Windows Analysis Report
NEEmRGwBAG.pdf

Overview

General Information

Sample name:	NEEmRGwBAG.pdf renamed because original name is a hash value
Original sample name:	25cc9eab5abb14695ee27a8c990921121b86de002ce7fd199ad32f14e915099b.pdf
Analysis ID:	1543757
MD5:	ab5bd55bca3e5b93e184148531714c33
SHA1:	ee5242b10bfcb2d99cde579654bfa251e8f63b9a
SHA256:	25cc9eab5abb14695ee27a8c990921121b86de002ce7fd199ad32f14e915099b
Infos:

Detection

Score:	22
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

AI detected landing page (webpage, office document or email)

HTML page contains hidden javascript code

IP address seen in connection with other malware

Stores files to the Windows start menu directory

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Signatures

HTML page contains hidden javascript code

Source: https://app.blaze.cx/link?li=671ee3647dc00d7a53f3bb9c&c=7e9547&sk=7bdfe5d198

HTTP Parser: Base64 decoded: <?xml version="1.0" encoding="UTF-8" standalone="no"?><svg width="9px" height="29px" viewBox="0 0 9 29" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <!-- Generator: Sketch 39 (31667) - http://www.bohemi...

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Source: https://app.blaze.cx/static/js/12.705c50ea.chunk.js

HTTP Parser: /*! for license information please see 12.705c50ea.chunk.js.license.txt */(this.webpackjsonpblaze=this.webpackjsonpblaze||[]).push([[12],[function(e,t,n){"use strict";n.d(t,"a",(function(){return u}));var r=n(1),i=n.n(r),a={color:void 0,size:void 0,classname:void 0,style:void 0,attr:void 0},o=i.a.createcontext&&i.a.createcontext(a),s=function(){return s=object.assign||function(e){for(var t,n=1,r=arguments.length;n<r;n++)for(var i in t=arguments[n])object.prototype.hasownproperty.call(t,i)&&(e[i]=t[i]);return e},s.apply(this,arguments)},c=function(e,t){var n={};for(var r in e)object.prototype.hasownproperty.call(e,r)&&t.indexof(r)<0&&(n[r]=e[r]);if(null!=e&&"function"==typeof object.getownpropertysymbols){var i=0;for(r=object.getownpropertysymbols(e);i<r.length;i++)t.indexof(r[i])<0&&object.prototype.propertyisenumerable.call(e,r[i])&&(n[r[i]]=e[r[i]])}return n};function l(e){return e&&e.map((function(e,t){return i.a.createelement(e.tag,s({key:t},e.attr),l(e.child))}))}function u(e){return function(t){return ...

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 1.1.1.1 1.1.1.1
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 172.67.184.158 172.67.184.158

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: NEEmRGwBAG.pdf	String found in binary or memory: https://app.blaze.cx/link?li=671ee3647dc00d7a53f3bb9c&c=7e9547&sk=7bdfe5d198)
Source: chromecache_211.9.dr	String found in binary or memory: https://blazestorage1eufrancec.blob.core.windows.net/blazepublic/1cb4dd7d7be8f6e5ccd117624a0b80cc809
Source: chromecache_211.9.dr	String found in binary or memory: https://blazestorage1eufrancec.blob.core.windows.net/blazepublic/26f214803e9cdbc311c5982084e9e2ec679
Source: chromecache_211.9.dr	String found in binary or memory: https://blazestorage1eufrancec.blob.core.windows.net/blazepublic/359e69e0f5284bcbabe29684a6cbed5b21f
Source: chromecache_247.9.dr	String found in binary or memory: https://fonts.cdnfonts.com/css/clash-display);
Source: chromecache_223.9.dr	String found in binary or memory: https://fonts.cdnfonts.com/s/65008/ClashDisplayBold.woff)
Source: chromecache_223.9.dr	String found in binary or memory: https://fonts.cdnfonts.com/s/65008/ClashDisplayExtralight.woff)
Source: chromecache_223.9.dr	String found in binary or memory: https://fonts.cdnfonts.com/s/65008/ClashDisplayLight.woff)
Source: chromecache_223.9.dr	String found in binary or memory: https://fonts.cdnfonts.com/s/65008/ClashDisplayMedium.woff)
Source: chromecache_223.9.dr	String found in binary or memory: https://fonts.cdnfonts.com/s/65008/ClashDisplayRegular.woff)
Source: chromecache_223.9.dr	String found in binary or memory: https://fonts.cdnfonts.com/s/65008/ClashDisplaySemibold.woff)
Source: chromecache_224.9.dr, chromecache_238.9.dr	String found in binary or memory: https://github.com/oftn/core-estimator/blob/master/core-estimator.js
Source: chromecache_247.9.dr	String found in binary or memory: https://www.fontshare.com/fonts/clash-grotesk

Source: classification engine

Classification label: sus22.winPDF@38/130@0/6

Source: NEEmRGwBAG.pdf

Initial sample: https://app.blaze.cx/link?li=671ee3647dc00d7a53f3bb9c&c=7e9547&sk=7bdfe5d198

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5532

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-28 06-43-53-007.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\NEEmRGwBAG.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1676,i,11425198669066236123,16450259438300404404,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://app.blaze.cx/link?li=671ee3647dc00d7a53f3bb9c&c=7e9547&sk=7bdfe5d198"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2116,i,15328674476385843745,1406063215858999797,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1676,i,11425198669066236123,16450259438300404404,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2116,i,15328674476385843745,1406063215858999797,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: NEEmRGwBAG.pdf	Initial sample: PDF keyword /JS count = 0
Source: NEEmRGwBAG.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: NEEmRGwBAG.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: PDF document	LLM: Page contains button: 'VIEW LONG OVERDUE STATEMENT' Source: 'PDF document'
Source: PDF document	LLM: PDF document contains prominent button: 'view long overdue statement'

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
91.107.202.212	unknown	Germany	24940	HETZNER-ASDE	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
167.235.20.246	unknown	United States	3525	ALBERTSONSUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.164	unknown	United States	15169	GOOGLEUS	false
172.67.184.158	unknown	United States	13335	CLOUDFLARENETUS	false

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://app.blaze.cx/link?li=671ee3647dc00d7a53f3bb9c&c=7e9547&sk=7bdfe5d198	false		unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	A895F1C6E40E8970EF2ACD10569FDBAE	19416C12883163BB79CACCC9A59A8E3FB9770D9F	3C9F35201A927BB8AA1CF5C6F5C18FC4CBC330025DC53470BD56E55C843749EE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	A895F1C6E40E8970EF2ACD10569FDBAE	19416C12883163BB79CACCC9A59A8E3FB9770D9F	3C9F35201A927BB8AA1CF5C6F5C18FC4CBC330025DC53470BD56E55C843749EE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	540E24C6D1CCDB091CD701717D66140E	9983E9B0D75092C261AC739AE885AC83A770E4B6	902DB5E27A11C8F71F7D894440E8C16DBF92ECC28AB37060E2ED739F1FC3DBA2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	540E24C6D1CCDB091CD701717D66140E	9983E9B0D75092C261AC739AE885AC83A770E4B6	902DB5E27A11C8F71F7D894440E8C16DBF92ECC28AB37060E2ED739F1FC3DBA2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	184BDE246B92E564B37E7CC73EDADE33	F07C4F793F62D470B46ED92AB572B6B89E5DB1AB	1EC50A0A79421F169AD1965EB8D7132AE4C9C2F675E485D9CF770FF80DB9C71E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cc651615-5923-4172-ab2a-55c29463e147.tmp	JSON data	184BDE246B92E564B37E7CC73EDADE33	F07C4F793F62D470B46ED92AB572B6B89E5DB1AB	1EC50A0A79421F169AD1965EB8D7132AE4C9C2F675E485D9CF770FF80DB9C71E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	5A25D8F83E1BBA5D1AEA3A3395E48B21	5FF9D93CDDD9A21902EF971BFA3D7DB4DDC76EF7	FABACEDD8EC4736B6B62F495CC75CAD4B19F14E62DFE660BB89BBFC67F53B98F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	AA5B61DF91F49D2C10A0B00D953C1720	05273A00D929FA6F3F6A1AEA29A9600C231906CA	17D6DD8052143E61649A553DAA45F25DB6A6CDF2FF04A6C7A7F00DDBC9C31AB3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	AA5B61DF91F49D2C10A0B00D953C1720	05273A00D929FA6F3F6A1AEA29A9600C231906CA	17D6DD8052143E61649A553DAA45F25DB6A6CDF2FF04A6C7A7F00DDBC9C31AB3
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241028104354Z-155.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	AA72DCF78099F22FDFB2A8923CEB6066	4D543BF3C23A27201AF5E97AC89B160209CFEF44	9B22ED539EAB53E40BF29F4B7C5821597B179FEB78E325D7591AF15AAF83F3AD
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 4, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 4	A20EC8F7B790555B43B0FC9265B8CCDE	0F7B861A7DEB04CA4DBAC18F82691ED380710990	CA267239DB930CA8F859F55E88BB4EAFAAF88FAEF37F8880A15F8DCBF448604F
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	09DDEB7B7CB129ECA42CD554FBBAF3FC	AB409153D66EA3BE76431DFB2E28E70A8EB63CE0	063BAA2F022133B57EB378FAEF23260E413360D9043C3092C20EB10416870840
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	6D7693306020BE1E5A2F221FCD703338	1168C5090210C81C0DA1C5260AB9C12E5EF58331	3EF83519847EB72CD1A2453B1853B8ABEB042E47BE1E75F6868E5E36D7F8C7E9
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	2B3B4849BBAE4F2917D78B97B6EAC6D1	6F94D1960E15199D305A3B35EBEB8AF4FAA99404	0E225C39A17AA69DE8ACA8BD53E023EFF827E0CC22F84B6FF2E7F40C0EB0F48A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5532	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	87EDBEE38F56C20298F25D5D3D4D1B5C	7F904E9615AC3186A87472EF366DD8202855B0B7	A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	81E180226C73386E8C7FE021F245B94D	0FBE2B9DCEE188B69344A6F62FDEBE63B998F7AD	EFA2FB2B0B174E23CA9F079867D5855030A0A85E5F0F5440E5F8CEAD828D992B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26	6D72DAC5D955209F057E7E0B950C8290	03AB9A53B03C211A0813F73CBEEDC3DF5CE1CFB8	43284A264154239E261EA2B1B67F89CF9B388372ADBC2D1733961D349B2FB3C9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	2C97319C109D1DEC30037C78306C644B	417B547C745170C09739D7F136E49A14FCCB3339	E4F646A958BBD7BAE6D976FD1071AE315C7E734B8287A0251116928D23BF0AE0
C:\Users\user\AppData\Local\Temp\MSIbea32.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	35CD5A2BAE0FF4CD3FFF476D0FE1DC8B	3D11E437774ADCEA927DF4743B6698E8178A31DB	6CE41AD166476A637E6F664ACB0642F5186F9E4776CE6DFB29297EB457DD47E7
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91v5ciz_1fbdbi2_49o.tmp	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)	BA1716D4FB435DA6C47CE77E3667E6A8	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9w9o2ld_1fbdbi3_49o.tmp	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)	BA1716D4FB435DA6C47CE77E3667E6A8	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-28 06-43-53-007.log	ASCII text, with very long lines (393)	1336667A75083BF81E2632FABAA88B67	46E40800B27D95DAED0DBB830E0D0BA85C031D40	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	215D41268100E4B245C94492FAF1AF4D	B0A3DF483B795596ED6565ADE59D21F4C3003C2C	25DB2ED9A35B9B26CCB12D4674985A125FE3CF3A26765A8C78CFB7D6D2EA84A4
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	40244FE6685DF45F99153723BEC27864	66E2499F945086F07ADD0EA36E85933F40F64CCC	A94AB457EBE1F9C748CD885A0CE6D405E8E49446D98056E577EBD69BEE21A352
C:\Users\user\AppData\Local\Temp\acrocef_low\1d52eaaf-ac8e-45fa-9330-663254fb07bd.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\6be9c9ca-7025-44ea-a477-ddbd1c23b6bd.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\c23626b4-c8a7-49e1-b07b-817ec446f01d.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\f3e1787c-5ae5-4216-bf1a-3cb64374b1af.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings	ASCII text	DD4A3BD8B9FF61628346391EA9987E1D	474076C122CACAAF112469FC62976BB69187AA2B	7C22C759CA704106556BBC4FC10B7F53404CA1F8B40F01038D3F7C4B8183F486
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl	data	7113425405A05E110DC458BBF93F608A	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl	data	5274D23C3AB7C3D5A4F3F86D4249A545	8A3778F5083169B281B610F2036E79AEA3020192	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata	ISO-8859 text, with very long lines (3486), with CRLF, CR line terminators	32FCA302C8B872738373D7CCB1E75FD4	DA85FAF24ED0ECFD5D69CCFD6286D8B77D7EB4F1	CD0DD26304B88C20801FE80B33C49C009E2E5D4411B5D7F83252E1D90CD461C6
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 09:44:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	70E7941912C910445592CF23A0D0EFD8	7BBBD2A9FF5D948D486DB0EDB7DFF84582569DF3	47DB822F4C5EA8513B71D639BBBDC336CDC4596DAD929A4D2D6053C2323B905B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 09:44:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	9C49DC547F9C82429A1805186ACED0B1	2A84106262226A30A97E1585EEB50C6C37B78674	6EC066E55E3313ACC673A5EE2002B1D5F2A7F52CFD34FAAA063B843B15780DC1
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	B07CEE46347CDA08886B4BF026E305C2	21DBB8DA5A70DB0C511CC66BC99C4DE73FBAEA07	28551E76C76C4555E893C0E5F24755E153E2912A7730047B4863D33CD9D9741C
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 09:44:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	119290F1B994CC6F13BFE9CCA0C5B624	BF54A95787CB4C85E1EB09C1E2DA342DA75B7F8D	9C23BAA4EF560BE725223BF5B524C6CCB4CBC30AF5C7B5FF8E06D7BA2EE14D34
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 09:44:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	B01BF9CBF4D5681596CBDD68A0ABF4DD	699B3320A5F285B2EA580A124D198836DFB54058	8B6CE7290495DFF8F47F7036B9701BB359E26F0AAFE9B0C15B969BE2B819FB47
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 09:44:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	FF7355227A645592109437EA9CD62996	7559D18F799B06D2B22A57078A776FA37EBC8A90	D42796373DFAFF02272CD5D2AC42216249005AE275D53974D7625E66471B5503
Chrome Cache Entry: 202	JSON data	3B4C1C681D85D1C09F4550DBE93F0C75	AF97A1B4DFECABD1DF2B0F7089F28901FAE44FB4	072C300575D643413B65161101677CAFC20C58FCAB2F0C916A2FAC194BC592D3
Chrome Cache Entry: 203	PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced	8A61014EEF1165A0D81FC3F6561D6AD6	5E649919DFF65FD5D3E07D80A07837BC24AD9997	63F1CC79F69D154437F81F435564DCB49EE6ED135D5EF3B231D2B5D93FD04DEF
Chrome Cache Entry: 204	JSON data	F4D607469AC0657D2C0039FF904106B4	4919F322DBE3DC439BF56FBA024AC2CB0D635AB5	4555E8BF2649D04D24AC73446B0BEF0BF2BD4DF002EF260B143710C869BB32EC
Chrome Cache Entry: 205	JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, progressive, precision 8, 1680x1080, components 3	D1946C7F81C572CD970CA93B73D370D1	359E69E0F5284BCBABE29684A6CBED5B21FA9C00	4961BA93C45E1234BCF3B39525CD9CB22B38F4C2C0A078D6731537060468A037
Chrome Cache Entry: 206	ASCII text, with very long lines (65461)	F0C3D6379C2D3F7633735782DC17855D	992BD9E79CCB132A5144F4E3D5AFC6A0646665E3	10154878EA883C9691505235929B352CF003829AD8132293A51511C127D4873A
Chrome Cache Entry: 207	JSON data	E3DDB596569AA24CC7D23353896A8C9A	F6E61A917E36052279975E353174313FAF7F0C72	D6A84A5E5D6910E483EA1089E1FB68A240DFC1CFAA55A903FB47041B49EE7265
Chrome Cache Entry: 208	JSON data	04DFD81C4C1E67427BBC0BC84E96C9A7	94B53F47850B154CD7382B9577E41741FA3C1417	1C3631F5DE2F2F722CF000ACD51754985B07C4E6F8A679BDD1E920B6CC903C0E
Chrome Cache Entry: 209	JSON data	61F65D733D95D6C6F0B7B60EFD674F40	9544D693E4C53D648F74F9F45159D2DB080529AE	9C4B05CF9708030E91DA69B1F35D163DECC94B150527EE6EC33D82EC10308B5A
Chrome Cache Entry: 210	JSON data	7BF6148261AC66E2F18280A64ECFEDAB	795D8DC0D69F02C65704533A5282A71EBDFD71D3	8A853CF8DC38493476FE172FDA40861A4020D4EAAD207E5B51BFD2982A507DB9
Chrome Cache Entry: 211	JSON data	9F90758B9F584F8CD71AA80581C97E68	2274DC8C6ACA7AD6176983CB0F0299D3F34CA272	75F5BF006C330076611C62D1845B283585130B2B44C0FDABAA0D92E0C9F4512D
Chrome Cache Entry: 212	PNG image data, 709 x 237, 8-bit/color RGBA, non-interlaced	856EA871E1A30BE33A7A5285DC8C2A2F	45A89C7CCEBBE4E29FEF6581C8A144D38EB9B783	B633D55BBA100E7AC5321A3E8700EC13751E810D675692EF33C50D1315633394
Chrome Cache Entry: 213	PNG image data, 709 x 237, 8-bit/color RGBA, non-interlaced	856EA871E1A30BE33A7A5285DC8C2A2F	45A89C7CCEBBE4E29FEF6581C8A144D38EB9B783	B633D55BBA100E7AC5321A3E8700EC13751E810D675692EF33C50D1315633394
Chrome Cache Entry: 214	JSON data	6FF6EDFF05136535064E954932EB4FAF	90217D3E316FD4DAFA925A170F17FF0112B3C2ED	EBAD5785150D81E60D1F198BFDF24DE28FEDD929D3CF7C4D70520F0D4593E821
Chrome Cache Entry: 215	JSON data	B2C597E7C657CBECC85DC3EA68147160	F4FD77A056C95C7A99EC3225D80CADA48A5D65D6	ECB146C13F2FFEBE68954D58DBA1F04EFAA735C60C99F3AB52B923A5627C03F7
Chrome Cache Entry: 216	JSON data	2E8C96EA36520702A1ADFF16DEB82197	710798DEE0C510E7571F114425BFFFA7390E3F71	766CB87978924591E184A63F84FA189F310B37AB1935D4A235905CDD11E665CB
Chrome Cache Entry: 217	JSON data	DF3E51CE5C07E22E0F536B19A4FB200A	50A925AAAE6B82497E14D9219A0964C578E00E2C	7DF30E3574FA569A31C6C9B6A7ACEDAD1E39D71012E23275DCE623D507DF68AE
Chrome Cache Entry: 218	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel	B4593EAA7B269255B772E02F95752648	58AB7772075C9AE37B4049F95DAF16EC20A37C96	1AD7AEE4CD0D855B8B8E7D1750B04C3262CAE1F00DF861FBC6E11BDF25B1C4EF
Chrome Cache Entry: 219	HTML document, ASCII text, with very long lines (4821)	5EDB1AA56E29D50868B45395EC61B1A8	E9ECB72EB75DA45A38F561501D013196A91DF2A8	908A73399E87F170044E13D27F8A320B13D3FECC172CCA6A83F3268AE14BD290
Chrome Cache Entry: 220	Web Open Font Format (Version 2), TrueType, length 47264, version 1.0	218F4F81BDEE5932A127929C6D693F0C	21A507DFC03B8A1107EBA38D223F1F8C2217A48E	3C56FCFF3A74054781E42A712F7DC2B874EEC7A646C7282464C5D4CAD1A36186
Chrome Cache Entry: 221	JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5, orientation=upper-left, xresolution=74, yresolution=82, resolutionunit=2], progressive, precision 8, 1920x1080, components 3	0F5CC9665ED4D3F14C698333CD83A978	26F214803E9CDBC311C5982084E9E2EC6792B429	6F468A1574D30D268068ADA4A1DD42A9E8DB466DC7AD5F3A12F0E580508C7C08
Chrome Cache Entry: 222	JSON data	CC8595746B78A5A56DF2F419DFF73427	87317B51A2277FA050733F69204FE4584CDB5262	3C60E6F5B5ECBAB1DF53F1283C5E41C7B2C9C2EC3AE0F38257A4CCEBC0302CF6
Chrome Cache Entry: 223	ASCII text, with very long lines (1066), with no line terminators	E308577AB905A4729686B73F860A8E7B	C056E47DCA66F47D3CA2BD7C46FC7EFB0F33E925	E53B9F710F0B77988FB87B402546C9CE989A44038E3428C5E974BB1DBEEB67D9
Chrome Cache Entry: 224	ASCII text, with very long lines (3768)	7B9CA6C274AEDFB26429E858DDB3EB52	45F4A91F48DD8DBA3E20B4521FF37A9E7D0E0AE2	66CDA3E1DAC3EBE9368BFD528CA60D43F85A9261804616FD49F4FBF349E88785
Chrome Cache Entry: 225	JSON data	0908AA185AF44C3E1BF163317800C913	130D86035D0B6387C3F12D298A591B9D03E9DE66	7F59589AA6DF6CC791F6A392B1DAB0D70D06FD41143781BF3343073A8EA062C5
Chrome Cache Entry: 226	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel	B4593EAA7B269255B772E02F95752648	58AB7772075C9AE37B4049F95DAF16EC20A37C96	1AD7AEE4CD0D855B8B8E7D1750B04C3262CAE1F00DF861FBC6E11BDF25B1C4EF
Chrome Cache Entry: 227	JSON data	E4F1313DF1E451930EA2DD8008366349	3D7B9F23E3128AE72B2CCA363EDB05827C9FFA04	4C881BBB57462458D00E345F50CBEB3F1E9CA4BEFD3E03E48F1183A4A2985F03
Chrome Cache Entry: 228	JSON data	6F306AD78C48654DA3A5B621870B4584	718A118AE20278F138684B3EEBB97DCAF51D631F	545D857D4485CE93051F877EF2A62FA5140BE472A27B985331AFC3F91E4D914A
Chrome Cache Entry: 229	JSON data	04DFD81C4C1E67427BBC0BC84E96C9A7	94B53F47850B154CD7382B9577E41741FA3C1417	1C3631F5DE2F2F722CF000ACD51754985B07C4E6F8A679BDD1E920B6CC903C0E
Chrome Cache Entry: 230	JSON data	DDE1339ECB8D478034559EA8727B2BF8	779E4EF719BE6D6EEB0A9E405AA00EBB204495FD	BC75E1E0021CC9AA2CF102684B3351CE9422FD591193BFB9057CAA6B70B99C75
Chrome Cache Entry: 231	ASCII text, with no line terminators	B1DA4F9328240D8FE4533DC8B52800B7	22BED9CB8B1CE3B3833E1871B115091839AFEA65	981F09915FEB46B044AF13F2DCC0EBEA5122054FE86DE90FA83D78CCB5A38FD0
Chrome Cache Entry: 232	PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced	8A61014EEF1165A0D81FC3F6561D6AD6	5E649919DFF65FD5D3E07D80A07837BC24AD9997	63F1CC79F69D154437F81F435564DCB49EE6ED135D5EF3B231D2B5D93FD04DEF
Chrome Cache Entry: 233	JSON data	1DB346227D566CA86D92E743751E2425	D8EC46C42BA219BBDBAC1CEB5D14097ABC9804BB	CF8FB52F7126D128ECB5064CFA2208716C3A8D608EE528381874B472FEF9F9EA
Chrome Cache Entry: 234	ASCII text	C349E22984D11203E403618A4368A733	4FFCBC7A02A4EA20C62F25A84AC9BB8AF4339BDF	05327913F38992D0349C464F45F7A1BE761B4D3A00E550F178F84479E300C4DD
Chrome Cache Entry: 235	ASCII text, with no line terminators	B1DA4F9328240D8FE4533DC8B52800B7	22BED9CB8B1CE3B3833E1871B115091839AFEA65	981F09915FEB46B044AF13F2DCC0EBEA5122054FE86DE90FA83D78CCB5A38FD0
Chrome Cache Entry: 236	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1648x1080, components 3	3A1CF7973B97A21BF8AD69C28BAD4ED0	1CB4DD7D7BE8F6E5CCD117624A0B80CC8094D074	A4A6CEC948F13383DA27EDBCD5C3E200DFEADAAFF549DCEFFD9C14FD90F6FDED
Chrome Cache Entry: 237	Unicode text, UTF-8 text, with very long lines (65415)	2F42669D37586DCA93E9FC789F07C7C0	B2E3BB8B944E6129A94858F0D13EF8C054395BF4	92D51D1E950380F8FFF362B4FE46D55E4BAF22F3188634A6EDC133FF52694004
Chrome Cache Entry: 238	ASCII text, with very long lines (3768)	7B9CA6C274AEDFB26429E858DDB3EB52	45F4A91F48DD8DBA3E20B4521FF37A9E7D0E0AE2	66CDA3E1DAC3EBE9368BFD528CA60D43F85A9261804616FD49F4FBF349E88785
Chrome Cache Entry: 239	Unicode text, UTF-8 text, with very long lines (65415)	2F42669D37586DCA93E9FC789F07C7C0	B2E3BB8B944E6129A94858F0D13EF8C054395BF4	92D51D1E950380F8FFF362B4FE46D55E4BAF22F3188634A6EDC133FF52694004
Chrome Cache Entry: 240	JSON data	0EF17FCA6E2E72765A946B460DD8AE28	4604F54FFDB61F81596F27ADBF4356739BBDD112	D03B7B064357009CDD06B2042751C6AB9B7DFF9E76493C7E1E173F031BB51064
Chrome Cache Entry: 241	JSON data	CA0A6689937F5B27D3EC433ED65F188A	C9EC801EF13DDF536D83CA90B17B3F7885B8F108	0D2FCE1B328BA0673776858B81C2DAE3F963F190581066071AB4D79E7D9DEE2E
Chrome Cache Entry: 242	JSON data	690372299C135DF4C6D3BE73AE08F806	5C2E8E32D97984B378A32A353CDF70C396968925	5DA7132F409F98D07FE8CD7AB029C35874328BBB915D71425EEAAC7004FD862A
Chrome Cache Entry: 243	HTML document, ASCII text	0FFEE32DFE2F8E18FE3958B6CA5B27A7	E2F9A6074F4676D1B42E3E0D1DD06F65ED31564D	1E8B66E9F3F416287E6141A3EED006C7956C6419B0AF8BEA307648A2E74413D2
Chrome Cache Entry: 244	JSON data	3B4C1C681D85D1C09F4550DBE93F0C75	AF97A1B4DFECABD1DF2B0F7089F28901FAE44FB4	072C300575D643413B65161101677CAFC20C58FCAB2F0C916A2FAC194BC592D3
Chrome Cache Entry: 245	JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5, orientation=upper-left, xresolution=74, yresolution=82, resolutionunit=2], progressive, precision 8, 1920x1080, components 3	0F5CC9665ED4D3F14C698333CD83A978	26F214803E9CDBC311C5982084E9E2EC6792B429	6F468A1574D30D268068ADA4A1DD42A9E8DB466DC7AD5F3A12F0E580508C7C08
Chrome Cache Entry: 246	ASCII text, with very long lines (65461)	F0C3D6379C2D3F7633735782DC17855D	992BD9E79CCB132A5144F4E3D5AFC6A0646665E3	10154878EA883C9691505235929B352CF003829AD8132293A51511C127D4873A
Chrome Cache Entry: 247	assembler source, Unicode text, UTF-8 text, with very long lines (6820)	DFD3AD917AE229FF1EED095C8684417E	703FA87FE97EED5D5DE0B9B675DBD811AD559DC7	9FADB05815B0F398C8054E17F4D244487FB426FB93B9AEA3D764FE27FE11FBF2
Chrome Cache Entry: 248	ASCII text	FD77DBA69519A3C1BC9EE0AB8FC5CD36	A28527B32C84AE57A94FBEE60C1FBA977705FF31	E3DAD898F252DAE36A51F6B093B11014A636C4C8FA0EAF1F440F79C18DF23AC0
Chrome Cache Entry: 249	JSON data	FDB7238CEA9C6C0C1643B5C490F773DA	62D67674C7080274753C85308557011DFC034AFF	5148F5D3E9BB90E822DAB1D8AA241EEEEB5EB42A8C2109EFA88FFD1926CDDDFB
Chrome Cache Entry: 250	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1648x1080, components 3	3A1CF7973B97A21BF8AD69C28BAD4ED0	1CB4DD7D7BE8F6E5CCD117624A0B80CC8094D074	A4A6CEC948F13383DA27EDBCD5C3E200DFEADAAFF549DCEFFD9C14FD90F6FDED
Chrome Cache Entry: 251	JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, progressive, precision 8, 1680x1080, components 3	D1946C7F81C572CD970CA93B73D370D1	359E69E0F5284BCBABE29684A6CBED5B21FA9C00	4961BA93C45E1234BCF3B39525CD9CB22B38F4C2C0A078D6731537060468A037

ID:	1543757
Product:	CloudBasic
Start time:	11:42:55
Start date:	28.10.2024
Sample:	NEEmRGwBAG.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	ab5bd55bca3e5b93e184148531714c33
SHA1:	ee5242b10bfcb2d99cde579654bfa251e8f63b9a
SHA256:	25cc9eab5abb14695ee27a8c990921121b86de002ce7fd199ad32f14e915099b
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Windows Analysis Report
NEEmRGwBAG.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted URLs

Windows Analysis Report NEEmRGwBAG.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted URLs

Windows Analysis Report
NEEmRGwBAG.pdf