d0bdb1b53a127f4d5fe4901e4100c5addda444f8e7549d596fe2ed85d400b4d5

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 09:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
10th Annual Electrification & Decarbonization for NRMM 2026.pdf
Size 378KB
Sample260820-k6hlmscd72
SHA256 d0bdb1b53a127f4d5fe4901e4100c5addda444f8e7549d596fe2ed85d400b4d5
MD5 26acc5b92affee51b9d42fed49e94fb4
SHA1 80eedc4286162b76386ba4d28c99e027c220eda3
SHA512 4ad54660560b0b89bebe297fecd71a83131477123bb68bf14a84a7a5cd805c52087cd67527aa9f47651f8c285b9f85222f2db15361de4a5d724b1db112c7eb21
SSDEEP 6144:dx99/tARkbPcxCUAKILWL9bClwDFQ2q8QwGFiTh/hKCYp/QqfRt3qEwt:d/91tBtWIlwfq8KqdhRYp/rfRt3fo
TLSH
T17A849FB7E6EE745DC88686C0AA8C1581448EC2F6AF1C70632C6C86C5374CD91FDA5BF6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FullTrustNotifier.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeCollabSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeCollabSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\MuiCache	AdobeCollabSync.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
5156	AcroRd32.exe
5156	AcroRd32.exe
5156	AcroRd32.exe
5156	AcroRd32.exe
5156	AcroRd32.exe
5156	AcroRd32.exe
5156	AcroRd32.exe
5156	AcroRd32.exe
5156	AcroRd32.exe
5156	AcroRd32.exe
5156	AcroRd32.exe
5156	AcroRd32.exe
5156	AcroRd32.exe
5156	AcroRd32.exe
5156	AcroRd32.exe
5156	AcroRd32.exe
5156	AcroRd32.exe
5156	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5156	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5156	AcroRd32.exe
5156	AcroRd32.exe
5156	AcroRd32.exe
5156	AcroRd32.exe
5156	AcroRd32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5156 wrote to memory of 2644	5156	AcroRd32.exe	87
PID 2644 wrote to memory of 5904	2644	AdobeCollabSync.exe	88
PID 5156 wrote to memory of 5372	5156	AcroRd32.exe	90
PID 5372 wrote to memory of 5224	5372	RdrCEF.exe	91
PID 5372 wrote to memory of 4508	5372	RdrCEF.exe	92
PID 5372 wrote to memory of 4508	5372	RdrCEF.exe	92
PID 5372 wrote to memory of 5024	5372	RdrCEF.exe	93
PID 5372 wrote to memory of 5056	5372	RdrCEF.exe	94
PID 5372 wrote to memory of 4984	5372	RdrCEF.exe	95
PID 5372 wrote to memory of 4984	5372	RdrCEF.exe	95
PID 5904 wrote to memory of 4192	5904	AdobeCollabSync.exe	96
PID 5372 wrote to memory of 1476	5372	RdrCEF.exe	97

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\10th Annual Electrification & Decarbonization for NRMM 2026.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5156
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c --type=collab-renderer --proc=2644
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5904
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" GetChannelUri
      4⤵
      System Location Discovery: System Language Discovery
      PID:4192
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5372
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=799303905D909DA18A7089F079332C19 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5224
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2E1C811DBF27A1350BB537BD9487450E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2E1C811DBF27A1350BB537BD9487450E --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4508
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B9613489331FACFFAB8C933AE51C3EBD --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5024
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=20328A91D94C072959B2213433FC8FD4 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5056
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=561687B164E4125E23C4A1447FA2A828 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=561687B164E4125E23C4A1447FA2A828 --renderer-client-id=6 --mojo-platform-channel-handle=2456 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4984
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0FFEE1C1DC6B2021B168CAC807B493CC --mojo-platform-channel-handle=2668 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 158e2dcc2baf02fde3f0f600ef2b9437ec6e945513594e432dad5809f3d0b907
MD5 46e37cd78bd3f90c4be4c29417ac7fd1
SHA1 544b2513e129d83dae20093134a2250b81b93201
SHA512 9fefbab556704bcd7ca03aad9d599473b994b1f7671701e418e1f2850dbd65107bc4fc6bbb441ed0d6e288181e9a48f36c7a3108149854cec6ce3d5aed1a9f15
SSDEEP 384:ye0dThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:/+eUZsLQCZsL3hUS4
TLSH
T1F653CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 87aa4c64348b534771f03919b5bdca09596e89f6e0cca0a992bb3d290ec4155a
MD5 aebe0d2eb7a2077a55e57a955e62406a
SHA1 3f811b8148f12220f4b45699135e6d21c9847d8a
SHA512 efa1b082925a4e478fcea74764bbacb91d43da8c01c4b360a34e6f7402af23f91c93b5e91c6266120e144b5300e8dae73a62a7b6d7c4328410128f6a72a7baed
SSDEEP 192:t+oGsTzoU27NTaUxmYeMb1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:tklNveMbUNlNaN
TLSH
T1D293FD0F3556F261C5A8A6B4850084F351AEBF1BE7E6B1A391B6CC3F06F9743012DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 3b0672787d02f3ef5bbe0f67125631453f7fd26e65f3e1ff334b6e0af2c2116b
MD5 ac1518aae104db697b080af9a48b15a8
SHA1 664f6044be0a04de6b1344933673ad1ab406eb4a
SHA512 c78789d116aab0c65a8a67cc8fd5eb28159470c5971349c9fcb5c14257c6dbf53de1b99c2d4312a9d30be62614c24cd88c1f1e79b30a4e5d814d25bad5f0b40a
SSDEEP 192:q+oGsTzoU27NTaUxmtC441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:qklNKC44UNlNaN
TLSH
T15D93FE0F3556F261C5A8A6B4814084F3119EBF1BE7E6F1A392B6CD3F16F9643002DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 32b6e0e29973cd382ee93087d34e6b648677db2e6f06ccb721580a1a00a9a97d
MD5 0738dac9137efa981900c9e33d9d33dd
SHA1 123e5e37483697734a8d3f75e8e9584ff28c6c2b
SHA512 4f4d28abff9a8e99f23d18881de0855c864c7abd333a255e2a7a943d758485f958e55b3175a53f0f337383694a462f064baa6932b93b9c6039904745bc610d0d
SSDEEP 192:q+oGsTzoU27NTaUxmEyZMVy1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:qklNXxVyUNlNaN
TLSH
T162930F0F3556F261C5A89AB4814084F3119EBF1BE3E6F1A392B6CD3F16F9643102DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 e330b95c44ab7fa89109c7105585794b3684780c7027a5366693edac9e1fdb7d
MD5 28250a443657f41773f0d68617408843
SHA1 15ac2c8fc4044d4ec0e4810938c2462dac8c94b2
SHA512 a6baa315e1e0febba6140cd7c4440b728a01245fe4f27fa7a7666867d446aeaa1c17ae2eae50c66628bb98f8c8f8c976c2968ce2939d97a6859991c884e12656
SSDEEP 192:K+oGsTzoU27NTaUxmxywMVy1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklNKWVyUNlNaN
TLSH
T1FA930F0F3556F261C5A8A6B4814084F3119EBF1BE3E6F1A392B6CD3F16F9643002DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 d8b560462cf65dfd1bf5ffa6fef735a46625a9e8ae04eb325bc52d936a93b7e8
MD5 1348e6d23b2f54481e801969140791e1
SHA1 0ab775507b9978c27a03bf456224e65f4ec0275d
SHA512 7b23bd1a63e28668d31f6b7c2db35205ec6a79dd1c7f6e7093923ad7b39a95141b27f3caeab6da550e29779b09eb787f7190ca92cdb859338bc335e1671aca6a
SSDEEP 192:6+oGsTzoU27NTaUxm9X441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:6klNOX44UNlNaN
TLSH
T154930F0F3556F261C5A8A6B4814084F3119EBF1BE7E6F1A392B2CD3F16F9643002DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 d1a281ab5514b079f0486556db129257d3e954a8527c8949dd7d5988406a4288
MD5 c7ea10ba006f7ce0d2cd52da35be9985
SHA1 2971c1f92ec88b860ed2c4edd29ff03c66003136
SHA512 9e3f06bfd920c91dfd46473e317e19e9747dcdabe250fa79cbc3bc656ecbcee90497e00344ca004517953716568692ce9cb3ce7717cc6d174f7801b3e5f575a4
SSDEEP 192:K+oGsTzoU27NTaUxm2X441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklNxX44UNlNaN
TLSH
T18E930F0F3556F261C5A8A6B4810084F3119EBF1BE7E6F1A392B2CD3F16F9643002DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 a027cf12f2055635a3020f08e0448b2f0314791260ccd25570426088c5b0e307
MD5 245950c48f668cf2fcb3c64778e64089
SHA1 3a5a14c820f58e35a3fc6f5de29669f0840587d8
SHA512 4fc8448536663b551cc716d78715f06d4ed217fbdf755924f0b30aebbb6212798a61c6638f919d5c14bdb6998d6a12f0ca37281f3c7f484c1821fbfc98d4a24d
SSDEEP 192:K+oGsTzoU27NTaUxma1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklN7UNlNaN
TLSH
T17293780F250AF221D5A96A74C144C9E342A97B0FE3FA35F751F5CC3E5AD5A82013EB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 471B
SHA256 c3dec61579a131697275223a1db34e4cca3758a28f5111f8ab774b36313b04a1
MD5 8b6f82173b46190b8cd964af6918a5c0
SHA1 205632aa7bb77e9173034ff43907fed72bb196eb
SHA512 96dd135de6f1cbbd00248676c19ab5576d9e58a5eae32cf13772db8b15ea784f53b3295c50d8acff3194a0eb6d8647ef78909c9512a426a1c190f712ea37f8e1
TLSH
T1C1F0D473C0DFD4D42E4D9CCC15F7123B5414E2120C86884B5879C7624D6FF76A91C936
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 66282e121bcf27266c62669d15032e071078c10b8f0c51fa5f9ca6b207e3d272
MD5 faf220c0afd99fdba52494140ad98dd3
SHA1 b15f6a876bcd4dbf7c9c6d1f403b89d9a2ad567f
SHA512 2238a399732665a39ffa38bd66bdfb5a28850b225f88eb77b087e86ccd36d539e7c9e6ada8674e94e2d7926496b52eb521c10ae434261bd74c66f8df3fbb106b
TLSH
T1B9E05E112BE80204F6770A3CA8736549AD7BB76BAA41CBDD0275008D1C25F62DD3671D
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 412B
SHA256 c0dd82ed9cc0f59f166c000f30ec346d6f5392d014647f5f943cfd915f95e401
MD5 990539e76a0e32c59ab08be8d8da9a37
SHA1 829699424f64256c81c03be2d34f4614b6e21ef7
SHA512 21f15c3601c71ac1d5c4361b290fb644de22925ab1156e6979dcbd0876ab5a1302d32e19f05ab2de2e48126dc47e49b91c9e6555ebe565f5ef174da9e1b221a6
TLSH
T11BE0C02812FB502CF5F4D4788BD67C6109ADF0A20559B2BD1BE017047717500FC42D35
MD5 SHA1 SHA512 TLSH

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 ebb6d72e5f3b895c63f0d1a6fc441a6ae0d3d42bb24dfa6baf2d0cc6d244a7bc
MD5 473706774cb787a69dae84c315e5e777
SHA1 3cbd0f31c068c17d9c00dcbe5e5812039ae76d95
SHA512 c297ce1edfecf4c84940d4d5f9eba2df2942e553ac7e26d97b8be1d68e2c3cd71b3189ad5c815d33679e448fe11f1e9553d533cf45fccdb992897ee8cf308e34
SSDEEP 24:TL+jx/XYKQvGJF7ursf8PZP3PWiePe9Z2Pgs0sH:T+l2GL7mskPZP3PWi6e2PJ9H
TLSH
T14B42919B2B385635CDD40A33958104431E3DB41BB26F23FEA6208B7DD1E7F0675195C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 55252df7d8c6386a350068edb992435eaf7aa58bbbd4266d95687a8a4b3ba2bb
MD5 c156b8afc301f4984619e09ecd57419d
SHA1 6ccdb812ff14d783597d0d66c99ee4d95797f3c6
SHA512 cdc120cddce2915f64c074ca06e68a2e6795e8cdac9a4b9bbf6f6002265d0f26e87ba3427c69a713e69e0af4d08c4bf38e37de1cd025e92bbed6bc28ebecce3f
SSDEEP 24:TLaNx/XYKQvGJF7ursh0PQPBPOskDPZP3PWiePe9Z2Pgs0sH:T+l2GL7msaPQPBPzkDPZP3PWi6e2PJ9H
TLSH
T112423A9A2B395A34C9E40A33958108432D39B417F26F23BEA2308F7E91E7F0679295C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 839b8f1748173c2a787acc3c27be17ccdb658b4df1a59d54ae425430620910ed
MD5 4ed7fb4c9ca373e35c22d5fcc07bdcfd
SHA1 d0bf64a4ce708ac7fdd4a1e312a1ecd52396844b
SHA512 c80b095e79561ea1d4a639a7d81ff158cea2e4d5524e1524057ccfd5eecf6481f935fe5cefc4dbb1fd034f90a2ae964ec35f9c0d4f8f2254acd895d9267c59e3
SSDEEP 12:TLWbmJtO9OiyopOz2VVXet3aQK+GyMFO+rlhurs7qYvPPxcDsP+yZos2+:TLr2x/XYKQvGJF7urslPgs0sH
TLSH
T14C427BBF8E25B632C8E44633E4C100433E3C641FA33713B2A6644DBDD55BB5666165DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download