Overview

overview

7

Static

static

3

50b850e405...56.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    117s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    26/08/2026, 10:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    50b850e4054f66183ab31ad2335d1a0707d79d2b8365098be027932ec96cea56.exe
  • Size 1.9MB
  • Sample260826-mq7xpstyfy
  • SHA256 50b850e4054f66183ab31ad2335d1a0707d79d2b8365098be027932ec96cea56
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 45 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Drops file in System32 directory 46 IoCs
  • Drops file in Program Files directory 60 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 46 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 46 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\50b850e4054f66183ab31ad2335d1a0707d79d2b8365098be027932ec96cea56.exe
    "C:\Users\Admin\AppData\Local\Temp\50b850e4054f66183ab31ad2335d1a0707d79d2b8365098be027932ec96cea56.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4116
  • C:\WINDOWS\system32\Taskmgr.exe
    C:\WINDOWS\system32\taskmgr.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4304
  • \??\c:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\EXCEL12.exe
    "c:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\EXCEL12.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4220
  • \??\c:\Program Files\DisableTrace.exe
    "c:\Program Files\DisableTrace.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2328
  • \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.exe
    "c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:552
  • \??\c:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.exe
    "c:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2636
  • \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.exe
    "c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1820
  • \??\c:\Program Files\GrantLimit.exe
    "c:\Program Files\GrantLimit.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4400
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4620
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1720
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Dark.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Dark.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1300
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Light.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Light.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4332
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4340
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1228
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Light.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Light.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4184
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4044
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4052
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4512
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2096
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1912
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4632
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3176
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Dark.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Dark.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2592
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:540
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Bus Schedule.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Bus Schedule.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1000
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4324
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Complex Machine.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Complex Machine.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2080
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Acrobat Pro DC.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Acrobat Pro DC.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5204
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Light.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Light.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5232
  • \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.exe
    "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5240
  • \??\c:\Users\Admin\AppData\Roaming\CloseDisable\ExpandClear.exe
    c:\Users\Admin\AppData\Roaming\CloseDisable\ExpandClear.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5496
  • \??\c:\Users\Admin\AppData\Roaming\MountUse\AddDisable.exe
    c:\Users\Admin\AppData\Roaming\MountUse\AddDisable.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5504
  • \??\c:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].exe
    "c:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5536
  • \??\c:\Users\Admin\AppData\Roaming\StartCompress\AddHide.exe
    c:\Users\Admin\AppData\Roaming\StartCompress\AddHide.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5280
  • \??\c:\Users\Admin\Desktop\WriteInitialize.exe
    c:\Users\Admin\Desktop\WriteInitialize.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5512
  • \??\c:\Users\Admin\AppData\Roaming\StartCompress\InvokeReset.exe
    c:\Users\Admin\AppData\Roaming\StartCompress\InvokeReset.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5716
  • \??\c:\Users\Admin\AppData\Roaming\StartCompress\WriteMove.exe
    c:\Users\Admin\AppData\Roaming\StartCompress\WriteMove.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5828
  • \??\c:\Users\Admin\AppData\Roaming\SetSelect\DisconnectConfirm.exe
    c:\Users\Admin\AppData\Roaming\SetSelect\DisconnectConfirm.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6024
  • \??\c:\Users\Admin\Desktop\UseSearch.exe
    c:\Users\Admin\Desktop\UseSearch.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4764
  • \??\c:\Users\Admin\Documents\BlockSearch.exe
    c:\Users\Admin\Documents\BlockSearch.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6160
  • \??\c:\Users\Admin\AppData\Roaming\RenameConvertTo\SwitchInstall.exe
    c:\Users\Admin\AppData\Roaming\RenameConvertTo\SwitchInstall.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6168
  • \??\c:\Users\Admin\AppData\Roaming\StartCompress\SwitchFormat.exe
    c:\Users\Admin\AppData\Roaming\StartCompress\SwitchFormat.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6176
  • \??\c:\Users\Admin\Desktop\RestartStart.exe
    c:\Users\Admin\Desktop\RestartStart.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6184
  • \??\c:\Users\Admin\Documents\MeasureCheckpoint.exe
    c:\Users\Admin\Documents\MeasureCheckpoint.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6196
  • \??\c:\Users\Admin\AppData\Roaming\UnlockRestart\WriteLimit.exe
    c:\Users\Admin\AppData\Roaming\UnlockRestart\WriteLimit.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6280
  • \??\c:\Users\Admin\AppData\Roaming\UnlockRestart\UninstallPublish.exe
    c:\Users\Admin\AppData\Roaming\UnlockRestart\UninstallPublish.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6304
  • \??\c:\Users\Admin\Documents\ConfirmExport.exe
    c:\Users\Admin\Documents\ConfirmExport.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:6312
  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.exe
    c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.exe
    1⤵
      PID:6072

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          Click on 'Change' to select default PDF handler.exe
          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.exe
          • Size 2.0MB
          • SHA256 b878c5f38119e483d9a18b25429b42f4b0f1b9c1b276e1df23684822a7e50e80
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PDFSigQFormalRep.exe
          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.exe
          • Size 2.3MB
          • SHA256 a0d46b1ce174523ede5db6340e1dce6e0995a2f4e466c4a4379d63aad477cb22
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          HomeBanner_Light.exe
          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Light.exe
          • Size 1.9MB
          • SHA256 a1194e530355328c34231c505f618d4cc67a3f137f4914b6164e15e94e4f5d8a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SignHere.exe
          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.exe
          • Size 1.9MB
          • SHA256 212ef6cbb67a31fc5ee64ae955dc6aa5d997645713681e765cd44602a66ba470
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StandardBusiness.exe
          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.exe
          • Size 2.0MB
          • SHA256 2b90562377f0d82b06031f3cd7b6e10ff9a48a1e6f16093f5102ee9300471061
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DisableTrace.exe
          • Path C:\Program Files\DisableTrace.exe
          • Size 2.0MB
          • SHA256 5a2e6d6edd193049c334cc4d149d9734004931086ce3308e77bf263d32378be7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PROTTPLN.exe
          • Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.exe
          • Size 1.9MB
          • SHA256 a7fa579255b6e927d901d8c1d323a7306452969c002830bf66cd01a1213e276a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PROTTPLV.exe
          • Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.exe
          • Size 1.9MB
          • SHA256 18316169e94e554f28d74bc6d13ea85276200e7489c71301cd64afe20ebd8cce
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          EXCEL12.exe
          • Path C:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\EXCEL12.exe
          • Size 1.9MB
          • SHA256 943d7b404e53a22c089ec241918597d23863f798d26cfa4b141c7ba3ae3f526f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AddHide.exe
          • Path C:\Users\Admin\AppData\Roaming\StartCompress\AddHide.exe
          • Size 2.2MB
          • SHA256 9c3f061668a32ef6c0720a52311e01cd20ad27a6720f9cde955bba15837f50c2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AdobeID.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.exe
          • Size 1.9MB
          • SHA256 913e194a798cc75ad8b370c93e042d535a0c7371516c037922a4e93da324b5d8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DefaultID.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.exe
          • Size 1.9MB
          • SHA256 4df9d8287e798d82a97a757ad1560dfa021254d1b6cc65d346b77561b2fb11ff
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          HomeBanner_Dark.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Dark.exe
          • Size 1.9MB
          • SHA256 f1c5c91240a791efeb36c51d72526cc39313ffe336dbec8d6228cd93f4898cbd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MobileAcrobatCard_Light.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Light.exe
          • Size 2.2MB
          • SHA256 bd76c534749f7582150307fdd8eac718e2acb8a422fd98c55014c8f8b749607a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MobileScanCard_Dark.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.exe
          • Size 1.9MB
          • SHA256 597563d3abbe8a1756fcfc457afadfac9caf5b0bef75c2ada0355be72aaa8564
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Adobe Acrobat Pro DC.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Acrobat Pro DC.exe
          • Size 2.0MB
          • SHA256 e0e5ebab2818cf1f1c65b0d68ff12fd6f7d7d64e1c28bb431a37ff151060ba73
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Adobe Cloud Services.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.exe
          • Size 2.1MB
          • SHA256 5961a93b37de03603a1a5cf96bfb1b4939e5266e147ec173f3490c207e2844ad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Adobe Sign White Paper.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.exe
          • Size 2.3MB
          • SHA256 a1475937d95af53f93437df799677d5a8603c64a16b6b0b8d3f74bc016856c8e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Bus Schedule.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Bus Schedule.exe
          • Size 2.7MB
          • SHA256 a6e3b651dc6d76d6b444153ee9efaa6c06901b7c02d351976150e068dfacb41f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Complex Machine.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Complex Machine.exe
          • Size 2.0MB
          • SHA256 ef94c1566ba0d5c69961ce78f078d324e863c9cc8169c742ca8341c69d232e41
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Welcome.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.exe
          • Size 1.9MB
          • SHA256 5ea54388764530331bc4f99b3faae50f5dac3cc2ec2cba9e08f00e308fd3949b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Dynamic.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.exe
          • Size 1.9MB
          • SHA256 f832989fc14fa4321b5ebe50117b14a807ca846701c249f1637f9d50e10754ee
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Words.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.exe
          • Size 2.0MB
          • SHA256 a7653de8b5f15579db9657f01de27933515a79aa9aa91318348f17361b084c67
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ENUtxt.exe
          • Path \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.exe
          • Size 1.9MB
          • SHA256 a6cf0da46a2adceeaf0fcc361fb69f4bf566a077b8d7bd5876c6c478d3e1ae35
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GrantLimit.exe
          • Path \??\c:\Program Files\GrantLimit.exe
          • Size 2.0MB
          • SHA256 e26241f85e14d738785843108fcdedb6628208600180f51dfdd9d9c927d45cbe
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SOLVSAMP.exe
          • Path \??\c:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.exe
          • Size 2.0MB
          • SHA256 2380193337fd1008cb539701261e0e85e361af31dc47bbd268b45d14f55cd520
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ExpandClear.exe
          • Path \??\c:\Users\Admin\AppData\Roaming\CloseDisable\ExpandClear.exe
          • Size 2.6MB
          • SHA256 f4a51c28104ae1870892a61dd8af38a2771c03a558868f9d9b47d23403544eae
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].exe
          • Path \??\c:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].exe
          • Size 1.9MB
          • SHA256 2064ba1179111477b7ba2ff4ac744643d19224ca698c388026e962e598da34f4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AddDisable.exe
          • Path \??\c:\Users\Admin\AppData\Roaming\MountUse\AddDisable.exe
          • Size 2.1MB
          • SHA256 84bd8f4527721b1eedf2992fe331ad519e9a2299562443ed62a8cc89263dc90c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/4304-94-0x000001F007E50000-0x000001F007E51000-memory.dmp
          Download

          memory/4304-82-0x000001F007E50000-0x000001F007E51000-memory.dmp
          Download

          memory/4304-93-0x000001F007E50000-0x000001F007E51000-memory.dmp
          Download

          memory/4304-83-0x000001F007E50000-0x000001F007E51000-memory.dmp
          Download

          memory/4304-84-0x000001F007E50000-0x000001F007E51000-memory.dmp
          Download

          memory/4304-92-0x000001F007E50000-0x000001F007E51000-memory.dmp
          Download

          memory/4304-88-0x000001F007E50000-0x000001F007E51000-memory.dmp
          Download

          memory/4304-91-0x000001F007E50000-0x000001F007E51000-memory.dmp
          Download

          memory/4304-90-0x000001F007E50000-0x000001F007E51000-memory.dmp
          Download

          memory/4304-89-0x000001F007E50000-0x000001F007E51000-memory.dmp
          Download