bcc645e20e47d3127d8f90ac6cb22cb75521777dc0cb43baa975f4fcc6cad676

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payment_Requisition-Nairobi_City_Water_and_Sewerage_Company_Limited_organized_%281%29_signed.pdf
Size 4.3MB
Sample260813-phebjayhkd
SHA256 bcc645e20e47d3127d8f90ac6cb22cb75521777dc0cb43baa975f4fcc6cad676
MD5 cdd3d1dd50a05255c47a7317b14ecd60
SHA1 ce6600d4b1baa2ca0f0018788a407dc9f18a10b7
SHA512 51ab1ecb28df6b906dcc0dfbcce76ee759923a3b22e6534eecdc392db417f6ee1489d2220e20bbadb56e46f03f9b8725e1f29708babeedbb32ed5c00b652f782
SSDEEP 98304:in/fvkMFG/cxR/3reBHoxl0gCt1drgXBdhj7npPS/CNbyJPn12:i/fvdq2vry8lEh8jhjbAC8h0
TLSH
T162262366E459AC6CCD83C6DAD76935D20FAEF17362C938A3241C4FC03445EC1BB5A78A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FullTrustNotifier.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeCollabSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeCollabSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\MuiCache	AdobeCollabSync.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4500	AcroRd32.exe
4500	AcroRd32.exe
4500	AcroRd32.exe
4500	AcroRd32.exe
4500	AcroRd32.exe
4500	AcroRd32.exe
4500	AcroRd32.exe
4500	AcroRd32.exe
4500	AcroRd32.exe
4500	AcroRd32.exe
4500	AcroRd32.exe
4500	AcroRd32.exe
4500	AcroRd32.exe
4500	AcroRd32.exe
4500	AcroRd32.exe
4500	AcroRd32.exe
4500	AcroRd32.exe
4500	AcroRd32.exe
4500	AcroRd32.exe
4500	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4500	AcroRd32.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4500	AcroRd32.exe
4500	AcroRd32.exe
4500	AcroRd32.exe
4500	AcroRd32.exe
4500	AcroRd32.exe
4500	AcroRd32.exe
4500	AcroRd32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 3316	4500	AcroRd32.exe	87
PID 3316 wrote to memory of 1940	3316	AdobeCollabSync.exe	88
PID 4500 wrote to memory of 1436	4500	AcroRd32.exe	89
PID 1436 wrote to memory of 4048	1436	RdrCEF.exe	90
PID 1436 wrote to memory of 4464	1436	RdrCEF.exe	91
PID 1436 wrote to memory of 4464	1436	RdrCEF.exe	91
PID 1436 wrote to memory of 4600	1436	RdrCEF.exe	93
PID 1436 wrote to memory of 1608	1436	RdrCEF.exe	94
PID 1436 wrote to memory of 1608	1436	RdrCEF.exe	94
PID 1436 wrote to memory of 2336	1436	RdrCEF.exe	95
PID 1940 wrote to memory of 2456	1940	AdobeCollabSync.exe	96
PID 1436 wrote to memory of 1788	1436	RdrCEF.exe	97

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Payment_Requisition-Nairobi_City_Water_and_Sewerage_Company_Limited_organized_%281%29_signed.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c --type=collab-renderer --proc=3316
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1940
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" GetChannelUri
      4⤵
      System Location Discovery: System Language Discovery
      PID:2456
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=52F49429247EF1CCADDE9591D2835DCE --mojo-platform-channel-handle=1716 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4048
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1379F8C8994BDB2BC3EF61B970EF8486 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1379F8C8994BDB2BC3EF61B970EF8486 --renderer-client-id=2 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4464
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FE040B239BBD3A2588BFB9D7B65AD7B3 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4600
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1DEF0244DB50FFEBB25D8C63BBA957FD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1DEF0244DB50FFEBB25D8C63BBA957FD --renderer-client-id=5 --mojo-platform-channel-handle=1936 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1608
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3E58A055B90E49F46CD585241A881E7E --mojo-platform-channel-handle=1944 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2336
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0DA9AA10D54DD31A47F4A472580F1C18 --mojo-platform-channel-handle=2804 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 8c9d4a0f980fcbe53e0f220847c48597260b9f216b7a50b31f46bf0344fbe830
MD5 b387c90dd0e0a283a75b447134555f6c
SHA1 d3016e04dca80a04d0b457ca3f21539e5bfbe85d
SHA512 d10b5e00f918ac4eff7ab2b7bcc671f4edc828bb1690b0ebd62dda7e3ca4802f18c72686b77982c3e847f708a77fc09a86f767f5d687e5b9796f03f73fc63631
SSDEEP 384:yeVdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:k+eUZsLQCZsL3hUS4
TLSH
T1E753CADB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 87aa4c64348b534771f03919b5bdca09596e89f6e0cca0a992bb3d290ec4155a
MD5 aebe0d2eb7a2077a55e57a955e62406a
SHA1 3f811b8148f12220f4b45699135e6d21c9847d8a
SHA512 efa1b082925a4e478fcea74764bbacb91d43da8c01c4b360a34e6f7402af23f91c93b5e91c6266120e144b5300e8dae73a62a7b6d7c4328410128f6a72a7baed
SSDEEP 192:t+oGsTzoU27NTaUxmYeMb1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:tklNveMbUNlNaN
TLSH
T1D293FD0F3556F261C5A8A6B4850084F351AEBF1BE7E6B1A391B6CC3F06F9743012DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 4107286969a59563bcf41c063e283f7b2abb23f5f7b2c31d3ab32e75c161284c
MD5 4b3e3aa8d6578364502428f9a9115ae7
SHA1 2200c6155bc053e7fd3e36195784bd13081941b4
SHA512 98d549822eaff0148d11b0aa299e343d92905c6a8ab6ed6fab74b490dd2c39255b72ea30d644bc031fac726f9a58222407f6baebe2a5d03d0397975e032cfce3
SSDEEP 192:q+oGsTzoU27NTaUxmNC441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:qklNaC44UNlNaN
TLSH
T1D293FE0F3556F261C5A8A6B4814084F3119EBF1BE7E6F1A392B6CD3F16F9643002DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 4456b35cd6c112d17a841fb1dd2b7020e0723dfde48c8b8caa822bb22f3199e8
MD5 fc8e0ea2c7a30f9d4d8a08b74c44e7c6
SHA1 b07c93508425f102dbfc6754972cecb155bbd936
SHA512 c8a7c0ed0527e507928ac67c9f5cb2c238d409dda668f1dc011513ef03c94ecbc74dfff522313490ad7225bc95735e55aaf6678f344ed88d63d529507b3148d9
SSDEEP 192:q+oGsTzoU27NTaUxmkyZMVy1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:qklN/xVyUNlNaN
TLSH
T16E930F0F3556F261C5A89AB4814084F3119EBF1BE3E6F1A392B2CD3F16F9643102DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 eaa47c0a34bf0cf21efcf8789a2e5e1fe2a6376e86a7eecf89f0ca3f7bfffbe7
MD5 08c51fd38e0650ebe0918ef991f3993e
SHA1 65cb7317b8c66c955c9b30350dffe2ea517f1349
SHA512 ffb711aeee17867d06dfeb942682420d365c88d7e242033effe375a3ac11e244c5e7cb4593804dee9779a0944e1131274023da138b2a1a51d191061a75f1b69e
SSDEEP 192:6+oGsTzoU27NTaUxmeyUexQlJ5Vy1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAx0:6klNJYQz5VyUNlNaN
TLSH
T14A930E0F3556F261C5A8A6B4814084F3119EBB1BE7E6F1A392B2CD2F16F9743012DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 5eff1e093e369b26ffe0413eb2f5a9b3e2c97955aa9349ecb55bceea824084f2
MD5 ed07b6c637c1b2c121d56db6225b8c40
SHA1 7755d849cf63087165a94a8f7df15249735a4578
SHA512 3470b70e5344c427c2117d65e1698bf452620ba99e72bc63b3be5f74c7997c4fae9d326b397d7ec6f2a52730da22462976c22211baf39ffd04e23de33e0cc9c1
SSDEEP 192:K+oGsTzoU27NTaUxm+X441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklN5X44UNlNaN
TLSH
T17E930F0F3556F261C5A89AB4810084F3119EBF1BE7E6F1A392B6CD3F16F9643002DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 a027cf12f2055635a3020f08e0448b2f0314791260ccd25570426088c5b0e307
MD5 245950c48f668cf2fcb3c64778e64089
SHA1 3a5a14c820f58e35a3fc6f5de29669f0840587d8
SHA512 4fc8448536663b551cc716d78715f06d4ed217fbdf755924f0b30aebbb6212798a61c6638f919d5c14bdb6998d6a12f0ca37281f3c7f484c1821fbfc98d4a24d
SSDEEP 192:K+oGsTzoU27NTaUxma1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklN7UNlNaN
TLSH
T17293780F250AF221D5A96A74C144C9E342A97B0FE3FA35F751F5CC3E5AD5A82013EB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 3bfdcfd0a9617d6fb18b115b797339ce28d00d0936f31028fe2cb76c123e50e9
MD5 0327cb69b62706e7ef62b3ab501ecc5f
SHA1 17217b6d5ad794b0d682e1c4073cdef1c34d90d8
SHA512 f53340cda7581f46a961d28553376bb41c45cd241e05a51cdc2f7adc39ed0b4a7ff4bd60e5623c354063852099231e9f7c55e957aeaefc4fe37eef5bdbf6ba5f
SSDEEP 192:K+oGsTzoU27NTaUxm41AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklNJUNlNaN
TLSH
T17393780F250AF221D5A96A74C144C9E342A97B0FE3FA35F751F5CC3E5AD5A82013EB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resource-19

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\resources\resource-19
Size 4.3MB
SHA256 ed7d2fc2c84e03a3b7805b2d7baafae7b5db47bb1cc513d31ee5953453292abb
MD5 afee19ad5dfb509155ae17143c2fc5fc
SHA1 c7577c1d72933d0c817501041b4cc4fe1db14b57
SHA512 6a5e5ef76f59f26daaae41e28cd718e71f2eadaaf7f95bb600318b8dd770f3a38ad931778035bc8c5ebc97098456a190769952543c5931986489629f57e65685
SSDEEP 98304:N7cvkxdmiophbqm19q7Z80v9sJqu0wdr/dl6HGdRwfCJ7D7GA261fzITbjFdmF+:JcMfOphbqp7Z8i920wdLdl6mdTD7GA2h
TLSH
T1982633D8EE0B18F8CAB574A4845EB2CD82AA37076ED17003B74E998427167F1F5C5EC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 cd801c7bfd256cb6686b38fcbfaebe7e7a5fc86abf7329df38f72b1a16a5258b
MD5 f7ee5513b41e99a5fe2d7d34b8aaa28c
SHA1 b6b6b31d607f882b34d96c486660720eee1ecc4b
SHA512 94c685a910d4a9c7f23aca4e8c0517c34fd2174f969760f6cdf25c21219a06695c951e1fe07f1ebe7a29ae466e9c53283cf728be570f95b04b1868353e3d4a41
TLSH
T1CDE017122AE80208E5770A3CA97366499D76B76BAA01CBDD0275008D5C26F628932729
MD5 SHA1 SHA512 TLSH

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 d7a95c47fcf363955ca81f3e739e54cf3fec16930b33fd990f602563f327109b
MD5 658afa392a708f7d71a2fffbe4fdb4c3
SHA1 a864472a15776242cd5b08397149ffb2498ec6b1
SHA512 7b5060b3b9033f73b867d35139bbe1c1c39a58d018afecfa9eade8a0e4c9658f458b4be031485c7040ce1bc9de9d2c99204283e58bf93676087863c569cc3685
SSDEEP 48:T+l2GL7msBIhISQP7wHIINII+9IbIDtIWINI4:8Vms+eTsJv+/4
TLSH
T14A424D9D16EDB772C8144B37808109B23EA8427F87AF155A77334476FC7F9099822993
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 808b4efef6016868413d2a4b567efe5500cbca8ed2709af87435ac270ebaf4e7
MD5 84fb61c0a5270c00015cc9f864566ac0
SHA1 737bdc7b9f5072d57b6fb83368388349a3a44c53
SHA512 f1a99063b668f31a9b196cfc7e71ffc238c51ae1841b1d466803c6f67ed76a0331ca949c035995abb13e7a6e7a6388f57d4a568aee560b6264e20ddd249652a6
SSDEEP 48:T+l2GL7msQHIIjIIcHIIwIz3IhISQP7wHIINII+9IbIDtIWINI4:8VmsSpjp2pwzeTsJv+/4
TLSH
T18F426F9D16EDB772C8045B3780810DB23E94417A86AE164E7733447AFC3F90A9832D93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 8c445705b0e64e7b3858786113a003d92772b35ba3bff48b5c1e2a4e1c84e169
MD5 0fcd4bf5736df1cd35d9d60740e5e909
SHA1 58c1de69a57a811d444fdf3f8983376bea5fb2a4
SHA512 e0499a793f15ee6f36ca64275a8063fc5b64a1f85a73726d16c53d1f86d0d87394749e7440b9eaf122dfb0f3d930fce710b7c55e3a4912176d597dba6e65b25b
SSDEEP 48:TuNl2GL7msl7IdIMInIVIaXvHXuXoX6XB7xHIIjIIcHIIwIz3IhISQP7wHIINIIr:CDVmseSFIKav+YKfpjp2pwzeTsJv+/4
TLSH
T12642F85D21EDB762C8055B3744450EB27AC4427A86AE164E7B33447AFC7F90AD832D93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 d37555915eb7204f48d2d9e4a314d1ed0d86e7744c8692a779bf6b9476462e0d
MD5 e941ec88526aa173e0a6e06caec53de3
SHA1 12316c80c6b9cb48b99e9dc070930952725d40d8
SHA512 383d17ea0a0c31551e809a08cd62e301b19cd1e2e3ecc21f317b8e6c3f6e102bd3176d1038de0164150c63a93d1d1ffcd2e5a18858fbeae022007239a2e29644
SSDEEP 24:TL6vx/XYKQvGJF7ursdPqHEXeP2QtEXeP+9EXO8EXOebtEXOeElEXOiEXOH:T2vl2GL7msQHIINII+9IbIDtIWINI4
TLSH
T17F42599E06AD7772C8444B36808109B27FB8017E436E090A772344B5ED6F94AA862A97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addressbook.acrodata

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
Size 14KB
SHA256 06a576fc14e995c437b26c0d150b4e84cd745e7cedfd972a84b42b51c842fc9b
MD5 947f93fe0eed44767626846f28cfde05
SHA1 f6276d2a2b4a9d8a8e23c84019cd3961e9d60e88
SHA512 f97739eb0d22a99b06ef340aefb0d5a5b45b679d28accff3de2565166392c7d2fabaa33f945696f7d456ba2ef323f48e43eb26578f71c8b2e8ed32fb4dc69bc9
SSDEEP 192:gcPqYV/saFlwwR+kMqe8TlZMX1sgUVa3ddMVsuNeMcGdSD9obOUAVlcMudM/Y14W:g7Q/X4kMb0lZ6mgtdHOelGdWaolvsTh
TLSH
T18652B7E55E67BC99D827C649CB3430965AF250A703981E20928D6BD43EE789F3B40B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addressbook.acrodata

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
Size 6.4MB
SHA256 69d8e6484ffeeaa9b1ec6bb8707cdb15fe9cc4e854d1c7a40282c8772f53e1cc
MD5 ac80456395578e672c2a270d06469148
SHA1 eb91b84732599c333a1274904f39766f08bcac5c
SHA512 68416678d6f235d88d8c111d01a51a4565433eb0c642252e37a2285372dfd66c083bd95e80b4d95e9ea385ff203f6842763c1e87decf4ca76daeea4a10839204
SSDEEP 24576:67GBIIYsDBY2kNIe8o5UUvZ62BvqmN1qj+sgn80qsMbFmx8Az2DgpN3BB026c6gF:c
TLSH
T1CA66FAE48A6BECC5D817E188CBB875F756B2317703A40D20479D36D02F9698B3B44A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download