106bcff0966a2c465eb303cbb2333ff6065997284a85c70d1fd992b397689059

Analysis

max time kernel
149s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65156969.pdf
Size

90KB
MD5

8146dd152261c010df741747e2ddccef
SHA1

2c3f40cf224a748b390336d5d0c82d05324d29be
SHA256

106bcff0966a2c465eb303cbb2333ff6065997284a85c70d1fd992b397689059
SHA512

3b6536c753934b12691d40e141224925af5393803c352ff246a107999e565785c3fc91100c8ee96598becea74f333523f652c8b30d3d461c37d138cf936aa086
SSDEEP

1536:HTU71fxV92FRUqv6zvJ0CUZUxTCXOFY6jEzskfID3mgx5Re6K:HoR6TMdxTCXOF7Idwbmgli

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4992	AcroRd32.exe
4992	AcroRd32.exe
4992	AcroRd32.exe
4992	AcroRd32.exe
4992	AcroRd32.exe
4992	AcroRd32.exe
4992	AcroRd32.exe
4992	AcroRd32.exe
4992	AcroRd32.exe
4992	AcroRd32.exe
4992	AcroRd32.exe
4992	AcroRd32.exe
4992	AcroRd32.exe
4992	AcroRd32.exe
4992	AcroRd32.exe
4992	AcroRd32.exe
4992	AcroRd32.exe
4992	AcroRd32.exe
4992	AcroRd32.exe
4992	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4992	AcroRd32.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4992	AcroRd32.exe
4992	AcroRd32.exe
4992	AcroRd32.exe
4992	AcroRd32.exe
4992	AcroRd32.exe
4992	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 4888	4992	AcroRd32.exe	86
PID 4992 wrote to memory of 4888	4992	AcroRd32.exe	86
PID 4992 wrote to memory of 4888	4992	AcroRd32.exe	86
PID 4888 wrote to memory of 540	4888	AdobeCollabSync.exe	87
PID 4888 wrote to memory of 540	4888	AdobeCollabSync.exe	87
PID 4888 wrote to memory of 540	4888	AdobeCollabSync.exe	87
PID 4992 wrote to memory of 1260	4992	AcroRd32.exe	88
PID 4992 wrote to memory of 1260	4992	AcroRd32.exe	88
PID 4992 wrote to memory of 1260	4992	AcroRd32.exe	88
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 2128	1260	RdrCEF.exe	89
PID 1260 wrote to memory of 644	1260	RdrCEF.exe	90
PID 1260 wrote to memory of 644	1260	RdrCEF.exe	90
PID 1260 wrote to memory of 644	1260	RdrCEF.exe	90
PID 1260 wrote to memory of 644	1260	RdrCEF.exe	90
PID 1260 wrote to memory of 644	1260	RdrCEF.exe	90
PID 1260 wrote to memory of 644	1260	RdrCEF.exe	90
PID 1260 wrote to memory of 644	1260	RdrCEF.exe	90
PID 1260 wrote to memory of 644	1260	RdrCEF.exe	90
PID 1260 wrote to memory of 644	1260	RdrCEF.exe	90
PID 1260 wrote to memory of 644	1260	RdrCEF.exe	90
PID 1260 wrote to memory of 644	1260	RdrCEF.exe	90
PID 1260 wrote to memory of 644	1260	RdrCEF.exe	90
PID 1260 wrote to memory of 644	1260	RdrCEF.exe	90
PID 1260 wrote to memory of 644	1260	RdrCEF.exe	90

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\65156969.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c --type=collab-renderer --proc=4888
    3⤵
    PID:540
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" GetChannelUri
      4⤵
      PID:3576
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1260
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8FA1AFD9E6D0C42B9E0076DBD9F4C6C1 --mojo-platform-channel-handle=1716 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2128
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4B67A2D7EB941EE8277A135E51036D30 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4B67A2D7EB941EE8277A135E51036D30 --renderer-client-id=2 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:644
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B39AC2BA68EE4019B8CB9C56E6B15609 --mojo-platform-channel-handle=2288 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1288
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=43ABADFB56DDC721753D1EE06E33086B --mojo-platform-channel-handle=2388 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2152
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C7F49189567E36898A3F3AA831EE53BE --mojo-platform-channel-handle=2328 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4876
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=AFDA808B9C6450FE4B090BE6BAFE0D4B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=AFDA808B9C6450FE4B090BE6BAFE0D4B --renderer-client-id=7 --mojo-platform-channel-handle=2356 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer

Filesize
92KB

MD5
8cb23b0e83bad1f09079a0c358cbc0af

SHA1
4b081c7934be6b8cf799cc6624735bdb5e9d0d92

SHA256
6bbacfb86cae24f9face26efd7f37d3bd3d482b171efd51a5854fd235edd290c

SHA512
8cc3cf5d9dcc7ccec2769323e13f931d9796b6c7e365d6fa3717a79517f5c270d7af2b29619730ef3d81acdaa7af239467cb7a7daf047ab1d8bcf84623446780

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer

Filesize
92KB

MD5
91d29d1950c1d9b8405bca5f5b8f2ba0

SHA1
d198fe5c9dfb21382eb6b008c1456710beb77057

SHA256
5060411d4654a5d56c8cdbb384ea7f86c96bdc4b72708ba88670e3b237cb94ee

SHA512
dbaf61ced427563b88c19b554fef471dd875993f06e856e4ae594fe60e0b5a7649ba8bfb41ad8bec17c121a41e8452d6f97eede206286359cb866e525a997b8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer

Filesize
92KB

MD5
aebe0d2eb7a2077a55e57a955e62406a

SHA1
3f811b8148f12220f4b45699135e6d21c9847d8a

SHA256
87aa4c64348b534771f03919b5bdca09596e89f6e0cca0a992bb3d290ec4155a

SHA512
efa1b082925a4e478fcea74764bbacb91d43da8c01c4b360a34e6f7402af23f91c93b5e91c6266120e144b5300e8dae73a62a7b6d7c4328410128f6a72a7baed

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer

Filesize
92KB

MD5
674e154a04d8d74b2a87187f47adfe5d

SHA1
2a0cb9cfce39d5c73d197f5956c3a328a2c9ed7e

SHA256
c2126767097b5ee59e60b7526ed1f38025f82df9554709b2c286ba5c50ddece7

SHA512
de4fbcc9af8ab448dbbeb7975a61f5d35a0cab143c599fc3d5b67b8199517d1a7ec0954733f126962eb8a8e52d0d281d9e565548349f7eeccf37ad302c7b1a63

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer

Filesize
92KB

MD5
ca04de081da1805f0a3ed00b01cf6c60

SHA1
f5d596aeefe9d527dff0f9f6c398f3df61c8ca96

SHA256
b1b587615be26501e8a0f7da3352677c719e3bf749284ae5b0b1e91c4e5d9b43

SHA512
30c7db8091316882ea9d97ee3d66ce32a7e0a5f2fac14a39ffc8e006c02f2a14fb62bf18aa93a2d1832b63a764a18fb13bbdee049ad33fd1371fc0de86b65391

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer

Filesize
92KB

MD5
adc3c8788db9d28cda6ef429b53b18db

SHA1
5a76af2db3c6bd990fc80782827d50916f46da4f

SHA256
bd37d0d389251eba1d6957836975b39455db881c41ddbb43ea3c916c70c3bfe9

SHA512
e17eec0950ade575529920e5648f954b7edd061b10b1845ed28b482fad44609517926780cc23d20ffbe34721b3731668a94c3b120c21018fc93077d8aa8d3afd

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer

Filesize
92KB

MD5
245950c48f668cf2fcb3c64778e64089

SHA1
3a5a14c820f58e35a3fc6f5de29669f0840587d8

SHA256
a027cf12f2055635a3020f08e0448b2f0314791260ccd25570426088c5b0e307

SHA512
4fc8448536663b551cc716d78715f06d4ed217fbdf755924f0b30aebbb6212798a61c6638f919d5c14bdb6998d6a12f0ca37281f3c7f484c1821fbfc98d4a24d

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Filesize
12KB

MD5
5f86048b7117ff304de77fd4fe888c6f

SHA1
0e66a864f5996a35eff6a052832c9f33cc4f4af5

SHA256
705b19789307c6727231c0aba306be56f1d6576cd5c915ef44990117be75fd16

SHA512
add16ca3525cd710a059a4cc054433d7956985e37398c95520463a29dcdee255532fd2c03efa81b24eebea63ef20dd096269da5bffbf641bc1d203fdd21cdf88

Download Submit