Windows Analysis Report
Resume - Ms. Kyi Kyi Oo.pdf

ID:	1559187
Product:	CloudBasic
Start time:	09:37:35
Start date:	20.11.2024
Sample:	Resume - Ms. Kyi Kyi Oo.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	1c41f617e44bc8e620cc682573cb8363
SHA1:	c1a10c8aab66733f910546b09d5f4b1fb0d3d5e1
SHA256:	ec74560f1c40aadec1a061cc796411806aef5d32eff94a855fa679196fad15a4
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	0B2CFFDE0F079F3C0787653551515707	FAC102B1FDE2E271FACA4E0004EBCE4869F04FCD	8F69D2BA687284A07C50812BF798F0CF825757A6B7057697A046B7C6CAA8AE08
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	0B2CFFDE0F079F3C0787653551515707	FAC102B1FDE2E271FACA4E0004EBCE4869F04FCD	8F69D2BA687284A07C50812BF798F0CF825757A6B7057697A046B7C6CAA8AE08
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	7905FC6D4CC5A6D425E1D74342F456EB	5467079E84488B022EAC4F0714B11ECA66DB21ED	0D6A3923B6CACF9C0C0B7B9BAF9A4364F6CD32F913A0AD5A0D4349D3003B1D43
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	7905FC6D4CC5A6D425E1D74342F456EB	5467079E84488B022EAC4F0714B11ECA66DB21ED	0D6A3923B6CACF9C0C0B7B9BAF9A4364F6CD32F913A0AD5A0D4349D3003B1D43
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	Unknown	99C8141D4E0205C57BBD053495B50D0E	F5AF8D6A05B572DD8FF9BB9F92CD2970961AB430	335D69B3B4C1051BB37A1BBE2A00702057113FB809116F805E623A48458FBE4D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f87a8a89-c465-485f-82ce-4937bc1ee9d2.tmp	Unknown	99C8141D4E0205C57BBD053495B50D0E	F5AF8D6A05B572DD8FF9BB9F92CD2970961AB430	335D69B3B4C1051BB37A1BBE2A00702057113FB809116F805E623A48458FBE4D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	84A7D3617CBADE0B2028DA5AB2089B0D	2A5F573959ADC9C28A2A4C64CFFE59FB097A1579	845FA6DB59B27EA980CDD9B20F002E8EBFEFCB7454524C6FDD1C06E2AD180098
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	D7FBFE6D77DA85BC2D2B84EE4595D667	4E6234D324A745426510129B0073FFF7C966D2A1	10ABFEC8A066DC8C9F7687891EDC23E98770BCB6819553DB1B53B25339C75E38
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	D7FBFE6D77DA85BC2D2B84EE4595D667	4E6234D324A745426510129B0073FFF7C966D2A1	10ABFEC8A066DC8C9F7687891EDC23E98770BCB6819553DB1B53B25339C75E38
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000001.dbtmp	ASCII text	46295CAC801E5D4857D09837238A6394	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log	data	6B8E12338F874A0602998C0EB718A75A	49F9ACC8AF1EC396DD8F0A767AD3EC7032358757	A1CFC142EC2B1AA3526D02CCA4478492E9C6131A4D8B8D8B09A0DDD31B736F2B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\CURRENT (copy)	ASCII text	46295CAC801E5D4857D09837238A6394	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG	ASCII text	33694096FD011F3CEE7991B9DD9C3944	3C3EBA39B6886B75C0B9E2D011E6FA2C395D08F1	01711587B43F6EB50E73212A097B8211BBBE6BA0A0575A36A87BC92DBB1A4F4D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\MANIFEST-000001	OpenPGP Secret Key	5AF87DFD673BA2115E2FCF5CFDB727AB	D5B5BBF396DC291274584EF71F444F420B6056F1	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000001.dbtmp	ASCII text	46295CAC801E5D4857D09837238A6394	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log	data	A05963DD9E2C7C3F13C18A9245AD5934	15A87493591860C6C22499DF3A705ACB3CB466BD	F40B7EF0FE0B676871403B8DD21CE42AF8E482DC8B81F09D93CB2C48CCD112B4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\CURRENT (copy)	ASCII text	46295CAC801E5D4857D09837238A6394	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG	ASCII text	95EBF90CA73B35511DB832D0CE7642D2	01C81E153142E576ECE38E3B538CEA472C308BFB	B9F452A446D92AA14A910665D7C5D3B44DA28C2ABEF1F4485CD500FC4DFDB9C9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\MANIFEST-000001	OpenPGP Secret Key	5AF87DFD673BA2115E2FCF5CFDB727AB	D5B5BBF396DC291274584EF71F444F420B6056F1	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241120083823Z-182.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	49FBE601BB189C0E1DB599F8445974F4	F5DE3210B7E6BF70E656BBF4B9281C8F00245CA0	6274FF8B8FB123DB5D0481AC1E95B036AE48835E3BCCB04C7FD645286F80CFDB
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 12, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 12	17957FEABAB4A23D5F507DF54CC98440	FBD184B737FD2A2F23EA1F588B44FB730D4861A3	9C0CCE0B47B849B9040CAF6EB651CCF1AB9DE939D6EE4D3EFD9B79B921C19B25
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	BBCE93CFD342B6EA74E14322C2C29DA6	E05CB2AC950A4E675F486564493EC483CFDC7FF3	8DE614300B7BA027D6EC4B1092A4E33B0292F7AE698EA89C53034C16DBB7EB0A
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	8A25250BDE3484A948E09F347F47242C	8A75E4EAFF31EED00773D8AEA8AE519D1BC4B430	F75B62120E1D02EFF69B0DEB160F2C2C8BDD5100711C9292D519F0E4C096693F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	4FDECAB9999D7CB3408FF88A902557C5	DE715D3F5A7D39B2953EE719B98AE7A65DD008E2	10F618A41EAC29E2BA759229137325F90319F61CE599051116F7248C2D0D659E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	1853205F333304A9EE356983DC3CEEF0	174262E74E02939D9B9F4842CAEE292EDD90B00E	1EBD5C13C4D64EC385190EDECEF3143618A9F96CFA6EB92E5957EBD399ACD601
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	DFB82C4CA00B544441CC6532E80211D4	60381A8E834ED923CF3A9857E35B1651FA32D8D5	BEE2B3696A3CC2E56194AD7AE3CBCEFEDB89D7D1453C7FA6F3B742E165970F6B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	CF569EFEB26D762E26CFAE788AC458AF	704B65C43863ED5862265764593C534CE69D7D47	BD9A633DBFA22433ED222A2969EBA7CAB321C359D4C009B9F66F3098CC7502F1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	BF22151A82A343B5C3657B350195F87C	053585A79C2C46F9576E13EFAA592985415139C8	A4A33665072F075FDFDED91536C00523E87D9A4EB053C41E6AD53ECC70F17019
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	66045AF2B62CE11A366F54F076DC021B	87B1E43E216C5B91B8F8C2C30C195F05BB9CB6AA	E715B93094CBDD2748B66106D9C58CE63F90B09EB11216868A0E5B0405BFFD28
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	C885D1A06C2744DAB352E1F5F591A4BA	E730331B1463EA78D5D8689A3A64DADC6196748E	7013A9CB48CF324F9BE59527BDBEC221149C87AA847D8A06F4EC1AEFE940A1EC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	31F423FAE6D922433EEFC1C6E113BFD3	040F5226E395F8F60711E7CCF56A2B23D343E4F0	B7D2C5DDE76887073FB0889AF514082073AF281C81387C9963AC5150C425AE90
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	0B6CA35BBF6A286C69D6F0F1453EA070	4394FAF9186DC79BE3BD34F9AEBB94D5432C5A6A	A8D90E3AFB7D4D6995E3F338853BCE21D5479711CC72C41C5F9ABE3B5E5B4BF0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	E9374867A540B96C9E09F1E6036534FC	4FFC0B209C4706B23B1F96561E88789FA0E0EC13	C1D7543E6449710540BFD8933CBB42CFDB8F90E8F2C81E7C762FB997A0C5DA91
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	480BD9EDEAA8F599C2165BE2E601272B	F282BF79F1ADB5D2D63E69E448B2B91B888E32B2	75D3A9BEA771CD97826927DC1D11C95CA59FBCD993347C879B981B41FEFC538F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	18396041204231399BBC462352ACC8BA	DBA3AB6DA68A09BFF6E5B373ECDA0D36E3642A61	84B51BB4FE13E6D6461AF54FFF9F3656CB1A4B7401ABB8B0146187B11881D6EF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	5738A5176BD402AADEE171AC465C03FC	444F4DFE0AF5E590DB235293E6FF9312BFF5EAF3	FEF582DCA0A5A2159D7195C0172ECE9B9D918EA8AF9A8A8AF5D23785D45DE18C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	54C497B765B767BD3DF0D80F22A84AA7	350BA2CA71A0D3E35F08974446C8BB2012D4E6C5	A2289E74EE7F170C25D89689A2114E5FE436B438D736B8059E04FAE0121A1D40
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	24386251FC413FB4A56E581384E2DAE6	292E0D64BA9B8EB5107FE49C50C7A4580341B285	F86B94DD52515DA08C98A954CF9F035CDCEE7AF1C41835CD370525D94CA58764
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	500BFA276E0BC6DF43AAC89E1B9360AF	A504D12491687D4BBF9574A63CD9F29A69E4EA68	6B9839268E5C62852DF1ED5A3FB08487C04505A1DF5E5EB99D58F20735A14D0D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	2EC80CD7938CA4D268DD8F03E0460CAE	6E6EB4763856D1B5370CE34287631919AD0F4DD4	A2A672FEE61F589884056E4D61F8C067AFA29302A1BDE2210B297FB148883143
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	82AED75A92E72F3EA9CD99F18299480F	886EBD407B50ACDDDBA6E55640A710F1DCECA8AC	DC3940DD52A742EC9DB510AA0CA94F5F7D83B1F44A6D70A4C59AB700CE8FA52E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 23, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 23	F327B4AAE8584FF293719232B0D51A8F	F102768C432E9023E56605A632215250619A3751	8B945A89D8B2B5BE41CEB629100CE4013E062FAAB1BBC96EDCE5C47474732CE3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	6F1D82DB5CE787B6424B48B9629BB123	36A4667F7880B3F7BE62FC9AA58608E9EC6DCA45	443006892359B903EBFE6777EAD6C14E59F5FFA9AB56DDAE4FCD5720A0A2E51D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	3D25F271E5D5231FABED8116F8B48235	69265C44FDD644AD77C95B3AB0F4A39981A9D76E	14F4983D786708F8FF98B7552503A17AA1E54536A258E039EFB2AFE1B2B6CFBB
C:\Users\user\AppData\Local\Temp\MSI2b092.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	45C327897F697D737D6AD714F2F55462	6F01F32455519517282AC0A253705615B6D3C87F	FC80D7520618BCA4780D9E63792EB30E7CDD722FD2DE82ED56B07AAD7A98705E
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A915cnbsh_1ean3vs_22g.tmp	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)	BA1716D4FB435DA6C47CE77E3667E6A8	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-20 03-38-21-702.log	ASCII text, with very long lines (393)	06DEAEDB81D09FD8FB5FF668D8E09CB2	28A02BCBD5975117B97A08AFB049F2C94F334726	D98DE785425112A2D7A41B16073812FA4FA4955F2D5139AE87C9A5FBC4717D64
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	A8DBC473B7E94436EA9569190CC1E4FE	B38D1620D8046714A31B3EF900E1C752DFF42B33	ED31035A57E23588B65E859031EFB4EA3610C52FFD132324EA7888F360F6CA01
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	E9917CC18F353AC0A4357C1B6DC509D0	D0AC7D8E137EDC334D4A728C14020B52D04617A0	7DDAF411425D972D67455D20B1BF5DF7A7E873B9613AC4D2759CC0B581480EDF
C:\Users\user\AppData\Local\Temp\acrocef_low\1ba806b4-3272-4ede-8fdf-bbd1aecf4ded.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	0A347312E361322436D1AF1D5145D2AB	1D6C06A274705F8A295F62AD90CF8CA27555C226	094501B3CA4E93F626ABFCAE800645C533B61409DC3D1D233F4D053CE6A124D7
C:\Users\user\AppData\Local\Temp\acrocef_low\219280c8-4291-4e88-8aea-c5981c353583.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 160932	5B21A6981E55EF9576D169BBED44BCDB	B3A14100B7E7C2C01D61B010A54937952D111E20	9555E661370D1DC26605DAE88BDBC1ABA68038C769BF6E354A256B1A1C4C110E
C:\Users\user\AppData\Local\Temp\acrocef_low\96ffe625-ea5f-4d97-b8fc-e55524c88d7a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\b9243dbe-6b96-4b21-a89b-12bb840784c5.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\bc09a417-c270-4b7f-81da-31baad472e18.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	716C2C392DCD15C95BBD760EEBABFCD0	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl	data	7113425405A05E110DC458BBF93F608A	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl	data	5274D23C3AB7C3D5A4F3F86D4249A545	8A3778F5083169B281B610F2036E79AEA3020192	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97

Software Vulnerabilities

Source: global traffic

DNS query: name: x1.i.lencr.org

Source: global traffic	TCP traffic: 192.168.2.17:49716 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49716 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49717 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49717 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49716 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49717 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49717 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49717 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49717 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49717 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49716 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49716 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49716 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49717 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49716 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49717 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49717 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49716 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49716 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49716 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49716 -> 23.47.168.24:443

Source: global traffic	TCP traffic: 192.168.2.17:49716 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49716
Source: global traffic	TCP traffic: 192.168.2.17:49716 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49717 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49717
Source: global traffic	TCP traffic: 192.168.2.17:49717 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49716 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49716
Source: global traffic	TCP traffic: 192.168.2.17:49717 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49717
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49717
Source: global traffic	TCP traffic: 192.168.2.17:49717 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49717
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49717
Source: global traffic	TCP traffic: 192.168.2.17:49717 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49717 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49717
Source: global traffic	TCP traffic: 192.168.2.17:49717 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49717
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49716
Source: global traffic	TCP traffic: 192.168.2.17:49716 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49716
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49716
Source: global traffic	TCP traffic: 192.168.2.17:49716 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49716 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49716
Source: global traffic	TCP traffic: 192.168.2.17:49717 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49716 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49716
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49717
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49717
Source: global traffic	TCP traffic: 192.168.2.17:49717 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49717 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49717
Source: global traffic	TCP traffic: 192.168.2.17:49716 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49716
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49716
Source: global traffic	TCP traffic: 192.168.2.17:49716 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49716 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49716
Source: global traffic	TCP traffic: 192.168.2.17:49716 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49716

Networking

Source: Joe Sandbox View

IP Address: 23.47.168.24 23.47.168.24

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.6.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: Resume - Ms. Kyi Kyi Oo.pdf	String found in binary or memory: http://www.pdf-tools.com
Source: Resume - Ms. Kyi Kyi Oo.pdf	String found in binary or memory: http://www.pdf-tools.com)
Source: 2D85F72862B55C4EADD9E66E06947F3D0.6.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: Resume - Ms. Kyi Kyi Oo.pdf	String found in binary or memory: https://v3.camscanner.com/user/download)

Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443

System Summary

Source: classification engine

Classification label: clean2.winPDF@16/59@1/1

Source: Resume - Ms. Kyi Kyi Oo.pdf	Initial sample: http://www.pdf-tools.com\
Source: Resume - Ms. Kyi Kyi Oo.pdf	Initial sample: https://v3.camscanner.com/user/download
Source: Resume - Ms. Kyi Kyi Oo.pdf	Initial sample: mailto:thaemarwin4@gmail.com
Source: Resume - Ms. Kyi Kyi Oo.pdf	Initial sample: mailto:yinmonhtay11111@gmail.com
Source: Resume - Ms. Kyi Kyi Oo.pdf	Initial sample: mailto:amml.acca@gmail.com
Source: Resume - Ms. Kyi Kyi Oo.pdf	Initial sample: mailto:kyikyioo48351@gmail.com

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-20 03-38-21-702.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Resume - Ms. Kyi Kyi Oo.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1608 --field-trial-handle=1560,i,10592316759477976454,9644130627290774418,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1608 --field-trial-handle=1560,i,10592316759477976454,9644130627290774418,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior

Source: Resume - Ms. Kyi Kyi Oo.pdf

Static file information: File size 9115944 > 6291456

Source: Resume - Ms. Kyi Kyi Oo.pdf

Initial sample: PDF keyword /JavaScript count = 0

Source: Resume - Ms. Kyi Kyi Oo.pdf

Initial sample: PDF keyword /Page count = 13

Source: Resume - Ms. Kyi Kyi Oo.pdf

Initial sample: PDF keyword stream count = 1655

Source: Resume - Ms. Kyi Kyi Oo.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Resume - Ms. Kyi Kyi Oo.pdf

Initial sample: PDF keyword endobj count = 2386

Source: Resume - Ms. Kyi Kyi Oo.pdf

Initial sample: PDF keyword endstream count = 1655

Source: Resume - Ms. Kyi Kyi Oo.pdf

Initial sample: PDF keyword obj count = 2386

Hooking and other Techniques for Hiding and Protection

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior