084dae7b6477a0470ae6c1f10bd019f74463e3f78c9f561abac45eb72719707e

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 23:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
084dae7b6477a0470ae6c1f10bd019f74463e3f78c9f561abac45eb72719707e.pdf
Size 230KB
Sample240225-293jnafb95
SHA256 084dae7b6477a0470ae6c1f10bd019f74463e3f78c9f561abac45eb72719707e
MD5 cf7b311fa4c75630273a0fbc091c2088
SHA1 82798bdfe415f46141e193f47a54c77680de46d2
SHA512 34e46d2c9d01d87e31d3bc590327db0087704a2126fdb8594ecf49c080813e7f395837c73809435ad9bb363efe57fa59d78eac24c826a1e43051c00e858889af
SSDEEP 6144:/TjOl5qG4EssmTreeFUvKfCM2xc1eGkxoQxi:/vYwRWmTpUCf92a1Eni
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\MuiCache	AdobeCollabSync.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3928	AcroRd32.exe
3928	AcroRd32.exe
3928	AcroRd32.exe
3928	AcroRd32.exe
3928	AcroRd32.exe
3928	AcroRd32.exe
3928	AcroRd32.exe
3928	AcroRd32.exe
3928	AcroRd32.exe
3928	AcroRd32.exe
3928	AcroRd32.exe
3928	AcroRd32.exe
3928	AcroRd32.exe
3928	AcroRd32.exe
3928	AcroRd32.exe
3928	AcroRd32.exe
3928	AcroRd32.exe
3928	AcroRd32.exe
3928	AcroRd32.exe
3928	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3928	AcroRd32.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3928	AcroRd32.exe
3928	AcroRd32.exe
3928	AcroRd32.exe
3928	AcroRd32.exe
3928	AcroRd32.exe
3928	AcroRd32.exe
3928	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 2960	3928	AcroRd32.exe	92
PID 3928 wrote to memory of 2960	3928	AcroRd32.exe	92
PID 3928 wrote to memory of 2960	3928	AcroRd32.exe	92
PID 2960 wrote to memory of 1528	2960	AdobeCollabSync.exe	94
PID 2960 wrote to memory of 1528	2960	AdobeCollabSync.exe	94
PID 2960 wrote to memory of 1528	2960	AdobeCollabSync.exe	94
PID 1528 wrote to memory of 3200	1528	AdobeCollabSync.exe	95
PID 1528 wrote to memory of 3200	1528	AdobeCollabSync.exe	95
PID 1528 wrote to memory of 3200	1528	AdobeCollabSync.exe	95
PID 3928 wrote to memory of 2080	3928	AcroRd32.exe	96
PID 3928 wrote to memory of 2080	3928	AcroRd32.exe	96
PID 3928 wrote to memory of 2080	3928	AcroRd32.exe	96
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 1884	2080	RdrCEF.exe	97
PID 2080 wrote to memory of 4328	2080	RdrCEF.exe	98
PID 2080 wrote to memory of 4328	2080	RdrCEF.exe	98
PID 2080 wrote to memory of 4328	2080	RdrCEF.exe	98
PID 2080 wrote to memory of 4328	2080	RdrCEF.exe	98
PID 2080 wrote to memory of 4328	2080	RdrCEF.exe	98
PID 2080 wrote to memory of 4328	2080	RdrCEF.exe	98
PID 2080 wrote to memory of 4328	2080	RdrCEF.exe	98
PID 2080 wrote to memory of 4328	2080	RdrCEF.exe	98
PID 2080 wrote to memory of 4328	2080	RdrCEF.exe	98
PID 2080 wrote to memory of 4328	2080	RdrCEF.exe	98
PID 2080 wrote to memory of 4328	2080	RdrCEF.exe	98

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\084dae7b6477a0470ae6c1f10bd019f74463e3f78c9f561abac45eb72719707e.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c --type=collab-renderer --proc=2960
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1528
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" GetChannelUri
      4⤵
      PID:3200
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=40D83E3863D57201B797A45640626D1F --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1884
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=436F92E46F667EBB0EA6F2F09AFE2A9E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=436F92E46F667EBB0EA6F2F09AFE2A9E --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4328
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=ABCD88B638BE1F27F7851137C62AA65E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=ABCD88B638BE1F27F7851137C62AA65E --renderer-client-id=4 --mojo-platform-channel-handle=2180 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1980
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=245C54DC51CCD963B09F5F620AE96384 --mojo-platform-channel-handle=2572 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4060
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2018A77160911AB2A7BC961BD5884ADE --mojo-platform-channel-handle=1728 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2408
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=96DD93ABA7123FA3FD939B0F983CC0AA --mojo-platform-channel-handle=2776 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 f8cb6eea1d4cbec017bdc54724ccff596f7ddd199f82263fe8880687833f3416
MD5 5bd7ccf527b7179efcfadc84e59603ea
SHA1 f6e33a10a18440590b7f7a878abcf4c912628f96
SHA512 1ebf1065f8e559f230d52cb2c020e7492b69f28230beeb9bda5bdcbd34795e8d556061cf1c00a46ca696cf3526d3e5d9ff6a4a66c8fde6d4b694ccbe7387a91d
SSDEEP 384:yeudThatELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:l+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 87aa4c64348b534771f03919b5bdca09596e89f6e0cca0a992bb3d290ec4155a
MD5 aebe0d2eb7a2077a55e57a955e62406a
SHA1 3f811b8148f12220f4b45699135e6d21c9847d8a
SHA512 efa1b082925a4e478fcea74764bbacb91d43da8c01c4b360a34e6f7402af23f91c93b5e91c6266120e144b5300e8dae73a62a7b6d7c4328410128f6a72a7baed
SSDEEP 192:t+oGsTzoU27NTaUxmYeMb1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:tklNveMbUNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 d7549fb0223d801e4ef85261e653d983ecdd442a4fcb7047f298490e2b7a7b1a
MD5 d2b534884e21158f16c12249252b06dd
SHA1 49555035fcf3f713935a3db5be4ee909e37cf5fe
SHA512 cb13c0a07ae66f2b0ec26c6f383a6bbee0264bfb54ff881c78a7ea63b83922bdb0964e525784a1776582a67b65102bdb6b3f39445a4d2e159ebfed039d17537f
SSDEEP 192:K+oGsTzoU27NTaUxmKX441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklN1X44UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 28c74909b9bf8664b67671088fdad670f60383902e9ee0b06e9080d847441830
MD5 a360fdf87616a2ea00a748034fc0020d
SHA1 db29e8f9e2b172f95e75ea93c1738a5938267222
SHA512 ca9bae00c631b5037b5db6dc36df922f406905eb5d5633ccce253162d7f635e4b36765e0095f2a9b8afffd84871bdc7b167866371da4c869fa58866a4990d965
SSDEEP 192:a+oGsTzoU27NTaUxmGEaOa441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:aklNPEal44UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 a027cf12f2055635a3020f08e0448b2f0314791260ccd25570426088c5b0e307
MD5 245950c48f668cf2fcb3c64778e64089
SHA1 3a5a14c820f58e35a3fc6f5de29669f0840587d8
SHA512 4fc8448536663b551cc716d78715f06d4ed217fbdf755924f0b30aebbb6212798a61c6638f919d5c14bdb6998d6a12f0ca37281f3c7f484c1821fbfc98d4a24d
SSDEEP 192:K+oGsTzoU27NTaUxma1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklN7UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

resource-18

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\resources\resource-18
Size 3.5MB
SHA256 a0c4a82ac8f55627773a23f421a50a033ece9bc8898fa1d4d5b29a8563dba12b
MD5 17b8abba81aa32dc79778a6305717ac0
SHA1 e661e0d2247fd7333bd49391b5d66194e845cc2d
SHA512 df9381f37f77922aee95e18271ae15fb3c1b46146311a593c10c7113ee5dc3c4ecea2fafee0d466e8d352255f80e0baded36ca4c769d780cbf4f1ca086f1d354
SSDEEP 98304:1wmD7n+ZUxlO2VUb/8bWNJpw/pY2MwCs6fS:mmD7n+axsTj8qNmowCs6fS
MD5 SHA1 SHA512 SSDEEP

Submit Download

B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Size 471B
SHA256 d0363e04d3fa9b820291ecdb19d2b33be6dad234547198256e16c6e4bfcc2c27
MD5 5f7275c64e727e9826ba6f0214b9d8e1
SHA1 6c3d9109745b618a4c60c40d5214679e52e87ff6
SHA512 373f0dbe7cc5186f420c6945f8bb029ecbb0947293d393e609664f0d113cf9e4d9d6d304fb2e89d9bfea174a3e77672bc83b703d645a5e0ff409710f7cf8f590
MD5 SHA1 SHA512

Submit Download

B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Size 400B
SHA256 28ab62d014887e3f9a49143f1f892ddad8bc2fd4a8cfe5b660c414843d8b1885
MD5 5686b8c71abc5c7b6e01e612ab583e8d
SHA1 a857f3bcf9d7055e867c2627eca75eb4a2d3c00b
SHA512 99aca4ee17bcdee4a4918ac3cfed45adb5606b61c34e714e054571ce57b12b513ba38ed3a454d74f32b813c803cf620def1c0e32b23a7649a88143617475943f
MD5 SHA1 SHA512

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 4cf8c34b3196ece94538fd5b841ff16a937c120c9dffd8d02164b826994253a8
MD5 75281e8590a9af2f2b00a0efec192b6d
SHA1 01e11b6430ba33d504a55105632a46cf913f0c70
SHA512 4a9854fc9c7f34e578565e21c33c16156d0403dacc3aeaefa7c492308c2d00383d26cf8278b4b94a9356bc6d479082bcd42477b244920ce8533d17a1bf64bf52
SSDEEP 96:MVms+xINXIMI6Iy3a8qOSRXIZI+p7D5CZ4:5Jxg53v3a8qOSRX0Tp7D5CZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

addressbook.acrodata

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
Size 14KB
SHA256 06a576fc14e995c437b26c0d150b4e84cd745e7cedfd972a84b42b51c842fc9b
MD5 947f93fe0eed44767626846f28cfde05
SHA1 f6276d2a2b4a9d8a8e23c84019cd3961e9d60e88
SHA512 f97739eb0d22a99b06ef340aefb0d5a5b45b679d28accff3de2565166392c7d2fabaa33f945696f7d456ba2ef323f48e43eb26578f71c8b2e8ed32fb4dc69bc9
SSDEEP 192:gcPqYV/saFlwwR+kMqe8TlZMX1sgUVa3ddMVsuNeMcGdSD9obOUAVlcMudM/Y14W:g7Q/X4kMb0lZ6mgtdHOelGdWaolvsTh
MD5 SHA1 SHA512 SSDEEP

Submit Download

addressbook.acrodata

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
Size 24KB
SHA256 d17a84826334bcc88b19e2f144b35243ada88db4ad18a6833f8ec0f5e161e652
MD5 3ae0ff0f2888a4599a1d6ec37f162832
SHA1 5bdc3033db04b1c4cd19ff44c45e57a84d4d9902
SHA512 721688e165b34c0e4e45b9fa17512b065144c724414a1b21f74270ea5bb0399ecc559e4962e5627252ef736e8b1d00c1fbfdd210526ef09cf0883ffd40d2693e
SSDEEP 384:Gxm2Pg3POzbxY3Z0ecspEBDL0pnYQ9MAVYdTrfBX:L2I/OzVY3ZhJOx6Yix6d/BX
MD5 SHA1 SHA512 SSDEEP

Submit Download