Windows Analysis Report
ppop_verification_request.zip

ID:	1428769
Product:	CloudBasic
Start time:	15:41:44
Start date:	19.04.2024
Sample:	ppop_verification_request.zip
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	f2a28541d1b4cb1a6fb00495d78970c7
SHA1:	06380029fe042a4c9a29796d626edca04d25fbef
SHA256:	da951a118e08263357427047351f95c30ebb6b577e56fcd8a618e445c0373d09
Filetype:	ZIP compressed archive (8000/1) 57.10%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	81B06E0226FE9982659FCC2ECE03ABE6	B69B7BD300D900A995A453757DBD4CE42ABA872D	7511A42C7A2E1A8071AC296575B9382541B95AB465379970E8F823CA5580F5B2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	0B22483163EE0DA2D4BDB097D23A083B	8DE88B994CACBCC0CE966DFAECB94D49E2DEC486	E2E31E3989154E2231054AE2F268FCE3B0EC1EC40A647329A5265F73C04E6131
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	BA0027DB01469FC32B53B0B70E23AF91	1963D16DE703B6F20E0000C06F0BF53264F9AD40	44A578D0D09F8DECC2CA47BC328D48425F75F2E00C71B651962875FE684BE58E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	5EF6DDB74A929D55DC0847063B2F8786	8266CC28B163B4954AE2D3FAE13C6C758B6F019D	3226E2C06E8108DB00B7A4E83AF66FFE3275889D8030164D4A8DC5CCDF138614
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	D6BE99540F09983A6A6A483DF0A2625F	2CE5ADC35B21B4F6EF6CF0A735E0448D39EE18D6	1E191C9DD7E7BFD931A7BBA24BA8A32E0F66FAEDCACD79965E90D8CA2BD4CD0C
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	28469E1417120A36FF08D302D2563C42	5B35AF645EDE93568618A783D2A623DE21192262	168A6C33EAE0265B8967C480C3E8DB7585711D20F9A8AD10815987B03AC247A6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4216	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	D7B2FAE2FC820DB2314C686D288E5E31	ABA814AB1BB4061EC6E82E7E0FDE4E45CC5957AA	DEA73ED8CAB414ACBA22548C327C6E0DD19741BC822C6C5CD7BA4D4994BEAEDD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	429E80FD99C60BA0EBDAB7CF6CF8B1AA	463C6F6FF7348F0C86C25DE11081A0B51F2A294C	EE851391660934D39253C53A7392301A7EB9607916522C6E7F54BEDC177B1AED
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	392EE7A52A8CB8852FCD07D67F51E632	B44A61305DD3F432B10C3F8E2D2400572F8B8124	64339B757CAA48906201B7604D4306CD526FD7644076A02876925686A1A0F222
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	2729081693814931F5B87A5E94847F07	2C2A07420F748C0C2207C2E17026541A30E762A2	D1D9CAA59596D1824195083ED8C17F7A789C8731FD67EF5D32EA5DBD2C3B0795
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	105DE1298F711138553D9919A7A3609E	A8BCF80C6C9DA552932B6AA4CC644368EF7EAB94	4EF4A50DA7B382CFD1A3AA5F3AFBF85F2688A9B70730C9E04FFEB4BD7B5BF371
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	D6C158CBD6A3F83BDC21BA35D230086E	C8814B2534C7367F9501D1DEC034BD2EB69EDF5D	65FCC9724084A336EFA37FF5B723C94342C48E4A3BE7CD59E9BAB5CC4B0CE7B8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	FA1CAC3DEAB836465F11C36F4C26AFD7	22FE93F1C547ADD1BD0F4B48C364361B897EF22F	F403EC072127E5C9F8D7C5D5F2EE653E89B7928D1B9374851BE285DF61296A62
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	8A6E57CEE2BB020119BB396C5D361762	F7C84C83F73704DD1D37DF120BF2C17D6EC66556	AF5A941F90C6662E2701585FA8A1A82BA5B0CF91956C0854F584B2AD6EAB1065
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	50763BBD181FE57DCA9D113B0C7D4017	EC1B0A5346F7353A4A0066CCBE397795315DEEC1	0846347692CB130D3CF9D4483FFF190D890C493AECEACB2A2D1D2F4372FE9963
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	079DEF7FEF9D2D7BA1756BAAF3B0642E	789E04B525C75C7B47FD18E6A06A095A35E3D4F3	B8E3C566DF51C7FA47F86533580222C34D824A627DD7BB8596C694D601A76908
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	1B34095340C7B76D184A80A2ECFB9181	94037516A580EFE5183259A6E29A62B05C3A2AC8	56FD71220FF30D570B39202182F3E5FD97FA14842B278F4B8EE74A4450874270
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	484FF75A3065E0DB6911B762663187F5	A14A3B5E4F06DC8D1478AFC8170534DE20B54A67	87AD5A2120797B18ED2C481384628A78CCFB1CD32D21FAB2ADD5A8811005E5AF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	E558B9E77E0285DF524E36EC0B5ECA88	38FBC79EA21B142B83D4F137BCF8EF210EFD866D	4DAC3BA4D361862714FD82BC31CC66A417958905AB61C40C498C87A6599481E1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	0687EFDF3DB2C47702DB9697BE278384	8EAE5EE3734EE47185EE65EF526EE60DD3A3CFBE	29871498D5C1DA67705EF81F2D40FC94E95527BD2DEB17E573225C4080DB2CAD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	A599D1B41AB32DA106C8EE6597D1E228	5F7756730AECA1AB6D1E943A97A9570B0A26ED7D	075B4D5DE7FF44E611433884262C453565F38EFFD502BF80F4FD332C24AC31AE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	6CA6C838985F488B496DE0AD653AC9E4	D5BB58E2426A7A3EA1FFC22EA0058D26110E5155	5E2C3A4F04123389168678F7F213CE4FE5462030D61F536F91FCEA07A8E76266
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	B7FF2D2CBDDFBAE71D06ED4C946B3509	661F4A305FA6AABE87E3E11C4F3FA67CE5023EB4	B25CB7164F311055BA5B256C9281A92709567A165B4603EB6B17DAC4C8FBF7F5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 28, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 28	03A5CB0D63467427293B1352E35590A9	4ACD06CF45FD7360C81751C6E296FC5F4ABF8D4E	CA4DC1C8BFA40FDBE23A6D685DA40361D0A0BEFCAC1ACA66F26B178251A23CDB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	6DB68E76BE86AF192799CB32DF0F7A60	4E6600E3B9E063163E2B5219C5FAC892B5BD5B1A	A8A4C71C20588C1CE96AED4C51F23BE846B383D9785B06729505E059381C96F0
C:\Users\user\AppData\Local\Temp\MSI26d32.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	07E59B2673439F42B85EEB4C4876F330	F5EC2E1386783953F4127ECC48D760DCE69EA4B6	987B1BDB5D684AE429BDA98C2E7BDD0A3D958E40B85049F8740BC9AE590609F5
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-19 15-43-19-575.log	ASCII text, with very long lines (393)	E89CDF7025B70E5A72FFC801BADFB345	2C55C26FD5231BEBD6531BDB7962D12BE288A1BB	2A90DFB97133E5C0219784D1C4A94C0DC45AE4787C40CFE6894A59D94C4FB88C
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	B5AF9D5561901BC1D8DBC6FEB08E9AF4	25511DB8C3AC607148B6D7EF2D6648DC1E4B39E2	CA15A13FB3830C66406EB99459040430AE34DF9E31F5AF9A1A908A55104BB5AC
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	C4D4565274D0A2C7C949E32CD8358868	446E960F1589779C5C66391DF1D7ECD341FCFBC3	BE680874346BA60F67FFE82B525078961C05002617B477EB3F823EE855E8D1E5
C:\Users\user\AppData\Local\Temp\acrocef_low\af9976f7-1c6a-404c-b147-9d8274c5503c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	E787F9888A1628BE8234F19E8EE26D68	44D5180C06ADBBDAADDBCE350CE4DEC997CD83E5	3A09F3799148DA49F039A35AEDD22F368FB35B8D6022C4691C10606F704DAF80
C:\Users\user\AppData\Local\Temp\acrocef_low\c9ba430e-9297-4738-8289-4f83e36810f1.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	956BEC2EB32005025184F904D9622D32	C6A9A8B3F7A7AB8122FB00457C0F83D4A77F21AF	DEFD4ADB96BA87467278B6B06980FDAB1EE460D971B62ED05A89FF32983784EF
C:\Users\user\AppData\Local\Temp\acrocef_low\d82781a8-e4ed-4267-bf5e-4e2a2e1f267d.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\e35b88b1-a2bd-4355-8d1a-4648fde66076.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\eec11257-f98a-4ced-a9a5-9464d3a76930.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	408F8BA5ED5014C1E10FA19D75C944A6	87595F69D692B4D785AAFAD71394426879C7980F	FFFE47EBC7E157F63F4BE40AC0B2DCD73A5DCDF57B9D03FEA3EB99212A7EC16F

Networking

Source: Traffic	Snort IDS: 2855542 ETPRO TROJAN Agent Tesla CnC Exfil Activity 192.168.2.5:49705 -> 135.181.124.14:587
Source: Traffic	Snort IDS: 2855245 ETPRO TROJAN Agent Tesla Exfil via SMTP 192.168.2.5:49705 -> 135.181.124.14:587
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.5:49705 -> 135.181.124.14:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.5:49705 -> 135.181.124.14:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.5:49705 -> 135.181.124.14:587
Source: Traffic	Snort IDS: 2839723 ETPRO TROJAN Win32/Agent Tesla SMTP Activity 192.168.2.5:49705 -> 135.181.124.14:587

Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708

System Summary

Source: classification engine

Classification label: mal48.winZIP@19/37@0/20

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4216

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-19 15-43-19-575.log

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Temp1_ppop_verification_request.zip\LETTER OF AVAILABILITY OF PRODUCT_page-0001.pdf"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2156 --field-trial-handle=1596,i,6208737274966404848,17431096215579782997,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 0CA561018861774839103ED9175540F1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2156 --field-trial-handle=1596,i,6208737274966404848,17431096215579782997,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown

Source: ppop_verification_request.zip

Static file information: File size 1784469 > 1048576

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX