Windows Analysis Report
REGISTERED LEGAL NOTICE AND DEMAND.pdf

Overview

General Information

Sample name:	REGISTERED LEGAL NOTICE AND DEMAND.pdf
Analysis ID:	1467210
MD5:	ebc0c57a71d16d0c8e2f1972a676b802
SHA1:	a3f4f5230f1baa2f9de773f20c340eda3b9dab47
SHA256:	f524dbd0d47d9115488e8c70d1b5525ad073f937bf5cf14bc0c071644535c2ec

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Classification

Signatures

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 23.52.160.183:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 23.52.160.183:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 23.52.160.183:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 23.52.160.183:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 23.52.160.183:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 23.52.160.183:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 23.52.160.183:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 23.52.160.183:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 23.52.160.183:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 23.52.160.183:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 23.52.160.183:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 23.52.160.183:443
Source: global traffic	TCP traffic: 23.52.160.183:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 23.52.160.183:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 23.52.160.183:443
Source: global traffic	TCP traffic: 23.52.160.183:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 23.52.160.183:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 23.52.160.183:443
Source: global traffic	TCP traffic: 23.52.160.183:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 23.52.160.183:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 23.52.160.183:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 23.52.160.183:443
Source: global traffic	TCP traffic: 23.52.160.183:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 23.52.160.183:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 23.52.160.183:443
Source: global traffic	TCP traffic: 23.52.160.183:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 23.52.160.183:443
Source: global traffic	TCP traffic: 23.52.160.183:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 23.52.160.183:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 23.52.160.183:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 23.52.160.183:443
Source: global traffic	TCP traffic: 23.52.160.183:443 -> 192.168.2.16:49709

Source: unknown	TCP traffic detected without corresponding DNS query: 23.52.160.183
Source: unknown	TCP traffic detected without corresponding DNS query: 23.52.160.183
Source: unknown	TCP traffic detected without corresponding DNS query: 23.52.160.183
Source: unknown	TCP traffic detected without corresponding DNS query: 23.52.160.183
Source: unknown	TCP traffic detected without corresponding DNS query: 23.52.160.183
Source: unknown	TCP traffic detected without corresponding DNS query: 23.52.160.183
Source: unknown	TCP traffic detected without corresponding DNS query: 23.52.160.183
Source: unknown	TCP traffic detected without corresponding DNS query: 23.52.160.183
Source: unknown	TCP traffic detected without corresponding DNS query: 23.52.160.183
Source: unknown	TCP traffic detected without corresponding DNS query: 23.52.160.183
Source: unknown	TCP traffic detected without corresponding DNS query: 23.52.160.183

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709

Source: classification engine

Classification label: clean1.winPDF@16/41@0/31

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1092

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-03 15-15-24-551.log

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\REGISTERED LEGAL NOTICE AND DEMAND.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1608,i,6198725211634245139,16709137506503140447,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 05774A92EFC2D731C3C71D4AAD5F180B
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1608,i,6198725211634245139,16709137506503140447,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: REGISTERED LEGAL NOTICE AND DEMAND.pdf

Static file information: File size 10483149 > 6291456

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.219.243.226	unknown	United States	14618	AMAZON-AESUS	false
95.101.54.195	unknown	European Union	34164	AKAMAI-LONGB	false
23.52.160.183	unknown	United States	16625	AKAMAI-ASUS	false
2.19.244.159	unknown	European Union	16625	AKAMAI-ASUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
87.248.204.0	windowsupdatebg.s.llnwi.net	United Kingdom	22822	LLNWUS	false

Contacted Domains

Name	IP	Active
windowsupdatebg.s.llnwi.net	87.248.204.0	true

ID:	1467210
Product:	CloudBasic
Start time:	21:14:57
Start date:	03.07.2024
Sample:	REGISTERED LEGAL NOTICE AND DEMAND.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	ebc0c57a71d16d0c8e2f1972a676b802
SHA1:	a3f4f5230f1baa2f9de773f20c340eda3b9dab47
SHA256:	f524dbd0d47d9115488e8c70d1b5525ad073f937bf5cf14bc0c071644535c2ec
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	1818940670804CBA63695889F78BAA47	27ACF99B84C42A1561F8D39B1049C573EBE9F84F	E6E3D43330D5E165914192501688DEF2D11AFF9CD16B0086BF8B5463035F97A9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	121517FCCC34A3B951BEE1C897386C51	0B51D1971379DAE9AE3814F2486F78529678A81E	0C6113A2E0C4D72F6B0C08B4C771C2B93BA5FFC6A2EC0A13B6A922A1B91A32C4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d86c453f-9133-4a2d-a44e-0f7169511ae5.tmp	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	CD871E24131AB80B6C8DADBD3B8FC695	0D61F0F6AD6F54927772429E7B26FCE57031C592	FE063F12C565CC78062B89B8CD48A50647EFA4934D99081CF38DFA22933C76B0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	3338A1E9D1A12C70CCA1493C9E0CC6E8	33019D3D293D634252870FF83E729F3E87FFAF30	BF59FBA587BD34FFCB120A32FBC4BF9381F4B2A7D7E085291A683A7465698A5E
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240703191526Z-162.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	4E022E57E441E3FCA7508FC4CE501418	802B7F6694D4383589C91B8E14454814E3508016	08532F0201F281687C1AC1D0298E2344ABA21467598CA67EAF62AD41588424B4
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2	A4D5FECEFE05F21D6F81ACF4D9A788CF	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	9CD257E2206AB69CF3B2B942D8106C28	84EEBF6EEC7409057ECA5EDB0AA3BFC49273FB21	67DD943226A89CE1E33A05026B77C24E9BAF444AFE48087DCC675BB75E8DB9ED
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	D4AE187B4574036C2D76B6DF8A8C1A30	B06F409FA14BAB33CBAF4A37811B8740B624D9E5	A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	775F500CBD496E9F650486D67F6175D3	4A9A621B6ECE2A4BBBE43CCEDB54A0162BC22ABF	A16E84471E7684CB1F14F21AC7EF89CDA82F90478637C526B04796596091370C
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	B80956DA3C4F0538F4F6804D3EC04226	85D9CEA1A5C1984F5C95B4158733F1939F8CA362	6159A93824996F7FDEBDE3138821D3CDB23319F8E0E3395BAB5D0061B0824AF8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1092	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	2054A2679622E022FA817A40166C2164	CCE7CA98B07AB6B61DD366BDF62EDAF747446ECC	AD1723BF16BD26C8EECEEDABF125E848AADA0A1B15A1F135AE130977D0092CA3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	B5F81A397BEEE23D849B1D8335077D4D	82620766D5FFF0BF1BCAD32E930B22A9514CAA41	244D52F44080A919D2E42D34C0D429A6B557854B02CC2F6E877E7978F0049F77
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	CC26B5F334E501516D7132E3052DC714	49A5A49A1987114AE7B15F986EE00BAE5C4453A7	5B2519DDD85338168C8DF5CA15C109A768CE9673F1FFF0048E602D96C1E6E083
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	EFB874AD6679F19FA0312F43189513B2	F55C50CABCED378C3A9B1EE132E73E8FFA4C84EB	DA8464848AF29DE9B7EDBA9D6EE61AC3AEA5D0A61CA22E73649DF4A927EF381E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	B2B76D465A9C4EA2674C293C4F5DE8EC	72D7E70C951784803F2B9350DEFCFBC5CE965400	2EFFB8F15D8855A6DDE7891D91EAC824A7FA819D6C86390B14EA088BB156A0C1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	75D23186ED9310DC2A4CB29B1A84BF30	AE1A871F468B405BE7614603B949D942C415F450	71B1C3ABA4774A8D1A5485CD9D9862B7750B87596A36A07D73FC8444D86530CD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	66677CFD885C3D908C4EA2681D73D852	50BECDCB7E42E114AA13CCB26FFB53449BCBA5EC	D57F2F34CF0A356DC9D6F1BFED9791BB41EDAD9D66ED758E560311B36347C6AD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	87B80BD9FD22AFDD16A339F8F571710B	C7AB4F21B5C81870EABE9F34FB0511E67C02FAAA	1BFB67660A568380811C0A051B02007D5289CB05AB8B7D8B0697A716A7401798
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	CFED8A7157642F79C42E6E1248EC7DB4	E325955B23392FB728A746A93FBFCA2955C7CF76	C74C27C674E727AAE4F407C292D57FFDE9BFA37025E99AD3B414EB8D2C98FEEB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	1B6D0E27614EAFFE00A0B9BBCF74B08E	93E508F23894BF5723ADF00037267E90DFB172EC	E45D2F5A0DE82654806AEB02B69B6729289E5ADBB8A2853EC3DF9F519B21D145
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	11CD01E50A9AE9A6F840BC76D1EFF4D6	D0A3171EC5BD7B9A3E0F9F5BEC176683E572B930	C7CCE58678F29A3F49A17EAC92D90F43779DB7D0EF82EE17618774DF29DF4055
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	CB9CEF9CDD52D7E4E0EB5028F92B9863	E4A7AC5F2B66E7CD2C10C018644E7119D97A5992	2C6DA010056DFC019EA3CF919FFEC3DCA53676198DB4CA6EFE02D364B1E01F57
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	9A4774D85B3A55D8B928366DE1745BD2	BE2F4F24B950100FC3F71AA5F30C79A35F8AE32A	B3B135A05A8BE5B6369F3FF75630D56495A13DC69BB8CD356215402800D3FDD7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	61930C24D5E6A43095F3B2AE9470B28C	7138524F293A857E3EA596A3B4E317426823B126	26267F063C8A2C7D73AF72AE861A0FF31A0FDC9093726900FBD18EDD3CFC65BF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	6FBE3F44F1E5B4CAF2162C1F75B8D59D	CCA784C95B4863BC86A4F01725C91D6BFB3AFF17	92AD630CDF3FB8323861EB06D8BFF93CBCF9FFD3B4401DF0D2FCE50A78F30050
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	CEDEF9EC50BF5399F79060ED16CCF119	F4199E26E7022E4A7D932B84040CD81964E27EC2	564445F21461D2BF675490986F410DC3E6022A3CF0229D21CFF5B0F9DD327767
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	6C67828612E4D3A26B486026EA4FABC7	5836B3DE5CB27DB528E4958E212AF02D2CDD9BFD	646C1AE9A427F520988661E8F67B1F2E4E49EDE75B942E8133FBDEE7B8FFD21F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	604CEAA6C00247917E679B254321082B	87E4175D2BB0E5EBD551019340FC6136C8BB9283	8B9DE642A8B3912D1B282EFB83CF07641CC2AF37E49F78E8C3B8D6C4F00F89A9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	F7371BC4EA8A6E42DD575F35176B8CDB	48E02BDFC938B6D9928FFFBB6A55088F355F36C7	D2449B9EF741A2CF286F982BAF83511FC8048FC5790D7DCAFE012AE46C58C35B
C:\Users\user\AppData\Local\Temp\MSIa4477.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	D3D087E0F21CDB6AC2715540FB4860FB	0367014E5F21826A751389380DB715824A7BA62D	254F5C5700EC03619BAB0E514C8556E1CE09F7C84138E29ED21D8F90066DA6A0
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-03 15-15-24-551.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	B4EDEE9A7C6A059D2E509D5C2C098032	498CBE41F5A94A63FCFE5EF36C0B0EEF80257E3B	9E3982C43325C819F2AFA03181267E480934DD5EBBEFFDF11C9A535216CBAF56
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	32676B3BFC77FD911C230189E655C2FD	48CB812CC8309A886CA460656B2E56965680758F	8C23F5F2FE1E67EF260401A4E4050FA44C40F648D7C3F78FF2B4DF37BA94383D
C:\Users\user\AppData\Local\Temp\acrocef_low\19ab12da-5296-49b9-8beb-5ccebb9aa76b.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	CF199C0DF13EA982569ED42E93E899C2	8819BBBB5AE1810DAB7F9BC347D0CAE1C7DF5262	85C89DE533AC6C8748763A3BFE37DADB538F0C46022DF8BE7BE8BA0403F1891F
C:\Users\user\AppData\Local\Temp\acrocef_low\78274ed9-5eaf-4670-87ff-4af26d61d537.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\a843e125-ab33-464d-8ba4-1a7510747e5a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	207450D6B117C53B842582BEE9AAD59C	1461AD75274ACB600EF67AAD4621C3E949D894F8	D92A0BDDEEE3AC93BFC5490300394E0C8FA0FC1DFADA8A36CA146EEF262142B7
C:\Users\user\AppData\Local\Temp\acrocef_low\c2f3fedd-00e9-4baa-8722-58b20b08a2e9.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE

Windows Analysis Report
REGISTERED LEGAL NOTICE AND DEMAND.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report REGISTERED LEGAL NOTICE AND DEMAND.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
REGISTERED LEGAL NOTICE AND DEMAND.pdf