Windows Analysis Report
Specification Sample.........pdf

Overview

General Information

Sample name:	Specification Sample.........pdf
Analysis ID:	1544425
MD5:	aeba7f17c41f5649d00cc2d728e8d41b
SHA1:	f481d17c0ea06eb8740f4034e77ac21c9e66f08d
SHA256:	c0c081d9deec15050d9b50fa0f648729e87d6b393694db94ad40b20f89997429
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

No high impact signatures.

Classification

Signatures

There are no high impact signatures.

Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: clean0.winPDF@14/50@0/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-29 07-09-23-911.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Specification Sample.........pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1596,i,12715773412985011628,1919190508316726040,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1596,i,12715773412985011628,1919190508316726040,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Specification Sample.........pdf	Initial sample: PDF keyword /JS count = 0
Source: Specification Sample.........pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Specification Sample.........pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

ID:	1544425
Product:	CloudBasic
Start time:	12:08:19
Start date:	29.10.2024
Sample:	Specification Sample.........pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	aeba7f17c41f5649d00cc2d728e8d41b
SHA1:	f481d17c0ea06eb8740f4034e77ac21c9e66f08d
SHA256:	c0c081d9deec15050d9b50fa0f648729e87d6b393694db94ad40b20f89997429
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	7A69F6B54B9A07CF16B8F91FFBB4D181	9F0CE850C4C602F9CF496AAA6557DD1FE23AF841	B68607D7B8C86FDE1E747C9A1E6E19E7DA5039A6DE2525F3B2AD8353E205EB39
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	7A69F6B54B9A07CF16B8F91FFBB4D181	9F0CE850C4C602F9CF496AAA6557DD1FE23AF841	B68607D7B8C86FDE1E747C9A1E6E19E7DA5039A6DE2525F3B2AD8353E205EB39
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	82577FBD712531BD861AF06617CB312B	D15A81C32095042D40CE3A9E02514EEC1747378C	4543AD58B82695C0D2C145953FFCC0AE8CE0E91D7F557C54316B18172BA26AC1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	82577FBD712531BD861AF06617CB312B	D15A81C32095042D40CE3A9E02514EEC1747378C	4543AD58B82695C0D2C145953FFCC0AE8CE0E91D7F557C54316B18172BA26AC1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9525c6db-19cd-450e-99f1-c1cd200b8d0d.tmp	JSON data	FBD32379A5B7D1EA6DF6E136013608C7	CBB2AAABAD7C0E1C0794B6B00DD1F65A7D525371	330058D8656F80F762E675ACC13B64383F17703C38F1CEAA5BA0BAADB6FBD171
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	FBD32379A5B7D1EA6DF6E136013608C7	CBB2AAABAD7C0E1C0794B6B00DD1F65A7D525371	330058D8656F80F762E675ACC13B64383F17703C38F1CEAA5BA0BAADB6FBD171
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	A2169AF7130CE8A49B7C22D878932FB8	B8D7CA02B9AB955C69D877437FC98ED67098E43A	CE29D2E8DD2C372192C3124FE3A106F77DDF83017F379B658A25DEE5AFB2FD5D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	AF57335213699B607755C93952ABE9C1	538E5331957556EDEACDE81A8DA46083FD02D849	02F431F5DBEFCA1CFFB0FF9FF2C58BC9806A7D9A4ED73000BC0216D9A4D08082
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	AF57335213699B607755C93952ABE9C1	538E5331957556EDEACDE81A8DA46083FD02D849	02F431F5DBEFCA1CFFB0FF9FF2C58BC9806A7D9A4ED73000BC0216D9A4D08082
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241029110925Z-160.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	9837849FB2060D183D66EF85E3B3D671	C2F6FD7BE80BE2B054F95F143CCF41D48270F2D6	5499B33BEEFE768026421315BD4BBEA094B9E1D52C1EC29C1FA290B53DC99454
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17	4EA5CB1C33562FC7DF6EB55DE2E5BB22	AA8722D2ACAC080E1DB13EFFD610A29D3BA17CB6	65DAE4133956455E75EBF5AD3D159E5D3ABC62766404FB56223D5A5478EC0C21
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	8DC4DA98EB78BC9F2C2B941D18730A77	277B3BD95E71FF6CDF205A085E2EF5180AF99CDE	8FB349B45D3447AF677193854AC7C64C1F5575C613885B518EF4981256C40862
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	CEBF630D81AE85A6687873BA6B74F48A	7C4F1F10CCEBCE1B40EEAF4DE0925C3EB7D29E0C	A9FD5C43484CF501B440DEC4846D8D68E924E28E8864173B07DFC24138A231AD
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	6120B9A1333277F623AF0F88B93C1444	6FBBEB531FC6B13295A9F8E626BA92FFB302BC15	15B0FE99D1710D8BA54EBB61D7137BAF225779356E0B69C9A86ACEEC94A4E7DE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	D044C6A2BD484EBB53FDEF2B6010624A	D6DF9D40243443428DBA5DC479F83FC85D90C081	398AB1377E98B689D11AA28B998A579F0752D54ECB2D6CF93067656A9A3EF114
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	9D7D76BA9CE52FB4F8344D6135D13E88	3137B61583C0AA61DA5659B4C1C1EC04B75DEA6E	BCDAEF8D520CFC5E36380FA53EE9E81891622243FB59F1CEC7EF0714033FECF6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	1F9237F2DDC74CD218D026F2494782B7	7C15A3E7823040AA398BB6A1C917184722E3AE9F	E0DB836DAD35974A1C6F2774B805747C6B3401F1CAB0E2726B41D2C49A73C8F9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	CA1EE81654403842E8FFA7A8AA397559	F99D0D3788C64DD56688F2EC792B41F33DE92092	1AB89FED7EF62E33CBA9F1B9A0A2200690BB904FA709FCA6E7221A4A9885E035
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	F1BDAB1AA080E8C3D53F3A3DB6E08F76	259897ADBF49FE21BA937F8D98528F373CE7D13B	2656EEC0278A54D52EF721575956FD4DCD559DAADB972823F359C43C513AEA51
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	67BD011C495549B24EB2F11354FF0C34	9EEE64A16A750E75994ED9F6102E635E9FE6237C	829F7DD2BC132F06DD20BC947DEA2CCE30AEC22463A3722D36AFFB25BFB6B2D0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	02D6DBCDAAE16944C5AF3D8B4F411E58	71D0E8FC9DF4D5E5176A4DF025223D0FA54DAACD	A2AD21A0CD235132607092B7D6B071906D77025C398283825EA246904B673702
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	612D39EE9F11F6C9DF884EB62022885A	DDA6DD1A078385EDBB5AD86DB9BCD14D125522F8	CC6081A20B9E7070CCC51170F47322BE3369C134A52EA8919F059A7F5A7E39BB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	F2195E5DA731D5CBC1B6632AD64ACC08	7C8E08E054C402BE0ED7C5C9571007650AC9BC87	2C06C99D018D484971D5FBD02FC4812A25F00A1F8DA28F6207FFC3FCA0E44BAB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	D96563A9C8AFB64F8026E91392A7702B	D26A99E61163C7F2710FE335E0D6EC24DDA5F635	501EB9D621AFF5A7EDB37A1FB03A31DB305E694493A421F67D0378C4C5B1331E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	48947BB8F05D54AC0A94BEF38B7D4B29	8783602AC788841E8D111588F4543821B6FFA8DE	7C67502F583A3449E5A6751EBF3A10B7748841BE67E325BEDC47428951C9A2CD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	548E5236E26D766D3ACB9520E9262847	9D6EB6B7C57B65904FF1CF7E17C41B19A69E0248	3CED53AECD9BFD31803E5A971F99B47D67316F803F81AC7FD61A8C4677A2C20C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	0C84F1D7265F89D2356EE2BB07C35CA8	F691EF85AB24D559DA6EB1003C1F09E95D75434F	48ACFF18A9C1FD6E90E25FB8AE88A261D7086EBB8FD26CF3E5B4A758B95A6273
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	0FD0C4465CA7590AFFC26CB8B3E14601	432144135F73D23F89FBBD2151D983B61ED716EF	9BCDB67F812279A8856DD1109B69B1F9940E7A3AFF3A353858075C067F5AD696
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	FDEB5918ADC5EBB3E5ED1A26DBD61473	6878E43C15891730EE8CB86E15E948CCC1F3E3FF	93AA6C52501D6E177EFB4B2713CE00EC49421A19D59F8536B0325E68ABC8E72B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	EF49DC24664EE70CEA3B1A4D6593DF38	AE6344E301D772FAE7BF97B52FA8FBE6AF8787A5	1FBEDC2F5B74C6C21C7A676E8B8505FAEF35110BA656E2FA0573E6632BFF9822
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	2047D425F296CC07247AE44D172F8B34	4CA41B22F98290346C285D6181032F3406AA48D7	C6932AAF087EB563335DEEDC9720532F1F07F18A721A23FCAAE9E198CCEB765A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	88E77966D625B2D69C42D92CF338AD35	8ACEDCD87E31C236E255CC580146139D86CB39F9	BA332BDC4D7E2E026073023CE8206527DE2BBBE4ED6E290C1676F600B620DD94
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	E51CD0676CEBE900F261BE0143C1B04F	1D7212942818A939A3520399BEAB8F7E66AEF5BF	B5EA3627AC52A64698D1A93B7AD7796BDB2BA8B200EE46927055746ECA633FC7
C:\Users\user\AppData\Local\Temp\MSI94c2b.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	A93950AA0FBF0E3562ACFAED9213DFAB	EAE4E89D1C5C7A164E6AFCA6A921C8EB188B4F5E	1920F74269849DD8DC706EE257BB16A6721120BB740B1D2A69D00A1517D127C3
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91ym1cs8_1owqx9p_5ow.tmp	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)	BA1716D4FB435DA6C47CE77E3667E6A8	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9okhbi8_1owqx9o_5ow.tmp	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)	BA1716D4FB435DA6C47CE77E3667E6A8	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-29 07-09-23-911.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	1828AA985EA2DE33B3B00DDEB6C79A04	F6D2578FACC46BEBC948BE304945235607BF616E	409667434AC5C3C9BE19CB7540AA59F6D3C3B2C0F03953D95AA6CD3215559F01
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	791ABC758BA7F86D4650AB3887E8A591	570AC96CCCA35351611DB28ED05DB86F761EFF0A	2D71F359A6C23E33E5D20EA76D11AA5A59B84777CFA9DC64646B49450543BD2B
C:\Users\user\AppData\Local\Temp\acrocef_low\0199ef3c-5c05-4e27-a714-033318d41b9d.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\70852c7c-a4c4-4ef7-943e-9aaf64baba2d.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\75176025-d6d3-4063-963d-29ac66a380c5.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\d9387583-9424-43c1-9cff-1113f8add3fa.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	8D0363CB6E658F9FB75DDF89015A7BE9	DFCD52F83EB0B2771B4AB26AEC58CD3EE33CDA98	EC6C6ED5878F0E123E39886C673B97FFC93C42166202F31A6ED41EF39F205999
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings	ASCII text	DD4A3BD8B9FF61628346391EA9987E1D	474076C122CACAAF112469FC62976BB69187AA2B	7C22C759CA704106556BBC4FC10B7F53404CA1F8B40F01038D3F7C4B8183F486
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl	data	7113425405A05E110DC458BBF93F608A	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl	data	5274D23C3AB7C3D5A4F3F86D4249A545	8A3778F5083169B281B610F2036E79AEA3020192	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97

Windows Analysis Report
Specification Sample.........pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report Specification Sample.........pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
Specification Sample.........pdf