Windows Analysis Report
CP01 - DESORMEAUX - LOT 07 - SAINT HILAIRE.pdf

Overview

General Information

Sample name:	CP01 - DESORMEAUX - LOT 07 - SAINT HILAIRE.pdf
Analysis ID:	1545596
MD5:	9ebea89f3d1a93fd3ee90b3f4c860d36
SHA1:	2523ad7b01c2b16d9fbb6e2f1e14043ee83d1272
SHA256:	52833138f08afa8ba5512127806d2b7b89d0d13ebd80e67c656b9f016dfaaf67
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs DNS queries)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: 06130fff-273c-4118-a880-ec7cb786c49b.tmp.3.dr, 669d5ca7-f5a3-4949-a591-d1a315b8512c.tmp.3.dr	String found in binary or memory: https://chrome.cloudflare-dns.com

Source: classification engine

Classification label: clean0.winPDF@16/48@1/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6960

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-30 12-53-01-341.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\CP01 - DESORMEAUX - LOT 07 - SAINT HILAIRE.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2220 --field-trial-handle=1576,i,2527262263396610559,4175806813873224483,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2220 --field-trial-handle=1576,i,2527262263396610559,4175806813873224483,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: CP01 - DESORMEAUX - LOT 07 - SAINT HILAIRE.pdf	Initial sample: PDF keyword /JS count = 0
Source: CP01 - DESORMEAUX - LOT 07 - SAINT HILAIRE.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: CP01 - DESORMEAUX - LOT 07 - SAINT HILAIRE.pdf

Initial sample: PDF keyword /Page count = 10

Source: CP01 - DESORMEAUX - LOT 07 - SAINT HILAIRE.pdf

Initial sample: PDF keyword stream count = 57

Source: CP01 - DESORMEAUX - LOT 07 - SAINT HILAIRE.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: CP01 - DESORMEAUX - LOT 07 - SAINT HILAIRE.pdf

Initial sample: PDF keyword obj count = 71

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1545596
Product:	CloudBasic
Start time:	17:52:23
Start date:	30.10.2024
Sample:	CP01 - DESORMEAUX - LOT 07 - SAINT HILAIRE.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	9ebea89f3d1a93fd3ee90b3f4c860d36
SHA1:	2523ad7b01c2b16d9fbb6e2f1e14043ee83d1272
SHA256:	52833138f08afa8ba5512127806d2b7b89d0d13ebd80e67c656b9f016dfaaf67
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	12ABE29C8017C5839E26F248A2C459EB	807A2F9382E5ABA76BBE1BEABFB71CEDBA0AA10A	967E8961C6705B8F1B4947F9D4215EB16497B2F680659290B3B6ADA3BE9BC9B4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	12ABE29C8017C5839E26F248A2C459EB	807A2F9382E5ABA76BBE1BEABFB71CEDBA0AA10A	967E8961C6705B8F1B4947F9D4215EB16497B2F680659290B3B6ADA3BE9BC9B4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	2AF3088BFE98401E09D02DBF60EAB19D	31E1609028ABA7B7512A781F6635634DACDE50C7	84588FD434E115B70832DDEF68D1BB47CA4C495CE7A26A5C51E5A60EDCB5E228
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	2AF3088BFE98401E09D02DBF60EAB19D	31E1609028ABA7B7512A781F6635634DACDE50C7	84588FD434E115B70832DDEF68D1BB47CA4C495CE7A26A5C51E5A60EDCB5E228
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\06130fff-273c-4118-a880-ec7cb786c49b.tmp	JSON data	CB1D589CD719E0CEE650D5C557DB7017	044F0DE3FD8CEBCCC204811C141B9ECE6A40C1F3	D83911F1E2F936F88E46382FE4F2107C7D028FBA565350E92FE743C43D4DD6D7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\669d5ca7-f5a3-4949-a591-d1a315b8512c.tmp	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5f0dbd.TMP (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	54677B97799661E6E7615BE712A2FBB4	91696138240AA2603BF5629469F08F1FBDF84519	0FF49D1E174897794F4ED14271ED27EA2CC6F3031D4F6A49D32025FA3290591A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	7E89E187C537D1471FBC68A7F53A63CB	2C61B4DCD22AA2F600C7A4ADC4626A8943638FE8	33C562A48AE8CBF51E538FE6D3D9832010811D44827D7E694F82EE6A6F131E48
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	7E89E187C537D1471FBC68A7F53A63CB	2C61B4DCD22AA2F600C7A4ADC4626A8943638FE8	33C562A48AE8CBF51E538FE6D3D9832010811D44827D7E694F82EE6A6F131E48
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241030165303Z-157.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	D16EC6EC86564355EBFE03EE0D83A32F	08B07EF5B8090B6262D7125206BB6C06729304F6	3D3D97A7919C81DE94D875304043A6B340A43F63B1B05AC3A29699B8C94621A3
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2	A4D5FECEFE05F21D6F81ACF4D9A788CF	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	D9041BD2D8D0684A9DC3A71D49B2572C	32E5A79B8199BFABBD15B81680B69BA3D3F28688	04E527416AD97405283470471AAE5E2343FE481CE2F699E38B0D84D4556668BB
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	20E448DF7871CF745F85A099A738E1EF	84582828EF6291FA1E462B54765EF750021164FB	8DD4315B358099EE8C71BA9FC54AAB376597FCD364292B2F8D20C5543F945655
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	45F290681D92C5419EF1A7ED7892B3E8	F08C7211D874AC03516F40C9C9107D13CC59C2BA	FDB15B5AF88BB3A6109FC01F02B922A109C72D9C0A1F126F105732091D3CEDD0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6960	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	C4ACEFFCFEA733A9E587234C9A40D90D	652A39036B51170EB1D410A46DF48E0A234FB5F2	F1F8B074539F1FEF744296F386032782FFE09FB706B7FB4F48125FE0851C5447
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	6BA77011C799CE126586C90741D7D31C	0F00193C1CDC97FD6CBD634D1580F969AA9BC479	FA73D9D3D050433C28446DD3EBFAA8FA0195780F160CCF7B05F5865F2F22CFFD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	94CEB9E2F3BB26D28FBEA4DEFCD7A4C7	A83F1B1B369E1574D6665D2A960B244861FE1E7A	88C3A8DA796B3C2C4C33A30A17343B9554500F47998A8D8D8D4454A1432B1CB5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	8703C35EBAD8263665D1C96A8FE6271F	F7B27A86DC9F930C57FF2A6FADD3E9ABA22A9160	3CD628B0B9C1C5344E01B04ACA186B954D3BA037FBC6D364932EF6364A93B58B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	D5E8DE44D189E3DD4157D5CAD296A4B1	A6CCCD3925971217DB73C2B4172C2EAEE813A1B2	94E706A76E83D225FF915C3619EF504082DBEAA6B9B7BD6CC3ADE0F76F9C7F49
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	D6AA25F7BE95C457CCEF8F9373D9BA62	A1089087DF4CEDDA8F0884179F0A7AEF656C7E61	386A4C3E8BB82CAE2E80B478BA2EFD7411FA2AD07A7BCF8CD5B7978187BC6B8B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	9FFC2017155CBF6BE236BED4AD030723	E3DCE17D52C8CC8396E6AD8B403235DA2593136F	81CEF5E5D94E1730597FF295A5C2C325E841B4B598598B84F312AF867E4EA14D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	E3014F58E1420D1E5ABAF93967850F14	617269E5BB52A27CA6DA400631EBE8EC9110EFA6	66375265F4B4E76BCDC223DA87BAB3D89553F8C6D994612F7333FD25F0D3D581
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	602400C158C50113D6C3DA6FD888127C	5F50834B0A629A97DD69EE52C76BD62E9B2BCF6F	F1373A96EB327452F0CF98A4D40F9349A16804CF1AC3B81DC69D2768F903FE07
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	1309039C26B05BBC2DBB4BE7CC477684	1D853EA9E8AFB714F9F9215A78AA12B79B64DBAF	222F97BE27052E635FEBC3FCDC70BDF653FA6B284437C6DB50C96BA092BE7E85
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	12A5CF0A0FFA1483C636F1A9FA805880	08D89007C0B9FD4DA6AFF8F88655FD860935FB82	EDE2FD163177F8D78FDE84C93939CD1C5FC367D8655F749151B563C49DCC5477
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	8D8E360AC75A88D663311021664EA054	DDC744F1A5BB3CE31ECC53DEE54B539C2EC3038C	33A14154835C1A42BE69B35FA8CAAB381D251E05741D1C2F77B0343BCB10A661
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	3BA77585E23DED92FC4A68C8470AE12F	5A911A3B8B597A813B1B1BBC2E8142034C5B2F17	6670890F4CE71190783EF4FF1108F2974D5619A7195610530F9CB15C85B13F45
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	B3822C10BA564233617BF38B1D506099	0CAB653476842776BF69DC6926893A9FB4A440D5	1F781F3E9BC196CA9294512B0999194F79C1D6C0410D472BC345577BF6EDA565
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	D58A89E24FC52CE08F6CC172376359B7	8DDEEA965483FC1DF396C52E97E061E4919B4B05	CBA3D469DB21B4EBB7D0B9EE00F1D510D2B683B7824ABCA1B0E87D9E188AB57A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	3A2A26FE54658FE7522C4E4A6F672B01	D1E49A5ACE3C04490CAD10C3805CC98575A8C431	608A829CCAE14EA4B58CED408CD3F0E7E6521A26BB915550CBF702B35E8C87C8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	80E616DBC6DABF293C5B86CAF1B25F09	1C28ADBA76155E3FC88579F4C02C43A4A5309D41	C3816CEEBF55773CF310F8DA909971F963E4087949149062DBE2518979DD81E9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	881A9BD08513B6D3CF43C1204386F7F8	A61AF07CCC67AD2B020EEDA5F054AAFA6A4D06B9	D6523D8C01B3E827FCEB05DCFE3CC71B9E9E4CD27A8C46A4525489FB564B4059
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	6CD83625DB4BE6CA2442D420202C6E07	B701DA25B5FAF1F4CEB3438C8ED2C5B7EA8425A7	E87C1691BD930995273966C95AE4DCA293644746259943F49CA95B6A702E3FFA
C:\Users\user\AppData\Local\Temp\MSIdff0c.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	A3A2F207D417A5B2B40E4827A9D5ADD8	D4524FB7245794607C77390A98E9A4BFD78E2CD2	059BC7C5F2075D268B57B016AE262CE705BDA70583A0555CACB83B1A5076AAC2
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-30 12-53-01-341.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	139DD15B5708B95FC78AFC487826E240	6B543DE6D67E64B8860733F799EF23732DFDD3B4	94EB32B75C4A6AE38414CDA60439DB28B8D81A55805BB95B379B39CAF49A41BE
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	663A88733A8FFDC1F763A1FD0E717615	061E429A9B73362E1D76A8E816C033230505C35C	2BFF1F993CFCCD20A01A86E6A5692DEE98E087A7E225A6B89CDC283482A5C29C
C:\Users\user\AppData\Local\Temp\acrocef_low\aea9de07-e6c2-4b4d-8e4a-4146ea5aab2e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	1A39CAAE4C5F8AD2A98F0756FFCBA562	279F2B503A0B10E257674D31532B01EA7DE0473F	57D198C7BDB9B002B8C9C1E1CCFABFE81C00FE0A1E30A237196A7C133237AA95
C:\Users\user\AppData\Local\Temp\acrocef_low\db60578c-bfcc-4f57-9736-28437db22ced.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	1D64D25345DD73F100517644279994E6	DE807F82098D469302955DCBE1A963CD6E887737	0A05C4CE0C4D8527D79A3C9CEE2A8B73475F53E18544622E4656C598BC814DFC
C:\Users\user\AppData\Local\Temp\acrocef_low\edde5c7b-4672-49e5-8e10-5a7889de4106.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\f2dc2bff-649b-4c55-950f-ca6beaefa4b0.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE

Windows Analysis Report
CP01 - DESORMEAUX - LOT 07 - SAINT HILAIRE.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report CP01 - DESORMEAUX - LOT 07 - SAINT HILAIRE.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
CP01 - DESORMEAUX - LOT 07 - SAINT HILAIRE.pdf