Edit tour

Windows Analysis Report
Acrobat_Set-Up.exe

Overview

General Information

Sample name:	Acrobat_Set-Up.exe
Analysis ID:	1408868
MD5:	8d7d40664e5e9fc996304fda10ae7711
SHA1:	0b2c3803d9343b9728111281c16bcb6cc9770b51
SHA256:	3525e47b1e0f59a161a95093ab177f641b075073790ad908dc0b540ac71dc260
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Downloads suspicious files via Chrome

Query firmware table information (likely to detect VMs)

Creates a process in suspended mode (likely to inject code)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries keyboard layouts

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Suspicious Execution From GUID Like Folder Names

Tries to load missing DLLs

Uses 32bit PE files

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64_ra

Acrobat_Set-Up.exe (PID: 2012 cmdline: C:\Users\user\Desktop\Acrobat_Set-Up.exe MD5: 8D7D40664E5E9FC996304FDA10AE7711)

msedgewebview2.exe (PID: 408 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Acrobat_Set-Up.exe --webview-exe-version=2.12.0.23 --user-data-dir="C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2012.6436.7181158753740944932 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 5388 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7fff284b8e88,0x7fff284b8e98,0x7fff284b8ea8 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 6924 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView" --webview-exe-name=Acrobat_Set-Up.exe --webview-exe-version=2.12.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1728 --field-trial-handle=1772,i,11516986330360833211,8951212453920135853,262144 --enable-features=MojoIpcz /prefetch:2 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 6876 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView" --webview-exe-name=Acrobat_Set-Up.exe --webview-exe-version=2.12.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=1728 --field-trial-handle=1772,i,11516986330360833211,8951212453920135853,262144 --enable-features=MojoIpcz /prefetch:3 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 5612 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView" --webview-exe-name=Acrobat_Set-Up.exe --webview-exe-version=2.12.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2352 --field-trial-handle=1772,i,11516986330360833211,8951212453920135853,262144 --enable-features=MojoIpcz /prefetch:8 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 7284 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView" --webview-exe-name=Acrobat_Set-Up.exe --webview-exe-version=2.12.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1710407052292660 --launch-time-ticks=5373013704 --mojo-platform-channel-handle=3436 --field-trial-handle=1772,i,11516986330360833211,8951212453920135853,262144 --enable-features=MojoIpcz /prefetch:1 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 6492 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Acrobat_Set-Up.exe --webview-exe-version=2.12.0.23 --user-data-dir="C:\Users\user\AppData\Local\Temp\{D203A074-44CF-40A3-AB92-7019F99D2AE5}\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2012.6436.11210826955497310688 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 3860 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\Temp\{D203A074-44CF-40A3-AB92-7019F99D2AE5}\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\Temp\{D203A074-44CF-40A3-AB92-7019F99D2AE5}\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x174,0x178,0x17c,0x134,0x180,0x7fff284b8e88,0x7fff284b8e98,0x7fff284b8ea8 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 6916 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Temp\{D203A074-44CF-40A3-AB92-7019F99D2AE5}\EBWebView" --webview-exe-name=Acrobat_Set-Up.exe --webview-exe-version=2.12.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1768 --field-trial-handle=1784,i,16217667153113628476,13801749321451562027,262144 --enable-features=MojoIpcz /prefetch:2 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 7036 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Temp\{D203A074-44CF-40A3-AB92-7019F99D2AE5}\EBWebView" --webview-exe-name=Acrobat_Set-Up.exe --webview-exe-version=2.12.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=1668 --field-trial-handle=1784,i,16217667153113628476,13801749321451562027,262144 --enable-features=MojoIpcz /prefetch:3 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 4872 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Temp\{D203A074-44CF-40A3-AB92-7019F99D2AE5}\EBWebView" --webview-exe-name=Acrobat_Set-Up.exe --webview-exe-version=2.12.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=1668 --field-trial-handle=1784,i,16217667153113628476,13801749321451562027,262144 --enable-features=MojoIpcz /prefetch:8 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 7296 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Temp\{D203A074-44CF-40A3-AB92-7019F99D2AE5}\EBWebView" --webview-exe-name=Acrobat_Set-Up.exe --webview-exe-version=2.12.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1710407052289267 --launch-time-ticks=5373023488 --mojo-platform-channel-handle=3388 --field-trial-handle=1784,i,16217667153113628476,13801749321451562027,262144 --enable-features=MojoIpcz /prefetch:1 MD5: 9909D978B39FB7369F511D8506C17CA0)

cmd.exe (PID: 876 cmdline: C:\Windows\System32\cmd.exe" /C start microsoft-edge:"https://ims-na1.adobelogin.com/ims/authorize?client_id=CreativeCloudInstallerWeb_v1_0&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&locale=en_US&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3Db03c1725-36bb-4637-a794-afe3afd3d30b%26client_id%3DCreativeCloudInstallerWeb_v1_0%26deeplink%3Ddelegation&dctx_id=v:2,s,bg:kaizen,0f006db0-9d68-11ee-ac84-4fb64a02ffee MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msedge.exe (PID: 8092 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://ims-na1.adobelogin.com/ims/authorize?client_id=CreativeCloudInstallerWeb_v1_0&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&locale=en_US&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3Db03c1725-36bb-4637-a794-afe3afd3d30b%26client_id%3DCreativeCloudInstallerWeb_v1_0%26deeplink%3Ddelegation&dctx_id=v:2,s,bg:kaizen,0f006db0-9d68-11ee-ac84-4fb64a02ffee MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 756 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=1992,i,16464347968842645331,5301158859442629810,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3912 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate --single-argument microsoft-edge:https://ims-na1.adobelogin.com/ims/authorize?client_id=CreativeCloudInstallerWeb_v1_0&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&locale=en_US&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3Db03c1725-36bb-4637-a794-afe3afd3d30b%26client_id%3DCreativeCloudInstallerWeb_v1_0%26deeplink%3Ddelegation&dctx_id=v:2,s,bg:kaizen,0f006db0-9d68-11ee-ac84-4fb64a02ffee MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3492 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2008,i,14748627208075227203,11121797941367171544,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4808 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6608 --field-trial-handle=2008,i,14748627208075227203,11121797941367171544,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8152 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6924 --field-trial-handle=2008,i,14748627208075227203,11121797941367171544,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Sigma Signatures

System Summary

Sigma detected: Suspicious Execution From GUID Like Folder Names

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Acrobat_Set-Up.exe --webview-exe-version=2.12.0.23 --user-data-dir="C:\Users\user\AppData\Local\Temp\{D203A074-44CF-40A3-AB92-7019F99D2AE5}\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2012.6436.11210826955497310688, CommandLine: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Acrobat_Set-Up.exe --webview-exe-version=2.12.0.23 --user-data-dir="C:\Users\user\AppData\Local\Temp\{D203A074-44CF-40A3-AB92-7019F99D2AE5}\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2012.6436.11210826955497310688, CommandLine|base64offset|contains: )^, Image: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe, NewProcessName: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe, OriginalFileName: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe, ParentCommandLine: C:\Users\user\Desktop\Acrobat_Set-Up.exe, ParentImage: C:\Users\user\Desktop\Acrobat_Set-Up.exe, ParentProcessId: 2012, ParentProcessName: Acrobat_Set-Up.exe, ProcessCommandLine: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Acrobat_Set-Up.exe --webview-exe-version=2.12.0.23 --user-data-dir="C:\Users\user\AppData\Local\Temp\{D203A074-44CF-40A3-AB92-7019F99D2AE5}\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2012.6436.11210826955497310688, ProcessId: 6492, ProcessName: msedgewebview2.exe

Source: unknown	HTTPS traffic detected: 108.139.29.98:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.139.29.98:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.164.124.172:443 -> 192.168.2.16:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.164.124.172:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.164.124.172:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.164.124.172:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.211.174.17:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.24.84:443 -> 192.168.2.16:49747 version: TLS 1.2

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Local State
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\Local\
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\Local\Adobe\
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\68238525-71ed-4ccf-a81e-351aea99d4f5.tmp
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\

Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	TCP traffic detected without corresponding DNS query: 13.225.63.17
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File dump: C:\Users\user\AppData\Local\Temp\scoped_dir3912_427663208\CRX_INSTALL\eventpage_bin_prod.js	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File dump: C:\Users\user\AppData\Local\Temp\scoped_dir3912_427663208\CRX_INSTALL\page_embed_script.js	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File dump: C:\Users\user\AppData\Local\Temp\scoped_dir3912_386857987\CRX_INSTALL\content.js	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File dump: C:\Users\user\AppData\Local\Temp\scoped_dir3912_386857987\CRX_INSTALL\content_new.js	Jump to dropped file

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5076:120:WilError_03

Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe	Window / User API: threadDelayed 872
Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe	Window / User API: threadDelayed 1653
Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe	Window / User API: threadDelayed 6093

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851

Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe TID: 7964	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe TID: 7888	Thread sleep time: -43600s >= -30000s
Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe TID: 7952	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe TID: 7924	Thread sleep time: -113000s >= -30000s
Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe TID: 7952	Thread sleep time: -90000s >= -30000s
Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe TID: 7924	Thread sleep time: -37500s >= -30000s
Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe TID: 7888	Thread sleep time: -82650s >= -30000s
Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe TID: 7888	Thread sleep time: -304650s >= -30000s

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Default\Code Cache\wasm FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Default\Code Cache\js FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{D203A074-44CF-40A3-AB92-7019F99D2AE5}\EBWebView\Default\Code Cache\js FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{D203A074-44CF-40A3-AB92-7019F99D2AE5}\EBWebView\Default\Code Cache\wasm FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Default\blob_storage\ad23257b-0811-42db-9dd7-636bf19651be FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Default\Cache\Cache_Data FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{D203A074-44CF-40A3-AB92-7019F99D2AE5}\EBWebView\Default\Cache\Cache_Data FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{D203A074-44CF-40A3-AB92-7019F99D2AE5}\EBWebView\Default\blob_storage\ed7bb900-183a-40a9-8949-2d1e27389cb4 FullSizeInformation

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7fff284b8e88,0x7fff284b8e98,0x7fff284b8ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView" --webview-exe-name=Acrobat_Set-Up.exe --webview-exe-version=2.12.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1728 --field-trial-handle=1772,i,11516986330360833211,8951212453920135853,262144 --enable-features=MojoIpcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView" --webview-exe-name=Acrobat_Set-Up.exe --webview-exe-version=2.12.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=1728 --field-trial-handle=1772,i,11516986330360833211,8951212453920135853,262144 --enable-features=MojoIpcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView" --webview-exe-name=Acrobat_Set-Up.exe --webview-exe-version=2.12.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2352 --field-trial-handle=1772,i,11516986330360833211,8951212453920135853,262144 --enable-features=MojoIpcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView" --webview-exe-name=Acrobat_Set-Up.exe --webview-exe-version=2.12.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1710407052292660 --launch-time-ticks=5373013704 --mojo-platform-channel-handle=3436 --field-trial-handle=1772,i,11516986330360833211,8951212453920135853,262144 --enable-features=MojoIpcz /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\Temp\{D203A074-44CF-40A3-AB92-7019F99D2AE5}\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\Temp\{D203A074-44CF-40A3-AB92-7019F99D2AE5}\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x174,0x178,0x17c,0x134,0x180,0x7fff284b8e88,0x7fff284b8e98,0x7fff284b8ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Temp\{D203A074-44CF-40A3-AB92-7019F99D2AE5}\EBWebView" --webview-exe-name=Acrobat_Set-Up.exe --webview-exe-version=2.12.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1768 --field-trial-handle=1784,i,16217667153113628476,13801749321451562027,262144 --enable-features=MojoIpcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Temp\{D203A074-44CF-40A3-AB92-7019F99D2AE5}\EBWebView" --webview-exe-name=Acrobat_Set-Up.exe --webview-exe-version=2.12.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=1668 --field-trial-handle=1784,i,16217667153113628476,13801749321451562027,262144 --enable-features=MojoIpcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Temp\{D203A074-44CF-40A3-AB92-7019F99D2AE5}\EBWebView" --webview-exe-name=Acrobat_Set-Up.exe --webview-exe-version=2.12.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=1668 --field-trial-handle=1784,i,16217667153113628476,13801749321451562027,262144 --enable-features=MojoIpcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Temp\{D203A074-44CF-40A3-AB92-7019F99D2AE5}\EBWebView" --webview-exe-name=Acrobat_Set-Up.exe --webview-exe-version=2.12.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1710407052289267 --launch-time-ticks=5373023488 --mojo-platform-channel-handle=3388 --field-trial-handle=1784,i,16217667153113628476,13801749321451562027,262144 --enable-features=MojoIpcz /prefetch:1
Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe" /C start microsoft-edge:"https://ims-na1.adobelogin.com/ims/authorize?client_id=CreativeCloudInstallerWeb_v1_0&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&locale=en_US&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3Db03c1725-36bb-4637-a794-afe3afd3d30b%26client_id%3DCreativeCloudInstallerWeb_v1_0%26deeplink%3Ddelegation&dctx_id=v:2,s,bg:kaizen,0f006db0-9d68-11ee-ac84-4fb64a02ffee
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://ims-na1.adobelogin.com/ims/authorize?client_id=CreativeCloudInstallerWeb_v1_0&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&locale=en_US&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3Db03c1725-36bb-4637-a794-afe3afd3d30b%26client_id%3DCreativeCloudInstallerWeb_v1_0%26deeplink%3Ddelegation&dctx_id=v:2,s,bg:kaizen,0f006db0-9d68-11ee-ac84-4fb64a02ffee

Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\Acrobat_Set-Up.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\CreativeCloud\ACC\WAM.log VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\Trust Protection Lists\manifest.json VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\WidevineCdm\manifest.json VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\Trust Protection Lists\manifest.json VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\WidevineCdm\manifest.json VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\MEIPreload\preloaded_data.pb VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Default\Network\SCT Auditing Pending Reports VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{D203A074-44CF-40A3-AB92-7019F99D2AE5}\EBWebView\Default\Network\SCT Auditing Pending Reports VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\MEIPreload\preloaded_data.pb VolumeInformation

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	21 Windows Management Instrumentation	1 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	13 Security Software Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	14 Virtualization/Sandbox Evasion	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Modify Registry	Security Account Manager	14 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	55 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Source	Detection	Scanner	Link
chrome.cloudflare-dns.com	0%	Virustotal	Browse
part-0012.t-0009.t-msedge.net	0%	Virustotal	Browse
sni1gl.wpc.nucdn.net	0%	Virustotal	Browse
bzib.nelreports.net	0%	Virustotal	Browse
adobe.com.ssl.d1.sc.omtrdc.net	0%	Virustotal	Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com	18.213.136.10	true	false		high
chrome.cloudflare-dns.com	162.159.61.3	true	false	0%, Virustotal, Browse	unknown
adobe.com.ssl.d1.sc.omtrdc.net	63.140.38.217	true	false	0%, Virustotal, Browse	unknown
part-0012.t-0009.t-msedge.net	13.107.213.40	true	false	0%, Virustotal, Browse	unknown
d1n897799gitxr.cloudfront.net	108.139.29.98	true	false		high
resources-prod.licensingstack.com	18.164.124.172	true	false		high
googlehosted.l.googleusercontent.com	142.250.65.161	true	false		high
ethos502-prod-va6-k8s-p2-0-7ccfc4a2a823108f.elb.us-east-1.amazonaws.com	3.211.174.17	true	false		high
sni1gl.wpc.nucdn.net	152.195.19.97	true	false	0%, Virustotal, Browse	unknown
clients2.googleusercontent.com	unknown	unknown	false		high
delegated.adobelogin.com	unknown	unknown	false		high
bzib.nelreports.net	unknown	unknown	false	0%, Virustotal, Browse	unknown
use.typekit.net	unknown	unknown	false		high
p.typekit.net	unknown	unknown	false		high
ims-na1.adobelogin.com	unknown	unknown	false		high
dpm.demdex.net	unknown	unknown	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.6.158	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.213.136.10	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.200	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.80.110	unknown	United States	15169	GOOGLEUS	false
142.250.65.161	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
151.101.193.108	unknown	United States	54113	FASTLYUS	false
152.195.19.97	sni1gl.wpc.nucdn.net	United States	15133	EDGECASTUS	false
3.231.61.153	unknown	United States	14618	AMAZON-AESUS	false
23.51.57.215	unknown	United States	4788	TMNET-AS-APTMNetInternetServiceProviderMY	false
23.200.3.19	unknown	United States	20940	AKAMAI-ASN1EU	false
23.204.152.149	unknown	United States	20940	AKAMAI-ASN1EU	false
52.22.41.97	unknown	United States	14618	AMAZON-AESUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.40.179.37	unknown	United States	16625	AKAMAI-ASUS	false
23.204.152.140	unknown	United States	20940	AKAMAI-ASN1EU	false
104.18.32.77	unknown	United States	13335	CLOUDFLARENETUS	false
23.204.152.142	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.213.40	part-0012.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.189.173.18	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.237.241.83	unknown	United States	14618	AMAZON-AESUS	false
204.79.197.239	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
157.240.241.1	unknown	United States	32934	FACEBOOKUS	false
63.140.38.217	adobe.com.ssl.d1.sc.omtrdc.net	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
3.211.174.17	ethos502-prod-va6-k8s-p2-0-7ccfc4a2a823108f.elb.us-east-1.amazonaws.com	United States	14618	AMAZON-AESUS	false
13.107.5.80	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.47.169.232	unknown	United States	16625	AKAMAI-ASUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
20.94.153.70	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.21.239	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.225.63.17	unknown	United States	16509	AMAZON-02US	false
63.140.38.210	unknown	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
172.64.155.179	unknown	United States	13335	CLOUDFLARENETUS	false
20.125.219.220	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.42.16	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.164.124.172	resources-prod.licensingstack.com	United States	3	MIT-GATEWAYSUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
108.139.29.98	d1n897799gitxr.cloudfront.net	United States	16509	AMAZON-02US	false
20.96.153.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.183.229.37	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
44.209.177.127	unknown	United States	14618	AMAZON-AESUS	false
23.204.152.170	unknown	United States	20940	AKAMAI-ASN1EU	false
18.213.11.84	unknown	United States	14618	AMAZON-AESUS	false
18.211.200.223	unknown	United States	14618	AMAZON-AESUS	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Acrobat_Set-Up.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Bitcoin Miner

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\Local\Adobe\OOBE\temp_lbs_wid

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\37492dbe-4212-494b-be03-e3d30973825d.tmp

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\5d4b13bb-c711-4086-8285-c13f7d538450.tmp

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\67870f04-13bb-4eb1-a7c1-b8cb921a0cf3.tmp

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\68238525-71ed-4ccf-a81e-351aea99d4f5.tmp

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\6b0eeb33-e2b7-4295-9db8-09ec793f0b72.tmp

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\9780289e-88fb-45f6-ab90-3ed184c9e853.tmp

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\BrowserMetrics-spare.pma.tmp

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\BrowserMetrics\BrowserMetrics-65F2D287-198.pma

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Crashpad\settings.dat

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Crashpad\throttle_store.dat

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Default\6849885c-61a3-4aab-ad5f-fe30c06c3239.tmp

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Default\708ec0cb-30aa-4e3a-be88-00781835a98a.tmp

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Default\8accba9f-9a74-4a2c-b7e1-1581cfac43d9.tmp

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Default\9fe2fe20-3844-431a-8ea2-5d1f4e870778.tmp

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Default\AssistanceHome\AssistanceHomeSQLite

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Default\Cache\Cache_Data\data_0

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Default\Cache\Cache_Data\data_1

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Default\Cache\Cache_Data\data_2

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Default\Cache\Cache_Data\f_000001

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Default\Cache\Cache_Data\f_000002

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Default\Cache\Cache_Data\index

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Default\Code Cache\js\index-dir\temp-index

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index (copy)

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Default\Code Cache\wasm\index-dir\temp-index

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index (copy)

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Default\DIPS

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Default\DawnCache\data_3

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Default\DawnCache\index

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Default\Extension Rules\000003.log

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Default\Extension Rules\LOG

C:\Users\user\AppData\Local\Adobe\webview2\Acrobat_Set-Up.exe\EBWebView\Default\Extension Scripts\LOG

Windows Analysis Report
Acrobat_Set-Up.exe

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1408868
Start date and time:	2024-03-14 11:33:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	Acrobat_Set-Up.exe
Detection:	MAL
Classification:	mal56.evad.winEXE@87/319@29/80
Cookbook Comments:	Found application associated with file extension: .exe

Process:	C:\Users\user\Desktop\Acrobat_Set-Up.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	38
Entropy (8bit):	3.674916000001024
Encrypted:	false
SSDEEP:
MD5:	9C30A3CE71A5AAAE4FE5954419236642
SHA1:	AA92387B47BFB584CF0BB127286B400F2A9AED43
SHA-256:	36A91D758EDEE27D9F79EDACAA681D7B41C9230BC1F74C946F2AE7EC7551500D
SHA-512:	4E4D2D1748B18B5213A8A4E49F001A2C23581AD52033D345579023F985A04CB70CC41E213C8B5A71D213D2637F929BA8258DA12869794B2F5A2FB6D0939831B5
Malicious:	false
Reputation:	unknown
Preview:	{E43DB969-5496-4169-A1D9-C50E9AAA00D4}

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	18035
Entropy (8bit):	6.066782834506118
Encrypted:	false
SSDEEP:
MD5:	B0A234F9D341813431C3FD7CDD031FDC
SHA1:	877B13A3A1F968C5237F91E58BECAB29BEBB3ED4
SHA-256:	C733AE5B4AA683AF883730F83B872AF4BA303C01A643D0621A1EB1F5110D9702
SHA-512:	C07217AD3934BC45BF04720E14D828FCBEB4A801F45D3FC2C77989F728D84C9BF159A08594C5F26C12B06B618B5B25C23E791D3903F2AFDE17D8B9EBC273DEE6
Malicious:	false
Reputation:	unknown
Preview:	{"domain_actions_config":"H4sIAAAAAAAAAL19a3PktrH2X1HpU5LyQNLe5M355HeziV3Jxi5nU656T6VUIIghIYIAF5eZ4bj83083ONJKOwRmmutzPngtUXxwY6Nv6G78evmdqa1z/N/f/biRzqlaXv7510s+DFoJHpQ1/vLP//2fby4HCw+UxN9+vTS8h9cu39eN/Pd3l99chnHA3wfuguL6ZzloLmQvTYC/bbiO+MfvoEn5i6z+rsLV65e37OWbiz/8/fuPH/7xzYVWnbz4mxSd/ePFu9bZXl7dXrNr9vL1y2/ZzfWLi3/xNXfqAYbdXt3AX25v37y8/O2bx/FM2KcjkvDqR9tJMz+mp+C/2H/a8LgGjy3Uzx4/eR9H8fbt/8rk376Fyb/69tUrdvvqeO7Tn29uXl+z16+Pp/9/Pqa5LwBE9U4r6O97ZYIvf4+jdw8D/PXSS7ES7SryFa/rRHiV4wZ+uvybtY2Wh7Fd/gb0+fldJ3u7Afx/X35Qwllv1yGRzCW8Fb10d7yBzu7sI7kDGWAL8LsHer/8881v31zyzc2dsLUUd2vJQ3TyTrSwHk9QR5vk8EDWd2mvjNDwj0P4MeKa17bnCpq+NDKstdoxYfu0budDfIi1sn5CZjbkI/iw3N9tbt7hJP46zeEdTuHwztGMRd1TZ2f0+H43WC9/0nz8WfJ6fDpur5VpChN9RP8CPW6UkU/BwUYWNkuQPd/Bz5IddisRzSuxeMgbhgi5FK/5LVNhCXK3VkaFcWnHWx5EC6MXtkSXxSZUAwOQ0IazDRDV0mYq2Pgiug225Fu+ZYIvaaaVuMU28BcbnDVLRyMczMkB/YuWGyP10nZM4KFFklz6fex2cNID0/KDjosXd9PuFm6pNuq4tFd4nX2KSnTwUYaljfxF+fY7M25b6WSZAc6ypAM3xEcuPXoisWY7PgAenxwzyyQaaOzye3jzw/p7uRGJJ9NYRwFsQGxKUOKKC3OMP8zx6c

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	53476
Entropy (8bit):	6.102515950606322
Encrypted:	false
SSDEEP:
MD5:	3FEAC080D2D82DA48CAF18C68716C6BC
SHA1:	30204F8789F18EBF0967A834EFAF25EE6601CCFD
SHA-256:	24741ECEB9CFA5B048A4A20FA4D928CDE7C59FD77657732BF5B7A07BD8F101D6
SHA-512:	11FFE4643EB384EF84AD70629DFF67792FF4716B7F0C62E6AE4B19301F8E853965802CC453CFD507056F86F012B66511E293EB92FB3C99ACF0A47A218479000F
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"483AA87BBED748390129C70ED7CAF3443459F6FEE63C9F3C73F4DD9E6BF5D63A\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1710412499"},"domain_actions_config":"H4sIAAAAAAAAAL19a3PktrH2X1HpU5LyQNLe5M355HeziV3Jxi5nU656T6VUIIghIYIAF5eZ4bj83083ONJKOwRmmutzPngtUXxwY6Nv6G78evmdqa1z/N/f/biRzqlaXv7510s+DFoJHpQ1/vLP//2fby4HCw+UxN9+vTS8h9cu39eN/Pd3l99chnHA3wfuguL6ZzloLmQvTYC/bbiO+MfvoEn5i6z+rsLV65e37OWbiz/8/fuPH/7xzYVWnbz4mxSd/ePFu9bZXl7dXrNr9vL1y2/ZzfWLi3/xNXfqAYbdXt3AX25v37y8/O2bx/FM2KcjkvDqR9tJMz+mp+C/2H/a8LgGjy3Uzx4/eR9H8fbt/8rk376Fyb/69tUrdvvqeO7Tn29uXl+z16+Pp/9/Pqa5LwBE9U4r6O97ZYIvf4+jdw8D/PXSS7ES7SryFa/rRHiV4wZ+uvybtY2Wh7Fd/gb0+fldJ3u7Afx/X35Qwllv1yGRzCW8

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.901710468106949
TrID:	Win32 Executable (generic) a (10002005/4) 99.39% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	Acrobat_Set-Up.exe
File size:	3'160'024 bytes
MD5:	8d7d40664e5e9fc996304fda10ae7711
SHA1:	0b2c3803d9343b9728111281c16bcb6cc9770b51
SHA256:	3525e47b1e0f59a161a95093ab177f641b075073790ad908dc0b540ac71dc260
SHA512:	5593843126d3bfa245d45edc9594a45f7ab45e59839344b1972afbc8fe7d7fe76672ab216adc3453b440a919f86025e856a98145fe583308f5851c7e4c8f505f
SSDEEP:	49152:VZnCRw3438x0TVDKNxOafuUYUc9no2IWkAyf1CQ+v5XxCv6PxW:VARw3UJKHOa/Xffs0S5W
TLSH:	BBE5233A0074DF00E06F2636D69362F26923DD58DE6A53CFF2983E9AB07AA40F471157
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........J................<...e.......e.......k.......k.......e.......................................................k.......k.(....

Entrypoint:	0xdb92f0
Entrypoint Section:	UPX1
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x65AE1874 [Mon Jan 22 07:25:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	28a18f58924d2f4dd2bffbbc85a12952

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	03/11/2023 01:00:00 05/11/2025 00:59:59
Subject Chain	CN=Adobe Inc., OU=AAM 256, O=Adobe Inc., L=San Jose, S=ca, C=US, SERIALNUMBER=2748129, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=US
Version:	3
Thumbprint MD5:	27F5C05722CD5478ADEB03BADB1B4103
Thumbprint SHA-1:	02E4107713CE4E95A736D4ACE47926EDED13555C
Thumbprint SHA-256:	1079E99A5160154F92A969871111FECC98F0CD6D4E7BE96ACAE9FBBB5511DB9D
Serial:	098A2F313AB2C29CD42B062A0E467B0C

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9c491c	0xd4	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x9ba000	0xa91c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x300600	0x31d8	UPX0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x9c49f0	0x1c	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x9b94c4	0x18	UPX1
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x9b94ec	0xc0	UPX1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x5e896c	0x2a0	UPX0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x6c3000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x6c4000	0x2f6000	0x2f5600	b42ab35b40044483c5febca80c638c19	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x9ba000	0xb000	0xac00	1e7443f4d0c361d859640c3be79287d9	False	0.16755995639534885	data	3.8153067123035282	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
CSS	0x62f774	0xe572c	empty	English	United States	0
DICTIONARY	0x714ea0	0x9210	data	English	United States	0.993581514762516
DICTIONARY	0x71e0b0	0xaa58	data	English	United States	0.9945422858191157
DICTIONARY	0x728b08	0xb022	data	English	United States	0.990441339543136
DICTIONARY	0x733b2c	0xc273	data	English	United States	0.9912211976938067
DICTIONARY	0x73fda0	0xa5d9	data	English	United States	0.9912146406952917
DICTIONARY	0x74a37c	0x9dde	data	English	United States	0.9924283664076805
DICTIONARY	0x75415c	0xab1c	data	English	United States	0.9921696648707881
DICTIONARY	0x75ec78	0xa26e	data	English	United States	0.9915107498436824
DICTIONARY	0x768ee8	0x8b1f	data	English	United States	0.993289344377369
DICTIONARY	0x771a08	0x8d8e	data	English	United States	0.995557149953088
DICTIONARY	0x77a798	0x9ff7	data	English	United States	0.9950428560963103
DICTIONARY	0x784790	0x9bb4	data	English	United States	0.9962870045158053
DICTIONARY	0x78e344	0xa699	OpenPGP Public Key	English	United States	0.9952636638608173
DICTIONARY	0x7989e0	0xa4b2	DOS executable (COM, 0x8C-variant)	English	United States	0.9949243394525876
DICTIONARY	0x7a2e94	0xe588	data	English	United States	0.9925289312457454
DICTIONARY	0x7b141c	0xa3ff	data	English	United States	0.9928780696948765
DICTIONARY	0x7bb81c	0x9c47	data	English	United States	0.9939010673132201
DICTIONARY	0x7c5464	0x9f5e	data	English	United States	0.9931614294818374
DICTIONARY	0x7cf3c4	0x9d4b	data	English	United States	0.9971192291454541
DICTIONARY	0x7d9110	0xa5db	data	English	United States	0.9970795355519442
DICTIONARY	0x7e36ec	0xb048	data	English	United States	0.9968755539797908
JS	0x7ee734	0x13fbb4	data	English	United States	0.9556398391723633
XML	0x92e2e8	0x2c8	data	English	United States	1.0154494382022472
RT_ICON	0x9ba778	0x1045	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9080432172869147
RT_ICON	0x9bb7c4	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 11811 x 11811 px/m	English	United States	0.03719886632026453
RT_ICON	0x9bf9f0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 11811 x 11811 px/m	English	United States	0.04948132780082987
RT_ICON	0x9c1f9c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 11811 x 11811 px/m	English	United States	0.0799718574108818
RT_ICON	0x9c3048	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 11811 x 11811 px/m	English	United States	0.1069672131147541
RT_ICON	0x9c39d4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 11811 x 11811 px/m	English	United States	0.15602836879432624
RT_GROUP_ICON	0x9c3e40	0x5a	data	English	United States	0.7666666666666667
RT_VERSION	0x9c3ea0	0x304	data	English	United States	0.43523316062176165
RT_HTML	0x937fc0	0x1aa	data	English	United States	1.0258215962441315
RT_MANIFEST	0x9c41a8	0x773	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1847), with CRLF line terminators	English	United States	0.29365495542737285