Is this PDF document safe? Treat it as suspicious.

Programs the file ran, with their command lines.

• mobsync.exeC:\Windows\System32\mobsync.exe -Embedding
• Acrobat.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\<USER>\Desktop\PDF document"
• Adobe Crash Processor.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe"
• CRWindowsClientService.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" updatepvbpreference c0de53ca-f166-4b38-89ab-4780a127e731 0 0
• CRLogTransport.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" "C:\Users\<USER>\AppData\LocalLow\Adobe\CRLogs\crashlogs"
• CRLogTransport.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" "C:\Users\<USER>\AppData\LocalLow\Adobe\CRLogs\dumps"

2 hosts, listed as 2 addresses. Links show the host and path only.

• IP address184.29.30.201
• IP address23.22.254.206

Files the file created, changed or deleted.

• WrittenC:\Users\<USER>\AppData\Local\Temp\acroNGLLog.txt
• WrittenC:\Users\<USER>\AppData\Local\Temp\NGL\
• WrittenC:\Users\<USER>\AppData\Local\Temp\TmpE92.tmp
• WrittenC:\Users\<USER>\AppData\Local\Temp\A9qjy75q_8vkj4l_4x8.tmp
• WrittenC:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
• WrittenC:\ProgramData

Settings the file changed, including ways to start again after a restart.

• DeletedHKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cAcrobatUpsellTracking\tTrackingParam
• DeletedHKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AdobeViewer\ProductInfoCache

Named locks a program uses so only one copy runs; malware families often reuse them.

• Local\SyncServiceThread
• Local\SessionImmersiveColorMutex
• Global\_MSIExecute
• Global\MSILOG_4ce7be391dce1b5GOL.b1211ISM_pmeT_lacoL_ataDppA_onurB_sresU_:C
• Global\AdobeCrashProcessorLocalLowLock
• \Sessions\1\BaseNamedObjects\{100184D2-BDC3-477a-B8D3-65548B67914C}_3504

The analysis machine's own processes and connections, recorded in every run.

• VM processExplorer.EXEC:\Windows\Explorer.EXE
• VM processservices.exeC:\Windows\system32\services.exe
• VM processsvchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p
• VM processsvchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup
• VM processsvchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
• VM processlsass.exeC:\Windows\system32\lsass.exe