Windows Analysis Report
IES PAW Montepio.pdf

Overview

General Information

Sample name:	IES PAW Montepio.pdf
Analysis ID:	1525975
MD5:	4a551c9d39c68ad88fca7747e8e99934
SHA1:	e6ea992a83809249061e975908fa4ef7873ee930
SHA256:	fa7171135021f816e7259f88a273307da9b3e545f5502bb34025061772ec055f
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Classification

Signatures

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 34.193.227.236 34.193.227.236
Source: Joe Sandbox View	IP Address: 23.200.196.138 23.200.196.138

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: clean0.winPDF@14/50@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-04 10-25-14-960.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\IES PAW Montepio.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1768,i,16637311774661600001,10864908080861009943,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1768,i,16637311774661600001,10864908080861009943,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: IES PAW Montepio.pdf	Initial sample: PDF keyword /JS count = 0
Source: IES PAW Montepio.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: IES PAW Montepio.pdf

Initial sample: PDF keyword stream count = 101

Source: IES PAW Montepio.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: IES PAW Montepio.pdf

Initial sample: PDF keyword endstream count = 101

Source: IES PAW Montepio.pdf

Initial sample: PDF keyword obj count = 194

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
34.193.227.236	unknown	United States		14618	AMAZON-AESUS	false
23.200.196.138	unknown	United States		2860	NOS_COMUNICACOESPT	false

ID:	1525975
Product:	CloudBasic
Start time:	16:24:17
Start date:	04.10.2024
Sample:	IES PAW Montepio.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	4a551c9d39c68ad88fca7747e8e99934
SHA1:	e6ea992a83809249061e975908fa4ef7873ee930
SHA256:	fa7171135021f816e7259f88a273307da9b3e545f5502bb34025061772ec055f
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	301273C7267AA5B22600E38833FCC58F	80AE72E2AC37EAEA4EBADD28B1D1156A61978C37	D4E2B4771B5EA94530A344EE7A99435C6B4CDAF3E5A6EC228BDF3289B600CCA6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	301273C7267AA5B22600E38833FCC58F	80AE72E2AC37EAEA4EBADD28B1D1156A61978C37	D4E2B4771B5EA94530A344EE7A99435C6B4CDAF3E5A6EC228BDF3289B600CCA6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	83B84428DA3AA96E7A27B752970B65CD	358B8B28172646A99F689406A7BCF005F34AB7A8	8E9EBC19A98E2F8BE143F7C1A8C8ADF484267838AA1D144CC27F1656A4E18274
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	83B84428DA3AA96E7A27B752970B65CD	358B8B28172646A99F689406A7BCF005F34AB7A8	8E9EBC19A98E2F8BE143F7C1A8C8ADF484267838AA1D144CC27F1656A4E18274
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\66ca7422-1064-42d5-a97d-bc9bb408bf00.tmp	JSON data	6A764638F2D0BCACDE2D0A62998771ED	5BC9053CE9BD759FD43F8C746F088FC97AE99D62	330F7B85306EBE322BF9C314E85DBB12217B66B19CDE12364FD18EB2A2D10D6E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	6A764638F2D0BCACDE2D0A62998771ED	5BC9053CE9BD759FD43F8C746F088FC97AE99D62	330F7B85306EBE322BF9C314E85DBB12217B66B19CDE12364FD18EB2A2D10D6E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	C020503B146A50E7EFC252F333FF28D5	B2CAA5E1383BA992F6986E48E6DA42BCF578AF42	B0C2EC650C3E3D3A2C4F667E157B90707ACD234716A4BF2FD1530C1544451AE6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	75A7B35D4EA7811A73B83652BD6C4903	34EF4267B280CFF7F628D9114B05A29CD551819F	C7A0FE614636957F4194AC35A260684086110807B4D39C18450340F393900355
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	75A7B35D4EA7811A73B83652BD6C4903	34EF4267B280CFF7F628D9114B05A29CD551819F	C7A0FE614636957F4194AC35A260684086110807B4D39C18450340F393900355
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241004142518Z-195.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	14B6D1F7B33B52C965F7A87FE9B30611	A6C959DF9D2FFE0462E99B79007A02A8FECA5851	8EAD9905B1F0BAD8EB22FDF10F8191C402EC353D13DAB5D9C60F51DFB721CFD5
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 12, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 12	FDDB41B9779D1A99395730D2130C3923	D86F29A5585EC46CE2B0D9F1604F656777D624B2	913B3C6474885FC16AD72C3B29B03B2E65CE555630E1897841B51EECDD146213
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	846DC7D9A8154C82DB4DCDA7A7D92352	DF935D1958357C4B2CD4D4C1C051C2E4CB5C5477	6FAE740DFC705D7F63228C2571F9604A6A3CFD2C0B86964EBD19C2A28084E422
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	86B56A7740090EF2735AD98D83FC2F77	749FB20BFF2C7D010B53BC70DFC58BA1A3CBB01C	082F3615D091A1C898710394B6EDA89169EFB2E534DECE3DF3224BDEF03776EC
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	655A6DE8FA2C7B1E26DDF65293754C62	1AA1540187854D9E96BCE551D3E55E3AC437DFC4	26401A919741341F07A5777192455824B52947E7B171A5639848D8DB07593D57
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	265E3E1166312A864FB63291EA661C6A	80DFF3187FF929596EB22E1DB9021BAD6F97178C	C13E08B1887A4E44DC39609D7234E8D732A6BC11313B55D6F4ECFB060CD87728
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	CB6F0BDDEF72FF6F394EB0693380502D	91CC90E7E4F85B2DA92D59A546ABE9F92E10BBE0	ED88450F7C8AB9C5550C0951DBDE075F8A47F0A73C80C2CE4A86448D35AC2C47
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	BAADB794A30902BE6EEAE283018A48EB	DAAE9E1C9AC218535275173A717D7D6D71D1A8E9	6AC610B499C2A47F85967686555A40C8EE299DE14886E832898F60D3490CC2C3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	E9AB239187A0680F54F5D7767D66E608	18D2FC4F0154F0DDAB378B2B97871848C56BCEB2	D0FC35C1B89CD0451D3D087C3CBA99730B15DD7E6CE6664EB46D31D7D1E9707E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	A80DCC7DF47634A83131A779D3F407FD	1BB0188696A28B21AAB97158FC4E7AF3B00C2CA2	47EBA16486A0B996566879EDFEE4E1BD75D91D04366328D5917D50126F8C499D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	B6753315B17847C26F4EC93FED4957ED	87365892B0486AC27885956528F52158A5CE0EED	DBB050702574BC3A91880F499672B941AC28ED2800C622B433359F26F8CE278C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	E1B8A1CE9FB8A1E771B05A9642C5BCAD	4A0CE1C8060B3A4E027292AC63ACC435DAF0D95F	C60F7BDD7201264D57BAB2F940AF0261B46D9E5DAD48DAF72D5F5222B89A8719
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	BB4BE8A994D3EF5AF9AEA91C98FCC06C	297ABEBB0EFB62B2BCEBC63394E457B6FA2D91A8	58D379215ABAF3F2B3D708852126709F69557A88F107B5ED3D7369ADE0F59BF7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	925C2F51628A4C3BD9CCE69DB2737386	C7A33B6A4C2DE5992BE2B3E7068EA94AF39A5E8B	EE325CEE7D385BB4C4E4F80654579E3C6091AE5A57BA066BE44C99CA7E09045E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	7B3A51DD03D3E837AC99CF8916079E5F	E6FC4DD7C600D1157B3CDE2C5BDCB048E6951CFF	061FD2CF2975222B1DF25AA95D84F5B62DFDDA118EC318FA466141B6363D120B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	1E264153C5B41E715C3FB2B204521B7E	42CDF9A32203BCCE345DBE70BD35D652172F25B0	0246472F2B05D97F736D71EEA031C7A77E5CB47CB91E0E731C67B89A221ED0F9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	0AA3AE6CA37EA43E24CCEE4A11D1116D	D60AE55C43909F28F9850CA53B59756B499EE864	44A5FB75FA39151A891433E37CEE1F22B157A395CD9F33E95A385793158736BE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	88935A4A97DA9B1DC0C31D29A2C9B3C8	91A5E182CBA4E26DC3DAC3641A097C5D1FF59587	E927AE188C8F744AF2345DCF5438ACB976E43D6BB63DCE28C422326CCEA1710E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	3B9C9F3C0C5ECB8F0FAF356BE539CE87	D137FB6F084F1CC0D62771FE1A63CFEF6D088033	746B067BC4ED24E8C8FF51B6096E344AD1D3E0B6976B304CBA3504A2C16ADE23
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	7821C33F51B45166545BB7BA68C05359	9DF6C0EA3D40990239E20C5411E9BFA1FAE19758	79BD6CDF3D755EF90B1C63FD7B16662C589342ABDD892DEC81EF54D85E3CC1B2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	F71591F4E6E2F2AA287321CB6ADA2BDD	12814BA790CE2A6183F8B722FCFA73FA603E45E4	C781AF4147533CC894FE0375377F29F062B4AD8175CEF68CDE9A822BEAE26F9B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	DC414374CF437345794A00E94F292FA9	D2C3E59ACDC83BE100EA26F5594E825F04897421	281629CFE0E96046BB9DA1029A9A20728DA017E5FFBDCF20E0211FF4C3F82312
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	215DC8F8ECBF08C84D2ADF45B12F8450	EB8026BE94B0997485F4ED9E1789C282A8A3C1EC	8DDFFEEE99322F0DDC1F3E652F8B52B1602C84F35DBCE0EB289318C705F81080
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24	3A84CCFE9BE51EDD7A91EBD089F67D25	D524F491676FB5443580E2F6E17DA2AAA2074054	A1205A277A85E0254E664D5B455276A5A07D068269BAD61ED58A599D0CD3EFB4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	17B8BCA86460B0402ED292F1053DAA02	A42D07A22D4E2A4E4599A332DB10B6EE6E389F61	F66FFCB870434E5A98790E18BE7287DDCA0EC90E60A7CF67B8CDAA8F3A970BF8
C:\Users\user\AppData\Local\Temp\MSIf02e2.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	9618A4F43EBFF785C12F3A2683FCC1F9	C1B5521B550C6BF678B30DC982E94A771B7D7F0B	0346CF5DADD03AEBDE39DA0AF826805ED0648F59501F16B46686444F766E33E1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91g7osa6_88l9f8_3vk.tmp	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)	BA1716D4FB435DA6C47CE77E3667E6A8	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9ighfn0_88l9f9_3vk.tmp	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)	3B5F73FB39FA1A34F87572B93BF62653	31B182D7C3C53990FA5F87F5732165BB837C9797	2D490088481168DC4A9C5DF594BF42089F974BC29316D8594C72A5BB8EC3D5B0
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-04 10-25-14-960.log	ASCII text, with very long lines (393)	128A51060103D95314048C2F32A15C66	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	96BDCA2A55A4F831169E00AEFFBDB04F	3223DF10D74B32E1C9E43A808811C4C4DF012D0F	3C97ABE088732CB796B7B928284DC6C044F06D3CEE922B87A40EE8FFC1DD2AA9
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	ECBB09CB32B59E21DFCC8F39F0E64FBC	E036525FF8049F1E6748A065DAA86F404B037915	6A2EEB007480F1F91C01FCBB317615BD564A6D49E0AF41028A3852935DB14219
C:\Users\user\AppData\Local\Temp\acrocef_low\2a2b1b92-ece2-408f-ad46-7ed0c03822bd.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\643e6473-959d-4220-921a-7baaea6103f9.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	FFA982D6F2F9B46A1DECDD28BF3EF0E1	B1D05ED9BD6A80BD0E3377E9F62B47EF83FCC0C8	93D954FA4BBEDCDFBC7BF14FA1BB3986056261F4A5035C3CFF229FF16D12B78B
C:\Users\user\AppData\Local\Temp\acrocef_low\a397b872-204d-493f-ad17-c90279ecb8e5.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\c7f3809b-9fa8-44d1-ade4-fb318c953a1b.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings	ASCII text	DD4A3BD8B9FF61628346391EA9987E1D	474076C122CACAAF112469FC62976BB69187AA2B	7C22C759CA704106556BBC4FC10B7F53404CA1F8B40F01038D3F7C4B8183F486
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl	data	7113425405A05E110DC458BBF93F608A	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl	data	5274D23C3AB7C3D5A4F3F86D4249A545	8A3778F5083169B281B610F2036E79AEA3020192	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97

Windows Analysis Report
IES PAW Montepio.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report IES PAW Montepio.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
IES PAW Montepio.pdf