9c8a103ce8c9ca072f1ed3e7835f839915425646bf98241c1d8bbd49b7cca2c4

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20261001-527357-3yo7em.pdf
Size 211KB
Sample261001-ste9ravbnb
SHA256 9c8a103ce8c9ca072f1ed3e7835f839915425646bf98241c1d8bbd49b7cca2c4
MD5 019fda6ed5cf7528f63eae10713b2741
SHA1 f0160a4a7b7499fc11f4d88629a66e92c5c11a42
SHA512 e3ed77fff566ef5881d5ec8bdb74ec0f338bead1550e0b664cba64411038a13a1d4e819c90b7d4113bed334447e3b09d3cf9ad11d93c274bbd9ffb704e39e867
SSDEEP 3072:BjKT4edk8urg6jVTspibOtqNn4e4sJAHVbMk+ZNvW4ZJqW6u7WIOtGkexdCWz2PW:BjI4eZuc6ZTsprct5RApgZN+MrWptg
TLSH
T1F224D049B44E98FCD295CBC1AB28AC63F81DB2076EC045C635FD4E87AF05F62BD4A605
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FullTrustNotifier.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeCollabSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeCollabSync.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\MuiCache	AdobeCollabSync.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2884	AcroRd32.exe
2884	AcroRd32.exe
2884	AcroRd32.exe
2884	AcroRd32.exe
2884	AcroRd32.exe
2884	AcroRd32.exe
2884	AcroRd32.exe
2884	AcroRd32.exe
2884	AcroRd32.exe
2884	AcroRd32.exe
2884	AcroRd32.exe
2884	AcroRd32.exe
2884	AcroRd32.exe
2884	AcroRd32.exe
2884	AcroRd32.exe
2884	AcroRd32.exe
2884	AcroRd32.exe
2884	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2884	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2884	AcroRd32.exe
2884	AcroRd32.exe
2884	AcroRd32.exe
2884	AcroRd32.exe
2884	AcroRd32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2180	2884	AcroRd32.exe	89
PID 2180 wrote to memory of 4508	2180	AdobeCollabSync.exe	90
PID 4508 wrote to memory of 4880	4508	AdobeCollabSync.exe	96
PID 2884 wrote to memory of 2872	2884	AcroRd32.exe	100
PID 2872 wrote to memory of 1924	2872	RdrCEF.exe	101
PID 2872 wrote to memory of 688	2872	RdrCEF.exe	102
PID 2872 wrote to memory of 688	2872	RdrCEF.exe	102
PID 2872 wrote to memory of 456	2872	RdrCEF.exe	104
PID 2872 wrote to memory of 1336	2872	RdrCEF.exe	105
PID 2872 wrote to memory of 4956	2872	RdrCEF.exe	106
PID 2872 wrote to memory of 3016	2872	RdrCEF.exe	107
PID 2872 wrote to memory of 3016	2872	RdrCEF.exe	107

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\attachment20261001-527357-3yo7em.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c --type=collab-renderer --proc=2180
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4508
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" GetChannelUri
      4⤵
      System Location Discovery: System Language Discovery
      PID:4880
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BE03480F911F6B9115DF3681071F03FE --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1924
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=317B8AEBD0AF9CD26AE0C18FE0F39D8E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=317B8AEBD0AF9CD26AE0C18FE0F39D8E --renderer-client-id=2 --mojo-platform-channel-handle=1728 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:688
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=659F4CC127CD5412E9C689CB23488513 --mojo-platform-channel-handle=2272 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:456
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=90FD15E0D91E86FAD7AE7116DAC0D780 --mojo-platform-channel-handle=1920 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1336
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A742FE1E9B3DA7F31635583C7AD7AA13 --mojo-platform-channel-handle=2432 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4956
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=CB2D5BADC5CFC8E1C0E26C41F40C0AA2 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=CB2D5BADC5CFC8E1C0E26C41F40C0AA2 --renderer-client-id=7 --mojo-platform-channel-handle=2544 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 189d06187e5a5744809631a9a8d05ba99d451d926b266811724b05917376e6ff
MD5 11d39dd1f57b2d0a2209c3c3ece25284
SHA1 d0f892a6205538d7a9df756fb4dba88de42c587c
SHA512 86650da0378fa8da804c6dcb88927a7cf29da11e1e332414ca941ccaa89658d9207b525fa88e7228576fe901fd69ca6988edc390ada32825c7081f562244812d
SSDEEP 384:yeGdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:N+eUZsLQCZsL3hUS4
TLSH
T13253CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 87aa4c64348b534771f03919b5bdca09596e89f6e0cca0a992bb3d290ec4155a
MD5 aebe0d2eb7a2077a55e57a955e62406a
SHA1 3f811b8148f12220f4b45699135e6d21c9847d8a
SHA512 efa1b082925a4e478fcea74764bbacb91d43da8c01c4b360a34e6f7402af23f91c93b5e91c6266120e144b5300e8dae73a62a7b6d7c4328410128f6a72a7baed
SSDEEP 192:t+oGsTzoU27NTaUxmYeMb1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:tklNveMbUNlNaN
TLSH
T1D293FD0F3556F261C5A8A6B4850084F351AEBF1BE7E6B1A391B6CC3F06F9743012DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 d7659a62c51fbe36f19ae9eaf77e4a437f801d2da8ed036c84a5d5163b071e9a
MD5 bc61e632e600dfa2d1a334cfdf3f6e00
SHA1 cebde9aa5f1bb9e2537df26daab3496b6fa4923c
SHA512 6a5492feac66ec4512e9d45063aed4fa8a55fbca1540320ff7c7f86cb7d5e119d2eb3131f7f54a3e64b9abe364f158d6a3918925242f0998f1e6d1ee33dd1952
SSDEEP 192:K+oGsTzoU27NTaUxmlX441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklNKX44UNlNaN
TLSH
T12B930F0F3556F261C5A896B4810084F3119EBF1BE7E6F1A392B2CD3F16F9643002DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 d7bb6ee7dd952eff6fc1439aa20bb1fdba7c49b0eb49e2c6bfa72c2c9beec4cf
MD5 86b8ff20b268588e7c2a0dba39b8b3cc
SHA1 72a7996ae36eadf83f701145025bc3b7916d696d
SHA512 e297f435742a5e22e7f4a0aadcbf662ca9bf25b39dfdfa017df55b176e3e4a62aca13e3b77108ef71771f03507432cc18050beb22505d781160b0d22232b0d8a
SSDEEP 192:a+oGsTzoU27NTaUxmGDHQX441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:aklNPDwX44UNlNaN
TLSH
T170930E0F2556F261C5A8A6B4810084F3519EBF1BE7E6F1A392B2CD3F16F9743012DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 a027cf12f2055635a3020f08e0448b2f0314791260ccd25570426088c5b0e307
MD5 245950c48f668cf2fcb3c64778e64089
SHA1 3a5a14c820f58e35a3fc6f5de29669f0840587d8
SHA512 4fc8448536663b551cc716d78715f06d4ed217fbdf755924f0b30aebbb6212798a61c6638f919d5c14bdb6998d6a12f0ca37281f3c7f484c1821fbfc98d4a24d
SSDEEP 192:K+oGsTzoU27NTaUxma1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklN7UNlNaN
TLSH
T17293780F250AF221D5A96A74C144C9E342A97B0FE3FA35F751F5CC3E5AD5A82013EB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resource-18

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\resources\resource-18
Size 4.3MB
SHA256 e0e555342fa61a9d746aa6f2aba5899ff9e6268010c4213fd46a2d131806c2bb
MD5 dfbb3e2e9799cdfb49f90e2e27ca31c2
SHA1 6e093f38572e85693f6530e3140cb1509cfda8df
SHA512 1d3a32f22efb60428ab6084bf9a5ef1ac99c6a2e9d41465c37906dc6211bb7983a1307ac648d7e4c0ae001bedd61bf90569da6d7836109485d25683212ee80ef
SSDEEP 98304:jedlPe28cd4ceOyCLVFLmx3mifuSWS94DK1o+ErEM40MAbCM+pdHrlIKj:jOecgOyoL6H94+/n0MAOM+XJ9j
TLSH
T1F52633BD57256849C49B80B311E6B67946B03A3A30CB6F4EF9CC7291B32EDC67311687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 471B
SHA256 ee9489d8da5d43ca95e56be84f82b8131da9a705404568ad286a083a62cc4317
MD5 0637d26eb99983ec5ede092f27e7a3e9
SHA1 10556b6a76a7c0d7a4e1108bd769b06fc459d04d
SHA512 2086ba1d71665e35dac2f4e20f0081f07e92dd19d519747e25db42544663159fbd5f545a29d575957e3d68d35fe3a3fce4f04d7fda683e826a049c3400d1cc1a
TLSH
T199F0DCC3572AF4A12E850ADC14D99BBBE034635F16E20497B039E9B20FD9E1DDB11872
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 412B
SHA256 02dd67c46307c9bb0c9ee00b3882fe7a0d803e6b2ee0bc0432e09b197d59d533
MD5 d21c6a1251a5bf34a13b97e5db369433
SHA1 62452fc5342e228c20499819345d11ed9ab09c4d
SHA512 ef9a6ccd2ceaecbfcffd26d757dbf5e02eb8eaf6f860759a562a32fcd3955ec4c791d8d0944a3e0cdbe667ca1099b5214bc3ca67f765d887c08e0ef6386cf2b3
TLSH
T166E0C0B417FB501CF5E1D03887E5693105AEF062085AB2F81AE01F04F603E00FC42934
MD5 SHA1 SHA512 TLSH

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 e581962571ca9c19b1edf970044bce8850af7a51652032b109c12bab7f5e3a11
MD5 458553b7c447a05ca961ec03730db5fe
SHA1 e103e4e4aaf6c721950dd6193e308d3cdfd67054
SHA512 a311d34c167fd8e715191f2371099ca2e452ecc373c973b8734a3a1ece26e4ca285c8a0a2e22f942cd389b223213bd294f8608433eaadd7090216b7f80055549
SSDEEP 48:Tul2GL7mstlQ4wNOwLwhw52Jj5FPw+4PquGcCwyzw:MVmsAnNR8Wn+mRn
TLSH
T12C421739BA2C9F63EEB3D5B2825C452A615D3489A3118462DBA9873BF9043C7F7127C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addressbook.acrodata

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
Size 6.3MB
SHA256 9532b53f8a1bdc9958b20eeac8910e2f2091737ff5e9ce58d415dce122c56ac7
MD5 32618db429a1a5c9b3598cd3a4889c9c
SHA1 a25bc956675f27d73de15aac07de3e528ecc6407
SHA512 ca0b5a56dfb235c5f3d88816bdc6b5c8d27f5f5c6a6078627140160e14aa8b8b70631092cd518d52fb16dfed8f0c58e1e25502d4b1a0e79697a43dcd8a6e0888
SSDEEP 24576:T7GBIIYsDBY2kNIIYblHzkecQUKT5BPJxM0v40yIcnZCTbJ+9shCjJDNrfpjqgnn:R
TLSH
T11766FAE48A6BECC5D817E188CBB875F756B2317703A40D20479D36D02F9698B3B44A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addressbook.acrodata

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
Size 14KB
SHA256 06a576fc14e995c437b26c0d150b4e84cd745e7cedfd972a84b42b51c842fc9b
MD5 947f93fe0eed44767626846f28cfde05
SHA1 f6276d2a2b4a9d8a8e23c84019cd3961e9d60e88
SHA512 f97739eb0d22a99b06ef340aefb0d5a5b45b679d28accff3de2565166392c7d2fabaa33f945696f7d456ba2ef323f48e43eb26578f71c8b2e8ed32fb4dc69bc9
SSDEEP 192:gcPqYV/saFlwwR+kMqe8TlZMX1sgUVa3ddMVsuNeMcGdSD9obOUAVlcMudM/Y14W:g7Q/X4kMb0lZ6mgtdHOelGdWaolvsTh
TLSH
T18652B7E55E67BC99D827C649CB3430965AF250A703981E20928D6BD43EE789F3B40B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download