ef1cdd97bc1329536a3e1656f955ef9f22340addbcea18c3035cff0c58c7a9c6

Analysis

user interaction
yes
max time kernel
52s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ef1cdd97bc1329536a3e1656f955ef9f22340addbcea18c3035cff0c58c7a9c6.pdf
Size 2.4MB
Sample260913-shk1vs1thy
SHA256 ef1cdd97bc1329536a3e1656f955ef9f22340addbcea18c3035cff0c58c7a9c6
MD5 0b57bab726d82b0262a5e429248b562a
SHA1 450351e8b822e641d12fefc88e890d7d6f63c67e
SHA512 04afba15c9c6c8b0d23edbe7298f7921efc6680a308ff4bd088cac7bd5430cf98b86a1e9db3bdec2df6fb620049f1607506890d5743f33f202c6e0b5d50d61fb
SSDEEP 24576:BeJSrXkqR/el0Yr8eu/FFVJSW2Xqc1FYyYFnc+68gXoOfGSWfB9zi78DUKyfNr2:sJaRq0Yr8HrVJSW2fFYyh+p9+78lyfNy
TLSH
T1D8C5126AB60FACFCC04597F67F247A93A9AFF24121C4DBA03124C54B2BC4DA3BD65254
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeCollabSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FullTrustNotifier.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeCollabSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4892	AcroRd32.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe
4892	AcroRd32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 628	4892	AcroRd32.exe	83
PID 628 wrote to memory of 5872	628	AdobeCollabSync.exe	84
PID 4892 wrote to memory of 2616	4892	AcroRd32.exe	85
PID 2616 wrote to memory of 1740	2616	RdrCEF.exe	86
PID 2616 wrote to memory of 1708	2616	RdrCEF.exe	87
PID 2616 wrote to memory of 1708	2616	RdrCEF.exe	87
PID 2616 wrote to memory of 2052	2616	RdrCEF.exe	88
PID 2616 wrote to memory of 5984	2616	RdrCEF.exe	89
PID 2616 wrote to memory of 5984	2616	RdrCEF.exe	89
PID 2616 wrote to memory of 5708	2616	RdrCEF.exe	91
PID 5872 wrote to memory of 1628	5872	AdobeCollabSync.exe	92
PID 2616 wrote to memory of 5496	2616	RdrCEF.exe	93

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ef1cdd97bc1329536a3e1656f955ef9f22340addbcea18c3035cff0c58c7a9c6.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c --type=collab-renderer --proc=628
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5872
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" GetChannelUri
      4⤵
      System Location Discovery: System Language Discovery
      PID:1628
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D7A64CDEB2B5CBA0BB0DA50DCBE01470 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1740
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B51900572211E1B9E4E48EB553A1D378 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B51900572211E1B9E4E48EB553A1D378 --renderer-client-id=2 --mojo-platform-channel-handle=1608 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1708
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AAD27AFD3FC605A0A90DEEDAD57ABAEE --mojo-platform-channel-handle=2296 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2052
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=877E004FD0DD33905C98DCF5409AD709 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=877E004FD0DD33905C98DCF5409AD709 --renderer-client-id=5 --mojo-platform-channel-handle=1716 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5984
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=548B66AD78E32A0FB2A7B80735AA66CD --mojo-platform-channel-handle=2296 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5708
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DFF4CB33C23DEADCAADA425756915601 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 d1669f30ced27feb1aa527472f21e7903aeefffd1aabbc1f47161049b0b2da46
MD5 560b53c0412dc7c33629cdeb8f88a77c
SHA1 59855b23cae89d577c262e95acfd55e3bb759cc5
SHA512 f73bf6bb61c298b4b3f9e4a3ab4446f5ead3fe2a6f80eb3cb44221a6b7c05b1d1adeeb034daac09c98bdf2939baba720f91adb4ea803ccd1ca41fb64ec8c43cb
SSDEEP 384:yeqdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:p+eUZsLQCZsL3hUS4
TLSH
T19653CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 87aa4c64348b534771f03919b5bdca09596e89f6e0cca0a992bb3d290ec4155a
MD5 aebe0d2eb7a2077a55e57a955e62406a
SHA1 3f811b8148f12220f4b45699135e6d21c9847d8a
SHA512 efa1b082925a4e478fcea74764bbacb91d43da8c01c4b360a34e6f7402af23f91c93b5e91c6266120e144b5300e8dae73a62a7b6d7c4328410128f6a72a7baed
SSDEEP 192:t+oGsTzoU27NTaUxmYeMb1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:tklNveMbUNlNaN
TLSH
T1D293FD0F3556F261C5A8A6B4850084F351AEBF1BE7E6B1A391B6CC3F06F9743012DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 dfc0e61aec2c6414efb26d136a8d79b333bead17cd17b57fa44e737ed04e3333
MD5 4f079db7dacfb38b9df10848cbbbd0a3
SHA1 3fc7ba02d4462ee989b235b81ab86fc11ab28409
SHA512 79a3c8282ad14e36676149940ea80e5912a51ade38b7b885b97423d3b5c33f99d3bfb52ccb4515b0214b55b740c8ebbd91ddef8dae1ddc74b70e4246797fd0ef
SSDEEP 192:q+oGsTzoU27NTaUxmF0yZMVy1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:qklNm0xVyUNlNaN
TLSH
T1EA93000F3556F261C5A89AB4814084F3119EBF1BE3E6F1A392B2CD3F16F9643102DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 aa643442ed836b210a5c5dfdd690800f04a73e14a688eaca2f2bd659d60ba8d5
MD5 4f71b4c2af631b806c15f2619ba4e28b
SHA1 ee0e6d0ae862b6b0813c7e72bfd9e12fbbc3dc72
SHA512 28035ba8ea5ed518bd46d9401007269dfa81494b129e81466dc32d709ba23f335e4d3a731493ebfd433ebe9d5202a931b4689b0dc0c9f4293a1ee86f4ff5a56e
SSDEEP 192:K+oGsTzoU27NTaUxmfuywMVy1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklNsuWVyUNlNaN
TLSH
T19693FF0F3556F261C5A8A6B4814084F3119EBF1BE3E6F1A392B6CD3F16F9643012DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 de1961e3cb1a03f76f3a6da7580376573cf4f1fddbe199b472bae6a602b54542
MD5 4fdce9568bc549a4b465dbad0ee4342b
SHA1 31a607a4f37e71506741f2b5e6cf2320b7a7e905
SHA512 c39c9242d5568527f181dad531d12c8e1b5a00a6650176ffddec8d594e873f52992d880113226aa651fcb01a9addefddea09276cc88c2c8037054f5ab2ca78ed
SSDEEP 192:6+oGsTzoU27NTaUxmTZX441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:6klNOZX44UNlNaN
TLSH
T1CE930F0F3556F261C5A8A6B4814084F3119EBF1BE7E6F1A392B2CD3F16F9643002DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 04f551cab182c7a4d695db9f7cc52c92d8a6093cc26f753190beb0f17731799d
MD5 7fd9ef97d861668cb6188d4bed3ed1cb
SHA1 2083edba62d11ecce589e99c7577682935f1b06c
SHA512 962062e8c52d76a40a8b38d8b47ae6d88ea34b241311fff01d05207a3fab905a9776a78bd3b625c9231235ba5a4cf378b6fa06c0fb8ba4da0f95a4ee26252a90
SSDEEP 192:K+oGsTzoU27NTaUxmLiX441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklNciX44UNlNaN
TLSH
T18C930F0F3556F261C5A8A6B4810084F3119EBF1BE7E6F1A392B2CD3F16F9643002DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 a027cf12f2055635a3020f08e0448b2f0314791260ccd25570426088c5b0e307
MD5 245950c48f668cf2fcb3c64778e64089
SHA1 3a5a14c820f58e35a3fc6f5de29669f0840587d8
SHA512 4fc8448536663b551cc716d78715f06d4ed217fbdf755924f0b30aebbb6212798a61c6638f919d5c14bdb6998d6a12f0ca37281f3c7f484c1821fbfc98d4a24d
SSDEEP 192:K+oGsTzoU27NTaUxma1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklN7UNlNaN
TLSH
T17293780F250AF221D5A96A74C144C9E342A97B0FE3FA35F751F5CC3E5AD5A82013EB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 350970b4e14011d7e5b0284123b5523539a9bb521280187c68ee17c62c277788
MD5 b521466abdc90566d93cfd090b5bedda
SHA1 dcc75412a715ac976f8271b237cf97fa776dedf0
SHA512 1c2d941661939ce33a378a8968822dd6b29f3a19e00eeaa8742cd701e6dbf8916df3c354f59d793a69f555275cae568b4a74c9d0af687cd35e5b6dd723ef2c23
SSDEEP 192:q+oGsTzoU27NTaUxmBcC441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:qklNucC44UNlNaN
TLSH
T19E93FF0F3555F261C5A8A6B4814084F3119EBF1BE7E6F1A392B6CD3F16F9643002DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 4745575828d8806d6e53bd575f011727c63100c3435c0f45bf4f265f48379171
MD5 02aba874a50163842d1f7fa605f46396
SHA1 43ba660ef4a8051dcd06ea1507906e3fd69b80a3
SHA512 cf1b6139133c41ea8ebc1bb9d66137eaff85c3b06f8a4ac812fd4e33073bc8ee63275cc07c5ce67f9ae42bab8bc5a8860d380542ed4b114a70b854092dc16751
SSDEEP 48:T+l2GL7msM8A2+8A2G8AlvA2GA2+2AlUAlLmAlTAleAlg:8VmsM8n+8nG8enGn+2RmmAv/
TLSH
T199424C7ACD5DA363C9B06C7AE5C6D909232C400E131712E11350A8B2C7653D679AD6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 d17762579ba6dd9b05160982d7ede69dd9f8d886bf0074e8352baaf5b8ed40b9
MD5 27cf2f8ab82cf6da2f33c15e25df922c
SHA1 495418dd9da471776e6f718be13cb4feede5dd34
SHA512 07f28e409fe2a24fb2d3f1c07aaffe7be61a79b54d03c1d2eebb6746dfdec3c4908bde8cbfe75bcc3c1ae8112fcf09ae353c98fd4daaba5953f12cbef0b16f60
SSDEEP 48:T+l2GL7msv/A2sA2FA2yAlq8A2+8A2G8AlvA2GA2+2AlUAlLmAlTAleAlg:8Vms3nsnFnyr8n+8nG8enGn+2RmmAv/
TLSH
T1DE425A7ACE5D9363C970AC3AE5CADD09231C800E535B12E11310A8B3C3653D676ED6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 88bd0190e70c8e507f1b9a91a003f6c8f2ade481b275212ba3a4699db9a2bf0e
MD5 aca0161f799a419434f010814eabb7ec
SHA1 299de197e15af2e5e2de7b4f8d38843047350f56
SHA512 bbefc03a532ce027c6641127cccb51bc3ddfeab8163540c3b6cb6e80134084323075dff0e951d867b2b83ec4cfad875a24d555f38b5bf9138e48d98572fffeec
SSDEEP 48:T2vl2GL7ms3A2GA2+2AlUAlLmAlTAleAlg:i9Vms3nGn+2RmmAv/
TLSH
T188425B6FCE5CA373C8A06D79E5C7D50A173C401E132717E11314A8B2C3563D67A9A6DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download