3b5272ffad2eddad1f38a6fd7ca16730b93f9fba087deb5ca33e48fb73e1a9dc

Analysis

user interaction
yes
max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 13:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KIT SOCIETÁRIO QI CTVM 26/2026.04.24 - AGO 2026 - QI CTVM S.A (3) (1) (1) - A1-autenticado (1) (1).pdf
Size 9.1MB
Sample261023-qlft7syscv
SHA256 3b5272ffad2eddad1f38a6fd7ca16730b93f9fba087deb5ca33e48fb73e1a9dc
MD5 b69a225bf9bf065e81e16de0478b0140
SHA1 69138378d5574898703ee1b69dfabae32b0e752c
SHA512 23353b0a3f0f616a9512152fc6d5e4c89a15a703dd429326ca6b5c8ef03dcb3681b45c4111403b7e5f6c4c21633ec57eb4aa699d8450a8605675510c6a0963ca
SSDEEP 196608:Bi3zf+kIh9Kfzq1x228AXa6R1PI4mWqg/dSuB5OmK4QtAv6Md:BiDf+ZvKQnJPPqglSuB5FAtBMd
TLSH
T152A6335C0BE060B9E95D0628DCEB3B881E613AF712D9B08FD3475E9CB493E43A72556C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeCollabSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FullTrustNotifier.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeCollabSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\MuiCache	AdobeCollabSync.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4256	AcroRd32.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe
4256	AcroRd32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 4240	4256	AcroRd32.exe	89
PID 4240 wrote to memory of 712	4240	AdobeCollabSync.exe	90
PID 712 wrote to memory of 3512	712	AdobeCollabSync.exe	91
PID 4256 wrote to memory of 4736	4256	AcroRd32.exe	93
PID 4736 wrote to memory of 3300	4736	RdrCEF.exe	94
PID 4736 wrote to memory of 3300	4736	RdrCEF.exe	94
PID 4736 wrote to memory of 2044	4736	RdrCEF.exe	95
PID 4736 wrote to memory of 2364	4736	RdrCEF.exe	97
PID 4736 wrote to memory of 2364	4736	RdrCEF.exe	97
PID 4736 wrote to memory of 4192	4736	RdrCEF.exe	98
PID 4736 wrote to memory of 4824	4736	RdrCEF.exe	100
PID 4736 wrote to memory of 4864	4736	RdrCEF.exe	102

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\KIT SOCIETÁRIO QI CTVM 26\2026.04.24 - AGO 2026 - QI CTVM S.A (3) (1) (1) - A1-autenticado (1) (1).pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c --type=collab-renderer --proc=4240
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:712
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" GetChannelUri
      4⤵
      System Location Discovery: System Language Discovery
      PID:3512
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=791176A8D4B5DEAA0F2D0DEEE6E4ADF8 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=791176A8D4B5DEAA0F2D0DEEE6E4ADF8 --renderer-client-id=2 --mojo-platform-channel-handle=1788 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3300
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C05D9BFC13C3A7EF7848C545ED617E76 --mojo-platform-channel-handle=1780 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2044
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=052452D15CA906EEDD26ED02E40AD621 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=052452D15CA906EEDD26ED02E40AD621 --renderer-client-id=4 --mojo-platform-channel-handle=2404 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2364
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E153F9BE0416DB50349CE09494AC9B82 --mojo-platform-channel-handle=2760 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4192
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6D97129F30CC2673F974CB8DC352AAC9 --mojo-platform-channel-handle=2912 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4824
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1CF6A4850DC1780B5A9A1EC96ECDF4AB --mojo-platform-channel-handle=2056 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 1297618873f4d881088c8db66322a1caac15ba8ea68205dbfc49a203f9d96da9
MD5 40c992165865e9c98219aec14d5cfc7c
SHA1 df4adc9346f77c18781829ef69f98a20035e404f
SHA512 7bf3336dfe3100293804f29370d212c42a6f3958e1ba2718ea63db2bc0340635354a165bf33d74342201204fa91bb6a74eedb3b8252ae8a9e7da9a354ee943fa
SSDEEP 384:yemdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:l+eUZsLQCZsL3hUS4
TLSH
T1EF53CADB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 87aa4c64348b534771f03919b5bdca09596e89f6e0cca0a992bb3d290ec4155a
MD5 aebe0d2eb7a2077a55e57a955e62406a
SHA1 3f811b8148f12220f4b45699135e6d21c9847d8a
SHA512 efa1b082925a4e478fcea74764bbacb91d43da8c01c4b360a34e6f7402af23f91c93b5e91c6266120e144b5300e8dae73a62a7b6d7c4328410128f6a72a7baed
SSDEEP 192:t+oGsTzoU27NTaUxmYeMb1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:tklNveMbUNlNaN
TLSH
T1D293FD0F3556F261C5A8A6B4850084F351AEBF1BE7E6B1A391B6CC3F06F9743012DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 da20dcddb0df1e955cd37646dc00517b9a426885d24c9ce692efd598a42fc45d
MD5 2ba4d8b122a6099b278b3af02d536c58
SHA1 609c33bfea3c1a8a2b54ab9bbbffae42679b30b4
SHA512 60867e36d09c83666f07e717bf7bf63f9f62050290ab139b4e89337bb0d70094acd4629285d58b0b257f3e85db41f3fa8a0a7f96e457dda016111f51b3cba266
SSDEEP 192:6+oGsTzoU27NTaUxmfX441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:6klNYX44UNlNaN
TLSH
T1B393FF0F3556F261C5A8A6B4814084F3119EBF1BE7E6F1A392B2CD3F16F9643102DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 6e8b0485864ad65051422918d43ec32bfad68a9ed9994804f4a6ac09a7532979
MD5 8beca4ea5174c699aafb654a63a262de
SHA1 6a4c4f8cb0b67577aec8c0add1cb5911658b6ffc
SHA512 2bffd404a9122a2c0124b0246bfbed4f2848f85003ee83c35bffbe3bc08e792888f4a965e87fec1b086298bbb2db8ebb6c0613698e734c8c1496baeae505f04c
SSDEEP 192:K+oGsTzoU27NTaUxmWX441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklNBX44UNlNaN
TLSH
T1AB930F0F3556F261C5A8A6B4810084F3119EBF1BE7E6F1A392B2CD3F16F9643002DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 b1d840cc30939087ff9fde273f4be3fb95580a7d38c42995989e7d68d7884769
MD5 660dff5c821fee88d5c17914ab756b40
SHA1 429532e3054222b41c0c1fd4d2229a76d8447304
SHA512 dd41422636603d03ee21c7428ef07a289747c620060a65717543e2db7305e30167e2cbbe6b6dfb825006f707a92d99aecc92d285498731b66c5acd3164f4561b
SSDEEP 192:a+oGsTzoU27NTaUxmGfHHX441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:aklNPfnX44UNlNaN
TLSH
T1EE930E0F2556F261C5A8A6B4810084F3519EBF1BE7E6F1A392B2CD3F16F9743012DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 a027cf12f2055635a3020f08e0448b2f0314791260ccd25570426088c5b0e307
MD5 245950c48f668cf2fcb3c64778e64089
SHA1 3a5a14c820f58e35a3fc6f5de29669f0840587d8
SHA512 4fc8448536663b551cc716d78715f06d4ed217fbdf755924f0b30aebbb6212798a61c6638f919d5c14bdb6998d6a12f0ca37281f3c7f484c1821fbfc98d4a24d
SSDEEP 192:K+oGsTzoU27NTaUxma1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklN7UNlNaN
TLSH
T17293780F250AF221D5A96A74C144C9E342A97B0FE3FA35F751F5CC3E5AD5A82013EB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resource-18

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\resources\resource-18
Size 4.3MB
SHA256 d8a90c7f0722581d46a02698ecff30f58a7e5f133451126865af2fa927e527d0
MD5 9aec7dea0f58838901fed1475eae786c
SHA1 aed5ad29de81ecbddfaa0f058616d0a2b97e5717
SHA512 613cc77b9cc337fb8e4165385af4958a26b1ed7eda39941e914f4654de70aa87bc7719e30b07c0fe5570ec576a1a02ca576be651ae9374349f23f3f12ae4c83a
SSDEEP 98304:liQDp7jS2oXx3BV0InCsJ7MpJhdi0PoAdbBbAetlFHxA:l5jSFHrTCdiqFhAh
TLSH
T17B2633DADD39499DEF6B0EBB16B172075BDB346626F4290CB8CDA9C403119013E41EAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 471B
SHA256 01eaa320258f850feaf6d295645834ec88cbea2c831569ccd78e3ba9145b9c99
MD5 ba6adc82256cb2cf486d876430e128d3
SHA1 ea01fbedb6b7a92abad0d868c736108d7faeacfa
SHA512 531c42de543ea61717867890b4f5f0cba6e5abae49afda9697cd39ba5637fe400d42dd350c86015af1a2c8a60fdbd0d819fa2deb12f9011fb2c59dc3d03e26b4
TLSH
T10CF0D492427FF481B9C695DC70F1BF71F42023353057615778EA4190C4536AB5D5547E
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 412B
SHA256 cfa83ded6548a466d072ae4fb1a90a55b5e2040c0c6f3c2a36c565258ad18c07
MD5 9224630d807d6fb44c86a57514db50d9
SHA1 e95805160a5eefec3d5f8e9f77e8f70fb3711dfa
SHA512 c36505a21bef23338459a9a0e0bf4df7dc6f3be3fbeb6988f611768d98e1bdd6a2de19568475df769289b1ecff734a9f469fb5b41cc6a017cef5489b8d26132f
TLSH
T13CE0C02012FF902CF4E4E03887DB6E35169DF0312408F2B81BD15704A617700EC01E35
MD5 SHA1 SHA512 TLSH

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 c9848ae075732f07023da3cfba3b33c5749e16fe88131089508186e7687fe574
MD5 6b515fa5c599be4e13c0ab5fdef0e91f
SHA1 2b1b309d281c722f0e5f3a524c6e3f1a5ea49872
SHA512 68f6d2ae012c75988a5da701b37699209a2b8169929a0ee2b4a21be5753e07abc1fc432536493805b13dbd81c50ba8549bc0ec85dbb28ba0fc1c022d9364a7e2
SSDEEP 96:MVms+PLNVLKLALYg1d9z7nEmLqL+c9T6KIRL:5JBpcQ7
TLSH
T13A42EAAE1687CF37C5A16BBBD9C000F6132D2325425136897E648D31B70A74FBD278D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addressbook.acrodata

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
Size 14KB
SHA256 06a576fc14e995c437b26c0d150b4e84cd745e7cedfd972a84b42b51c842fc9b
MD5 947f93fe0eed44767626846f28cfde05
SHA1 f6276d2a2b4a9d8a8e23c84019cd3961e9d60e88
SHA512 f97739eb0d22a99b06ef340aefb0d5a5b45b679d28accff3de2565166392c7d2fabaa33f945696f7d456ba2ef323f48e43eb26578f71c8b2e8ed32fb4dc69bc9
SSDEEP 192:gcPqYV/saFlwwR+kMqe8TlZMX1sgUVa3ddMVsuNeMcGdSD9obOUAVlcMudM/Y14W:g7Q/X4kMb0lZ6mgtdHOelGdWaolvsTh
TLSH
T18652B7E55E67BC99D827C649CB3430965AF250A703981E20928D6BD43EE789F3B40B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addressbook.acrodata

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
Size 6.4MB
SHA256 52d5a89ccf1b1cd6705ca3f83d3d61da96fb2011854edbdbb4dd283681307641
MD5 7cc86ecef253dc242342814b5053c51d
SHA1 9c86598e360c7640b3d41e9f20952d06ca52f131
SHA512 9a0a25f6130478ba3c9dbb8f26ef354870d14a0b0ef76e4d99f17b5ae9dc44cfdbaa7602b6265de7d68cd464f7eb18d744484fb22661d88b3a93b85950664c25
SSDEEP 24576:Brshdv7XuJXQsnNiJL4tU67Suene4fYhNcf5wKHMaEwrBaXlFWFR6rMEIPmYYtLY:k
TLSH
T1DB66F9E48A6BECC5D817E188CBB875F756B2317703A40D20479D36D02F9698B3B44A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download