Windows Analysis Report
September #35- J023196- Victoria College.pdf

Overview

General Information

Sample name:	September #35- J023196- Victoria College.pdf
Analysis ID:	1526108
MD5:	c7c2dd45d9b3a57907e0bdf2e19616ea
SHA1:	77c90fe83cb9324ac330e47f21d646286fb705e1
SHA256:	a2815b649a15a457dc00c469ff6b3261f82461436947e15d5ad85c90cdf39424
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.56.162.185:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.56.162.185:443

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.56.162.185 23.56.162.185

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr

String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748

Source: classification engine

Classification label: clean2.winPDF@14/45@2/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3684

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-04 13-07-08-959.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\September #35- J023196- Victoria College.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1520,i,2359972223169240925,15755556354658978647,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1520,i,2359972223169240925,15755556354658978647,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: September #35- J023196- Victoria College.pdf	Initial sample: PDF keyword /JS count = 0
Source: September #35- J023196- Victoria College.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: September #35- J023196- Victoria College.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.56.162.185	unknown	United States		16625	AKAMAI-ASUS	false

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1526108
Product:	CloudBasic
Start time:	19:06:06
Start date:	04.10.2024
Sample:	September #35- J023196- Victoria College.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	c7c2dd45d9b3a57907e0bdf2e19616ea
SHA1:	77c90fe83cb9324ac330e47f21d646286fb705e1
SHA256:	a2815b649a15a457dc00c469ff6b3261f82461436947e15d5ad85c90cdf39424
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	63C8C31081C90ADDC46FEE3C30F70391	004F60A1A6F143552D9E545C05C8B13C96A7464A	EE4C370D417E7B20F7D17331853E3886E05F62DC9E063FA1276E07E1245B21D8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	63C8C31081C90ADDC46FEE3C30F70391	004F60A1A6F143552D9E545C05C8B13C96A7464A	EE4C370D417E7B20F7D17331853E3886E05F62DC9E063FA1276E07E1245B21D8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	84602DFC67D84EE86B9F58FE03C30872	C88C70EC9E7D00B55950D8F0D69C24381DC83807	DE67B491622013AA23EE642F556235F9F8461970D9899485AB079907E7321595
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	84602DFC67D84EE86B9F58FE03C30872	C88C70EC9E7D00B55950D8F0D69C24381DC83807	DE67B491622013AA23EE642F556235F9F8461970D9899485AB079907E7321595
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\49dee721-1ea9-4765-bd8d-da72be44b7b8.tmp	JSON data	4FF001CFDF660618AC42A726ABE2C2A6	6FDDEB030A56328311797A69D5BC18A00037601D	79057B0EFB3E18575C90F69B33700A5D0E1C1103C42BF2B5A37F73DBE3466D60
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	4FF001CFDF660618AC42A726ABE2C2A6	6FDDEB030A56328311797A69D5BC18A00037601D	79057B0EFB3E18575C90F69B33700A5D0E1C1103C42BF2B5A37F73DBE3466D60
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	7C9367A3CDC0B46652D8409775C03EEC	8DC030DCBFFBCCED7AC78E7413AB8CA360ACC43C	05E38F169BFCE54323878DD960729E6F4A14484783B2CAC3FE189C5A5A6F8444
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	46498E3E999B2F634A4FB03579C91370	DE3560E8378995B34C20D1B8ECF70DE49D4103A2	2CF89CCD69B6A3368CB26043953EB1D1A8347853E67D0B556405B0E55D72B9F6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	46498E3E999B2F634A4FB03579C91370	DE3560E8378995B34C20D1B8ECF70DE49D4103A2	2CF89CCD69B6A3368CB26043953EB1D1A8347853E67D0B556405B0E55D72B9F6
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241004170710Z-157.bmp	PC bitmap, Windows 3.x format, 164 x -127 x 32, cbSize 83366, bits offset 54	908A1FCB01119C7486995958AA95808B	163ED0B1321B58D259FFB67FFEC017D44013B9C0	E80FDECCE5F9A6EF90CB012DE89B0CB0C6CBD24BDD2CD10A2C4EFC38783BCF01
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	4E94E43BA6C89C20EC432E8363273967	351C21454D8DD3987C117C596F4B14132A1DEE4D	1A2C590DAA4ACE6ACAB41AC1CCAB185DB9EB408171B01E9CE1EAF9B043B8E092
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	3B6FD825053611DFA40ECC4F3831D973	FAC39B9405CA2F50BEED164F72CCF0769C2B794B	F83F01339BE6EBC45FD025FC28DACF1AE06230394A0E769FA00ED63071DA764F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	8A18FA4A4719C042BF314A1AA906172F	E32796B8A1D455F4DFBBF94F32639A426173BF49	F2E411DA03FC62C3B76DE59FF00B096423F3E1EED7D62238B7294489A1A2B93E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3684	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	758B42992DDFC41CB5E57069C621B54A	D0C28AF6CF1BD2208DA97DEDE57F6C78CEC98DCD	55DF75758DD6CA825ED2DC9380EDC8469351191308C34CACFC44205197ABD25D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	C6554E9E44D733B02722D1799D624EC6	0A5DD08142F7A9470E288FE268B73F07AF812418	733B807C14C5CBCE07025F0E228DC6536B110A3040EC0B75123F3EFB882F9726
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	98097718A4ADFAFC82B2AA9CB4B7A6BE	9556711F9F161AE3DF2965CB46D636287FE630E3	8DAA7D224C6B3FB6871545E222911E76E048A28267122BF0B916C57767094C0E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	EB7DE02D85C52605F4BB273361D7E5D4	CEBAF5B25ABC800170320F4C315C215C13246552	68346CA959A813B137D61E83B7FBB3D4E07D709A8330345BEE0769300FD77B26
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	7EDE70C3BCC8A39EFA872262D6572AF0	463E56FF291C77DD680FE7FADA1244B008D845CA	481A4D149FC21196873F395EC093D6701EAEE7B23E4202E41E1CE89A8FF1120F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	8C7EAB89BABBBDDFF2FD4DDA087D2B8E	1C67FE7B8DB8805F94FAE7C4792C3194666593ED	2AAD695CB1B0BE95716633CF93F39656E3A2254E816DA54B24D09609DA78F537
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	F1A1F26AA0B8523BB347F78A2B149B48	265943879317213E1986B7CFEFEE8C763DCC1AA7	36B52670A21CF52D776AC70B9ADD49FE1FC963254B77BCB478F61A2E6CDCF427
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	C7B52FB389CF0875B34833F0B45D4A49	835E2FFD2A497DD83CF5A0D978DC412BE6710152	E9A3C52004A551B2B35DFCE121C82AE205701ADB685E8A80FF2B68295DA0F3FA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	63CD87B7D49C9F6CC525AD0E8B4FD7E7	950079734D06A3ED85C03B997528DC9A3A1A95FB	88AD720307D3F490E55A7B261B88A9C636C4890B2F01F641976A6F4FD2C60CDD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	E1052A63B6EBE3C8ABF69A8A1FA7302E	B0EA0C5B91CA5657627BD774187BC25B6BC54E30	CC3D9772C9B32F3E1E7B2F546D95F76DFD71B85D2241CE7F26C6CD13FF7413BF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	67F18B5364E8CBBF676FC14E56F02490	3022A6B3544FD28978218049587E63AFCF373355	2BFC8FFE35D0D1620A65286293A4290E328BC6FB2765723E3EB4789EB055175E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	C9F71FDE031833ABF6B046441615413A	79DFF450A44252BDED65B6425BD915135CFDDE4F	2FDBE7A1FE21EBB8C0607263611E165D08CE8700B592541C4C0D2E5DA5C423D5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	95ADD8B072E8E1380B281FCD9B3FD722	26607632C9BEDDF02584A7AEFE09B93E86D652D4	BEA00FDA27719CCDF26CCF5714E4F758E24A97C6F248CBF8AA972EDB0CA55819
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	1425D737A27E77AEC15D93A0BE692C92	0D1E4DF64514C56E7422DE0569ACACE6288C427B	E59F2ED52599462E714A090E8A7B8C4DF83287F6AF5B1A2788518863303DB4D8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	E6F6CD6F4740F4E8503F925F135520B9	9031A7593BE1138DC3FDA94CB61BAF207EA2531E	7D43F1D37E4293EF666A675C59EC25EB8F3BF0A51A5A0186C0AC244C201E3DDD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	ABA7590A44DED3D11845CD3509D53F55	F587733D3D21B47F52B02DC4880139869FF67606	18721A94ED332559FEA8546B7B98FDD5A2A805160818264449578D6955B0AFB1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	040CB1F2708FC2DDF16EC69D109501D5	922298C571E2B9477FCDBEB3778504D01BA98BFD	70E5FF95ECCAB81F245FCF0E8B924DCA62E4AFB9A039FE0B4F2F5B976F5FDACA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	43488125AD4F1A0D6F2BAF06CA28EA31	600F9B3D9CAF85949D1C2406C3B4691CF7F74541	C1F88F2094C7C9B5BF7A9CE89E5EC519D58FD65127D4C32A940059E71F562DBC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	5D8D5273523BA6B1BC4F7C463672F58D	1F8117D0865F128C7C9189D9CB351EA449E025DA	46B4981001B1939334F037323C325474D4177552D3436D1B4BCF15C1B14F68F1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	588CB2F537F9ED5A230B4B3129BF1CB9	E325EC675439E705BA4286BBC921430586EAE62A	A5B7FA53DB0D77ED076A6BAF040E50604D11616BDE61D251A0AA475874C074EB
C:\Users\user\AppData\Local\Temp\MSI71930.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	E469ADEEB5A40CD8F960205633CB3736	908B686B82416031B0A7D198CFF772977AE6626B	B5A6C2E0238E5397BAB1852F6B445106DABF7168FC0232C281EFE35A0F6B49CF
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-04 13-07-08-959.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	F79304E94E9B1064B2D655B28076D90C	9499EDCBC84D3CAF903771FA8E93D5B1D73CFC72	64C9C3FA458EC934C94B71608230010F0110A89690134867580F4411849D00F9
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	87D32B8BCE5EC8A2D2650ADF21EA043F	6EC14FFE568E90128386B525F91206F37D9F9D16	5FB6F75563D057E777CA0A4AC47263323598BEE95FFE900E5CC1B49700F23664
C:\Users\user\AppData\Local\Temp\acrocef_low\1520bab2-a727-4090-9cd1-92461f0e72e8.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\76f67664-5588-4728-979c-92b517fd4e51.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\935e4509-6e43-4bd3-a449-6a57347f7829.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\9ac16cf2-71e2-4546-a509-413dd75c8919.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4

Windows Analysis Report
September #35- J023196- Victoria College.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report September #35- J023196- Victoria College.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
September #35- J023196- Victoria College.pdf