9c8a103ce8c9ca072f1ed3e7835f839915425646bf98241c1d8bbd49b7cca2c4

Analysis

max time kernel
148s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20261002-143791-cbbhyl.pdf
Size 211KB
Sample261002-e6dd2avx4j
SHA256 9c8a103ce8c9ca072f1ed3e7835f839915425646bf98241c1d8bbd49b7cca2c4
MD5 019fda6ed5cf7528f63eae10713b2741
SHA1 f0160a4a7b7499fc11f4d88629a66e92c5c11a42
SHA512 e3ed77fff566ef5881d5ec8bdb74ec0f338bead1550e0b664cba64411038a13a1d4e819c90b7d4113bed334447e3b09d3cf9ad11d93c274bbd9ffb704e39e867
SSDEEP 3072:BjKT4edk8urg6jVTspibOtqNn4e4sJAHVbMk+ZNvW4ZJqW6u7WIOtGkexdCWz2PW:BjI4eZuc6ZTsprct5RApgZN+MrWptg
TLSH
T1F224D049B44E98FCD295CBC1AB28AC63F81DB2076EC045C635FD4E87AF05F62BD4A605
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FullTrustNotifier.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeCollabSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeCollabSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\MuiCache	AdobeCollabSync.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4856	AcroRd32.exe
4856	AcroRd32.exe
4856	AcroRd32.exe
4856	AcroRd32.exe
4856	AcroRd32.exe
4856	AcroRd32.exe
4856	AcroRd32.exe
4856	AcroRd32.exe
4856	AcroRd32.exe
4856	AcroRd32.exe
4856	AcroRd32.exe
4856	AcroRd32.exe
4856	AcroRd32.exe
4856	AcroRd32.exe
4856	AcroRd32.exe
4856	AcroRd32.exe
4856	AcroRd32.exe
4856	AcroRd32.exe
4856	AcroRd32.exe
4856	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4856	AcroRd32.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4856	AcroRd32.exe
4856	AcroRd32.exe
4856	AcroRd32.exe
4856	AcroRd32.exe
4856	AcroRd32.exe
4856	AcroRd32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 3224	4856	AcroRd32.exe	89
PID 3224 wrote to memory of 1276	3224	AdobeCollabSync.exe	90
PID 1276 wrote to memory of 972	1276	AdobeCollabSync.exe	91
PID 4856 wrote to memory of 868	4856	AcroRd32.exe	93
PID 868 wrote to memory of 1748	868	RdrCEF.exe	94
PID 868 wrote to memory of 3400	868	RdrCEF.exe	95
PID 868 wrote to memory of 3400	868	RdrCEF.exe	95
PID 868 wrote to memory of 5648	868	RdrCEF.exe	97
PID 868 wrote to memory of 5648	868	RdrCEF.exe	97
PID 868 wrote to memory of 2776	868	RdrCEF.exe	98
PID 868 wrote to memory of 4720	868	RdrCEF.exe	100
PID 868 wrote to memory of 2288	868	RdrCEF.exe	102

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\attachment20261002-143791-cbbhyl.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c --type=collab-renderer --proc=3224
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1276
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" GetChannelUri
      4⤵
      System Location Discovery: System Language Discovery
      PID:972
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AE4B40BF6AF05E98619C68CE179F24B6 --mojo-platform-channel-handle=1796 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1748
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=AF40F86BF7FFD8058C85E63A25C578C5 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=AF40F86BF7FFD8058C85E63A25C578C5 --renderer-client-id=2 --mojo-platform-channel-handle=1804 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3400
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6925B1A8923C6E7182BEAED02CCA0A68 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6925B1A8923C6E7182BEAED02CCA0A68 --renderer-client-id=4 --mojo-platform-channel-handle=2380 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5648
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AA9D1BDEB5C1863A15FC6EAD6D530506 --mojo-platform-channel-handle=2728 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2776
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3865FADBC8D7A7D7D3CD4DEBF13820D8 --mojo-platform-channel-handle=2888 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4720
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=58F195ED2B1CE990F99DFE1A66F2E126 --mojo-platform-channel-handle=1784 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 5e0a27f2cea2f3b77bcdff30798fb8781919a9b3c2cbb512e3947dc4a83a099a
MD5 77d2edc315a9777e482cb4de68de38b7
SHA1 8121292d09e83c5c339980e859cbc77795d222a9
SHA512 59db1901d445a266def87e867996475411c13290a973678a388ff6ded53613e8545fbbb960d4202455e26d47523b587a89b595c8494fcff0793827b2cb0b07a0
SSDEEP 384:ijeodThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:iS+eUZsLQCZsL3hUS4
TLSH
T16A53CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notificationsDB

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\DesktopNotification\NotificationsDB\notificationsDB
Size 24KB
SHA256 4901703febb24c665059d25ae6d0769c55051bcdc1b7a72b600252d4c3b0eca0
MD5 4fe2b64a2631d0d6eb30b8f42b49bcf5
SHA1 10c931554e79c2f4280a65ef2ad57ff61a2429ec
SHA512 8ad48178aa8d835e0c2028688e41f575e50e21b6b4b59161d08984c300911fda1a4614738bfa5557c3f2d254373a61497b491cbc7fb163afea2dbe08fcb67004
SSDEEP 24:TLD8fS8stZLNoz4zCQe8stZL+tCAConWZA2sZkgkxzcpS:TXF1K+CAWZA2skgkFcpS
TLSH
T11BB289CF1D1BBB80DEE90777C22797E1AB2F9F4E16D6CDB2A2E655020041A42E61B750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 87aa4c64348b534771f03919b5bdca09596e89f6e0cca0a992bb3d290ec4155a
MD5 aebe0d2eb7a2077a55e57a955e62406a
SHA1 3f811b8148f12220f4b45699135e6d21c9847d8a
SHA512 efa1b082925a4e478fcea74764bbacb91d43da8c01c4b360a34e6f7402af23f91c93b5e91c6266120e144b5300e8dae73a62a7b6d7c4328410128f6a72a7baed
SSDEEP 192:t+oGsTzoU27NTaUxmYeMb1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:tklNveMbUNlNaN
TLSH
T1D293FD0F3556F261C5A8A6B4850084F351AEBF1BE7E6B1A391B6CC3F06F9743012DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 1196cfa90147186cc5671e32094f2b8c2f9421602fff98fe7856cf24e07bcae4
MD5 927517aba51fe602fe22ed918a21ff92
SHA1 4c633d9999a682d0267c4bcd9fbb5dc79bba8c7f
SHA512 5826953cffabc50884d8746cde39f7814291111ba3f79c52feaab308eed9139fdc7573bce9a33f0da6d1e360cfb5a2cbbfa560962efa1ca4314296aac52a6fef
SSDEEP 192:6+oGsTzoU27NTaUxmbX441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:6klNIX44UNlNaN
TLSH
T11993FF0F3556F261C5A8A6B4814084F3119EBF1BE7E6F1A392B2CD3F16F9643102DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 0889b17806b269747218ee18105f1994312b2d0118a4f2a35dab23dcb36628d6
MD5 c9b08b07d521c922a32be752b20bdd7e
SHA1 1b6d9740cccf705a23ef900fd0a0c4bf3e799960
SHA512 25be04950fbe106f4596499faf1f483a698a06c375a2cd2cb42cf8ae78dc3db99a7c5ca369f3b6e5d8df6c01b2190fbb1f67a8fae935678d85233c0c88fab52d
SSDEEP 192:K+oGsTzoU27NTaUxm6X441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklNdX44UNlNaN
TLSH
T16E930F0F3556F261C5A8A6B4814084F3119EBF1BE7E6F1A392B2CD3F16F9643002DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 81f7a9455c7d46f935b0424f398c2c23e289d54aafa0a8637a2102610fe5e287
MD5 c741537f0ed7dde103a3b84746ad55e0
SHA1 16beb8ee7feada4447ccfd856de1d612ba6823c6
SHA512 9d9bc0a3e6cda1fcc36c92466f76d04cf23a8979d74d52f05eb3afa47ef8ddc4e6b6697716976a272635d816b34ee671d8e1920531aeb4c697ca1b36103589c1
SSDEEP 192:a+oGsTzoU27NTaUxmGLHOX441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:aklNPLuX44UNlNaN
TLSH
T1E5930F0F2556F261C5A8A6B4810084F3119EBF1BE7E6F1A392B2CD3F16F9743112DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 a027cf12f2055635a3020f08e0448b2f0314791260ccd25570426088c5b0e307
MD5 245950c48f668cf2fcb3c64778e64089
SHA1 3a5a14c820f58e35a3fc6f5de29669f0840587d8
SHA512 4fc8448536663b551cc716d78715f06d4ed217fbdf755924f0b30aebbb6212798a61c6638f919d5c14bdb6998d6a12f0ca37281f3c7f484c1821fbfc98d4a24d
SSDEEP 192:K+oGsTzoU27NTaUxma1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklN7UNlNaN
TLSH
T17293780F250AF221D5A96A74C144C9E342A97B0FE3FA35F751F5CC3E5AD5A82013EB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resource-18

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\resources\resource-18
Size 4.3MB
SHA256 e0e555342fa61a9d746aa6f2aba5899ff9e6268010c4213fd46a2d131806c2bb
MD5 dfbb3e2e9799cdfb49f90e2e27ca31c2
SHA1 6e093f38572e85693f6530e3140cb1509cfda8df
SHA512 1d3a32f22efb60428ab6084bf9a5ef1ac99c6a2e9d41465c37906dc6211bb7983a1307ac648d7e4c0ae001bedd61bf90569da6d7836109485d25683212ee80ef
SSDEEP 98304:jedlPe28cd4ceOyCLVFLmx3mifuSWS94DK1o+ErEM40MAbCM+pdHrlIKj:jOecgOyoL6H94+/n0MAOM+XJ9j
TLSH
T1F52633BD57256849C49B80B311E6B67946B03A3A30CB6F4EF9CC7291B32EDC67311687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 471B
SHA256 34aa12ff78aa93e311a82bff0d0eb6014b22ed175f57a1a12c02fd3cfd8c0f8e
MD5 cbe01d5888ee0c6ac889f446413e7bad
SHA1 b512d80fb110e924a5f8da698a10d1a130a45b82
SHA512 6312a694923272ff30e2b94a33d63825ca60475b3f4358eb7c8d325e85a162effa80fedb8a3a37e7271a7837193cab67bdb8a973f4780b8ce231b6f91e325db6
TLSH
T1ADF0D45A817ECC562F152CDC409E926E283095572D8408C15438C4A10E45A9E991643B
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 debf65ad2518cbf69b5485edf687a5f781fa75825325f99f923ab2e543e00879
MD5 d07e55e4347ad218efd3bdc803bdd3a8
SHA1 6db99bb90a6370e5a1588be72a03115c1a7001e2
SHA512 a434b429c35088e64f76a50c60c222cb1bb6a2be0826b313228592e0b602304262f92c1920d83d17b3ba663ef9db815cb9e35dbbe41cf8c74f086fcbf84a8d66
TLSH
T1D0E08C152AE80314E5334A7CA933A544AA377A27BE00CA890779008D0C29FA1C9B271B
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 412B
SHA256 c7e1ead5f7ecb0b88d6a2f8269c8a63832a23a61b55d2a6293f0dce829821cb7
MD5 ec198c8b547b986cc6d6fff41f22ffbc
SHA1 e30c9d1ac6284b17318868a58cef5a2035e4cb92
SHA512 9e45e22866b1b75e1fc7f074fad096d18e66dcc7982e3935eafa1d63ee3d8da0a9955c3fa36e1d082597f82c952e245b0bd6e5d50393d3175c2a35683c255b99
TLSH
T189E0C01812FF412CF5E4C07C8BD57C31059DF0610418B2B82BE027047727A00FC02935
MD5 SHA1 SHA512 TLSH

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 baa01b03bea04b0dc55679585c81ca486a146d41efa06766b076fce9a68e4bab
MD5 06c1e4cc127d2099d29269d69ec22713
SHA1 bb344dc1aed9b15244ad7a1245f22260663f2505
SHA512 7ae33ac959045db85b52c97e9880f971e94e44e6590d8752ab64b372b3fbb3ab98dd46d6e6937fa2c85e769b675b134215edac17523ddd8acf58738302efde92
SSDEEP 24:TL5wx/XYKQvGJF7urs+XXmxXX1XXgThtPXXaXXEXXf+cUXXH:TVwl2GL7msgUJgTPvkSf+DH
TLSH
T1A242C2AE4E65B5B7CCA04171C2A1019E2F3C50EEA62331A065508F2ACC0F359DD37DCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 c3e7302206928cd68896078689c48c9bdf74527aff02cd223534056ef5dfc7b8
MD5 0aaef49b317b56bd104ae26673f26721
SHA1 8358c7dc250250afe10bfe6bea12f476a43d7370
SHA512 d8b1a171a2411ac2d542009452a6869a053241b2a1e5cc66ab0a99bb30679cbcc6f0f1645cb51e9ea844c5a570a09a4c6828683d3fd4c6a64e0961764e78c0dc
SSDEEP 24:TLHCx/XYKQvGJF7ursaoXXfuaXXfbXXfRXXeSXXelXXeJDXXmxXX1XXgThtPXXaV:TOl2GL7mstfffjfdra6UJgTPvkSf+DH
TLSH
T1E9428E9D4E69B6F6CCA04471D2A2155E6F2910EDFA1331A031158F27C80F359DD37DC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download