Windows Analysis Report
JmoLm3fk6x.pdf

Overview

General Information

Sample name:	JmoLm3fk6x.pdf renamed because original name is a hash value
Original sample name:	53812d7bdaf5e8e5c1b99b4b9f3d8d3d7726d4c6c23a72fb109132d96ca725c2.pdf
Analysis ID:	1522689
MD5:	e762f98ebf5e28324ccc2fa4ba4fc3bb
SHA1:	eff5094bb9056a44fe39ccfe4c480caad61f8096
SHA256:	53812d7bdaf5e8e5c1b99b4b9f3d8d3d7726d4c6c23a72fb109132d96ca725c2
Tags:	pdfUAC-0099user-JAMESWT_MHT
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Classification

Signatures

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 23.47.168.24 23.47.168.24
Source: Joe Sandbox View	IP Address: 52.202.204.11 52.202.204.11

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: ReaderMessages.0.dr	String found in binary or memory: https://www.adobe.co

Source: classification engine

Classification label: clean0.winPDF@14/50@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4860

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-09-30 09-32-16-163.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\JmoLm3fk6x.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1604,i,14599695127855173402,3569513226058056659,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1604,i,14599695127855173402,3569513226058056659,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: JmoLm3fk6x.pdf	Initial sample: PDF keyword /JS count = 0
Source: JmoLm3fk6x.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: JmoLm3fk6x.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.47.168.24	unknown	United States		16625	AKAMAI-ASUS	false
52.202.204.11	unknown	United States		14618	AMAZON-AESUS	false

ID:	1522689
Product:	CloudBasic
Start time:	15:31:08
Start date:	30.09.2024
Sample:	JmoLm3fk6x.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	e762f98ebf5e28324ccc2fa4ba4fc3bb
SHA1:	eff5094bb9056a44fe39ccfe4c480caad61f8096
SHA256:	53812d7bdaf5e8e5c1b99b4b9f3d8d3d7726d4c6c23a72fb109132d96ca725c2
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	19080619ABD4C6C5A47165E20EAE9E00	25355B69FA2A2C0921ABF9FD38B64DFFFF51E27C	DC3E8252B7673E4D4033F22B2D1BFE8E37D643EBDB6EAE464D334A3D356A527A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	19080619ABD4C6C5A47165E20EAE9E00	25355B69FA2A2C0921ABF9FD38B64DFFFF51E27C	DC3E8252B7673E4D4033F22B2D1BFE8E37D643EBDB6EAE464D334A3D356A527A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	516E3502ADD46A79B98E3B94A19F23C6	2F00B6ED1D1A1A7BFC3FC120A600B4D5578E399A	BD170466522C8760A7A819AAE6EBE3948A0052A538105D0FA99781E512E4D505
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	516E3502ADD46A79B98E3B94A19F23C6	2F00B6ED1D1A1A7BFC3FC120A600B4D5578E399A	BD170466522C8760A7A819AAE6EBE3948A0052A538105D0FA99781E512E4D505
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\53a52fe6-a4b3-4a84-8292-ef5c706ea182.tmp	JSON data	7CDCB6B57190A7580A0EA5AB84809ADE	3E0C3E7A849BDBF3D7792FF59E62D794E6DADFEF	1E81F80172DB7280247DA08457860584BF2A456A9E45D03FD017B3A191908519
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	7CDCB6B57190A7580A0EA5AB84809ADE	3E0C3E7A849BDBF3D7792FF59E62D794E6DADFEF	1E81F80172DB7280247DA08457860584BF2A456A9E45D03FD017B3A191908519
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	F78F09FB7E2BDC3EE9964BB4652D4C66	2F20190EDFE2B079D1DD6E4F12590688B1F01FA2	389B2A5E5F68945FE68D9B4FCADA7CA338439A3E6940AF0A1349C00A39BD13A7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	D30AD64FEA43954B94B232C4091F0C44	27F482B64908CBEF5FD742F3A0A7E29864280022	E9069A744AF2310F6906A3E2761EEE3556EDC10EEAC13B23C8C8E92A2DBDAD46
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	D30AD64FEA43954B94B232C4091F0C44	27F482B64908CBEF5FD742F3A0A7E29864280022	E9069A744AF2310F6906A3E2761EEE3556EDC10EEAC13B23C8C8E92A2DBDAD46
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240930133219Z-186.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	913275AD9D8A17D6FE2695BB51BC7863	9C29246D92F80A7BDDEC1B53C8705EDBDC0A4759	5E6EBDE5554818D0BD1203842D3FEE08CF894B3426C291244506CF749A3569CB
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 13, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 13	39E90D1C43C687C7126AA1A978F52D8C	4D8D69879D0137D5ABE749AEBA5E47AD95ACB2CA	93DF33D2457E114B74EE34FB779B2AA1BEE3C69C4DDB289732475986730CE9C9
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	E63B8CEF0823D6B94AF2DE9C03AF9449	0414550494D080124BBD56311AA946BFECB43538	0F8448190EA54DFE1907858FF53622B11312136001EB1F1CCCA94145BB36F275
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	3573E49B9CE77E2CDC400985A1AC132F	5E42113ED79CD8F3F69446D47A6F6C4E392A0209	4EE73B22B155C960B407B48A4969130D616A98F1F4E9F65D44E3EF26DF55E5AA
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	440B15A98BAE88AA3831AB27EE801720	41D0FE22D6D0DE2C7694F4B3E69EB6533492A77B	EECA2F0208B182A8328461D432D2A599C66F73426703A11F619AB16280504A40
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4860	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	707F273251926C2049A44853F321C9EB	84DF7863F1442A2752E77A6EF229CDD47AAB72AE	CDF799C2D6CFE11AC773D85E04606E3A81EF560DA6D81AF8DCDC0141652CD297
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	AF4A6AB23782DD65E337E4EC6EC97886	7AE0CAAE73A42DF0F7A89EA26A9703ABBDEC53F4	3FDE8328F1311B0D4CA8AA5786A1BE3570C5D1AB8A772DFDE856A0E3F5FD9921
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	20E279730B8E6D406EF37DFF8886B8B8	6E123C42D70F7BF37D629BE89B50D3604632B0D8	75CFD4033B29C0A9D97BB8DFA40DC9D35990B8FFA593E28DFFA843CCFDB5F641
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	00190C49C7964B05BAE78EB0A0CC5E52	B02884C605A6F068A2CAE1B063450C690A99C24D	C97C0E93BCAF638ABE478C4FE16E47BF1038036B6E721D09287A36FEC2FE6B70
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	7FED08D56842954FB16BAA618F190BC6	BFAFADB54418FB3E83BB49C25596A90257F24895	FAA8CF45021C0794E83136D6F4D18B420A03CFAB2A68AF329AFF5E4F0FC8EE93
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	C862DEB130BA77200AAF28FAF2F70862	3746F13B5D664329CECF9B6D469D6DAE7BB0F685	8A9B23B831C1F2B0E3015331A39D8252C5BDFBA5E18D98CBA0CBB42860C88507
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	3C09FE5ECA8081F200C036FBD5E77592	2DA7CCCD8BCB69BC32F022421A53D2205E153DB6	92B8E1A4A69AED2E31E45E89FD5EE0BB4E72C990A5D9ABF78134710693BC6829
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	82A26E79BDFFA447EBE6160B10CF52C0	24AD16D5D7C50294304FD1C4DA49CB3D87B2052C	C40CED2C78AF25CA94423CA57780A3BB8FFE5D5AA6301CBC76E876F499280743
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	C5C3C5E17D1FFD0907C4F2AFEDBDC367	FCBB76447CD99A029655C3D769866EF9401A47C6	3F669DBE9606300131BA069C27DCDB0CB32D784AF34596C78B0A142464C956DD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	1A9FB6B48DFE2A5664CCAC78724C8FF4	F8B6F8C9EA760167B5E5050ECCD25462430C01F7	C7E6FA2F39F9626C7D62D5230C28DA209B3724A958CD9E9CDEF457800FFDE86B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	5B4E12157C21C652DB15319B37F379B8	55E0062AD4BA6D95E711C6BB00C4DE1FA42BB36C	3D0B64CB84B2A356793686A8CB97BF2E9C5E2B3EB08F5DC16C40D394DE7FE18A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	353816800D84FC796724EDE439FF3104	51155257600B315F56A849F41AA99291B75BA0C1	E6D1472A8BF1CB8AFE8367D257DB8E113CBE3C728A6A5123554BADF350F2C347
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	D3CC9474ACCEFD5630440B371567671D	5A98E4AF7D222A407E397DAE2B47410EACC4D6AA	D64C42A9D31B2A5A022A5EE89319CE16FA4769DF4944A738E3B6CF7DFDE2A3AB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	5C183BC1590ECAF8A0B98C5ED8096963	5DC759B19F80FFE6F1EC68A12C0A9E4B9D74B067	322E27562739610DA5A80A2EA259892FE0B22B12E34492C06B6BC8FAD3A1DD32
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	6C254B1CEBD5558EF22C83F340450085	230640C062A4E721E7AF9485B3656ADFEC97E7C3	C91ED0B726A5915F6AE400C86EAC149272686E0E6F62CB4C5AF7751AEB94ECC6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	FFF9D687B1601007D6018DB1A2F692A9	67D64684940247BCB7B370A807F10A7E31393D41	843C88B6F305700DEED875A4D1EB115CD1140F6DEDA068C48913B909FAC4E412
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	112C84971E9CFBB61DD893E772C7B67D	8778CDD625F45E7BFD288B2AFBB7633C4B7DD1B3	34C68AE8CD252462C5CE45791B07EFE18D6775A401D334E81CD2774E9B6A3321
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26	8BC25E8B274B8D29586796EBDB983EB5	1B2799122F37343B16F407BDA3F0E2A07E078D70	C74A8005B1AB1940E9A5EB8F889A4B1B03504C6CA582FEEE01665516C29FB5AC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	D8F792124A2CC4DBD3567337443B00F5	9517E51D7FC93F4E291E33116E03237D64098C9D	18F6A1913464CB2F02B09955FCAF6A2A97FAC7EB104B42677C41C860A9038B47
C:\Users\user\AppData\Local\Temp\MSIfc8c2.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	8879277D939E6A56DB940F08C70AD2B5	30F18CECE79F37306DC751FD0E59E028AEE435A4	D87DD863CCD78661F074A836FF7A7D92712BD41F78CCEDCE57FAE9D93628F44C
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91xica5i_11u895v_3r0.tmp	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)	BA1716D4FB435DA6C47CE77E3667E6A8	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9tnioiq_11u895s_3r0.tmp	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)	BA1716D4FB435DA6C47CE77E3667E6A8	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-09-30 09-32-16-163.log	ASCII text, with very long lines (393)	5BC0A308794F062FEC40F3016568DF9F	14149448191AB45E99011CBBEF39F2A9A03A0D15	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	A7D1D5E826F037C42A7AA2C02B1AA217	D2994381F9319CB148ADE58E56A30106C5FD5682	7516E602A1CA0DA0F107820630D7B554412EE7555C6595F9F5611B1077420563
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	4D8BCA8311E03A60C1D20171ADF141FD	DD5504FA86AD67310FF1C2F36C24885631F6B110	0B0D8EE337CB682A83191A84800E64BA2209D6FED198462083A36477A210E457
C:\Users\user\AppData\Local\Temp\acrocef_low\01201a76-a451-4780-a30b-3bd839ce556c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\494894c7-2a44-4739-a6ec-c49a89481948.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290	279B811F8FB7ED83618C0B37825CCF25	5718DA0EF8F5A938CB88800665F18C9B805208B2	2AF4D3CE45FACE3A6DF83A17E90912767BE01A6F2C96AD8B3F270FDB13F77E46
C:\Users\user\AppData\Local\Temp\acrocef_low\8c7080df-ae4f-456a-9557-a6eb5c05cdd9.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\abadca73-2d8e-4553-96cc-1d6a16f4b90f.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	95F182500FC92778102336D2D5AADCC8	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl	data	7113425405A05E110DC458BBF93F608A	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl	data	5274D23C3AB7C3D5A4F3F86D4249A545	8A3778F5083169B281B610F2036E79AEA3020192	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97

Windows Analysis Report
JmoLm3fk6x.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report JmoLm3fk6x.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
JmoLm3fk6x.pdf