Windows Analysis Report
a61.pdf

Overview

General Information

Sample name:	a61.pdf
Analysis ID:	1468119
MD5:	e800cacb7da9706f7cbadecc954b0a10
SHA1:	58342023921cfa86088d234ba94230e805acfe94
SHA256:	13a80791ee707dca434fa10783c8adc4175c091adc6499c8cbc32db0d59a27f8
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

No high impact signatures.

Classification

Signatures

There are no high impact signatures.

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.1.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: a61.pdf	String found in binary or memory: https://www.dynaforms.com

Source: classification engine

Classification label: clean0.winPDF@14/47@0/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6212

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-05 05-18-06-308.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\a61.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1588,i,9066750775414929388,1342811030952036363,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1588,i,9066750775414929388,1342811030952036363,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: a61.pdf	Initial sample: PDF keyword /JS count = 0
Source: a61.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: a61.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

ID:	1468119
Product:	CloudBasic
Start time:	11:17:13
Start date:	05.07.2024
Sample:	a61.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	e800cacb7da9706f7cbadecc954b0a10
SHA1:	58342023921cfa86088d234ba94230e805acfe94
SHA256:	13a80791ee707dca434fa10783c8adc4175c091adc6499c8cbc32db0d59a27f8
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	F85EEC373DEED56E5CBD6846E40D5FC6	CDF9DEAF1597DC0DAA1A900085D12CC6449E158E	755CCB72E6A1D99891C2E51C72EF6C66AF377C08BB50797C7CCD990ADD447E2C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	F85EEC373DEED56E5CBD6846E40D5FC6	CDF9DEAF1597DC0DAA1A900085D12CC6449E158E	755CCB72E6A1D99891C2E51C72EF6C66AF377C08BB50797C7CCD990ADD447E2C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	94D7DB1B6E40487A2F89BB13D01CE745	15171F64B1F25B0EAB20E15F83D78213B5C37D63	B6B3574E8041CF1352A28694ED9B0584485C94661972D10ACBB3BDE96ADE340C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	94D7DB1B6E40487A2F89BB13D01CE745	15171F64B1F25B0EAB20E15F83D78213B5C37D63	B6B3574E8041CF1352A28694ED9B0584485C94661972D10ACBB3BDE96ADE340C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7a44801b-c5d8-4dd6-9ea5-5862bca4e41c.tmp	JSON data	D23C73440627D7F7212B2DFA28D360AB	20EE2E066B70973825537014C9C47BFB6CE513A4	B5B24263F741BBC33182C3CC494676ABAB25C4B4A16463CD27220320EA50054A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	D23C73440627D7F7212B2DFA28D360AB	20EE2E066B70973825537014C9C47BFB6CE513A4	B5B24263F741BBC33182C3CC494676ABAB25C4B4A16463CD27220320EA50054A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	8B39DC59211E07A1C57FFD602BE235EE	1EACEA1457C9E03C3D9425FB506259514604C3B4	B293072C1752CCEE94ADFC858FDE0A1D88CAEDE2E87DC286F5D7FDD26463A52C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	EF7D6F619A45B073C5BC95F503B53E1C	A56234B2F66F6ED0343EA209D4F950CD1E0BF57E	7D6ECE19B8C6560BB1DB3718BD9FFDD49BB4C18B8AB85B15771B7F6B18AA69F8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	EF7D6F619A45B073C5BC95F503B53E1C	A56234B2F66F6ED0343EA209D4F950CD1E0BF57E	7D6ECE19B8C6560BB1DB3718BD9FFDD49BB4C18B8AB85B15771B7F6B18AA69F8
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240705091808Z-158.bmp	PC bitmap, Windows 3.x format, 119 x -152 x 32, cbSize 72406, bits offset 54	3077E0AD608B5D120A28634DC3890B8B	13B57A30AD0C726A3BA787A2250E14DF87D3BF18	0FC2D40E490DD2FA04909CA9840F24AEA668F86B1B99C6D81B65DC1DE9084F6F
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	5E5852B40C13E2F0565CC3062C2D8587	7EE2F18319898DC38D87099CFEAF174E00FC8993	82D835CF9303868AF038E1D1C0DD5C9B8135A68F357ECD019E91A35AAF03C248
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	53EEB416A947DC2A12E7C92891F3B546	E1B940DBECC2B1149930E983D90E026F7909B781	D54E9F303DFAD8D9CAC780946D2D3EDC1AFFAF0DCBA5C8E39C12B740D7E05F84
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	D4AE187B4574036C2D76B6DF8A8C1A30	B06F409FA14BAB33CBAF4A37811B8740B624D9E5	A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	F146A68C20D47DEC05484ADCE0EE81E4	086DD8489CA207F8C6D4B126C5235BE7CFAA1B30	FAB5D389E3B18F859CAB4AC40E88D3916DD92D891971B2FEC691636BE2868687
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	3676A31874BEA367ED202E16AD913081	430B23EB36ED40C8E1B2110A90FA4FEEEDEDF21E	33DF79FF1BFC21E8A5343C79CD6C3F9F9DF701D004FEF11E304D5D03078896C8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6212	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	6EF713BDAF61DF5E1A890B713CB8E000	2E1D5B439E7DB7C3099A9036980CD838405A18D0	2DE2080EEE967867C4BFD048F3F1D4FA45D2291E55A6156656CD7E448B0CBAD9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	ACA2844D7644C3700D14567B34AD61F2	1A645C1C83341F16439096BBF6567E20527B9E62	28E26685774890342B09E5A97A66FE99D25636245BD775445AAA9B26B01DB43A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	E53B858FE6DA7D5A226147F8A7DC584A	2B7D77403B5BB24D40635F4D26616C2F0D9B396E	29CA3384245547CD8637ED5FAE1E7AC03687898D7D2489492413B723BFD1EF15
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	CE9625B26281435D4F131393749735B1	451D5FC4712EEAD062DBF6B624EB648938839B58	077E608FD6A730B89B756C99377E85DAD55992DE77B9EB48F0DBAEB9295BD185
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	94896098175FE8815AC99A72A36A5D16	8C216C4020B41C464E2139478F03B13194E37BA4	63D656FE02F166CBBB8D56CA2D8C3631A9DA186AF957D8C5A28407E9E4EC75BB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	2467DA73DFA517D624EABFD526AADC3C	0B4944116CD244099E98A92951F6FA2226D0A1AC	A199F9DFC37153D54A412EC9013117DCE127455504FD1792B12AF0DF35C03198
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	F51D5BABF4F9545A4973A061C429A721	324EA0804791C83FDCAC9BC68FF799FB2279BAD1	11AB43C42F6F61588FE692F0649164F32FEBA502F7AA8E3F77A22E05F1FE0262
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	7F3D2E0C0A2C91763D0B628DED42C481	071EFDB953EB02341C50CD82CCDA388EE0A72629	AE4C31E2B75858724035A552DC8ECC306493B19947F599B1B3D36366D8114797
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	B384E8D0EFF1EA409FE93D1B3C3CCB81	FE83502C0B74FCE082C26F8D749791D3D85C7D11	AC8F19ED94B9D95513936ACFE66A4AA0CCF6CB5FCE389D04E30CA40E6E1937CD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	A9E8D7D987DE9FCB1584DBE2B587B142	2777590270BD87F42091B564BA2FFC9551C0B27E	E736E807F70FC524B78D7E6E8A57D16C9857B0D477A23F7F0F494E9BAF414BF1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	157D76681E802822D0AF185A02355738	839225B6023B1399369582F00121D8E3E9027F59	AECA2F97E97AABF12DA58FB54A59276337B6C7B823C1FB597CFCC9E6C840C753
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	BB5A68BA18FD92F619CBE7ADC71D0D08	91C9F25B4FA64ECDA1484A5C72C1F7E50C814E44	ACE01DE13E469DD4657CFBE7AB0EACBA3834C278034B039AF9E185D08F9CE96D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	EEE120F00B312A1EDDF0B7CE9059547E	16C9E4A24E173BE1F6CE76AAF70BA9020A580842	DE66AE00A7F060C875B2FF8C1B0321B689DE7FDA19ED1EC0C45CD48B6A502507
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	E222B6C65FB23A1FD7926B1FEC9020BB	296A24141884BAF6A346B98CEBD4601038830A40	0C8828A44CB70367EAFE9A8FE1BD21AA44FF66B5A5C43C4F7F240BE456EA22C2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	EEA44BAB70F4CA4DDE5AB3D55707C109	ABC6DD09DD4C5134E3F00A8598C64832CB1D7A78	CF133DFB243C1AA9283DDFB0526BB49E6427543F06392783D6E5E9DE689A5A5B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	10415C1D2C6DF9E6E0CB8BC777A10E2E	5F40773CA23F79E71B1A578773FA0D1E7D80993D	5B1F55E941F92E4204A22FE63FE555F3AD63FDC1E6213C0379BC95B107EECD08
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	C50268D0CC7CB39B4D88C8980339409A	B9A1F92102F13475E59F19063F7785DF2064DB7F	9E10DE4DA4B4461CEBE4917B61EEF526914C65E538D01129354E937A9E606E30
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	C2E5260832AEBF10922985286B77CD7F	1703FBEE718D05AAD683135AD7947AAEFA794E12	9074A66846FE913E37F4E8F275D7C8FBD3E14EC6D30C6DD03E8E2E213BCA522D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	4BB82DF95B1CBDC613E1FCC980D3DD90	E7DC9E7BF89912FC49CAE353E8A546F28FAF2139	FBF328EE7C4EDB12CC7C68D465843E40F0990433DC9D2C64F973F9E355A10F2B
C:\Users\user\AppData\Local\Temp\MSIf712c.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	53791AA73E192A3BC97CF40D012A8577	B8004956D80F213BED379636E16A13EC855EED8D	56F5C2C9DFE963CE200ACDCD8050D5D7D494EC8F42EF81D598E832A548A12A13
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-05 05-18-06-308.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	AFC5D329D1561FDA6297E30634C6C4B6	4A3C4FBF19808A9C427597B57C55A3CA67EF150F	6361BBE5FFDBD95261D946355555931674AA7AEAA84D984937892B21DF94EC1B
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	4647C99B203B2F973F0AD402303D3200	33F7BD6F7B42F95DB12480FACF76E8B8AC640124	025FC1479AA587F1DF60CC2C75FDAAA270EAC27A87E4E83F988DF73427361483
C:\Users\user\AppData\Local\Temp\acrocef_low\2a1e63a1-3d57-46e1-af68-4a3032d96f4d.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\87cd1966-f640-4535-9b95-6a247265ab7a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\bef33441-3bfa-49a6-b2fa-44787ae88f62.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	E787F9888A1628BE8234F19E8EE26D68	44D5180C06ADBBDAADDBCE350CE4DEC997CD83E5	3A09F3799148DA49F039A35AEDD22F368FB35B8D6022C4691C10606F704DAF80
C:\Users\user\AppData\Local\Temp\acrocef_low\ee1392a5-88ca-4ca1-ba5d-fc62b478f42c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	8B9FA2EC5118087D19CFDB20DA7C4C26	E32D6A1829B18717EF1455B73E88D36E0410EF93	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD

Windows Analysis Report
a61.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report a61.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
a61.pdf