Windows Analysis Report
MDE_File_Sample_c8baaba3954f190f1ea0f1d83f0609c9b7493cee.zip

ID:	1431750
Product:	CloudBasic
Start time:	18:04:16
Start date:	25.04.2024
Sample:	MDE_File_Sample_c8baaba3954f190f1ea0f1d83f0609c9b7493cee.zip
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	03607710715ad3f38b5eda1f7c7575b2
SHA1:	d05df273f0071c1ed68dabd497b67260506298ce
SHA256:	e3bc8db50d87afc36ff6d3fb7f36e3f514978d1bdc28f7603ab2ed4736dc3036
Filetype:	ZIP compressed archive (8000/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	22F4C5E2F624AA9FA38EB3721CB9E59E	6B260F3314FA530486AF42D496ABBD9379F37FC1	A19ACCA9BCEAFEF69BA06580EDE9BA361A441510F1B506468691C6230B539637
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	231C4E7D7639F98384BA7026A1EBE39B	5FB9A8E02C3DC5FBA71A5A394A0AEF055A92952D	45549575A345972BC9AF4BEAEF6917093AAF42E669ED175CA25AEE0EDE9D30E2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\229c939b-7ff7-45b1-9dbc-d35750dd27b5.tmp	JSON data	FCD1B4420A3714FDBE2ABA35A6F6B615	95310D82D22C7158B1A20E0EE6B1A78457681C64	C59A15248DF261997E4D93014E15C7535FFE1015D2CFA8D10EFF6113C0C9E372
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF466cfd.TMP (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e815a980-aad1-4f51-b8a0-a9cb8649de67.tmp	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	D3DB40E91EAE9EBB3C86F787ACDD4503	6645101C336311CD86E0503E6D158E120D456F5F	5914C730740354049E376475B020445391F3436E88607C6369E5369852A9B275
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	AE619EEB75E8CE6E1DBF93A6BEC20439	FE6FB38103A18CBFF5F17662BC88A69332E9A704	E169F7D61C5E4279A27FF6AE99677CEFC5B5DB2D929A84C3A0F954F1691AF59E
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2	A4D5FECEFE05F21D6F81ACF4D9A788CF	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	BE7247DED0FF61F50C37D49388A43BC3	98D70433B84429D04002CF8FBB6E5E5C5A9A8F6C	AE7538461D49FCA9A10C99991C0C8F255C1E1FCE483B7796062C935BDE1E343A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	C89447C536B4C8A93A222C796D78FFB1	EA5B3DB005B5204D0393CEE424BA3C9B698CDEB0	E50F0D3C8FCF9BAD1E0105868919BA2FB2240FF57B320A822A5C6FA78E9C9AAF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	91092923924ABC1C4A292970557BC9F0	C5EC61CC7932ADEA70E0C5D9B64437F1E4318CCA	AB36208CD2A47F058C22D7E9BA29FAE1A7B80B09BDCA8FE212EB9F97F23027B5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	FCAAA9E40EF9781F0FB0DA1FF79DB2D5	D5B60B2DBFF8C3273CC89EB4DD8F55111F967891	10F8272F7B1ABA7EDDC8998AAFF2462014A54DF597C03476E6B96D16B752D387
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	C5A50A74BFED0D7431045A0E7A63192F	D5973373ECD15CB87406D41A4E17BAC268895274	954BAF81FE62FCD7114642A5305AAD166D4140D2D5B4982A6DFDA97CF4BEB711
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	2656A58FC6899CF267A31905792DEB45	A781BA56B55B2516861614AA73A6D5A35B514B1D	E4387F2CF0E85B4EC0B62BCF18D16B9F4542F2CCDC9BF6E5D294CF2C47BB23B5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	D3E9DD7B854C6C0B5C380F7F60BB289C	A288562C248D0AD9DDA163A079AD1D515D1C499D	E9C37DB9588C5D17186F5557BC2AA086826940D5FA4EC7FE52D63A1F2F4B811C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	756D5063E4B9E72FAF42EFA3FF512980	75FCDB6219F220B6C2DCCA998FE385E891A3C445	099B1493A1EC94075D8318C89C24D076DB85FD098BAC68DD3157384104AB6FF8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	96B28E025EFCE5071C883F99D0CD38A0	7E189B5A814F7D864C595F128EB56CC755D2CD9F	370E7E1143101EC8849A4395C3547846FBF6741806F6ED81762D5880BC145774
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	9E6439D26CFF9FDF6C958D9DA7F66596	7FD8320DDA0BCFB453623059F3C0EF58495B0C29	15343600274CDCC2CB9CCA378DE3148F3E68AFBD26C3F69E8C54314E9540DFD9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	BDC217B4001B45FCA3FC515C39491B8A	F8DCC8B0DF9FFDD170D6E265A598B10E0D5B1405	2D49A59CA7E49977EB7A744D4297834149EC08AEE097318A7DA32A6675D61B11
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	6F7D15CFB4FF6284DFBEAC04F4E2C527	9118FF899C4DF3B6510AED7DBE74EDBA050DB99C	8CD7D2C6110B6F33CFC0581681A8E2D106402CD3A578E986BA53558463D37E33
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	6E6E8776963AD1234FCE59CC10DC7583	984CFF2F3CCB06C8925C6EAA7B30321850D85C23	B1AECF4CCDFE8212115399990634C624E9E7DBC43D3E200F4DD23C8E6A493929
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	106A4FA3D022E715883DFAD1C54906F0	432F3EB7E98F5075A46A7059EDECC3E75B3772FE	D4479E4BDBAE2DA3176E1807425D71A473E2F760D04D9A442DCABF9B3A0840FF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	2CA4438DAC8D4556CB7D9D8ABD062EF0	A81CC6CE371809F2F4C38D79E750450638F858BB	5558D14C596F5736A067EA6D0B16A9E23E0EDD942EDF8AA1A25F92160EC1DBBC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	8377A465A9414BB990AEF1D754A241B0	0EC12B16C1B81578D53534B0BB3D3D27FCEDC903	65792A8F3EB4C15D7E55F7EE3048992C7BAAF7CDF36AEC42E237D429AB3873D2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	68938A73DA7C0D5CC9263758F446B333	1B2BCE8EDC96A61BBBD8655F2F05C904CD5B5B38	1B34E00C114F5340DA1739C6F19B16A91FBD1A6E2A926A0834F62F72BABD9169
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	A5B3F69EC40B9F33DFA1F3B3B98863F2	C75FA3E42ADE55C22BDECBDE747946C84252D79F	A22C4E8C52BBBDBC072F2F8317C4168A1167D0C60A1927000C2C1441AD15E834
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	3DBFA76DD407C9066C0AE69BD50FFFB7	AFDB34678BA7A0D0698727FB34384D6063630777	66B428371E4D58BC9C8BC757117EC4C27916F28C4FD747CCB86D9957831C129C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	D2B5551143B18EF0585A2D262804D936	A028E0B711CD95E617B1E533B266FE4628571CD3	4F7523962367B7F6CBFD327C33530D957A9002BDA77C1C576B35ED28DCDF8ED6
C:\Users\user\AppData\Local\Temp\MSI56060.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	AFEB25E07B622BBAC6A5ADAE19F67264	8FF7CC3133855EB82F041672FA4DD2C73988DEBE	42E6AA896BC9310F898506817A587E58B22D83BAC3BC39135706FF94813BCFDA
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-25 18-05-03-394.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	2368A5C5360F3CE1C5B71DD9D2AB19AF	ABF9BE990256C3A701CA803DC972777625129411	A730130F530D4C2430A455A867FEF8496082ECF7FC4D1E8261E69F0475776F9C
C:\Users\user\AppData\Local\Temp\acrocef_low\5892ea80-266e-4ccf-9649-43613ec41ae8.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\73dd7345-d605-474a-bf51-0e10127be3dd.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	1A39CAAE4C5F8AD2A98F0756FFCBA562	279F2B503A0B10E257674D31532B01EA7DE0473F	57D198C7BDB9B002B8C9C1E1CCFABFE81C00FE0A1E30A237196A7C133237AA95
C:\Users\user\AppData\Local\Temp\acrocef_low\befcbcdf-44c1-431b-a10d-b5fbd9a8cccc.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	22B260CB8C51C0D68C6550E4B061E25A	DF9A5999C58A8D5ADBB3F8D1111EAB9E4778637E	DAB1231CC22DAB591EBB91C853E3EE41C10D3DA85D2EFAB67E9A52CCB3A3A5A0
C:\Users\user\AppData\Local\Temp\acrocef_low\d878e1c5-0194-4665-827f-41b7df17ba46.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE

There are no high impact signatures.

Networking

Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185

Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

System Summary

Source: classification engine

Classification label: clean0.winZIP@18/35@0/35

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-25 18-05-03-394.log

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_c8baaba3954f190f1ea0f1d83f0609c9b7493cee.zip\BIOLEGEND EUROPE B.V._AVOIR_SCM5200.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1576,i,3793786668890330827,6820266977843083251,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 55D10A27458B87506DEDF3280DCF6093
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1576,i,3793786668890330827,6820266977843083251,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX