3009cddaebd91f8fa5e80c6d0cafac9752164be45d77f5470fad1c1aab361db3

Analysis

user interaction
yes
max time kernel
223s
max time network
203s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 15:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NORC Contract.pdf
Size 960KB
Sample260424-sn58zset7j
SHA256 3009cddaebd91f8fa5e80c6d0cafac9752164be45d77f5470fad1c1aab361db3
MD5 da29599b32304f815c565330299983f1
SHA1 5414245de92b5b063177ade37dfe9d2f6c4c009f
SHA512 11fdaec62aaf6efff0db0506704a92812ce55e4469da88257e8d3808e04d507df56dd17b80a7b218a82f623f6d626e4ce81f2bb0d910b567eb73de3ee27693c0
SSDEEP 24576:c+QbFTLRAJICdnA3J7qMT9gAWobd0gG6SXPQhhu9XmjSrY/OTkwKOvQ2j8Mw:c+6xIICA3JnTTegPSXPq
TLSH
T186252220F958E88CD0C3C5AE40BB76C8D2ADF36397D57C55093F8B01FA4AD91EA93196
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeCollabSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeCollabSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FullTrustNotifier.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\MuiCache	AdobeCollabSync.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2188	AcroRd32.exe
2188	AcroRd32.exe
2188	AcroRd32.exe
2188	AcroRd32.exe
2188	AcroRd32.exe
2188	AcroRd32.exe
2188	AcroRd32.exe
2188	AcroRd32.exe
2188	AcroRd32.exe
2188	AcroRd32.exe
2188	AcroRd32.exe
2188	AcroRd32.exe
2188	AcroRd32.exe
2188	AcroRd32.exe
2188	AcroRd32.exe
2188	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2188	AcroRd32.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2188	AcroRd32.exe
2188	AcroRd32.exe
2188	AcroRd32.exe
2188	AcroRd32.exe
2188	AcroRd32.exe
2188	AcroRd32.exe
2188	AcroRd32.exe
2188	AcroRd32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 4764	2188	AcroRd32.exe	80
PID 4764 wrote to memory of 5248	4764	AdobeCollabSync.exe	81
PID 5248 wrote to memory of 5852	5248	AdobeCollabSync.exe	82
PID 2188 wrote to memory of 5888	2188	AcroRd32.exe	84
PID 5888 wrote to memory of 1876	5888	RdrCEF.exe	85
PID 5888 wrote to memory of 1876	5888	RdrCEF.exe	85
PID 5888 wrote to memory of 3484	5888	RdrCEF.exe	86
PID 5888 wrote to memory of 2712	5888	RdrCEF.exe	88
PID 5888 wrote to memory of 2748	5888	RdrCEF.exe	89
PID 5888 wrote to memory of 2748	5888	RdrCEF.exe	89
PID 5888 wrote to memory of 5144	5888	RdrCEF.exe	90
PID 5888 wrote to memory of 2492	5888	RdrCEF.exe	91

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\NORC Contract.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c --type=collab-renderer --proc=4764
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5248
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" GetChannelUri
      4⤵
      System Location Discovery: System Language Discovery
      PID:5852
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5888
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B47EEEAD20E7161049A3C582CE489236 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B47EEEAD20E7161049A3C582CE489236 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1876
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=15C96080F6749FC50004F3535012778E --mojo-platform-channel-handle=1764 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3484
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EBD789BF444AD83713AE58473CB7B39E --mojo-platform-channel-handle=1996 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2712
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=37C5E7C3ABD5B5B1E622022C8EFD60B1 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=37C5E7C3ABD5B5B1E622022C8EFD60B1 --renderer-client-id=5 --mojo-platform-channel-handle=2448 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2748
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9500279BEE8D98B27138725805A68181 --mojo-platform-channel-handle=2696 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5144
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CF491768BCAEE0DA2CDCA98D735DD733 --mojo-platform-channel-handle=2868 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 6a3c5c4a8e57f77ecc22078fbf603ecc31fb82d429bd87b7b4b9261447092aef
MD5 c26ed30e7d5ab440480838636efc41db
SHA1 c66e0d00b56abebfb60d2fcc5cf85ad31a0d6591
SHA512 96cdb78bca3e01d4513c31661987e5646e6a8ff24708918aa0d66dfa3ca5d98af4862c9f38c4f41f933c345d2d3adfb1d34d1430b33f45f916f41a9872a030df
SSDEEP 192:xedRBsKhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:xe+KhBvkZsLRGlzh+vS9
TLSH
T12C4387DF26348100CA07A8BABD71771BBA55D0BFC1C2F0E87A968A1780B457CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 ce1c8df679e31d5c1dc455a8c6064a195ab1305c6a29fd26d1fed8343e426b4e
MD5 13074ab54b1802f37bdcd91a5d46732d
SHA1 fea43dd29c29082e094d27e9773a683b7b3ed280
SHA512 3c02ecd8d53536df875cfbbb7bb30f714960f89ba55ea045f2be0310c95cf3efaa6ee6f7d3d5f793b1a592d49b1e2525ea9be116848c261a5c6e7d631e93dbc3
SSDEEP 384:yewdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:T+eUZsLQCZsL3hUS4
TLSH
T11E53CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 87aa4c64348b534771f03919b5bdca09596e89f6e0cca0a992bb3d290ec4155a
MD5 aebe0d2eb7a2077a55e57a955e62406a
SHA1 3f811b8148f12220f4b45699135e6d21c9847d8a
SHA512 efa1b082925a4e478fcea74764bbacb91d43da8c01c4b360a34e6f7402af23f91c93b5e91c6266120e144b5300e8dae73a62a7b6d7c4328410128f6a72a7baed
SSDEEP 192:t+oGsTzoU27NTaUxmYeMb1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:tklNveMbUNlNaN
TLSH
T1D293FD0F3556F261C5A8A6B4850084F351AEBF1BE7E6B1A391B6CC3F06F9743012DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 fba6a6e022d5a029dc7602d66b989f44396cbc6f446c754230989dc4aa12d096
MD5 ca211d4acbc8401c49d87b7c0b2630e3
SHA1 cb053c0d58e32b423f6d6482d7bc584d53c8b27d
SHA512 4f3ab6fe40076ca954b739ee40e5e671d8795a08ac4605aa8f6212d3cf064898389fa65db5b19f7a2e42dd453988d0b5563abb29391c9877ed8ffb8c2280cc24
SSDEEP 192:K+oGsTzoU27NTaUxmmX441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklNhX44UNlNaN
TLSH
T199930F0F3556F261C5A8A6B4810084F3119EBF1BE7E6F1A392B2CD3F16F9643002DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 217469d990a6de844cb77dc0adbdb738d5614e518f72f4666acd50abec3c3caa
MD5 57b94e3c1aa9d51d8dfbe7d6e21e952f
SHA1 43fd8ed9c2b56b1d339cccd26435f20d20448307
SHA512 e0a7b90a302548c7aed69cfd3e72e541b6c09713b240dc43283bee00f663caf0ab68e1fd35383ac8801722faab53336876ce4457165b7c312b98bb9ce2205cee
SSDEEP 192:a+oGsTzoU27NTaUxmGNGHMX441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGW:aklNPssX44UNlNaN
TLSH
T13B930E0F3556F261C5A8A6B4814084F3119EBB1BE7E6F1A392B2CD3F16F9743012DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 a027cf12f2055635a3020f08e0448b2f0314791260ccd25570426088c5b0e307
MD5 245950c48f668cf2fcb3c64778e64089
SHA1 3a5a14c820f58e35a3fc6f5de29669f0840587d8
SHA512 4fc8448536663b551cc716d78715f06d4ed217fbdf755924f0b30aebbb6212798a61c6638f919d5c14bdb6998d6a12f0ca37281f3c7f484c1821fbfc98d4a24d
SSDEEP 192:K+oGsTzoU27NTaUxma1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklN7UNlNaN
TLSH
T17293780F250AF221D5A96A74C144C9E342A97B0FE3FA35F751F5CC3E5AD5A82013EB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resource-18

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\resources\resource-18
Size 4.2MB
SHA256 17420491277461b61cd7d9334fd8dc9360f3ceb1545e85578a5e86d02a81a707
MD5 f08bf967cc493e693d95878d53410865
SHA1 21a01d7fd8813cb92d7d5a163232ef26941a8c3c
SHA512 89bbe92ab22d68bac3737200f8a18e7db1f82febdf952c28c6cfe29efd6f88599c1391811320aa8cef9566463837d5a46b47520f566c4bd1e45158e93afa7df1
SSDEEP 98304:uoRiM5n8Uq8HzJLdIiZmuFQglXDcgFIuAx+X64SuHp8t9s/XKdmu:pR1Lq8nQUWzJYNJ8aXKd5
TLSH
T14A1633C6A43A58A9D91B87DF1E797C7201ABBC1B85D636CD7C5CAB848301DC3F66012B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 471B
SHA256 a1f2b22a35774e545ea3c3e2b94442e2ba950ee10249aaa445a348c4a236be38
MD5 d910f6c913ba5856c0b8d5d5eca77eb6
SHA1 ccd9122325b29362a1bbd4da866db9321a918c07
SHA512 d8639e90707f025212fc5f60d71ff2774835547f20e6ee8562b580382210dd1ef0ae7e3ed2c0627c268c56e480cbcc64546a3164d10da4ab6e7b16bdc38cfb70
TLSH
T126F0D4464290F1F21BC188DD14F61BA2F424D31A0C4891C8D47D49D75E6DB79F859877
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 d45f53d7d1d073d6c00c2d4d7d717a4bf160bada8174b5630a3abc0a0f14bb72
MD5 d52511c67d4d54ccd14701f67316c8d1
SHA1 bd123010a29f383824c908f5e83b221a30c03c52
SHA512 a5289bf60b9682a9107b495c9178498d7e5b0142d525fd4a233d4e44d98ad10e9eb7708bc7040cdac2310a0948a7574782b57343fc18204679b4c64aae52abbf
TLSH
T1A2E08C113AA84200E5330A3EAD73A5449A767626AA10CA8E4675108C1D26FE19D32319
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 412B
SHA256 60b7e7ee4d3d646715fb2dcf9ca3b423261906fd663562154b3afe770f380dad
MD5 5346acb167f740fd89753ddacf1291d0
SHA1 a425491365e489abb3d5c5c48babcfda1fbfe71d
SHA512 ac03551bd7ab8a5d2e4b8a04d75525b014df7e90babaf08ecda3435634d00eed3c62d5a76e69a1d8b81daef70753dca080dc1baf4db8cb71b47ecb241f8279c7
TLSH
T106E0C01416FB44DCF5E1C63887E66C2149EDF021042AB3B921D02B0C7B03500FC02938
MD5 SHA1 SHA512 TLSH

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 71eac47458f26bded9b61d27f96b407541c868d03a3b24814f3262def4066939
MD5 a45f1b88ebc54232a343174190f96842
SHA1 b9b39d8c4b15a5e5c04cf41b0aed169aeaed9d1a
SHA512 106f7d110c1db9be64d322101e0d9405ef8c8615ea0e40ba8cd0c246dc4f0b527b69a2f1b53ffd44877279bc8c598ed84c8c108043bdd17d788295e9a86765e8
SSDEEP 24:TLCx/XYKQvGJF7ursdIONMJnhssoXtsoXesoXS/EwT0hU2QJ+aGsoXbssoXEiSA:Tul2GL7ms+ONMJnusestsRp+xsSss8
TLSH
T1DC4208D725ACAE33CD85E9367588B5013B68A185CFA33783B7A04B3184DC1BDD57B09A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addressbook.acrodata

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
Size 14KB
SHA256 06a576fc14e995c437b26c0d150b4e84cd745e7cedfd972a84b42b51c842fc9b
MD5 947f93fe0eed44767626846f28cfde05
SHA1 f6276d2a2b4a9d8a8e23c84019cd3961e9d60e88
SHA512 f97739eb0d22a99b06ef340aefb0d5a5b45b679d28accff3de2565166392c7d2fabaa33f945696f7d456ba2ef323f48e43eb26578f71c8b2e8ed32fb4dc69bc9
SSDEEP 192:gcPqYV/saFlwwR+kMqe8TlZMX1sgUVa3ddMVsuNeMcGdSD9obOUAVlcMudM/Y14W:g7Q/X4kMb0lZ6mgtdHOelGdWaolvsTh
TLSH
T18652B7E55E67BC99D827C649CB3430965AF250A703981E20928D6BD43EE789F3B40B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addressbook.acrodata

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
Size 6.2MB
SHA256 edad7d6ede0924c2cb0a736711ffb268bfd8059bd90f98c7af3e3da287fe64b7
MD5 4c55cc940a1f81a35eeb665c19313cfe
SHA1 ba79f05c8c744783991ea55f6710ab4b7ffb38fc
SHA512 dacc000a1546c72bc656a32630cba1606978e808e03788237b3969487ebf992c5b86881cb396569f814966224610ececa7c25d0eaef13cff4f4b3de1eebd9a49
SSDEEP 24576:uHrfne+B8kifqKT1+JPSYA0gXgaKn4rO/FJgbqSMzQe9zW7G7K0+mYj6SEEjLEWV:F
TLSH
T19566E9E48A6BECC5D817E188CBB875F756B2317703A40D20479D36D02F9698B3B44A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1876-194-0x00000000010E0000-0x000000000115A000-memory.dmp

Download

memory/2492-140-0x0000000001080000-0x00000000010FA000-memory.dmp

Download

memory/2712-123-0x0000000000FC0000-0x000000000103A000-memory.dmp

Download

memory/2748-195-0x0000000001350000-0x00000000013CA000-memory.dmp

Download

memory/3484-116-0x00000000011C0000-0x000000000123A000-memory.dmp

Download

memory/4764-53-0x0000000000A00000-0x0000000000A7A000-memory.dmp

Download

memory/5144-132-0x0000000001510000-0x000000000158A000-memory.dmp

Download

memory/5248-54-0x00000000011C0000-0x000000000123A000-memory.dmp

Download

memory/5852-48-0x0000000002640000-0x00000000026BA000-memory.dmp

Download

memory/5888-193-0x0000000001510000-0x000000000158A000-memory.dmp

Download

memory/5888-322-0x0000000001510000-0x000000000158A000-memory.dmp

Download