7b82c3211ac2385422370846a2873f6dae0f6441b5a96095fb08754d23ef71f8

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 18:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VCDS-PCI-15071-Installer.exe
Size

27.2MB
MD5

07b471064f26c23a28ae21cbc5c6ec07
SHA1

8fd8b5a7289e26aaf48397b89e0f6653cd43082c
SHA256

7b82c3211ac2385422370846a2873f6dae0f6441b5a96095fb08754d23ef71f8
SHA512

799181487ea18e4f82ca992b8266a7cedcf24d50eeccd4b589ab4054c10610eb44bc7990cad6d38a97ff42bb2f0b857b71857297a8bbde5f33f6a2d7432f3054
SSDEEP

393216:HWoSq/0R7XDdADriXkOG3aTGbz0SDTjIjSk3iO/r7HH8tQUpgrbs/iVA:H7ps7u/iUr3lMiTjIv3ifbpgPs/iVA

Score

7^/10

link pdf

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	VCDS-PCI-15071-Installer.exe

Loads dropped DLL 5 IoCs

pid	Process
3908	VCDS-PCI-15071-Installer.exe
3908	VCDS-PCI-15071-Installer.exe
3908	VCDS-PCI-15071-Installer.exe
3908	VCDS-PCI-15071-Installer.exe
3908	VCDS-PCI-15071-Installer.exe

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
behavioral2/files/0x000900000002341c-34.dat	pdf_with_link_action

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings	VCDS-PCI-15071-Installer.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2708	AcroRd32.exe
2708	AcroRd32.exe
2708	AcroRd32.exe
2708	AcroRd32.exe
2708	AcroRd32.exe
2708	AcroRd32.exe
2708	AcroRd32.exe
2708	AcroRd32.exe
2708	AcroRd32.exe
2708	AcroRd32.exe
2708	AcroRd32.exe
2708	AcroRd32.exe
2708	AcroRd32.exe
2708	AcroRd32.exe
2708	AcroRd32.exe
2708	AcroRd32.exe
2708	AcroRd32.exe
2708	AcroRd32.exe
2708	AcroRd32.exe
2708	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2708	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2708	AcroRd32.exe
2708	AcroRd32.exe
2708	AcroRd32.exe
2708	AcroRd32.exe
2708	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 2708	3908	VCDS-PCI-15071-Installer.exe	93
PID 3908 wrote to memory of 2708	3908	VCDS-PCI-15071-Installer.exe	93
PID 3908 wrote to memory of 2708	3908	VCDS-PCI-15071-Installer.exe	93
PID 2708 wrote to memory of 5108	2708	AcroRd32.exe	94
PID 2708 wrote to memory of 5108	2708	AcroRd32.exe	94
PID 2708 wrote to memory of 5108	2708	AcroRd32.exe	94
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 4804	5108	RdrCEF.exe	95
PID 5108 wrote to memory of 1812	5108	RdrCEF.exe	96
PID 5108 wrote to memory of 1812	5108	RdrCEF.exe	96
PID 5108 wrote to memory of 1812	5108	RdrCEF.exe	96
PID 5108 wrote to memory of 1812	5108	RdrCEF.exe	96
PID 5108 wrote to memory of 1812	5108	RdrCEF.exe	96
PID 5108 wrote to memory of 1812	5108	RdrCEF.exe	96
PID 5108 wrote to memory of 1812	5108	RdrCEF.exe	96
PID 5108 wrote to memory of 1812	5108	RdrCEF.exe	96
PID 5108 wrote to memory of 1812	5108	RdrCEF.exe	96
PID 5108 wrote to memory of 1812	5108	RdrCEF.exe	96
PID 5108 wrote to memory of 1812	5108	RdrCEF.exe	96
PID 5108 wrote to memory of 1812	5108	RdrCEF.exe	96
PID 5108 wrote to memory of 1812	5108	RdrCEF.exe	96
PID 5108 wrote to memory of 1812	5108	RdrCEF.exe	96
PID 5108 wrote to memory of 1812	5108	RdrCEF.exe	96
PID 5108 wrote to memory of 1812	5108	RdrCEF.exe	96
PID 5108 wrote to memory of 1812	5108	RdrCEF.exe	96

C:\Users\Admin\AppData\Local\Temp\VCDS-PCI-15071-Installer.exe
"C:\Users\Admin\AppData\Local\Temp\VCDS-PCI-15071-Installer.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\VCDSAnleitung.pdf"
  2⤵
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EBE1CE395F85F06C1ABF30780845E63E --mojo-platform-channel-handle=1712 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4804
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B7C2EAA85DDB4D7474DE3A6B2ACC3DB7 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B7C2EAA85DDB4D7474DE3A6B2ACC3DB7 --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:1812
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EDBDF3F6AFD0C044888DA42980CAB678 --mojo-platform-channel-handle=2296 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4776
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E4336F109768D42751E52BBE8B8E74CC --mojo-platform-channel-handle=1948 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:2640
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=12B240501049207EA5FF58AA0C855412 --mojo-platform-channel-handle=2360 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4744
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=FA322B13AC7356B44C6CD1FC42E0AC5A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=FA322B13AC7356B44C6CD1FC42E0AC5A --renderer-client-id=7 --mojo-platform-channel-handle=2620 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:3324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
025b288203a51a66db1123328b0bdd83

SHA1
e3dd281c708b68c443ae2a9d29ebc1b2688be030

SHA256
0c86e4558cb27d4180989775574ddcd7ce819dc66a2f564fdab877c3bb5b1633

SHA512
fce20e01f42294ef14c351ca2815dbd3ffb18086bf8ee090d857f7d34f3f2a6269516436cc5c3dd2f9d8ab48be6a72eb4baa07cdf75df93f8939cf8415249c28

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\VCDSAnleitung.pdf

Filesize
582KB

MD5
510b8e1b7d15f6f4ed84f57d12d1663a

SHA1
e88fc31a03a176aa89eab906fde162eb6536441f

SHA256
6207b8532f4074bca8cb08e7aca5503028b41c1deffe57540a7f6cda3a8e16fa

SHA512
a1c63e3a644d6264fcfe25e9eac546a67256a7e1fab0eac44629764c5a68d96c8916a259637b61e1d349ad0ab1ff49cb706d42540cde920246e2b363b5f0756c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu6C58.tmp\StdUtils.dll

Filesize
26KB

MD5
c291f96471927e7bc49398b0de7168dd

SHA1
eda478005d69ee86126a8378de5007b139e20a5d

SHA256
c169393e49723cfdcdcbcf80e062be9e841539f90e4b7b85b482212715a1f7c6

SHA512
b4244615e99617d437d3120f201ca88c7ab4a6b4b84e7f0c3b4495a0fe8c979e04feaa08f11ad14fa92f002a3a521422221132ff54a081ef1c6bcbdf09d5929d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu6C58.tmp\System.dll

Filesize
11KB

MD5
ca332bb753b0775d5e806e236ddcec55

SHA1
f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f

SHA256
df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d

SHA512
2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu6C58.tmp\newadvsplash.dll

Filesize
8KB

MD5
55a723e125afbc9b3a41d46f41749068

SHA1
01618b26fec6b8c6bdb866e6e4d0f7a0529fe97c

SHA256
0a70cc4b93d87ecd93e538cfbed7c9a4b8b5c6f1042c6069757bda0d1279ed06

SHA512
559157fa1b3eb6ae1f9c0f2c71ccc692a0a0affb1d6498a8b8db1436d236fd91891897ac620ed5a588beba2efa43ef064211a7fcadb5c3a3c5e2be1d23ef9d4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu6C58.tmp\nsDialogs.dll

Filesize
9KB

MD5
904d8313031ac05e2bac3dd329828833

SHA1
6c8322f76e5c38bc24b0bcc057a510c92ec40b43

SHA256
a7c5516478ab02b5d6c1684b3c2b31ee03331712bcd9f9a8ef8309d2b72c8ec4

SHA512
9d524ebc965f224e1a16f537f71df0963c586fd548cb9a901f8afb1951416dd656d5493cc5e304157dfa6d70d69bcd4c5a5b140fceb3736548e71fe7086b6de8

Download Submit