox.exe
35.163.112.241:443
location.services.mozilla.com
Amazon.com, Inc.
US
unknown
3544
firefox.exe
34.107.221.82:80
detectportal.firefox.com
—
US
whitelisted
3544
firefox.exe
54.244.16.100:443
push.services.mozilla.com
Amazon.com, Inc.
US
unknown
3544
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3544
firefox.exe
172.217.18.106:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
3544
firefox.exe
143.204.215.75:443
firefox.settings.services.mozilla.com
—
US
suspicious
3544
firefox.exe
142.250.185.163:80
ocsp.pki.goog
Google Inc.
US
whitelisted
3544
firefox.exe
143.204.215.44:443
content-signature-2.cdn.mozilla.net
—
US
malicious

DNS requests

Domain
IP
Reputation
geo2.adobe.com
  • 104.108.144.144
whitelisted
p13n.adobe.io
  • 23.22.254.206
  • 54.227.187.23
  • 52.202.204.11
  • 52.5.13.197
whitelisted
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
example.org
  • 93.184.216.34
whitelisted
ipv4only.arpa
  • 192.0.0.171
  • 192.0.0.170
whitelisted
firefox.settings.services.mozilla.com
  • 143.204.215.75
  • 143.204.215.126
  • 143.204.215.37
  • 143.204.215.95
whitelisted
location.services.mozilla.com
  • 35.163.112.241
  • 34.215.15.15
  • 52.89.115.53
  • 52.89.132.147
  • 54.187.205.23
  • 35.82.27.113
whitelisted
locprod2-elb-us-west-2.prod.mozaws.net
  • 35.82.27.113
  • 54.187.205.23
  • 52.89.132.147
  • 52.89.115.53
  • 34.215.15.15
  • 35.163.112.241
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

PID
Process
Class
Message
3544
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3544
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
1404
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
1404
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
2140
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
2140
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3696
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3696
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
cb7c86b23fe81bcf2a8fedf7273fe0d7.pdf