902d031274b4361ae409d4dbca89951f2ee2d27a06fb645dba31b4d95ec3cb26

Analysis

max time kernel
117s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26-08-2024 08:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

266e2b54a3c5f954287acfc4f78b8ce0N.exe
Size

1017KB
MD5

266e2b54a3c5f954287acfc4f78b8ce0
SHA1

feefc7929b0289b0e1a0c9d6c1130f99d692cace
SHA256

902d031274b4361ae409d4dbca89951f2ee2d27a06fb645dba31b4d95ec3cb26
SHA512

549d8047d0a1c6c90c5aaf39ff69716160837632f89f064ce3c9aeb3991c84f0b0bc808b47830b5096e698f8c0422b7d14c6cec06ff3fa022047bc7c77a0f932
SSDEEP

12288:rjfoMXG5cpFKksKwPsVY3Ymfp2GJwJSHB8GM0T4TD+Yks/0g3yfd3k94g6cQ:rjuy2dsUZJO8B8pD+Yb/M3Eb6f

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	266e2b54a3c5f954287acfc4f78b8ce0N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	acrotray.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	acrotray .exe

Executes dropped EXE 4 IoCs

pid	Process
3128	acrotray.exe
644	acrotray.exe
2232	acrotray .exe
1028	acrotray .exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe_Reader = "C:\\Program Files (x86)\\Adobe\\acrotray.exe"	266e2b54a3c5f954287acfc4f78b8ce0N.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\acrotray .exe	266e2b54a3c5f954287acfc4f78b8ce0N.exe
File created	C:\Program Files (x86)\Adobe\acrotray.exe	266e2b54a3c5f954287acfc4f78b8ce0N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	266e2b54a3c5f954287acfc4f78b8ce0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	acrotray.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ielowutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	acrotray .exe

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31127444"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31127444"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20c6dbc094f7da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 701bcbb894f7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3119695599"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003d1c6f3067c0c84abb3839afa92ebb0f00000000020000000000106600000001000020000000a2a4f48b2e0e1591541280307c24af9a9e5231c9eca4b93886bc30e8440be8dc000000000e80000000020000200000007eb40c9a45000f27d9fa2ef2099cc1b71c4cd07d216d997c45562d1fe5916f4520000000d10348da5f5bc03df0eb8c1ad28b712758a14a47f79ddf6ed5e9791d821c80944000000037f08f4b9a3cb0ec83365d4b262a0ee8200896aa820fe4da0f6a3fd0cf86b45c3d5d601f420bd920c91e0dfb1eb074597952582c4764d92bbc84b3605e0df98c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3119695599"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003d1c6f3067c0c84abb3839afa92ebb0f000000000200000000001066000000010000200000006213829a680c41570f09bc9a6b65b5f709ca12fd22cd2b9ace97e888657f53f9000000000e8000000002000020000000df4e6b361c8ec77ea059eb36afe96bdbfe1b5552d87b32e743b84cca64933b2820000000fb561b79f0d5a5895bed5096d483e16c127d6a94a16020965970bf518ffc9edd4000000046c98fba933b0f4ac95342420bd77676cd001d1541cce19c567e6f31684c63ff1475ec60be7757c5da570fda87f9d56c23e8f87a2f89abb62a3f048b28d084e8	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E586D9AA-6387-11EF-939B-CE3473C70610} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
4940	266e2b54a3c5f954287acfc4f78b8ce0N.exe
4940	266e2b54a3c5f954287acfc4f78b8ce0N.exe
4940	266e2b54a3c5f954287acfc4f78b8ce0N.exe
4940	266e2b54a3c5f954287acfc4f78b8ce0N.exe
4940	266e2b54a3c5f954287acfc4f78b8ce0N.exe
4940	266e2b54a3c5f954287acfc4f78b8ce0N.exe
4576	266e2b54a3c5f954287acfc4f78b8ce0n.exe
4576	266e2b54a3c5f954287acfc4f78b8ce0n.exe
4576	266e2b54a3c5f954287acfc4f78b8ce0n.exe
4576	266e2b54a3c5f954287acfc4f78b8ce0n.exe
3128	acrotray.exe
3128	acrotray.exe
3128	acrotray.exe
3128	acrotray.exe
3128	acrotray.exe
3128	acrotray.exe
644	acrotray.exe
644	acrotray.exe
644	acrotray.exe
644	acrotray.exe
2232	acrotray .exe
2232	acrotray .exe
2232	acrotray .exe
2232	acrotray .exe
2232	acrotray .exe
2232	acrotray .exe
1028	acrotray .exe
1028	acrotray .exe
1028	acrotray .exe
1028	acrotray .exe
4576	266e2b54a3c5f954287acfc4f78b8ce0n.exe
4576	266e2b54a3c5f954287acfc4f78b8ce0n.exe
644	acrotray.exe
644	acrotray.exe
1028	acrotray .exe
1028	acrotray .exe
4576	266e2b54a3c5f954287acfc4f78b8ce0n.exe
4576	266e2b54a3c5f954287acfc4f78b8ce0n.exe
644	acrotray.exe
644	acrotray.exe
1028	acrotray .exe
1028	acrotray .exe
4576	266e2b54a3c5f954287acfc4f78b8ce0n.exe
4576	266e2b54a3c5f954287acfc4f78b8ce0n.exe
644	acrotray.exe
644	acrotray.exe
1028	acrotray .exe
1028	acrotray .exe
4576	266e2b54a3c5f954287acfc4f78b8ce0n.exe
4576	266e2b54a3c5f954287acfc4f78b8ce0n.exe
644	acrotray.exe
644	acrotray.exe
1028	acrotray .exe
1028	acrotray .exe
4576	266e2b54a3c5f954287acfc4f78b8ce0n.exe
4576	266e2b54a3c5f954287acfc4f78b8ce0n.exe
644	acrotray.exe
644	acrotray.exe
1028	acrotray .exe
1028	acrotray .exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4940	266e2b54a3c5f954287acfc4f78b8ce0N.exe
Token: SeDebugPrivilege	4576	266e2b54a3c5f954287acfc4f78b8ce0n.exe
Token: SeDebugPrivilege	3128	acrotray.exe
Token: SeDebugPrivilege	644	acrotray.exe
Token: SeDebugPrivilege	2232	acrotray .exe
Token: SeDebugPrivilege	1028	acrotray .exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4320	iexplore.exe
4320	iexplore.exe
4320	iexplore.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4320	iexplore.exe
4320	iexplore.exe
5048	IEXPLORE.EXE
5048	IEXPLORE.EXE
4320	iexplore.exe
4320	iexplore.exe
4056	IEXPLORE.EXE
4056	IEXPLORE.EXE
4320	iexplore.exe
4320	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 4576	4940	266e2b54a3c5f954287acfc4f78b8ce0N.exe	87
PID 4940 wrote to memory of 4576	4940	266e2b54a3c5f954287acfc4f78b8ce0N.exe	87
PID 4940 wrote to memory of 4576	4940	266e2b54a3c5f954287acfc4f78b8ce0N.exe	87
PID 4940 wrote to memory of 3128	4940	266e2b54a3c5f954287acfc4f78b8ce0N.exe	96
PID 4940 wrote to memory of 3128	4940	266e2b54a3c5f954287acfc4f78b8ce0N.exe	96
PID 4940 wrote to memory of 3128	4940	266e2b54a3c5f954287acfc4f78b8ce0N.exe	96
PID 4320 wrote to memory of 5048	4320	iexplore.exe	99
PID 4320 wrote to memory of 5048	4320	iexplore.exe	99
PID 4320 wrote to memory of 5048	4320	iexplore.exe	99
PID 3128 wrote to memory of 644	3128	acrotray.exe	100
PID 3128 wrote to memory of 644	3128	acrotray.exe	100
PID 3128 wrote to memory of 644	3128	acrotray.exe	100
PID 3128 wrote to memory of 2232	3128	acrotray.exe	101
PID 3128 wrote to memory of 2232	3128	acrotray.exe	101
PID 3128 wrote to memory of 2232	3128	acrotray.exe	101
PID 2232 wrote to memory of 1028	2232	acrotray .exe	102
PID 2232 wrote to memory of 1028	2232	acrotray .exe	102
PID 2232 wrote to memory of 1028	2232	acrotray .exe	102
PID 4320 wrote to memory of 4056	4320	iexplore.exe	105
PID 4320 wrote to memory of 4056	4320	iexplore.exe	105
PID 4320 wrote to memory of 4056	4320	iexplore.exe	105
PID 4320 wrote to memory of 2700	4320	iexplore.exe	107
PID 4320 wrote to memory of 2700	4320	iexplore.exe	107
PID 4320 wrote to memory of 2700	4320	iexplore.exe	107

C:\Users\Admin\AppData\Local\Temp\266e2b54a3c5f954287acfc4f78b8ce0N.exe
"C:\Users\Admin\AppData\Local\Temp\266e2b54a3c5f954287acfc4f78b8ce0N.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Users\Admin\AppData\Local\Temp\266e2b54a3c5f954287acfc4f78b8ce0n.exe
  "C:\Users\Admin\AppData\Local\Temp\266e2b54a3c5f954287acfc4f78b8ce0n.exe" C:\Users\Admin\AppData\Local\Temp\266e2b54a3c5f954287acfc4f78b8ce0N.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4576
- C:\Program Files (x86)\Adobe\acrotray.exe
  "C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\266e2b54a3c5f954287acfc4f78b8ce0N.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Program Files (x86)\Adobe\acrotray.exe
    "C:\Program Files (x86)\Adobe\acrotray.exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\266e2b54a3c5f954287acfc4f78b8ce0N.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:644
- - C:\Program Files (x86)\Adobe\acrotray .exe
    "C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\266e2b54a3c5f954287acfc4f78b8ce0N.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2232
  - - C:\Program Files (x86)\Adobe\acrotray .exe
      "C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\266e2b54a3c5f954287acfc4f78b8ce0N.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1028

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:1844

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4320 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:5048
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4320 CREDAT:17416 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4320 CREDAT:17424 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\acrotray .exe

Filesize
1.0MB

MD5
f554c64871fd8e60f61d4a71f6548570

SHA1
d670bebd10d25adecf87c1d347cd80710cf15a99

SHA256
d9a3b7fa46415770959fce77f05f128c81839f8dc54eddc1a6839e1d8236b0d8

SHA512
9a1ec078bc9afff478208933375fe937af335cc12d8d329fc1ab70c998097c04b66fe658ad374b86a24466770e43b2a6cf58d59d206e02bbbbd827e12ce69257

Download Submit
C:\Program Files (x86)\Adobe\acrotray.exe

Filesize
1.0MB

MD5
6c6c8949114faf6f369e6635bb74d461

SHA1
96bf45383522d26fe12df82adfab03893bf65175

SHA256
34c5153b16ec299e4d071810eba0feea096422f968697b6649457fba40eabe20

SHA512
bf2e5df1ff606984deae2b1a1adca3dd4148ddf25933c37c24811a9aed6a3ac12a103bd58ddbfa3d2120ce4798b62684954506affc52cf89ff57e8b5672849a2

Download Submit
memory/4940-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download