Windows Analysis Report
summary.pdf

Overview

General Information

Sample name:	summary.pdf
Analysis ID:	1559001
MD5:	0dc333a63589f8bba75cbcfd165600c0
SHA1:	9c22ea10db23704b380cf5eab9d836ec748036c6
SHA256:	042c8fa068ff27e68ce36506135d97814daa06becdb42d5400c39a039362ffb6
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49742

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.195.76.153 23.195.76.153

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443

Source: classification engine

Classification label: clean2.winPDF@14/50@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-19 20-51-24-885.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\summary.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1664,i,16927450755282308475,6541615874730278391,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1664,i,16927450755282308475,6541615874730278391,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: summary.pdf	Initial sample: PDF keyword /JS count = 0
Source: summary.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A91hqesx6_uo0qhs_2oc.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A91hqesx6_uo0qhs_2oc.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: summary.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.195.76.153	unknown	United States		2914	NTT-COMMUNICATIONS-2914US	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.214.172	true
x1.i.lencr.org	unknown	unknown

ID:	1559001
Product:	CloudBasic
Start time:	02:50:26
Start date:	20.11.2024
Sample:	summary.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	0dc333a63589f8bba75cbcfd165600c0
SHA1:	9c22ea10db23704b380cf5eab9d836ec748036c6
SHA256:	042c8fa068ff27e68ce36506135d97814daa06becdb42d5400c39a039362ffb6
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	0FEBCB4FD1756C3E8E31B8EE1640205D	5D66EE02DD88CFEDB7BFBC1D0D3511DAFBF17553	2EFA9C45814E6DECD299797B9DE7D9DF28E51DCCB9CAB02EB0FF545B8EC2EF53
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	0FEBCB4FD1756C3E8E31B8EE1640205D	5D66EE02DD88CFEDB7BFBC1D0D3511DAFBF17553	2EFA9C45814E6DECD299797B9DE7D9DF28E51DCCB9CAB02EB0FF545B8EC2EF53
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	6A0F61CD1D0A86DCC751CE62150D50D3	6B596D851A69A7B08EC77598141E16F4C02E2F76	EE43CF91847543563661D87555BD2870F05F1AA29F9D4596B926ED75AEB8605E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	6A0F61CD1D0A86DCC751CE62150D50D3	6B596D851A69A7B08EC77598141E16F4C02E2F76	EE43CF91847543563661D87555BD2870F05F1AA29F9D4596B926ED75AEB8605E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\10ba09cd-07d2-477e-99c5-994597a14358.tmp	JSON data	320BD097E29864D130B54C04099BA3FC	3BB24B631DD005EFC978535B22659634AA862C50	76ACF68BC40D00E3D87247A61985557EAA46744464A27E3BCCB73902CF994B59
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	320BD097E29864D130B54C04099BA3FC	3BB24B631DD005EFC978535B22659634AA862C50	76ACF68BC40D00E3D87247A61985557EAA46744464A27E3BCCB73902CF994B59
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	E594490111F26D9891A77F29E5C3630E	5912F7BF7E9BFE2B238AE7D3B6C261891E36AB90	7614F88C46F479059D9C9701DB85814DDFAC4AAE8BF7D0B203CC14F763231A6D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	3CFD41D236D8A4EE8AD1BAD70784C2CA	177CB00943EB4225C74022C7947FEAC1F4F059ED	890AFA0306CEFE05E09B15ED8F6BF8BC76EC4CE3BF20A05B4BCC968540E70035
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	3CFD41D236D8A4EE8AD1BAD70784C2CA	177CB00943EB4225C74022C7947FEAC1F4F059ED	890AFA0306CEFE05E09B15ED8F6BF8BC76EC4CE3BF20A05B4BCC968540E70035
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241120015126Z-159.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	61B9B62E80F1FC4D9F25E947CE2595CA	BC1752B14BCF69D43ACCA1735A805E9717DB1534	25A15DD31A4F497DDB31840F6FF6C9FC438A8FD6CFB21EE476E6569C33954F04
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	AD9BD9369D21A10D80C63E027CD5BDA2	8BA4B0457935B5A9E7BE3196713D9BF13BB82C95	AE047FD7C733FEF45DBF4E6E49C22DE5E5F7D2CEA4E642DC2F519EEA9414642D
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	B5B9ECAD443E99456FEDBE205B04DC35	BE4BDE9BE4B16C4908A90C9662916645207CBB88	62DB99D0A5305E972D4CA1C6B40A7BC805CF0444D8517F0E7921764E72A49AF4
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	7E8F5BFBBE39D97C17E110ADBEE53516	CE52F9F2EED3F7A2DA842657ABF25296AC2BF319	24A337703B19BAF4A6AFF4C1C715A9D882188742A539E0EFB2857FF49EED12A8
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	AFF4484C64C0C77240885C5024320A28	FCF3B0998459448CBF2CECE00972D51A9F220806	5BAF61AB1D1A3DE3AD87BA8CF6EF23DBCBE614CD5007FD9D71017928EE36F375
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3468	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3468	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	10728DF3190C1E26B783664FA5F0A696	6E647074D95286ED75F1DF264E712480111F2D0C	59982B070ABAE625E871F48DFAC55C9A420238B8EA62720D01C0BDDBB49F1FAA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	3B71E42D88F43FF175941AB14CB2F5F6	91618E31B40E8F6F3BF0547F6CB8888E591A0D44	ED7F30B78CEC1AF30B4CD2892AD3B67AB9AD7056262A62311188B40161404ACB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	3CAC5A142800F0C9570F961041554D9D	62B170CBA3A22A0E41B96C8C993BC35C2C7C5CD5	F315E21E945265907774745713A8D3A8CAE236D5C4E7C4625D63E6AB295F80EF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	FF4C07F8CE2F15630670FC75CFEBF4A8	4EB2F7A0FABA88D33AF1E99BBB5225F6DD00602E	F82112DE5E201A1E149D24D8078BB4C114C9A85FF07EBF0869462A21AE0E53A7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	E06A38E2A6DD506279B87EC29859EB53	B5FEE3B05500FB9432A13DC282906270B5591B02	D2778AB3E14C91252991AB37600F4E2F880788045193DD7DD3BC8EA8B0CDBC69
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	0363E760741F7CA294E24FE3153B3261	93F5C087EFDC68406EF5528018FD138593E3F4A9	0F3566574256AC3A5D935E5BE834CBCFF16AC546AADDD9663C0C36CF4EB9B4AE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	447D1077BF5587D6CAA3835F79BE3CD7	511F59D0BC7B253A356EB9432E2C4B44DC14EF9B	662EEDDAB2FD5481346929386272FCA2E281FFBD5FCDF5D44C438D43B0551DFF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	3DC6C85B60E9A6EE27A6FF1F4EC32AB4	60D92C0B2E5DC79D0798840D81449165DE655420	5865EC67E5E6774D5EE5996729774A8FF15333CEDC6DCE9B5B3530D2D0D8BEA6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	420B690E6B35D03953521BC92B1830DE	078A20979D89F3BDD821DCF53CA5A80035348FB8	31C61DAD07BF575760755DBAD9E43428C70D201EFC65F0CBE432A4DCAE08542A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	F075E6D0E21A6D64AA09BCCEB6528B13	2144073B3A1F70A37DDD48CC340B4EDD829DED85	300FAC69FEF1ACA779089B973FD8B70EE838595CEC03D81F4824BDB1845C2F9F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	58BAA5F7618759485114E2BD26C75A58	6D3F6FF5A5859BA96BEF833125156FB7AE2BAB4A	D0661FFF471D5F514BA190DE9A997132704E5E5E73710EAC14A7EA20BBE3E0F1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	D5D349513DA9DA573B549D7DFF0FB5BC	77649B8FA642ACA1E105BC58F74E798CDD7EDAA9	690D8B36F9CDED7EB07684604A4AF61B89BEB90FFBC0728B06A6E357474B39A0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	CE65C445205A4A2E10D66615A3A4A7DD	DE65160C55F7845A5EB4AD83B312DDEBD0926B7B	DA6D32DBF7C6933C6824E41761EDCEEE3E6F88BC83D72823FAFA067EF9C386C8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	26E752EE1254150B6D59B770EB354072	F13BB4A8AD0566E9E8F49FD45F5F4B79A212C21F	8F23BDC3F729B8962108F5472F4A72B1AF48BB13198FA870D10774ED9F1EBEDB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	62B8271E8D2550E874BE39FB1B33C3BC	A02B920BE524972664C108B8407357F3FC7E9DC2	5BF1E553940C47025AE3E5B89FDC7A72659DC9B1AA966275C26E7D451D2E32D5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	B90C48409CAD084FBFB5E1C67F93D8AB	759E91117CCB2D20BD0287634F7B514446B7C5DF	F08BFF405EBC59C556632AC6719F888DE31EBFC0E06E9F1BBDB2BEA48E7B2461
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	DF90C6CDDBE9B59053A7CDA88D9DBF5D	EEB004886D6D989D5201BFC50208202E60E7C536	A803D544093C9F5CE6AE5BAF33D14B8F254468947DCF14227C94C4B939D689F1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	1C06CEE4CC2DF6F75161E12B27162D66	C4C38DD7435AED0AC4521C577A4D74E0252A829C	9FC18F78DCE48836CFEC852B97E88B12FE905439E40C3FD4E9557ACC008A50E9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	0DDFC7FC26503D46441C098CBE7D2C17	59482702B5C38DD5BB3ED25AA5B939EF8C95D096	CB0F3C1A7C2632B0865433631F21576D25AA15A5C5176383AE956F3C17C8EF8B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	23323EC4C9387F990DB28C3B3A1F3ED8	3AD4F351E53AA34B9C35E38F4C0C7593C7652689	86A710E963B8C3CBD18FD4B954FBD1688666E71CF7B7E8F4156486BB0CFE3AA1
C:\Users\user\AppData\Local\Temp\MSIdaf77.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	76BCEBC02FA0819386B33681248ACC0C	79680881B800F30AC6746A0A37E7ECC5F12C85F8	6F464465A8DB7A3AEEBDABE16B7C531C390C4D34993A41A2904BA72D84D45C6C
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91hqesx6_uo0qhs_2oc.tmp	PDF document, version 1.6, 0 pages	A0A334D6F37746B969724E83FF937FCE	8915B3358E1F9592BEBD8CA30C3116A1168CA81A	23C60A0A4BB0E023ABE5B49034E4B689444553B5ADF521517AD60A5E5F30E54C
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-19 20-51-24-885.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	56C02C7E43D39CED5C095AB1469F5714	EDEC7689431BBDC7B9FA1F1283DB30A4962ECB3A	0CC0D3CFA3105DD45817DFBDEAACBC5677BA27DC222E719AAA4B4D22E5A460DC
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	891EFCD291E8546510150756F4F12D2B	1832181A15A8CDE18C64FDD4E2ED1818BEAFA6D5	5155C4D000C8AAD8188A572D5BF2EFEB8C5DAA7193226C6F172C95CEDE5169A5
C:\Users\user\AppData\Local\Temp\acrocef_low\25eb2f33-58d7-43a3-ab25-c2aeb540b882.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\32b31bad-3f25-474e-b783-a24a53842a88.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\cbd0d584-b8b6-49b0-96a6-240f9d43f888.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	9E2FECE244C30BF0735D1302B038E18C	040FE05481FB6A507C945E7A360FF78490C8FCD9	64C4B80231815A5D741A1393103EB0A0746AF649AB9B1B04F70115BD7BE30A16
C:\Users\user\AppData\Local\Temp\acrocef_low\dc16a6fa-bac4-4fe9-89ae-46175105cc42.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 25552	1D199E3C883536AE05216AF4E04E3797	D7B9A7569A068F6B08492E12EB0DCE69557BD68C	594D3A0F6A30F1B99694D3D031C56A83809387D909C93AC441EDB0C7E9698E21

Windows Analysis Report
summary.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report summary.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
summary.pdf