45201ea8eaa70a67d4ab1931b50d319b762302053608b12d07066191641b8194

Analysis

user interaction
yes
max time kernel
306s
max time network
307s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 14:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
term-2-summative-test-1-except-VE.pdf
Size 4.5MB
Sample261027-rlykpadx3x
SHA256 45201ea8eaa70a67d4ab1931b50d319b762302053608b12d07066191641b8194
MD5 3d30b9869d9d96026f704b884a87b195
SHA1 21e5979e81d806db9d05344e82d5a53fe5975756
SHA512 6f89febd0a344c9950cde47d5e2a1ca7a2a65a7e4285be8c3efc6c691b13c697c54a93565d9fdbab0f56551dc95a1da905e5eb255005b3159684e13db002171d
SSDEEP 98304:3+7AmxJjnEDTPvJZplv6WSNg6yT6Hzsrv7MQTlDrEY50:3HKjEnvJZplv6S6yT6HwAY/U
TLSH
T127260172F889C98DF845C69895672C5E0F0EB61B76C935D9053A0F8EF401AA4EF8718F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4684	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4464	AcroRd32.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
4464	AcroRd32.exe
964	AcroRd32.exe
964	AcroRd32.exe
964	AcroRd32.exe
964	AcroRd32.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 996	4464	AcroRd32.exe	89
PID 996 wrote to memory of 2584	996	RdrCEF.exe	90
PID 996 wrote to memory of 2584	996	RdrCEF.exe	90
PID 996 wrote to memory of 4360	996	RdrCEF.exe	91
PID 996 wrote to memory of 5604	996	RdrCEF.exe	93
PID 996 wrote to memory of 5604	996	RdrCEF.exe	93
PID 996 wrote to memory of 552	996	RdrCEF.exe	95
PID 996 wrote to memory of 3588	996	RdrCEF.exe	97
PID 996 wrote to memory of 4716	996	RdrCEF.exe	99
PID 696 wrote to memory of 4684	696	cmd.exe	106

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\term-2-summative-test-1-except-VE.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E2E28D132B34F08BC54E1CCECE57D0DD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E2E28D132B34F08BC54E1CCECE57D0DD --renderer-client-id=2 --mojo-platform-channel-handle=1804 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2584
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C9913035FF72566D0F36E5A5474166F1 --mojo-platform-channel-handle=1796 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4360
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=327CF57C6904979F3EF26673744745F8 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=327CF57C6904979F3EF26673744745F8 --renderer-client-id=4 --mojo-platform-channel-handle=1808 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5604
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5FD5B3B594224618FD3BBC6FEE86A74C --mojo-platform-channel-handle=2768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:552
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C8864BC7B0108C72D7466982543B6622 --mojo-platform-channel-handle=2856 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3588
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=16DBA42A54BCD1D5432227F8AE49C75E --mojo-platform-channel-handle=1788 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4716

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:964

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:696
- C:\Windows\system32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:4684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 b6bd5a7dbc140e1807ba6f251aa75ce2b77867a5895ef7754cde942bce2b2029
MD5 043064518a75c3a80e8ef61e4c03c59f
SHA1 e8a22295423aec21ff9a4528bfdcb16cbd06d722
SHA512 3ae3a5bc53b2ad53e3db452836dddcd04a35d9e21f4d4e670998354e79ee90e8b7c041abcaab4a8ff37a3480a3cfd2a7cda56c3c1570d0f92127105ff7fdde65
SSDEEP 384:yevdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:y+eUZsLQCZsL3hUS4
TLSH
T15F53CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IconCacheRdr65536.dat

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat
Size 385KB
SHA256 9abd686775cc327182ba44a6e5d439521527364196d27e68cf87d4097af46add
MD5 707f6fd3e6b74b249f87e65c964b7a18
SHA1 786413f42aac902fe257730e242bd04d89a749b2
SHA512 65a147d68bccdba40f0d6c9fd01801920a2bc05fa11b66b20d513d3e903a33d824a92ac24b9cdb2aeacc71254e67f9cd1937d282c57377930417bb48a0df0f9c
SSDEEP 1536:rjKNTBeJFFFFFFpXyDyWPmbioPgpPLrtpyxxxxxxVzS:f2DyMmbioPgpP
TLSH
T12084664D8A5F8AC2DBD80E7B44989764D0A8ED2BE2D3ED666184730513713E714BF22F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 4326b737e3e0385ceae9816483002b5722aad8e2fda6970c85eb6b0d25b718ea
MD5 2e75fdeceb83857f4e3d93acdcbaf7ae
SHA1 676b826ceea79f688e02378c84609867852f3a4c
SHA512 f5982b82dafaa7bc813f67098dca12cd51d83ec5871ff7f0dc78b52bf0149c13b050693e0b737f23cee9646462a44dea009b38df461dd6b26f2a61f59412a569
SSDEEP 24:TLyx/XYKQvGJF7urs3DP8Opv8OFjbJb61BkC5IPCUt6:Tel2GL7ms3IOp0OFjbJb6DkQo0
TLSH
T14042AA5D8A1BE770EDD11A3BC1CD226A777C620E63A30252310CEEA48A9BA90A5135D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserCache.bin

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\UserCache.bin
Size 36KB
SHA256 aeb34b351975a092140e6f44e6522563c997f03e6ff5674d2ffe49bd2f583e61
MD5 0e478062a776437d73f6ffa0877ffb50
SHA1 4a9935716254dc369c55caceb82c443ab6f7f784
SHA512 8dc2b7a4f2dbdcdd2cadfff4c44a59c48c62fbb840c1a31c31512accaf7e081ded01dcc78da3e069c61c4565f0c8397beb7d7179b7adad76b293141bf8cb372b
SSDEEP 384:s7XduyVFrKAP8hMDJEsqb82pmwnWwk/YNg7y:sTduyVFrKAPvDJEsqbNFFk/Yyu
TLSH
T13803F34CBCBC5723D6561EB6724CDFA0AF349A3369A94F0E817472655E522E8FF28007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ES_session_store

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store
Size 10KB
SHA256 677c04bdc74e9d34f2d04d744cf2fb0c3eb239ae6b8e55bb8e6690654c268298
MD5 2ceaecc8cddbbbc615dee82c41d67f98
SHA1 3802bf7fd12eba61c4f82a97e0e7777052ceac82
SHA512 c03335858d20f20d0490511862f4b765b38f232524dd7f2b8b93d2c76d00755a0f71e9305feae8af6d3d68a21290566335baa5691414ca4d6905c8c2a88cfb5b
SSDEEP 12:kVmd5UFUK2ZR84C/Iu+kBQoDp/lS+3xuwmmkelopPL2rusPU:TUOW9r+Cp/44emhlo1SP
TLSH
T1DC2220B38CD8CAE0F05F007A9C36AB22D60718A2822D4D9030CE4D00CFCC9D15E6865D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ES_session_storei

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei
Size 23KB
SHA256 4ffe6cfbdb885cbe9b2c9b39d22ce46ef27fdbb2590e00777d2abe741945cb63
MD5 de6a1f734ac7a5ad4b0ef45fb4bb5362
SHA1 9f601e0204a2e843d9705d7c3cc475b9ecfc4f74
SHA512 492a4bc051683214ddf5fefe9d321a3fa40aad3879dc451999f67fd8d99220e6df70fa19abb507c1af0ffe059c0f233cb2757ee59f9e4d3aae07f17355b5f55c
SSDEEP 24:PDpia+uTvi7VUBWqmk1aaGO/uuR5/FkV4uEmySNbASaBJ:LA4eVUBWqmlmL/F24uEmrES8J
TLSH
T1B5B2B90026B26B46E5B2B4FE365F94E602A81703221CB029C164FD474E768518CCB653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4464-100-0x0000000010E40000-0x0000000011B73000-memory.dmp

Download

memory/4464-156-0x000000000D700000-0x000000000D84D000-memory.dmp

Download

memory/4464-155-0x000000000D700000-0x000000000D9AB000-memory.dmp

Download

memory/4464-123-0x000000000D700000-0x000000000D9AB000-memory.dmp

Download

memory/4464-124-0x000000000D700000-0x000000000D84D000-memory.dmp

Download

memory/4464-104-0x000000000D700000-0x000000000D9AB000-memory.dmp

Download

memory/4464-105-0x000000000D700000-0x000000000D84D000-memory.dmp

Download

memory/4464-101-0x0000000010E40000-0x0000000011532000-memory.dmp

Download