35665843ed75f2782ef1a39ba96d10331e882547fa185751113d57fb5dceebc4

Analysis

max time kernel
143s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/04/2024, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AM1-187319-Supplier Annual Representations and Certifications.pdf
Size 162KB
Sample240412-rmybbaeb4z
SHA256 6a378a7397968ba3fd33011534d352213ff6bdbd4a3ece1e6426232579c0bcc2
MD5 9c9834dddb73b44566dd42736f9daeaa
SHA1 a1dffbb2c2c72c662f4be8dd92c08ba953abaea3
SHA512 e2b7d789878548d8891048d7f12aa5f1abf553e00106749c35f89d6e395906636801a9271d45de68b2be7247d29032f00b85530004ae4bf3944e745b12b02393
SSDEEP 3072:FC8p0pAvPjvJbskoava86GUFBYFMtAhhDpzQLGtHWsVZnj/aIoC1Q:08pRtQnj86GU0FNpzQLwHWsVZnj/ra
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\MuiCache	AdobeCollabSync.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5112	AcroRd32.exe
5112	AcroRd32.exe
5112	AcroRd32.exe
5112	AcroRd32.exe
5112	AcroRd32.exe
5112	AcroRd32.exe
5112	AcroRd32.exe
5112	AcroRd32.exe
5112	AcroRd32.exe
5112	AcroRd32.exe
5112	AcroRd32.exe
5112	AcroRd32.exe
5112	AcroRd32.exe
5112	AcroRd32.exe
5112	AcroRd32.exe
5112	AcroRd32.exe
5112	AcroRd32.exe
5112	AcroRd32.exe
5112	AcroRd32.exe
5112	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5112	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5112	AcroRd32.exe
5112	AcroRd32.exe
5112	AcroRd32.exe
5112	AcroRd32.exe
5112	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 4956	5112	AcroRd32.exe	91
PID 5112 wrote to memory of 4956	5112	AcroRd32.exe	91
PID 5112 wrote to memory of 4956	5112	AcroRd32.exe	91
PID 4956 wrote to memory of 1476	4956	AdobeCollabSync.exe	92
PID 4956 wrote to memory of 1476	4956	AdobeCollabSync.exe	92
PID 4956 wrote to memory of 1476	4956	AdobeCollabSync.exe	92
PID 1476 wrote to memory of 2744	1476	AdobeCollabSync.exe	98
PID 1476 wrote to memory of 2744	1476	AdobeCollabSync.exe	98
PID 1476 wrote to memory of 2744	1476	AdobeCollabSync.exe	98
PID 5112 wrote to memory of 2688	5112	AcroRd32.exe	102
PID 5112 wrote to memory of 2688	5112	AcroRd32.exe	102
PID 5112 wrote to memory of 2688	5112	AcroRd32.exe	102
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 5008	2688	RdrCEF.exe	103
PID 2688 wrote to memory of 3152	2688	RdrCEF.exe	104
PID 2688 wrote to memory of 3152	2688	RdrCEF.exe	104
PID 2688 wrote to memory of 3152	2688	RdrCEF.exe	104
PID 2688 wrote to memory of 3152	2688	RdrCEF.exe	104
PID 2688 wrote to memory of 3152	2688	RdrCEF.exe	104
PID 2688 wrote to memory of 3152	2688	RdrCEF.exe	104
PID 2688 wrote to memory of 3152	2688	RdrCEF.exe	104
PID 2688 wrote to memory of 3152	2688	RdrCEF.exe	104
PID 2688 wrote to memory of 3152	2688	RdrCEF.exe	104
PID 2688 wrote to memory of 3152	2688	RdrCEF.exe	104
PID 2688 wrote to memory of 3152	2688	RdrCEF.exe	104

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\AM1-187319-Supplier Annual Representations and Certifications.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c --type=collab-renderer --proc=4956
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" GetChannelUri
      4⤵
      PID:2744
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=134BC1A25DC407012FD2D3391266C8B8 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:5008
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C62DC0410347A6F41F56B82CF8FE1ECA --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C62DC0410347A6F41F56B82CF8FE1ECA --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3152
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=BE4E26E20C93885D77AEE3E6B960EFD2 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=BE4E26E20C93885D77AEE3E6B960EFD2 --renderer-client-id=4 --mojo-platform-channel-handle=2176 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:5096
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BA57E4F594C752326B163108947504D4 --mojo-platform-channel-handle=2580 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4220
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F9EDAAFB0871AE44319649CEED637226 --mojo-platform-channel-handle=1936 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2796
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EFE550B69E2479C770FF6BE2B634ACAD --mojo-platform-channel-handle=1916 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3908 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 90dd45f49e7b29b6b545d3f0d1360e90b0c0671bc860033cdc26df4d81e6b770
MD5 db082cd5caee355d1b35b248848c83c4
SHA1 e99ee40718476549c7eee3ae751e064813fd1410
SHA512 f05f7123b88eafb582ca73abb5ab0750282248b1a6f584042973c9458b4278b2f701299858586448ac6e0c64c111a235e65af56d49c932954736f0711a25afdb
SSDEEP 384:yeapdThatELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:d+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 87aa4c64348b534771f03919b5bdca09596e89f6e0cca0a992bb3d290ec4155a
MD5 aebe0d2eb7a2077a55e57a955e62406a
SHA1 3f811b8148f12220f4b45699135e6d21c9847d8a
SHA512 efa1b082925a4e478fcea74764bbacb91d43da8c01c4b360a34e6f7402af23f91c93b5e91c6266120e144b5300e8dae73a62a7b6d7c4328410128f6a72a7baed
SSDEEP 192:t+oGsTzoU27NTaUxmYeMb1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:tklNveMbUNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 390ac5efb8b71f88530cc7f009663c30b2f1e183f2ff079e32c9d5f55cde733c
MD5 7a10c104cfb5fdfed716d3f8b1c264c8
SHA1 27f7e0d0ca09f874c28bc35d9d082f9783c179fc
SHA512 61fd89309cf7c52c55621d506d5a374a6e1ed3cc7d9a1dada2a72ae5f804ca58991eb851fccebdf1049afe959dbe18465b08a5e4ee145b520f0767d20c43b449
SSDEEP 192:K+oGsTzoU27NTaUxmeX441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklNJX44UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 268bae91fc13abe30e5c8db3d27b5037cb20a72b70d3061f275df144da975532
MD5 1f1d51f58d13a4a025abbc5a3ec4de08
SHA1 7fabaeeec9a6a96bf7259f1342c1e08aa3c96e2e
SHA512 2bb52b0b3bceab75c4011f03473c22a7517fb3fbe0c3d54892e393b6eb089a512735829663f6f3a2a11d3825719503ecd53df8ac1b6011283126409bf8751cfa
SSDEEP 192:a+oGsTzoU27NTaUxmGZa6iI9441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoF:aklNPZa444UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 a027cf12f2055635a3020f08e0448b2f0314791260ccd25570426088c5b0e307
MD5 245950c48f668cf2fcb3c64778e64089
SHA1 3a5a14c820f58e35a3fc6f5de29669f0840587d8
SHA512 4fc8448536663b551cc716d78715f06d4ed217fbdf755924f0b30aebbb6212798a61c6638f919d5c14bdb6998d6a12f0ca37281f3c7f484c1821fbfc98d4a24d
SSDEEP 192:K+oGsTzoU27NTaUxma1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklN7UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

resource-18

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\resources\resource-18
Size 3.6MB
SHA256 f0cbb9bed3f12ea767ee9572aefdea89338643b6b803b180f3c494a83745e83f
MD5 eacf7fae6113ca0dc6577bf4a0b4cf8c
SHA1 a070901fb29267aaa25e1f85f77bfed1b3ef8446
SHA512 9ef45a231319f1b86f7fc9a2f15048a3d28bed9e8fcc6007921ad9ad2dae9d9b3c3b0ee15cefbb9d80af8059c4bcb0ed5cd2eba4d4e3b27b29e6146f8eb9e22a
SSDEEP 98304:q0hYiHInIKyNXKxBRZfzOKap/h8e+xA7IOE8lALHQsf:qE7InlYO+pZiiUOE8lALwsf
MD5 SHA1 SHA512 SSDEEP

Submit Download

B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Size 471B
SHA256 4c446f0f3f4524e517b41616d0cb5b8b74a831461075780e5ace0bb76406ef51
MD5 cf921750b07e61cbc973212603303e4f
SHA1 5b8f5bd235a0942eecbcca55d15fe2f63e221395
SHA512 eafe82df0c04a9b5df42b5f1487372b77ebec3eb44f83bd156307dc7f472611cde324871b6ec953ab632bac2fa4dd8d3904e3cd92640314868934799332e8538
MD5 SHA1 SHA512

Submit Download

B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Size 400B
SHA256 8dff83e371d611731bb404d69a702117cab00c19b72cfa7e1b6ac1914390c859
MD5 794e86c0a9b4dc4487416e474cff827f
SHA1 213cac7007f32088ca11b87f1aece4833dee36bb
SHA512 f6caf43a23e4776330bdda4e7132a08f89604bb115407619621a8d3b66a3aadfae861079857095002886f523b7e17711bd5e5e3b92bbcc1c4ff945e9003c19b9
MD5 SHA1 SHA512

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 a0d4f7a614a815d5056f710b74ff8bff07c977b3abd5351e5094c06c9dc63158
MD5 a3ee730fc1997287a387e9b8579549c9
SHA1 0e61b148d3b060000b0f598f62febdc1e8e83afb
SHA512 f0cbc17aee1e7d5401293157dc3a1950b7ac53d635332a6ec5bc9bcf7ae58291d58bbefdda5494c703d428a9ff77770c9114ab94567f1b7d80f009b5544d5c53
SSDEEP 24:TLCx/XYKQvGJF7urstlQeNghThYvC8tlehJDXSp:Tul2GL7mstlQeNghTs+JGp
MD5 SHA1 SHA512 SSDEEP

Submit Download

addressbook.acrodata

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
Size 5.3MB
SHA256 03140463d9f2ed2a98d80d9e7210d8d35a6c8db17daa313c8ccddb9a696d3c90
MD5 c34fbec852686f9cdceb057afab88123
SHA1 1f0dc09dc3ddaee50f820a1d316b0bbbcf0d2b2c
SHA512 a6676c35896339b38729c49d21d8b3ddbc916e02d9e98974d7ccc98acacc1bb4acfdd9072927341985fdf3a3c11da7f4cfbd06a9703d15dc552c8c8170cc3be4
SSDEEP 24576:+WPZCFFJWXDceoSku1rv5ANdbKp9oDAD09SXgIG60/SNysPt8G+U6jAxGtVFk3Qd:a
MD5 SHA1 SHA512 SSDEEP

Submit Download

addressbook.acrodata

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
Size 14KB
SHA256 06a576fc14e995c437b26c0d150b4e84cd745e7cedfd972a84b42b51c842fc9b
MD5 947f93fe0eed44767626846f28cfde05
SHA1 f6276d2a2b4a9d8a8e23c84019cd3961e9d60e88
SHA512 f97739eb0d22a99b06ef340aefb0d5a5b45b679d28accff3de2565166392c7d2fabaa33f945696f7d456ba2ef323f48e43eb26578f71c8b2e8ed32fb4dc69bc9
SSDEEP 192:gcPqYV/saFlwwR+kMqe8TlZMX1sgUVa3ddMVsuNeMcGdSD9obOUAVlcMudM/Y14W:g7Q/X4kMb0lZ6mgtdHOelGdWaolvsTh
MD5 SHA1 SHA512 SSDEEP

Submit Download