91e2e09640a3ad87cd72d2625584b98e03643ad16effe605b4a99cb34b97df1a

Analysis

max time kernel
142s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91e2e09640a3ad87cd72d2625584b98e03643ad16effe605b4a99cb34b97df1a.pdf
Size 324KB
Sample240225-2vgnmsfc4z
SHA256 91e2e09640a3ad87cd72d2625584b98e03643ad16effe605b4a99cb34b97df1a
MD5 9bac0630178d39ceeeecd732df3c9a28
SHA1 6328f241e45da1fbaba3cd4a5e819e8dab05cd7e
SHA512 b836363604fdf9e5db4c6e0c66493caa045bb04ff856762450da45ebba8cdc55c7586acae2e85d0436aea6bdcffe52636702489618df55e0f247cd5f1fa55715
SSDEEP 6144:G8T1jZMtZ4ja1vk1DwAE3SIJy/l8k7Li9gjNMuZ:Gs0D4W1LiI68Ee9Yd
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000_Classes\Local Settings\MuiCache	AdobeCollabSync.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5220	AcroRd32.exe
5220	AcroRd32.exe
5220	AcroRd32.exe
5220	AcroRd32.exe
5220	AcroRd32.exe
5220	AcroRd32.exe
5220	AcroRd32.exe
5220	AcroRd32.exe
5220	AcroRd32.exe
5220	AcroRd32.exe
5220	AcroRd32.exe
5220	AcroRd32.exe
5220	AcroRd32.exe
5220	AcroRd32.exe
5220	AcroRd32.exe
5220	AcroRd32.exe
5220	AcroRd32.exe
5220	AcroRd32.exe
5220	AcroRd32.exe
5220	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5220	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5220	AcroRd32.exe
5220	AcroRd32.exe
5220	AcroRd32.exe
5220	AcroRd32.exe
5220	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5220 wrote to memory of 4496	5220	AcroRd32.exe	89
PID 5220 wrote to memory of 4496	5220	AcroRd32.exe	89
PID 5220 wrote to memory of 4496	5220	AcroRd32.exe	89
PID 4496 wrote to memory of 2888	4496	AdobeCollabSync.exe	90
PID 4496 wrote to memory of 2888	4496	AdobeCollabSync.exe	90
PID 4496 wrote to memory of 2888	4496	AdobeCollabSync.exe	90
PID 2888 wrote to memory of 2124	2888	AdobeCollabSync.exe	92
PID 2888 wrote to memory of 2124	2888	AdobeCollabSync.exe	92
PID 2888 wrote to memory of 2124	2888	AdobeCollabSync.exe	92
PID 5220 wrote to memory of 2392	5220	AcroRd32.exe	94
PID 5220 wrote to memory of 2392	5220	AcroRd32.exe	94
PID 5220 wrote to memory of 2392	5220	AcroRd32.exe	94
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4972	2392	RdrCEF.exe	95
PID 2392 wrote to memory of 4456	2392	RdrCEF.exe	96
PID 2392 wrote to memory of 4456	2392	RdrCEF.exe	96
PID 2392 wrote to memory of 4456	2392	RdrCEF.exe	96
PID 2392 wrote to memory of 4456	2392	RdrCEF.exe	96
PID 2392 wrote to memory of 4456	2392	RdrCEF.exe	96
PID 2392 wrote to memory of 4456	2392	RdrCEF.exe	96
PID 2392 wrote to memory of 4456	2392	RdrCEF.exe	96
PID 2392 wrote to memory of 4456	2392	RdrCEF.exe	96
PID 2392 wrote to memory of 4456	2392	RdrCEF.exe	96
PID 2392 wrote to memory of 4456	2392	RdrCEF.exe	96
PID 2392 wrote to memory of 4456	2392	RdrCEF.exe	96

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\91e2e09640a3ad87cd72d2625584b98e03643ad16effe605b4a99cb34b97df1a.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5220
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c --type=collab-renderer --proc=4496
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2888
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" GetChannelUri
      4⤵
      PID:2124
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6DE6DF32D89A29B108E1733B5ACEB467 --mojo-platform-channel-handle=1728 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4972
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=CAE2E7D9583581E6B415A8DAB71141FB --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=CAE2E7D9583581E6B415A8DAB71141FB --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4456
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1D3F1BA554DE146D519D832CC4886DBD --mojo-platform-channel-handle=2288 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1532
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6FD7043040CED41B7C20B4E5781ADAC1 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6FD7043040CED41B7C20B4E5781ADAC1 --renderer-client-id=5 --mojo-platform-channel-handle=1980 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2676
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=99632BDE934B5FAC3C9E5EF0774A6E28 --mojo-platform-channel-handle=2648 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3700
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4F8EA6ABA6106C73C7390F2817C2B86B --mojo-platform-channel-handle=2384 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 b1a2c50f4db2059d1aaf5988bccc319c01078b84f392fd6e8c417e3606624ebb
MD5 5e2746bffbe71c2acab2ce396fb1e306
SHA1 7ce64d03cd3b5f3890414b74aac26431411c4031
SHA512 3d26f7d45a4d8698cddfdab7f699090ab9b3168eacab1e2dbf56b451a91cc685710d9b32fb15a3727f3667375894c2d67312b403ae5419916d57c09fbf2bf724
SSDEEP 384:ye4dThatELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:z+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 87aa4c64348b534771f03919b5bdca09596e89f6e0cca0a992bb3d290ec4155a
MD5 aebe0d2eb7a2077a55e57a955e62406a
SHA1 3f811b8148f12220f4b45699135e6d21c9847d8a
SHA512 efa1b082925a4e478fcea74764bbacb91d43da8c01c4b360a34e6f7402af23f91c93b5e91c6266120e144b5300e8dae73a62a7b6d7c4328410128f6a72a7baed
SSDEEP 192:t+oGsTzoU27NTaUxmYeMb1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:tklNveMbUNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 2821b38c791fa068faf837d9fa88dafdc1e08508846a0238d6383c13f4e3db03
MD5 941fadd83b61418c431bb349e49e4516
SHA1 b69be1949c8573b62ff9510ed58f658b1377fafa
SHA512 a69f7cf7a2c15871c35db49768b705f9eaebaced3748334288a52a99462c11e1a77667475824f09b5ac1b99c28a50a99b52a16de4dbc2d435bef6e4211368066
SSDEEP 192:K+oGsTzoU27NTaUxm2X441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklNRX44UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 7b88591b994a58299404f3dab019c8c13d7ab4cfb4ac5d695ec0c5c5585e67c5
MD5 79d4b3052105dcb6a89c43d769cee44e
SHA1 56f28e9d053e4d1d9f5df02ba3a07b280cc9a636
SHA512 fbd42b3e00d742dbcfcc0cbf183d9cda24fc6200a6668567d3bab5459e8c1e58e215fef67a4b10c1c74b53f6724c271800ef24102bef77cb53ef01ee29f4b4a2
SSDEEP 192:a+oGsTzoU27NTaUxmGeaOw441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:aklNPeaz44UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 a027cf12f2055635a3020f08e0448b2f0314791260ccd25570426088c5b0e307
MD5 245950c48f668cf2fcb3c64778e64089
SHA1 3a5a14c820f58e35a3fc6f5de29669f0840587d8
SHA512 4fc8448536663b551cc716d78715f06d4ed217fbdf755924f0b30aebbb6212798a61c6638f919d5c14bdb6998d6a12f0ca37281f3c7f484c1821fbfc98d4a24d
SSDEEP 192:K+oGsTzoU27NTaUxma1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklN7UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

resource-18

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\resources\resource-18
Size 3.5MB
SHA256 a0c4a82ac8f55627773a23f421a50a033ece9bc8898fa1d4d5b29a8563dba12b
MD5 17b8abba81aa32dc79778a6305717ac0
SHA1 e661e0d2247fd7333bd49391b5d66194e845cc2d
SHA512 df9381f37f77922aee95e18271ae15fb3c1b46146311a593c10c7113ee5dc3c4ecea2fafee0d466e8d352255f80e0baded36ca4c769d780cbf4f1ca086f1d354
SSDEEP 98304:1wmD7n+ZUxlO2VUb/8bWNJpw/pY2MwCs6fS:mmD7n+axsTj8qNmowCs6fS
MD5 SHA1 SHA512 SSDEEP

Submit Download

B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Size 471B
SHA256 d0363e04d3fa9b820291ecdb19d2b33be6dad234547198256e16c6e4bfcc2c27
MD5 5f7275c64e727e9826ba6f0214b9d8e1
SHA1 6c3d9109745b618a4c60c40d5214679e52e87ff6
SHA512 373f0dbe7cc5186f420c6945f8bb029ecbb0947293d393e609664f0d113cf9e4d9d6d304fb2e89d9bfea174a3e77672bc83b703d645a5e0ff409710f7cf8f590
MD5 SHA1 SHA512

Submit Download

B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Size 400B
SHA256 846aafa4c14621773ed06e6352ef4ae7fc1603376214c9188a29acfb1f2615a4
MD5 906683be420a9f36007110ac803cf99d
SHA1 1a58bce5e221b41cb83103ecd33633d07b5f36fa
SHA512 bdb1385d05dedeb1bf01721147300beb8ea83d677314f503a52bceac0a4a369eb27c7d75208c375e85c11ea0fe52c1451872bb09587ead262b742446ae457f2a
MD5 SHA1 SHA512

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 2fd6a84d204f98d9d4befc4eb2ed1e287123e2f343bf7dcceda11ce23c755e98
MD5 14b2c4f35c892fd8fd1f5780f886245a
SHA1 9bb1a262c01876fec0f57563234a52bfe8d6da47
SHA512 91882c7338a260ceb0b0bbc59d792fd4ea17dde6ef38bee11989ccc3a4ed69f790199c2952057ecae984c98cb185c7d50d777da595edb0f632cb61eafcabdeaa
SSDEEP 48:Tul2GL7mstlQaMNIMzMBMpEt/9Z7M+aTcssy4M0HU:MVmsAjNBQeX+aZj
MD5 SHA1 SHA512 SSDEEP

Submit Download

addressbook.acrodata

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
Size 5.2MB
SHA256 e37ac866c10edfceae178fb0c41757142ba2a6ccaa19a7749f2cc6b243491b95
MD5 141f3b448cc8d3054ccdad1334616583
SHA1 0e48b93c00c7c83f36782aaa0b9b902a2e03d935
SHA512 077d467dca91a9603c481e0183f45c7f87e354a4d8ca5847e5120c952ff6e2665ded9bfc68090916c942b8ed4044067016dd1c75b89bbb45e7e0b6ec3ccd9a78
SSDEEP 24576:7WPZCFFJWXDFlQ94bANpUPIdn8ft2YwbAxCyLqOmSpBVcJoSUu8x+sbTj1Bto2p7:A
MD5 SHA1 SHA512 SSDEEP

Submit Download

addressbook.acrodata

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
Size 14KB
SHA256 06a576fc14e995c437b26c0d150b4e84cd745e7cedfd972a84b42b51c842fc9b
MD5 947f93fe0eed44767626846f28cfde05
SHA1 f6276d2a2b4a9d8a8e23c84019cd3961e9d60e88
SHA512 f97739eb0d22a99b06ef340aefb0d5a5b45b679d28accff3de2565166392c7d2fabaa33f945696f7d456ba2ef323f48e43eb26578f71c8b2e8ed32fb4dc69bc9
SSDEEP 192:gcPqYV/saFlwwR+kMqe8TlZMX1sgUVa3ddMVsuNeMcGdSD9obOUAVlcMudM/Y14W:g7Q/X4kMb0lZ6mgtdHOelGdWaolvsTh
MD5 SHA1 SHA512 SSDEEP

Submit Download