Windows Analysis Report
Session_74085.pdf

Overview

General Information

Sample name:	Session_74085.pdf
Analysis ID:	1500127
MD5:	b457e0bb0d2136c36f275833b76830c4
SHA1:	cc21ef5e3e2948ac8e909a3eb4cfa1ff5a87a247
SHA256:	4fdf086638b8015ec11ac712f2377af9355b66bf53a058ffeeb5a688387ec5b5
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Classification

Signatures

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 104.78.188.188 104.78.188.188

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.1.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab

Source: classification engine

Classification label: clean0.winPDF@14/51@0/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-08-27 17-15-37-470.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Session_74085.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1552,i,8772915315826890772,8538083150746886622,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1552,i,8772915315826890772,8538083150746886622,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Session_74085.pdf	Initial sample: PDF keyword /JS count = 0
Source: Session_74085.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A9ys6g9z_tua8u3_5x4.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A9ys6g9z_tua8u3_5x4.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: Session_74085.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.78.188.188	unknown	United States		16625	AKAMAI-ASUS	false

ID:	1500127
Product:	CloudBasic
Start time:	23:14:45
Start date:	27.08.2024
Sample:	Session_74085.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	b457e0bb0d2136c36f275833b76830c4
SHA1:	cc21ef5e3e2948ac8e909a3eb4cfa1ff5a87a247
SHA256:	4fdf086638b8015ec11ac712f2377af9355b66bf53a058ffeeb5a688387ec5b5
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	4B0813226AA6ABEF59C073166BAF119D	2B6FCA79DEA3F36E92B7D39CC27B2CC39C00A3A5	35491ED81221CFA4F8AD2B0B30B7D9B8E19E290090985E7E8D51A3577D79EACF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	4B0813226AA6ABEF59C073166BAF119D	2B6FCA79DEA3F36E92B7D39CC27B2CC39C00A3A5	35491ED81221CFA4F8AD2B0B30B7D9B8E19E290090985E7E8D51A3577D79EACF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	D9A2B56A1144E68085F0E7C04E4EB704	A0C8CF81C2B3EA25520CC361CB66CDC3253D773B	5518C9537845478E8563AB67B62FCCAB9718FD4A41A39A3FCB7638F1D3E9112F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	D9A2B56A1144E68085F0E7C04E4EB704	A0C8CF81C2B3EA25520CC361CB66CDC3253D773B	5518C9537845478E8563AB67B62FCCAB9718FD4A41A39A3FCB7638F1D3E9112F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	A51F6C00B6C8FEC534F70B104789BECB	B873548C0FEF3D3B96137370EE7C7DB1881752B2	25163B271ADEBEEF596001A0DA5CA4D63B4DFC3B0F1776BC384832E342EED32B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f39db160-1837-4a71-9411-953386254915.tmp	JSON data	A51F6C00B6C8FEC534F70B104789BECB	B873548C0FEF3D3B96137370EE7C7DB1881752B2	25163B271ADEBEEF596001A0DA5CA4D63B4DFC3B0F1776BC384832E342EED32B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	41850A000D3156763E1DF251A0C4EC4C	295EC4043BDFCECC50DFE078F4D260E53DDA90EA	432D0B820FC04BDA46037EA795AE69B40D8DF35FD8C48ACC3A35CEEF0059C6C6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	FA74C7EB33EEF3729B423D511921FFA3	C1CC925FC69618B4A58B13EBC2EFE307934DA94A	A631AFD7960ECB1DABA3387ABD670A84D531077B887E2DF619BF8DBF4FA2F8E3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	FA74C7EB33EEF3729B423D511921FFA3	C1CC925FC69618B4A58B13EBC2EFE307934DA94A	A631AFD7960ECB1DABA3387ABD670A84D531077B887E2DF619BF8DBF4FA2F8E3
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240827211539Z-154.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	1D97EE04E521EDD6D9E2B885C4E165B8	05182CADF7274D67B9E87240FC9C67D8BA94E2E6	BF8CFA439DD3E680D9C6FA907D70E487966863E534329D06B16BF26C54C1B4AD
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16	5BC2C4D2D2DD8DF2034B5D6950BEF51F	8FC9C1E67C3C1CD89E38E2D0276AB167A1FA5BD3	B13EA5EB574CA2AD4DAA17987A4148FAD88D391E6825DD7D225D88270AD64E1B
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	4B1BAFED5E057EA6ABCCA2CF51D0B0D7	0112E5B2C5D9C46F3D403695251AD0A58918BF28	D338F621FFBD1A1728B804C198ACD12A294AC0977BDBD3A154C2B92A0286AF0A
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	D4AE187B4574036C2D76B6DF8A8C1A30	B06F409FA14BAB33CBAF4A37811B8740B624D9E5	A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	F359CFB5475E05A7DEE063C129BAD0E8	9E2915D5DE899E0135B882F088344FC557D0EA29	D5F348F1C3363F225CDFE34D404BA6DB1EDFD167BBDDB83390DA1FB5D16615B6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	119B0447E42C90197CF61EC409AF2550	6F2B216B14C9FBE3D4E977BCF4593374A7512599	844F303186863559395CCBBA7110AE7EA101C7BA676EA71B7E61860A6FC9B5B4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	7E552FA6F7DDF63D83F05434FB211B88	CAFA240AB7401F8BFE7544B5582280C7A889BE29	B651D1A330347761A9C4A3E2E2B9388488CE99981A409BA5A5B9753CA08B0441
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	350488C8F391A1411F3A0525E17DB0C8	ACFCBCFDEAF1B62B6543D1AE5CA024EDFAEAA3F0	B0747D93D5413FFB6B3148BCA8544D553F4192C18178C4B07F521D5EEEF26A70
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	AC4D8ACF91853C5697DABF5BFEFBBCDF	E40A0F84B95CD20550CC1F323347E13F77B6B7E5	505DD71009D7F24A34AE21E332518BF89BEC5422BCB56678A8E30632CD92FFBA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	E74630E570E3153745AD0320719A24FB	11A183FA66E2595EDA953DFC4D9635138191271E	24FB9EADD1B0821B66C1117CC0C06E0A9B0C9EF01005F1D171DDAF9641C4F9CF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	734612558F6C4327C46B96A28331E636	61FB8CC723111437AE8411965B886A99741EC757	22F7DFCDEF106171B9B599169B3F3C60CA42B91A38C86AF60E7EF2633638951D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	4F75E2E4F8389C6A2C3475A705045DCB	9655E359BC8994CEFEDC516A225737B675C22113	C4B926CDCFA3AEA5AE15E4B9ED3040410FBDD26DD5462E232E071E76F1484C0F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	4FBABAD2A0EB9562FB7C7E0CB159CA8B	BAFEF452EFC155CEAC9C98C6FEAAAAB10617639C	9149C7117BD2FAB4AC271FB3FE97814BEBBE5680A74B6FA1DA7BA85CD4EED2E8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	3E80235D5815AC67FE6A9E7B118C2510	9895918526D1CA0975906AEC2996867C8B2C1F6D	87DF845E60138D25C992C53CE350FD5B2C1ED12866C4B8618401A750FDE81A7D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	97CABC6DA9A1F983CB1D8E1A485D728E	D3E3811056C73854D14956B542BFDABA158D0EF3	D2AA0F325AE2AA7CC8B37FB2D75CB1D606CAB8B230929CC49AAD09B4A2E88193
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	B355E68681D4DA0C29117EC124AB582B	0387F08B1C292C157E990AC4CB8A3F6E25009D11	5360106810D78346CF7B15FBCAB488CE0F2C40319030E75FD86CCFD1C16F0E21
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	8872D27008BC1CADBCDAA42DD7175BB8	E3B34687A281B4CA46A1C16FF5B803AFD4B08A93	7CD661786D486FFF5E9924A393AF4D8E82ABB1149E91CA60B471F33F6380F78F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	DDFFE8E3DB4808F52D2B0DB063FA4A5F	368815A83692DB9A9724882F8E45A41E56389C02	D4ABD208CAFF10BA629F1CF0A80CE8A1713082BA30D9D78DA4400A569AAF10EA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	B3EEE01D8071E00D8F9119B341922F3D	F682ED7F5A4504ED5E0364DFB1CC4652951785B7	217D2B3545485AEE55E7621392BD561F48C67DF00F89200C442E0108E60161B8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	E9884F9DF486656A0DF2A013B6EE116B	CE25F0BC9E8B9D3E137ACA70052DD9A76BCD9BD8	61DA04E5E116AAD99C0142C780F93DE7492B341D1476782E8707A0408925FA0B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	97C3DCCF69A2CDF660DA88035AB1E462	D1D4975C98535FA07F609D44EC86A92551F11D50	6AFFF2EE466A99E2ABE6EFD1F8EB5C7C34E63261139B249C27B9A9D42D1C0DA3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	80E4B21A8CBEB9B58DE01E9E7AAA581A	E5C2975B41EE2796B28CC0EE1A4A9652AC38EA28	F8B563E4F89D93B926290C53C0569BECB7E8DA9673E9A4652B5EF42A66B2F810
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	D3E1E7122BD561CB66B4E3BC67E03FFA	CE0F7B4CD4EA852B65A90205515C6C02BB55E9A5	9CED46DF363311E0ACC30A931CFE8A2E6494029DA87EE8543C1905B3F4FC1108
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	D089420B1F42F466C1F27C3A8670B3FA	06DECDB2175119EC9EA38495C0178B70D7E693F2	2DDD40236A2569CDBF0FBAA35C52088F7C683EE35864BA472DEC3C3A09A56BAD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	E37A494BFB9DCF6F87D72D2273EDBE36	A261E6AD4ACA0B182A16A084C5DAB128DD51663A	24D049BB05C4CAF02CCC4808D8CE625F8BD0C57D6526B7F1980D65BB0189C6A4
C:\Users\user\AppData\Local\Temp\MSI318f0.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	36E4CA19397A27113835ABD8AA5B18DF	8ED9103ADC54007BE1FA465038D3943395D0D461	B4F6230A1A064B9B446B94DB1628CB418650563FCAFEDD294E47ED0D6E6FF35D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91suk16f_tua8u1_5x4.tmp	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)	0178C6EE26590A8ABFC1CBD5BB5C335F	DBE042C4F652E96C34BC10FDCE2ECD8485077158	922CE47ECFC6144A881C2C9A06EE99F73DA4506E8F796FCC79E982599B364E33
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9nnvekm_tua8u2_5x4.tmp	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)	BA1716D4FB435DA6C47CE77E3667E6A8	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9ys6g9z_tua8u3_5x4.tmp	PDF document, version 1.6, 0 pages	43C8D1FA7D65FF4242D60558D0D1863F	85AD6FB27DFA6121EB31A8059B2B447A6D077F56	3E20963B243818A0FF2AE3784459A24F4D7C9D3C995F69242259660D6EA7DA58
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-08-27 17-15-37-470.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	0938220ADA5D51EEDF354B9E5DD86DDC	7C480AFE24F5D8CC8CEE77659ED8DE539128AE00	B5EAAA52DFC8BE28EE0993ADDD76118D7EC003742F7F1056E7B3DA7E6FED4ECC
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	5D916370059912A6DA773501F8D82777	7E80EF9C6C8E82B656D68EFD9B47D8E238077509	4EE3F9D498E6A594EE93487A7F824D9E0E67BC2F4C5A428D2BE18F0CCCD37823
C:\Users\user\AppData\Local\Temp\acrocef_low\2f9b2ce3-36b8-4ed3-92d4-2bf4961ee1e4.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\3245f622-a7e4-4587-bcbf-a924ff11d11e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	13F55292D0735B9ABD4259B225D210FC	810CC5D545BFA11D2825F6E1DFA69176794DA7EC	8C3FFEA68963D108599E8C5AE20DE6E9C473BF33197A03A9A7DDCD0F25A6C7F6
C:\Users\user\AppData\Local\Temp\acrocef_low\738e4aaa-4b3e-485f-9d23-44dd1f20ac15.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\9cb2fbe2-8cee-4ed0-b242-4cff6c745c4d.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings	ASCII text	DD4A3BD8B9FF61628346391EA9987E1D	474076C122CACAAF112469FC62976BB69187AA2B	7C22C759CA704106556BBC4FC10B7F53404CA1F8B40F01038D3F7C4B8183F486
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl	data	7113425405A05E110DC458BBF93F608A	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl	data	5274D23C3AB7C3D5A4F3F86D4249A545	8A3778F5083169B281B610F2036E79AEA3020192	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97

Windows Analysis Report
Session_74085.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report Session_74085.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
Session_74085.pdf