Windows Analysis Report
Service INV213351.pdf

Overview

General Information

Sample name:	Service INV213351.pdf
Analysis ID:	1531076
MD5:	b76c98650321d07e199293b07669a159
SHA1:	d7cf87ceb3e083214473abfa64abae3871e2bf36
SHA256:	e6795c7ecb90875cd60496c3361c55182c58266caa2e2e7695552491481f79fc
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Classification

Signatures

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.217.172.185 23.217.172.185

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: clean0.winPDF@15/53@0/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-10 14-24-11-891.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Service INV213351.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2244 --field-trial-handle=1508,i,16701083651804924548,11225176438331712936,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2244 --field-trial-handle=1508,i,16701083651804924548,11225176438331712936,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Service INV213351.pdf	Initial sample: PDF keyword /JS count = 0
Source: Service INV213351.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A91ga5xyl_u8pqvw_4og.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A91ga5xyl_u8pqvw_4og.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: Service INV213351.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Service INV213351.pdf

Initial sample: PDF keyword obj count = 58

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.217.172.185	unknown	United States		16625	AKAMAI-ASUS	false

ID:	1531076
Product:	CloudBasic
Start time:	20:23:17
Start date:	10.10.2024
Sample:	Service INV213351.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	b76c98650321d07e199293b07669a159
SHA1:	d7cf87ceb3e083214473abfa64abae3871e2bf36
SHA256:	e6795c7ecb90875cd60496c3361c55182c58266caa2e2e7695552491481f79fc
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	BF79D930A5C8A6BA06B28BE9C86A99EA	7630C1DFEF53D15902E8BBA60EA0961065342EF3	2D21C8754B7BE0B6A9C4B4E4F2733D3B583B8B70ED2478031F01F9F6FA86DF18
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	BF79D930A5C8A6BA06B28BE9C86A99EA	7630C1DFEF53D15902E8BBA60EA0961065342EF3	2D21C8754B7BE0B6A9C4B4E4F2733D3B583B8B70ED2478031F01F9F6FA86DF18
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	490C8687ABB4AAF809E1B3E3ACF49579	0D723E76C0E715C6ABF22EACEF9B12A23ED471EE	DDB23803C18897E8F3C1AE9752FF088D6002154940937E9C450BD5731D791A83
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	490C8687ABB4AAF809E1B3E3ACF49579	0D723E76C0E715C6ABF22EACEF9B12A23ED471EE	DDB23803C18897E8F3C1AE9752FF088D6002154940937E9C450BD5731D791A83
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\63653ab9-4e36-4ac7-82aa-48baf44f57a8.tmp	JSON data	89BB01E643FCBD9DBF54D43C3AFE8C06	099ADB21298BFDFA8ACB5E4863F24B8C3D526DE3	EBD6C79ECA9CC6A69E2C00C39212C6AE2EABC1AFFD48D84AD7F29FF43A93DBFB
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\985ceea7-c7e0-4d55-b1df-7cb8b0c9e9a7.tmp	JSON data	F326539D084B03D88254A74D6018F692	395B367E0E3554C3E78A8211F2D4B9F0F427CA87	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	F326539D084B03D88254A74D6018F692	395B367E0E3554C3E78A8211F2D4B9F0F427CA87	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF532249.TMP (copy)	JSON data	F326539D084B03D88254A74D6018F692	395B367E0E3554C3E78A8211F2D4B9F0F427CA87	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	A9AA2593BB871D0E71F5B38BA2BEE84C	9A0DAF7742A1A3892DE8F09B320EEA20583D946E	BB91B866761AA9DA008B22276DBF93C910A84601D26BADFF0AEC6E49598DC303
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	C5D049A8AAE093D3CC8A84D69AC15E33	132B17AAF678C65A6CAC30BB899C8EDDB0F30195	9A251C4B4D726C379DE933FE504F99C97A42FB9F375727A0710E23B1324ABC4E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	C5D049A8AAE093D3CC8A84D69AC15E33	132B17AAF678C65A6CAC30BB899C8EDDB0F30195	9A251C4B4D726C379DE933FE504F99C97A42FB9F375727A0710E23B1324ABC4E
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241010182415Z-218.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	78C1018F08D1BDCF4AFF06EB3B518E86	B63606921B7237277058C47CEB12C4543BC217A2	A55539C374D40D47A43B4369B3B510E95FFA6818F5A7621B2EE81AC11BFA0A7E
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 13, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 13	E20B5BEF6E77211E4C9A054B23C327A8	7C2A552DDA5679174C30D321FDF5D0163B886826	C973C834391439059B12347F0773442C47036FB53078B18AD527984C2F307D7B
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	8A35BA17D2AD89724B39BCD172C06EF2	7DDC117BB54572D6F46621E822E1B00B250966F8	61536472B663135893F4466C42569D0C005805F1E733FDD613A559C9FA70CDDC
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	56434AF34890D9C578D89847E071E30A	67A951DBCE5FA3802593532DE30D73F968031844	3A09984956B9A339AA62865FEC0C0EC01B76DB0E2985FEAAB60A1091FBCD1D1C
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	445605758ED8B1231A735DA39B7D63C5	504D332D1F88D92BD8FEB6E4BF17A75E299C3F64	551CF10641823613ED544F60292F92C517A2E98D2A5DB1C21FFD4055427BDF1A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	265E3E1166312A864FB63291EA661C6A	80DFF3187FF929596EB22E1DB9021BAD6F97178C	C13E08B1887A4E44DC39609D7234E8D732A6BC11313B55D6F4ECFB060CD87728
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	65783D2FB903BD53F44362C7E9EDECEA	A87D75106A3DCB0A6FC7CFED91604BA9B8D8C3BC	C4A70B56F77E4E4465339F68A10AE25A81E776620E5B622A9DDF44B92FE4B26D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	D7079FF2D6F8E0AB5EFADE496968432E	AABF6A824188BFB99130BA34637FBF949831515E	E99A152A1AA97BE980CEE6A32EEE5133741DC6CBF2CAA1D7967318FB9214E856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	1035E2214E21CDF1B2597C935A09DBB2	D1DF0B3B9A4EC93DC1C0F66B373EBFC19D402A00	C51E9F5E0AB62687E1F039521828CAFD373E9FE5846A3C5A4C7CFE3A2BF4B3E1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	B975B0842718BE95BFF331DA312D3958	B3386176914592538C17B6AB54E50206C0FF1C08	FDA2A2AEEE13765C81610983E8E87FC85D09DE56CC08D924C048B78914C50420
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	E1E2694FA315C150A10A21D7375E56BD	F5CB71E22EFC1E19BCFFD72BA490D22503C19B39	277BB1867EEE288158E61BFCF75C2D5596A709FF8AF3E4DB562E396E7C5B30CA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	D6CB7734CC31BDB557AAD21F06EBF82C	54F9B7B18AEBD321D88F1DD5A6FA795B4B80BAEC	D929CE905D8C55035D66E57C5D6B7CFD3956AD5A0248BDF0C9B47A311C6C79F0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	5724DFAB175A65C1B5F5B47344C1087C	025FC861BB9C96F36C8A418C70037F483B7266BC	739523F44F96646A434B46C030ADBCD5F2FFCFD53BED254C46A6EC67170CFD0D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	CE4CA0474796DC71EE545858D7632E4E	CDEF6FC56D489AF27E305836A5F797D378E75896	B86AAB0849DE3835E74ACA66CFFE9404C99A501E7A688FDF90AEF19CF0E5E977
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	0BC3D686A16CD5E44C641BDAE963D311	D753F8E8FAC294BB93A01857CA9F3545AACAD20A	B6985CCFF2108F1E8CBFFA6C717F72EC61B3719C488D1D0F99044EFD047EF9B1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	5AECAC0CEEC8DB6A3921A426A8DF0D70	3E4BFBA447141DBA29B37FBD4AAB7F0859ECC905	2D1C438E81F0122579F0A627789881F5F864BBC4C054BFEDCD09281ACD9F59F5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	D4B0E4CA3EC2C9807A0EF52E52B5685E	5B9D5AECFB9174BC539156230B207B1F5D5E032D	4D8F1382334340D5F66E768CB7544511DEC75868ED1DE34D6CDC3A299FA6A50D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	19006CD9A4D4D4847A21170BB6FAE372	A9066C43870D57791329FA184A425F1E905A6DFE	5D6F7D013C7514CEF5CFB047E33E7049CE99FA5357A4B0A561EDEDF67C01B450
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	441B799599588EECFE028407E7FE61AF	6D29D5BB26F6F08D4C7FB4F7052269270D2D4C0C	6442DA3989441025EBED4A776583A94C2A60EB4CD6F4E02CD6D151387C669C5B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	E0520FB532BAC7FE25DA5856B2CA4D19	1146DD77E1871E5366FAAA09B0D75B47C8E0D28E	8907C894A76EC333DDDEFDC34F6F7D208F81318CDFA09B54DC8B647475CA6DC0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	72AE978ABAD193B82D3DBACF6D669DBA	96EC63E67DB5B509E82C83A555A142053C42B3D4	EDE7C9F67CBCD3B5576EBC76B77598CDB3A4CFDAE77E87BF12B353A525760513
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	2C81407423943FA60B7B3C11F8349CCD	B430670D817173AC28ACEA2A736004FAFC3CF18D	4A0F6287E59CBE20471F10537448FAADA7A057AC5DCA53EE0AEE70C1F57E83C2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	759703EC57EA0D0457F47AC31AFB9209	5E601E58048A35351D13B6AA0E4B19FD57B8BBBC	DC4290991FC820E484B7861486B9FDEA0FE38A067FE397DAE488B6C2BAD425AA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	FD6A09A6EE6A0AFF89674EA8ECF99B0C	F42B719DBEFC698FD73BCDBED48F2BEC03E6747D	C3ADDF2192BB2D733671C3871B1F5D1AA1A0F2155D7B8F2D5E92CAE9CCC17E81
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	152E2DAB99BF4D7DBB96E84222D16D13	CDD641836A6702DC4DFE218BDE615BCACBE78CC6	D9E3CFC6745CB89C7879B70402B9E0DAC0B70CBE77F6DE7D818F04E03CD7A4C5
C:\Users\user\AppData\Local\Temp\MSI2f4f0.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	A269144BE909A60F3C5BBD7BE5E2FA47	C34A066ECD0238EBAA7E15F6ECDFF02421EB93D6	BF1A0DFCC469CA332B52C5D09A15BAD60F611403E35941F0E7EDEDFA1A7F5DE1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A912gnvb5_u8pqvv_4og.tmp	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)	BA1716D4FB435DA6C47CE77E3667E6A8	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91ga5xyl_u8pqvw_4og.tmp	PDF document, version 1.6, 0 pages	2BF1AD0FC4E89D13F4DD9FCC9BF109C3	9E794FF823760EBD38D99255198F781A3DC2EF33	DA4D00A95C95213A6AB7BDC53DEC0F8BC2E61E3C923D8AA3D52569D4AF6C3237
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91po0ft0_u8pqvu_4og.tmp	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)	BA1716D4FB435DA6C47CE77E3667E6A8	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-10 14-24-11-891.log	ASCII text, with very long lines (393)	128A51060103D95314048C2F32A15C66	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	036A0034A437D8A7B721098974EBF413	BD351F1E3FD9AD0DDFC583B1B4C559A9598B809A	993EEC69DF89B077BBA63445661D0DEC2560ECBE15A3BB36B27E5FA9C5172318
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	063BC5953008C854B0D3AAA31F4DF311	D566E92DA570578A7794AAB793DDFFD35F374A8C	8B6194A3157262453A584F79C2F3B2D32962A8AB8483A6B31B7D34B651E89CD1
C:\Users\user\AppData\Local\Temp\acrocef_low\1eafc0fa-6503-4781-8f8d-0fa723d5f7f4.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\abc2eff6-9386-4517-ba24-d0dba47799d3.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\b5b08139-a438-4e26-b3f1-04f2b56a95ff.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	AE6E9264D4A736DE180485A2DD226988	C215EFFC5901F2971FEE7EB6E4E6DEF379BA852A	6046FD0CF7BDD907456690FA143FF9570B3F94FB4B4F408EFDBC55F9DEB4D1D2
C:\Users\user\AppData\Local\Temp\acrocef_low\fa8b1f57-f508-4432-8cab-0340c27ae129.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	411E1D966EDAB90136CB7B3581B3DD2D	650E5BF319B35D52B6AD00A3C45F3153E061A687	C4AF78A233EAD1866C70361FA9F8287D7297FEF19138B4C4885249658B6EEC4D
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings	ASCII text	DD4A3BD8B9FF61628346391EA9987E1D	474076C122CACAAF112469FC62976BB69187AA2B	7C22C759CA704106556BBC4FC10B7F53404CA1F8B40F01038D3F7C4B8183F486
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl	data	7113425405A05E110DC458BBF93F608A	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl	data	5274D23C3AB7C3D5A4F3F86D4249A545	8A3778F5083169B281B610F2036E79AEA3020192	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97

Windows Analysis Report
Service INV213351.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report Service INV213351.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
Service INV213351.pdf