9c8a103ce8c9ca072f1ed3e7835f839915425646bf98241c1d8bbd49b7cca2c4

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-5oluqt.pdf
Size 211KB
Sample260930-ryxtxswbjb
SHA256 9c8a103ce8c9ca072f1ed3e7835f839915425646bf98241c1d8bbd49b7cca2c4
MD5 019fda6ed5cf7528f63eae10713b2741
SHA1 f0160a4a7b7499fc11f4d88629a66e92c5c11a42
SHA512 e3ed77fff566ef5881d5ec8bdb74ec0f338bead1550e0b664cba64411038a13a1d4e819c90b7d4113bed334447e3b09d3cf9ad11d93c274bbd9ffb704e39e867
SSDEEP 3072:BjKT4edk8urg6jVTspibOtqNn4e4sJAHVbMk+ZNvW4ZJqW6u7WIOtGkexdCWz2PW:BjI4eZuc6ZTsprct5RApgZN+MrWptg
TLSH
T1F224D049B44E98FCD295CBC1AB28AC63F81DB2076EC045C635FD4E87AF05F62BD4A605
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FullTrustNotifier.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeCollabSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeCollabSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\MuiCache	AdobeCollabSync.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2584	AcroRd32.exe
2584	AcroRd32.exe
2584	AcroRd32.exe
2584	AcroRd32.exe
2584	AcroRd32.exe
2584	AcroRd32.exe
2584	AcroRd32.exe
2584	AcroRd32.exe
2584	AcroRd32.exe
2584	AcroRd32.exe
2584	AcroRd32.exe
2584	AcroRd32.exe
2584	AcroRd32.exe
2584	AcroRd32.exe
2584	AcroRd32.exe
2584	AcroRd32.exe
2584	AcroRd32.exe
2584	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2584	AcroRd32.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2584	AcroRd32.exe
2584	AcroRd32.exe
2584	AcroRd32.exe
2584	AcroRd32.exe
2584	AcroRd32.exe
2584	AcroRd32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2832	2584	AcroRd32.exe	89
PID 2832 wrote to memory of 716	2832	AdobeCollabSync.exe	90
PID 716 wrote to memory of 2888	716	AdobeCollabSync.exe	91
PID 2584 wrote to memory of 4324	2584	AcroRd32.exe	93
PID 4324 wrote to memory of 2024	4324	RdrCEF.exe	94
PID 4324 wrote to memory of 2884	4324	RdrCEF.exe	95
PID 4324 wrote to memory of 2884	4324	RdrCEF.exe	95
PID 4324 wrote to memory of 1956	4324	RdrCEF.exe	97
PID 4324 wrote to memory of 1956	4324	RdrCEF.exe	97
PID 4324 wrote to memory of 3488	4324	RdrCEF.exe	98
PID 4324 wrote to memory of 1312	4324	RdrCEF.exe	100
PID 4324 wrote to memory of 4348	4324	RdrCEF.exe	102

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-5oluqt.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c --type=collab-renderer --proc=2832
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:716
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" GetChannelUri
      4⤵
      System Location Discovery: System Language Discovery
      PID:2888
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3096ED0135BE9DD67B52471264DAA617 --mojo-platform-channel-handle=1788 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2024
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C8A8992088C98A5B79343AFD57414085 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C8A8992088C98A5B79343AFD57414085 --renderer-client-id=2 --mojo-platform-channel-handle=1780 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2884
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=70EA8789693E308733560BBAE346B306 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=70EA8789693E308733560BBAE346B306 --renderer-client-id=4 --mojo-platform-channel-handle=2404 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1956
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5B1661AB05A80D2500261EDF18172DDD --mojo-platform-channel-handle=1904 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3488
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=68E2DAFF885CA8E1F66056AEF8251843 --mojo-platform-channel-handle=2780 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1312
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1E8E6EDE39EF9FDCF6DA00D455FCFC29 --mojo-platform-channel-handle=2760 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 d8c7ef9d7ecd785c70e4c7c4493fb50eb8e131fb3f52a604e9159b34e7a17c2b
MD5 d3679dabe163875c44d4a52f229c6785
SHA1 666c8afc975cef379639815426525ff646f2653b
SHA512 968cdc3672b2e7e35e602522a131f6da69eef9f1a685e5afe94081821b83bb6ee27228aa5917f02331705e79853fdc244a16f3bc22578ad60f6c96d57cc57d20
SSDEEP 384:ijeUdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:iS+eUZsLQCZsL3hUS4
TLSH
T14453CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notificationsDB

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\DesktopNotification\NotificationsDB\notificationsDB
Size 24KB
SHA256 4901703febb24c665059d25ae6d0769c55051bcdc1b7a72b600252d4c3b0eca0
MD5 4fe2b64a2631d0d6eb30b8f42b49bcf5
SHA1 10c931554e79c2f4280a65ef2ad57ff61a2429ec
SHA512 8ad48178aa8d835e0c2028688e41f575e50e21b6b4b59161d08984c300911fda1a4614738bfa5557c3f2d254373a61497b491cbc7fb163afea2dbe08fcb67004
SSDEEP 24:TLD8fS8stZLNoz4zCQe8stZL+tCAConWZA2sZkgkxzcpS:TXF1K+CAWZA2skgkFcpS
TLSH
T11BB289CF1D1BBB80DEE90777C22797E1AB2F9F4E16D6CDB2A2E655020041A42E61B750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 87aa4c64348b534771f03919b5bdca09596e89f6e0cca0a992bb3d290ec4155a
MD5 aebe0d2eb7a2077a55e57a955e62406a
SHA1 3f811b8148f12220f4b45699135e6d21c9847d8a
SHA512 efa1b082925a4e478fcea74764bbacb91d43da8c01c4b360a34e6f7402af23f91c93b5e91c6266120e144b5300e8dae73a62a7b6d7c4328410128f6a72a7baed
SSDEEP 192:t+oGsTzoU27NTaUxmYeMb1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:tklNveMbUNlNaN
TLSH
T1D293FD0F3556F261C5A8A6B4850084F351AEBF1BE7E6B1A391B6CC3F06F9743012DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 274cfbdd18b1f5cd33c0feb9c085e532e16e2a31e777327a2d5e417fb9ef2b4e
MD5 51b601888b8606a6985fe4aed6937854
SHA1 7d46cfc50f196fcb91547826e2e6e193cf081021
SHA512 760b18787acf6ed6d932e7aadce88d9bc744e5e93287ff863babb8393474bfe5670dd3d3071f9d93392f22ec8741c3ec24f900e29442af3ba4304cf90c50b879
SSDEEP 192:K+oGsTzoU27NTaUxmuX441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklNhX44UNlNaN
TLSH
T108930F0F3556F261C5A8A6B4810084F3119EBF1BE7E6F1A392B2CD3F16F9643102DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 840bfc8ddbf104f8c5c87b98db60c21fc3092b4f49e333e09e6463ad9de164a4
MD5 8f4386e37242906a6ed28c6a4b59b201
SHA1 d31cbe5f269de16e090c5a5da6219de86c4374a5
SHA512 01f48808646bedcbb4e3b7a19056ba16e46b6dd0a844011d0b828c991dfe4d9a91b88a7b4dca426f57c5081cea68c9b33d272abead32e7838473ad1223e1816b
SSDEEP 192:a+oGsTzoU27NTaUxmG2HlX441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:aklNP2FX44UNlNaN
TLSH
T13E930E0F2556F261C5A8A6B4810084F3119EBF1BE7E6F1A392B2CD3F16F9743112DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 a027cf12f2055635a3020f08e0448b2f0314791260ccd25570426088c5b0e307
MD5 245950c48f668cf2fcb3c64778e64089
SHA1 3a5a14c820f58e35a3fc6f5de29669f0840587d8
SHA512 4fc8448536663b551cc716d78715f06d4ed217fbdf755924f0b30aebbb6212798a61c6638f919d5c14bdb6998d6a12f0ca37281f3c7f484c1821fbfc98d4a24d
SSDEEP 192:K+oGsTzoU27NTaUxma1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklN7UNlNaN
TLSH
T17293780F250AF221D5A96A74C144C9E342A97B0FE3FA35F751F5CC3E5AD5A82013EB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resource-18

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\resources\resource-18
Size 4.3MB
SHA256 e0e555342fa61a9d746aa6f2aba5899ff9e6268010c4213fd46a2d131806c2bb
MD5 dfbb3e2e9799cdfb49f90e2e27ca31c2
SHA1 6e093f38572e85693f6530e3140cb1509cfda8df
SHA512 1d3a32f22efb60428ab6084bf9a5ef1ac99c6a2e9d41465c37906dc6211bb7983a1307ac648d7e4c0ae001bedd61bf90569da6d7836109485d25683212ee80ef
SSDEEP 98304:jedlPe28cd4ceOyCLVFLmx3mifuSWS94DK1o+ErEM40MAbCM+pdHrlIKj:jOecgOyoL6H94+/n0MAOM+XJ9j
TLSH
T1F52633BD57256849C49B80B311E6B67946B03A3A30CB6F4EF9CC7291B32EDC67311687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 471B
SHA256 6ac9f824b5582e5c96f113afebd471832e7e7a7da53b425c9c51760da99ccb53
MD5 3120e89fdca9f68827c6b71b12ec2781
SHA1 37f721c354097ef1df15ba298452080af95f3c63
SHA512 8323b94511ccef22285cdc107f6f4be8ea2b6cab26965dd7b46f5c0d43e82d323baebf36d8c70c304b95e52b955add3841e103c063b29063dcea8f14d2f3a0bb
TLSH
T1E2F0D492837668D03B0616F915E0563B9C30E29FDA8D48D2717C95B4CD5D854E91506D
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 412B
SHA256 7e119daab48aaf15bbed37e006464d1b1055010524c3003a4742e143d467e437
MD5 aa3cd2528ad090a186dbd0fcc2ec158c
SHA1 79cd38ad432992074bd591432eeb93b7b06f32ae
SHA512 c630f230a2a49227e45dc9ff7ca9c2ad3c0a25475b6a64cf3ff73692ae92cf03629a7db983c1e2f3bf8cd60226b1b1e6dcd0f4567f8c2000f37fcd1ad0682d74
TLSH
T141E0C02823FB803CF5E0D5388BEE697116AAF0210418F2B82BD157086643600EC41934
MD5 SHA1 SHA512 TLSH

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 c0a46a5839f98e31059f01bc1511c55e1569813a2f847e1d43cdf8a292313901
MD5 243d7470e2af96b2b3302b555664ec0d
SHA1 dd312f20aa182ae401f35af0d24191399c3e0063
SHA512 e181ef457b6403555436c91a7e27f2aeb69fa101adf1307b8041a6a0b6342c89e9d5c90c250e25db128215774174f96c211134ec0ed8353218260de31bafdd0b
SSDEEP 24:TLHCx/XYKQvGJF7ursarloyu1loyeloyklctlcIlcJGlIElTlWThtSlfldloy+cX:TOl2GL7msEmaiTPc++
TLSH
T16A42B17A671EA331D460997EE0D180276D3D613F06AF16952FD4A439CFC634E982E08F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download