3999fb587bea1c5ffc389c639e8783db7d485f4cae623f9178fc20b3e566b155

Analysis

max time kernel
149s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6462d468be4f6e758e2cf3c44a053200_NEIKI.pdf
Size 339KB
Sample240507-3dnajagf47
SHA256 3999fb587bea1c5ffc389c639e8783db7d485f4cae623f9178fc20b3e566b155
MD5 6462d468be4f6e758e2cf3c44a053200
SHA1 4fa05f10766a7c3102c7b43e0eba2ac061499618
SHA512 1dd5ff0a0493a4abb7decfd597ee9ea7279d8f1be7309431c464a74dd0293055d0d2baf62bf14a150c180650edd212a6c9892557375a7e8cadb65900d13a4d79
SSDEEP 6144:I50gmRe0e09sSSzRqKjvc4tl7h9rxyoH/74cLQrAnxuZ:Sv096zRXjvccRh9AnWxuZ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\MuiCache	AdobeCollabSync.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1240	AcroRd32.exe
1240	AcroRd32.exe
1240	AcroRd32.exe
1240	AcroRd32.exe
1240	AcroRd32.exe
1240	AcroRd32.exe
1240	AcroRd32.exe
1240	AcroRd32.exe
1240	AcroRd32.exe
1240	AcroRd32.exe
1240	AcroRd32.exe
1240	AcroRd32.exe
1240	AcroRd32.exe
1240	AcroRd32.exe
1240	AcroRd32.exe
1240	AcroRd32.exe
1240	AcroRd32.exe
1240	AcroRd32.exe
1240	AcroRd32.exe
1240	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1240	AcroRd32.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1240	AcroRd32.exe
1240	AcroRd32.exe
1240	AcroRd32.exe
1240	AcroRd32.exe
1240	AcroRd32.exe
1240	AcroRd32.exe
1240	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 4944	1240	AcroRd32.exe	86
PID 1240 wrote to memory of 4944	1240	AcroRd32.exe	86
PID 1240 wrote to memory of 4944	1240	AcroRd32.exe	86
PID 4944 wrote to memory of 2460	4944	AdobeCollabSync.exe	87
PID 4944 wrote to memory of 2460	4944	AdobeCollabSync.exe	87
PID 4944 wrote to memory of 2460	4944	AdobeCollabSync.exe	87
PID 2460 wrote to memory of 944	2460	AdobeCollabSync.exe	92
PID 2460 wrote to memory of 944	2460	AdobeCollabSync.exe	92
PID 2460 wrote to memory of 944	2460	AdobeCollabSync.exe	92
PID 1240 wrote to memory of 4920	1240	AcroRd32.exe	96
PID 1240 wrote to memory of 4920	1240	AcroRd32.exe	96
PID 1240 wrote to memory of 4920	1240	AcroRd32.exe	96
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 2916	4920	RdrCEF.exe	97
PID 4920 wrote to memory of 1220	4920	RdrCEF.exe	98
PID 4920 wrote to memory of 1220	4920	RdrCEF.exe	98
PID 4920 wrote to memory of 1220	4920	RdrCEF.exe	98
PID 4920 wrote to memory of 1220	4920	RdrCEF.exe	98
PID 4920 wrote to memory of 1220	4920	RdrCEF.exe	98
PID 4920 wrote to memory of 1220	4920	RdrCEF.exe	98
PID 4920 wrote to memory of 1220	4920	RdrCEF.exe	98
PID 4920 wrote to memory of 1220	4920	RdrCEF.exe	98
PID 4920 wrote to memory of 1220	4920	RdrCEF.exe	98
PID 4920 wrote to memory of 1220	4920	RdrCEF.exe	98
PID 4920 wrote to memory of 1220	4920	RdrCEF.exe	98

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6462d468be4f6e758e2cf3c44a053200_NEIKI.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c --type=collab-renderer --proc=4944
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2460
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" GetChannelUri
      4⤵
      PID:944
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6D640A6AAC8FC19627B21BCD711E95BB --mojo-platform-channel-handle=1724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2916
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B11D3EC281F3E504D67F0D478DE684EA --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B11D3EC281F3E504D67F0D478DE684EA --renderer-client-id=2 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1220
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E8B8AFF7266703B7D2937EA125D5BCD5 --mojo-platform-channel-handle=2324 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4592
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=535654E35A5A43B2A15426A73A573ABA --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=535654E35A5A43B2A15426A73A573ABA --renderer-client-id=5 --mojo-platform-channel-handle=2456 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1444
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F6209999EEC0EA94A1146294A93DD759 --mojo-platform-channel-handle=2924 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2156
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2419DE484F5166F4F3BBA847647714CC --mojo-platform-channel-handle=2336 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 78bb8ea6927c62e39b1bd6d82c2e664ac182b7c6037241b34cfb8016530c5890
MD5 9e3a2de97997a51290aad9f4a892bedd
SHA1 d240b9310700df0f485a4a2fe4be25fb84e72c92
SHA512 49cf6e19184ba312e851a6096ec712eaa80a5a42fb26081d0de258e38c6fdeaac32cd4a3f295f772b9e211ca2bf8a02216855bf540a3fbf710a5b0c27496f412
SSDEEP 384:yexdThatELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:Y+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 87aa4c64348b534771f03919b5bdca09596e89f6e0cca0a992bb3d290ec4155a
MD5 aebe0d2eb7a2077a55e57a955e62406a
SHA1 3f811b8148f12220f4b45699135e6d21c9847d8a
SHA512 efa1b082925a4e478fcea74764bbacb91d43da8c01c4b360a34e6f7402af23f91c93b5e91c6266120e144b5300e8dae73a62a7b6d7c4328410128f6a72a7baed
SSDEEP 192:t+oGsTzoU27NTaUxmYeMb1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:tklNveMbUNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 4edf76273b9b4796f032dc326d1a72ee59c65e6df3437084c6da2ee53d7ce3bf
MD5 f0470f5664713dd4d89f3148a08d462f
SHA1 ca53d2dea8c8ebcebd37f4175984fbd44ca54860
SHA512 d83d34c108efc44f604a7e52ef342990f39c547e546ccbe2e2685a54feacda978d5fc3a7dd2d143f6dcaa290a752995008e2cbf253fb88db338e6b4bd80c4ab7
SSDEEP 192:K+oGsTzoU27NTaUxmt8X441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklN5X44UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 2b7ca45e2c0d1ea48131eb53be7b7ee9a97dc03c50bbbf309e9a1b7ab672df26
MD5 9a5ac4a9a5211731482c26009c691e7e
SHA1 97b538c84f2ae709a0899ed6efc5b645ecaa1163
SHA512 45433bf0154adc54b7fab1fcd534a3d1dd6aef4d5ad94697470da55d517bb3367ef41d5791f5c9a05b4e52a2dda0ba60f30230e6058770dd582c4e4853928c3c
SSDEEP 192:a+oGsTzoU27NTaUxmG0a64rkq441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNy:aklNP0a1r544UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 a027cf12f2055635a3020f08e0448b2f0314791260ccd25570426088c5b0e307
MD5 245950c48f668cf2fcb3c64778e64089
SHA1 3a5a14c820f58e35a3fc6f5de29669f0840587d8
SHA512 4fc8448536663b551cc716d78715f06d4ed217fbdf755924f0b30aebbb6212798a61c6638f919d5c14bdb6998d6a12f0ca37281f3c7f484c1821fbfc98d4a24d
SSDEEP 192:K+oGsTzoU27NTaUxma1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklN7UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

resource-18

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\resources\resource-18
Size 3.6MB
SHA256 f0cbb9bed3f12ea767ee9572aefdea89338643b6b803b180f3c494a83745e83f
MD5 eacf7fae6113ca0dc6577bf4a0b4cf8c
SHA1 a070901fb29267aaa25e1f85f77bfed1b3ef8446
SHA512 9ef45a231319f1b86f7fc9a2f15048a3d28bed9e8fcc6007921ad9ad2dae9d9b3c3b0ee15cefbb9d80af8059c4bcb0ed5cd2eba4d4e3b27b29e6146f8eb9e22a
SSDEEP 98304:q0hYiHInIKyNXKxBRZfzOKap/h8e+xA7IOE8lALHQsf:qE7InlYO+pZiiUOE8lALwsf
MD5 SHA1 SHA512 SSDEEP

Submit Download

B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Size 471B
SHA256 e954bd6327609588121ecf95dfb7650ddd72db68772174780b03953fcf2f2e25
MD5 d747fee038a0ef193c38cc4ea4d44301
SHA1 a343787f3f478876278590afb7e5cff5a771c6c6
SHA512 cf318d8228b5138678ffd2e90d3dab634f914ad6e456b49b3722bb01942917b3dc824196c54a510dbcb3b68eb7dad5076f5bb613d05fa3c2cbe1e406bef2700c
MD5 SHA1 SHA512

Submit Download

B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Size 400B
SHA256 b213f4425027afd286aee2f023a33b3865b6428bb660ec9f8a559b93d6591c1b
MD5 9814d058826f1d0a5b1ba1fbfd611329
SHA1 c617b69196e37172ace4df2ddebee94bc710527a
SHA512 f76f7f30468f3019ffc04f46695e373df2983b5712e0c99567b56ed52b021369097d552b2406ae869a2afb6986785dc721f9f05b7ad797dedfa37ba952117d9f
MD5 SHA1 SHA512

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 919b710bf6cd38267df6612b38a5437b370096d4f6133d6444a789970316aea7
MD5 c0544bd1550962c823b457944ac20383
SHA1 74572156d0ee3702956bcfe4dfda6ac44627c71c
SHA512 7da29eeafc1335eb2cf9e681cd7df74f41c87d0684fd18d7bd8bd914d60096250cf661202feeb626e5ec7df483aac4ab9b11c0794d61df5ff3a7eb7e4736288e
SSDEEP 24:TLCx/XYKQvGJF7ursdIpNXush1ejh0V2Qu+Bb1EY:Tul2GL7ms+pNXusLO+ZJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

addressbook.acrodata

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
Size 14KB
SHA256 06a576fc14e995c437b26c0d150b4e84cd745e7cedfd972a84b42b51c842fc9b
MD5 947f93fe0eed44767626846f28cfde05
SHA1 f6276d2a2b4a9d8a8e23c84019cd3961e9d60e88
SHA512 f97739eb0d22a99b06ef340aefb0d5a5b45b679d28accff3de2565166392c7d2fabaa33f945696f7d456ba2ef323f48e43eb26578f71c8b2e8ed32fb4dc69bc9
SSDEEP 192:gcPqYV/saFlwwR+kMqe8TlZMX1sgUVa3ddMVsuNeMcGdSD9obOUAVlcMudM/Y14W:g7Q/X4kMb0lZ6mgtdHOelGdWaolvsTh
MD5 SHA1 SHA512 SSDEEP

Submit Download

addressbook.acrodata

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
Size 5.3MB
SHA256 03140463d9f2ed2a98d80d9e7210d8d35a6c8db17daa313c8ccddb9a696d3c90
MD5 c34fbec852686f9cdceb057afab88123
SHA1 1f0dc09dc3ddaee50f820a1d316b0bbbcf0d2b2c
SHA512 a6676c35896339b38729c49d21d8b3ddbc916e02d9e98974d7ccc98acacc1bb4acfdd9072927341985fdf3a3c11da7f4cfbd06a9703d15dc552c8c8170cc3be4
SSDEEP 24576:+WPZCFFJWXDceoSku1rv5ANdbKp9oDAD09SXgIG60/SNysPt8G+U6jAxGtVFk3Qd:a
MD5 SHA1 SHA512 SSDEEP

Submit Download