Windows Analysis Report
Autonomous Medical Devices Incorporated - AGREEMENT.pdf

Overview

General Information

Sample name:	Autonomous Medical Devices Incorporated - AGREEMENT.pdf
Analysis ID:	1446156
MD5:	ca582ffeae72d8fbd737b4a2e96308ca
SHA1:	30c4037e4709a98bda7701f07a8dbf84cfc1e5a1
SHA256:	08fc670b30bb5fef3eca1af88c9942436d18124e81dfe7218016943d391a2134
Infos:

Errors Corrupt sample or wrongly selected analyzer.

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

IP address seen in connection with other malware

Classification

Signatures

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 1.1.1.1 1.1.1.1
Source: Joe Sandbox View	IP Address: 23.47.168.24 23.47.168.24
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Autonomous Medical Devices Incorporated - AGREEMENT.pdf

String found in binary or memory: https://newagreeement.myvnc.com/?hqggurcl)

Source: classification engine

Classification label: unknown0.winPDF@44/48@0/5

Source: Autonomous Medical Devices Incorporated - AGREEMENT.pdf

Initial sample: https://newagreeement.myvnc.com/?hqggurcl

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-05-22 17-55-46-939.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Autonomous Medical Devices Incorporated - AGREEMENT.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1636,i,13229278376060799718,1582003535039204585,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://newagreeement.myvnc.com/?hqggurcl"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1960,i,4143171357290156241,13071037754588390243,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1636,i,13229278376060799718,1582003535039204585,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1960,i,4143171357290156241,13071037754588390243,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Autonomous Medical Devices Incorporated - AGREEMENT.pdf	Initial sample: PDF keyword /JS count = 0
Source: Autonomous Medical Devices Incorporated - AGREEMENT.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Autonomous Medical Devices Incorporated - AGREEMENT.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Autonomous Medical Devices Incorporated - AGREEMENT.pdf

Initial sample: PDF keyword /ObjStm count = 7

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.185.132	unknown	United States	15169	GOOGLEUS	false
8.8.8.8	unknown	United States	15169	GOOGLEUS	false
23.47.168.24	unknown	United States	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

ID:	1446156
Product:	CloudBasic
Start time:	23:54:57
Start date:	22.05.2024
Sample:	Autonomous Medical Devices Incorporated - AGREEMENT.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	ca582ffeae72d8fbd737b4a2e96308ca
SHA1:	30c4037e4709a98bda7701f07a8dbf84cfc1e5a1
SHA256:	08fc670b30bb5fef3eca1af88c9942436d18124e81dfe7218016943d391a2134
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	140B7AA7B217ED5424A55B46E6F9D5C5	301F15675F4FF10646867004135CE90916B457EE	F630AEF6BE723B259A0A6308FE01CD98CCCE882952130BA266B9573404F5E6E2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	140B7AA7B217ED5424A55B46E6F9D5C5	301F15675F4FF10646867004135CE90916B457EE	F630AEF6BE723B259A0A6308FE01CD98CCCE882952130BA266B9573404F5E6E2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	23315C52A402A4A1763E7EEBAF60C8D6	B60758D2BF7CE9C7EE48BBAD45CCAD14D7AD7A08	026D36C679549E57B90D5793253EADC7828E2A88FF963A9C16F3CFADEC5160D5
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	23315C52A402A4A1763E7EEBAF60C8D6	B60758D2BF7CE9C7EE48BBAD45CCAD14D7AD7A08	026D36C679549E57B90D5793253EADC7828E2A88FF963A9C16F3CFADEC5160D5
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\29efc47f-e870-4bed-9379-f6c4397127a9.tmp	JSON data	CDC62C1825D050282DDA8C9391AEA3A9	EF3ADC668900781DD8543EAB84F8429F9B574DB5	37192B0D66700201D7059420C81A343AD2261E5BF499190D418125115D7C0D5C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	CDC62C1825D050282DDA8C9391AEA3A9	EF3ADC668900781DD8543EAB84F8429F9B574DB5	37192B0D66700201D7059420C81A343AD2261E5BF499190D418125115D7C0D5C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	C131AAB7C6780E5B098E23983304A8BA	C86E08E7F907B36E79227C5448454C5DEBBCC570	F09D3FBE0E2F16CA52E57F2A33D6F05C224F5C3CFDFCFB237EEB66F975481D3C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	05660B12656A52EAEAF96474B6E364E3	7382A09C4BCE6F69592A48A87875DF83887B2AF3	9C7896504B1D9C3159BF359BBA16C44E8CB2A390A864B6EC613692208A3A1B73
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	05660B12656A52EAEAF96474B6E364E3	7382A09C4BCE6F69592A48A87875DF83887B2AF3	9C7896504B1D9C3159BF359BBA16C44E8CB2A390A864B6EC613692208A3A1B73
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240522215549Z-163.bmp	PC bitmap, Windows 3.x format, 164 x -102 x 32, cbSize 66966, bits offset 54	CEE55DCC6DB807E15FEC83045D1DF9D8	5EA13D13C68D3DD94E7073291D6FC0B867657684	E73D4B7A74F38134144868ED7FFC362FF99FB1B45476E9A84D943512F8D520ED
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17	B27C43594542586096EC5E2C54121272	E5ED524C536C67A608CA398E884F913565C04E29	9422DBA861F0344F149AE9E2B3E2B8E99469C586C1E0EBC55D70155B4FF4033F
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	D82F482A318F4DB132AF2474079604F8	61F1D1F23D413C18A5B2DEEBB4ABCBA61CC0AB02	781DFBD5BCB29DBFB03B15C4F0DC55E4EFA266BAAE943FED9AD6970E9D19C1DB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1668	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	758B42992DDFC41CB5E57069C621B54A	D0C28AF6CF1BD2208DA97DEDE57F6C78CEC98DCD	55DF75758DD6CA825ED2DC9380EDC8469351191308C34CACFC44205197ABD25D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	CBC3B465355DDDABC850B0161B6D26D6	2A785C0C0F46842BC21E3534A69B3859FBCB528D	6E79779249453EBB44B7C00ECE66497DB767B927F37FA3448673F01BD49BC3E2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	38C967DCFBE23A57D8ABE310B06D9FB2	5277BCB323A02653A821833173783A4884A644F6	D16FAE98D3CC34336E9B9C691C3215860A4279452E51468BFDDDA64A068BFCDB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	A125AF173BD787951894F7364DC53B03	045627BE98E5500E545A2D8F8584B845C2F00BB8	5C5F99E5DD57C715192386FDF9CF46E58F99BB3FAEDB3C1236E06E6DDC30820F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	FDEAB904371BAA4465CCD717FA935729	87DFBF08128D9485C4808A32F0E87D5C4EFA70BA	657E37E72E5259E7C54C4B3845FC604529AAC3870D31AD8B46D7CD98B689AE75
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	5A4B6D48C8CE63849F9CFB43F3B465E5	76E75301383DA6402D0E78A6D02D70F6D83BCB43	359683146B595B84BD91457F6CFD8BE31A9FAC2FD639CCB57B0CB8A483053849
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	C92739CD2152E94E89032BC303AE5EBD	71509CBFB5992BB2AAB2DE83E07E3EC74F4DC99C	8587BA7785EADA351A232676DE9F0ACD7AF7BD6296FFE6C5BE950305A0F586AF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	E8E90D92D074D16CBAD870F7CD09E671	8D90482E24754740B3DF00E83D57C830F02F8A7E	984ED724D6B9CEAFE86319573BA6454A530F3406CA9EADD12E348ECDACA830E0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	B6747E0128EE7B469EB293FD08E563D9	DBAFD066B0A880EC5F76ACDD67C42D22F0EED1FA	62F9CB263A2309D68E93EE76AEED02C653011ED153FDD0490DA445E15A04247A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	8BE59C76A8ED7A97F99CC909B0AB7B51	6A0290800E360D691BF7F9680D2971F3A75F2F0A	C1B27CA9B2B4BB78DBE23D54401B211061C280CA53E680CB226334FDBF390075
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	70E80C3B1F3E4EA48A937C0511BFC09E	A05791147F5454EF816AE0847738B0203836AD19	3CA0330CD734EEDCE7EF6BF5B049A57347223442D0FB74916220DE55625BADC8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	CE44F92B3CF8939EC8185114ED35D373	968FB9DFEE54E00A8AAA31315632C6F4791E7F50	FF75A5AD1D1BD070F8121361E0DEA9B951C5A660FD2DF09343CBA2770F339FCE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	060B51CE833D1FF10BF09EA43AF64475	E9C1614C1BF096F3E5193F2C682DC8366316F24D	4CB10154053B2AC160156F3C42C7964869198198C16ED1FC091A0DBD39FCF5B2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	191A6C30B6AE499B053D9D93448CEA6B	C9CD5376225CB0C9263F1BD45E863AAE130ED1B2	A9D00760BB39B6CCFC2A58382356033D089533FCDFFA46376AA1DE85D20013E6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	CB4D6147C459F7A11EF529F8DF81A983	2BC3F94E692D550FC246E75173D79B310AF34AA6	D8C87F29F8C013E42F532356E3FFF5BCFFEC231927523C5992556B9EF122EAA3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	36EB77856AB5F3BEFBDD9A6D4E1B1E4F	8971A4814D3240C8B7B4986664C4673664FEB79E	E44198FA7C5CC72F9CED0011B079123CB81C61406D38AA51F60A6659B10FAE07
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	9D277AD0728E8E2CA52844E3EA3969E8	F139B80D87E6D663A3AB89DD997EF9C4EE0942C4	97A398FC780B0E95DB44B01AF44A527817ED4AB72652F98C6F050154E3A0A954
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	FBB27D45A1E84280EB648F79498C2136	636AF3AF7464442159CB070BD4DA2F4492BF3CBF	70BF1FC9BE3E19454D6C47CC984566465DFCE90E1E154352769B797F1DF6BB7D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26	C6614C8EC261971732EA43737A2739B7	9FCCC2BD108766963A748A792BC3A23FA681A122	B78A7FFC0746ECC5FF705E8D85B8AC5143A7585ACC6A032AEC558FE094D385C7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	1765C8BBFFFE4A74964A24A4685EA533	8A1157F98813F2CEC25EF17D1D7E5E42566A80B6	277D6FD183B9FA7920148F2EE8039B5818F35D970D9D2D7CEAA6F56B2B7BE42E
C:\Users\user\AppData\Local\Temp\MSI3a4aa.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	F69D4A619D5E226A824B4CE503BCF2D0	E8290ECFD51CA10060E1F9CDAB091F9F655BE6B4	1C1BB3F470EAC9DF3FDF1FE9F85FEC37547E63E590D9FEF59B30DF457D44EB85
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91phv2w3_exedtq_1ac.tmp	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)	997CE5ED3633E8FF84C2F7D1F0E48E53	D22617BDF6D8DCE13E5FCBE9BDD57A812EE1E237	E06C221FB5B43F5A25220D326EB501573C2E0CC9FBB31007BF79054B6F613907
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9sok0qh_exedtr_1ac.tmp	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)	997CE5ED3633E8FF84C2F7D1F0E48E53	D22617BDF6D8DCE13E5FCBE9BDD57A812EE1E237	E06C221FB5B43F5A25220D326EB501573C2E0CC9FBB31007BF79054B6F613907
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-05-22 17-55-46-939.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	98F35BE0FBB7870BD376CFBEAE0A9CA5	C4E41A6CA2573BAA4FC659CFEC06F24E435D6EA0	C4C4F8F79296CD0E5E70AB4682B1516574610668A9741DD5A6C9EEDAFE1151B0
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	1DAEEFBAF449741941D9FA82EE8586ED	E6F459711CF205695A302B77EAB5BB06C62BAA6C	11796AB14D4A892588886567BB47A67288F88F02FE303CDD65B15916311440F8
C:\Users\user\AppData\Local\Temp\acrocef_low\059bf0cd-1d4a-4181-a41f-42c503682bd6.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\65528e2f-dfd7-4de8-b797-f55a10e0087e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\9e2cbcea-2e9e-4531-98ae-ef21da2f51b2.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\a457223d-2b99-4863-9396-570b6347297d.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings	ASCII text	DD4A3BD8B9FF61628346391EA9987E1D	474076C122CACAAF112469FC62976BB69187AA2B	7C22C759CA704106556BBC4FC10B7F53404CA1F8B40F01038D3F7C4B8183F486
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl	data	B7A9A5A223B9DCE0E7D10E2B32A0BA07	FFB925FA80873CF50D8CB6DA530BA8CD7F0D9922	4EF52E63D45F5230C47DBD3764AA90768F708B24885579375724473BB3FFB255
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl	data	152F65AAA856C44E87C8ED561AE43C0F	B6440383DBC4D3446E91CBB58EEB8C8BD6671F50	48AC59FC9FA38016B6D5A4CB5D89A2C0CABCD8A0404AF29FBE995B4AA647A292

Windows Analysis Report
Autonomous Medical Devices Incorporated - AGREEMENT.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report Autonomous Medical Devices Incorporated - AGREEMENT.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
Autonomous Medical Devices Incorporated - AGREEMENT.pdf