Windows Analysis Report
Resume - Ms. Nilar Htet.pdf

Overview

General Information

Sample name:	Resume - Ms. Nilar Htet.pdf
Analysis ID:	1559180
MD5:	d64856d9a6627005f1ad675e9e3141f1
SHA1:	ca0ee1e6b68a47370b220595e3cd1a505a4aa709
SHA256:	76dc5cb613a95b031765b5454c76819f528357ffb85f933088671e0ef73e6bf2
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.47.168.24:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.16:49713
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.16:49713
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.16:49713
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.16:49713
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.16:49713
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.16:49713
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.16:49713
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.16:49713
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.16:49713
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.16:49713
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.16:49713

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.47.168.24 23.47.168.24

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br

Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.3.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.3.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: a18afa0a-ac60-41a1-9454-1d365aa47b8c.tmp.4.dr, cde83237-edc8-4081-b86c-f46036a2e43d.tmp.4.dr	String found in binary or memory: https://chrome.cloudflare-dns.com

Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: classification engine

Classification label: clean2.winPDF@15/51@2/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-20 03-26-31-498.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Resume - Ms. Nilar Htet.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1568 --field-trial-handle=1604,i,7349804857027900102,10984797605832616491,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1568 --field-trial-handle=1604,i,7349804857027900102,10984797605832616491,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Resume - Ms. Nilar Htet.pdf	Initial sample: PDF keyword /JS count = 0
Source: Resume - Ms. Nilar Htet.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Resume - Ms. Nilar Htet.pdf

Initial sample: PDF keyword stream count = 55

Source: Resume - Ms. Nilar Htet.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Resume - Ms. Nilar Htet.pdf

Initial sample: PDF keyword obj count = 109

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.47.168.24	unknown	United States		16625	AKAMAI-ASUS	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.214.172	true
x1.i.lencr.org	unknown	unknown

ID:	1559180
Product:	CloudBasic
Start time:	09:25:58
Start date:	20.11.2024
Sample:	Resume - Ms. Nilar Htet.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	d64856d9a6627005f1ad675e9e3141f1
SHA1:	ca0ee1e6b68a47370b220595e3cd1a505a4aa709
SHA256:	76dc5cb613a95b031765b5454c76819f528357ffb85f933088671e0ef73e6bf2
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	61F5C3E0BA7090DCDA4DBD71114211E8	2E8745E7E0931DD9F2E7BBB2C61AAAA230769DBE	2537EA02841194954FCE9377CB85EEE5101F03FB54D119019382C506182C4BBD
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	61F5C3E0BA7090DCDA4DBD71114211E8	2E8745E7E0931DD9F2E7BBB2C61AAAA230769DBE	2537EA02841194954FCE9377CB85EEE5101F03FB54D119019382C506182C4BBD
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	5A8B616F5831227316E7FFC7B9B7CDE9	1ED0485D5C216E91923C9B95CD81CA93859651E1	88D2E38F6A4276CD113EEAA321CDCB0FE152FFDC3D9632D98E58DA1714809EF1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	5A8B616F5831227316E7FFC7B9B7CDE9	1ED0485D5C216E91923C9B95CD81CA93859651E1	88D2E38F6A4276CD113EEAA321CDCB0FE152FFDC3D9632D98E58DA1714809EF1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF419fbe.TMP (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a18afa0a-ac60-41a1-9454-1d365aa47b8c.tmp	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cde83237-edc8-4081-b86c-f46036a2e43d.tmp	JSON data	1041D8469D8D09CED8E94A497051C783	29C0CBD1EAC0DE20C62BABCA36A3A98825939DDC	0A293021BE97C825DAF830ADB6D6EF0869C1DA3AB8FA766759ECC7D0C3BF346E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	8C4DD64E080B1D189076E9F937FC143B	636794C8EA23810B9EEE7E44D4A1ED04491F0CAC	8D7C15B8B9C514B71EE2BC32DC35234FCA7C833CF481F69384C2F6E5B6ED2D17
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	262077E12161C7F029373CD1664D586F	128E08DAB4EAD3EEB1AFFDA454C3C843EFE9FAED	DFD242659B44CBA25B48ABF1E390FBC89840DAE72B3EA2B83C8F0A179F0DDC2F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	262077E12161C7F029373CD1664D586F	128E08DAB4EAD3EEB1AFFDA454C3C843EFE9FAED	DFD242659B44CBA25B48ABF1E390FBC89840DAE72B3EA2B83C8F0A179F0DDC2F
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241120082633Z-166.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	C1D585984466A1ED54455099E840DA8F	9672AA24805F6186FBEE1440887EA014991C0934	2DB1E4A5FACBE9E0B9AD4CA203DBA69A33B55C0CFB7ED34CE9DDBA38539E4F96
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 3, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 3	60D9215972BC7671E62BED38B50FAB17	D1A8B76E66476F7FBE4770851DD1CC05BB2ACAA7	541AFC165376795681B300B1A0F4BCC9F6D52068601BFAD0D39874D74B2D98CE
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	2B5238D49C5C18EAFD8FF9F97220CFF6	0EE179DAE1D521F9738C2B17E10F82B17F995881	1EBA3B54E6149BDB8C21F5D1882667EE4AC0D48FC91A15A3B7B42AA6F9D99C1F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	C2E55AC2E302CBABE750D72ED0A46F52	AA51C5411BF3236752B1427C8449DDD0632076E2	27E85845431F6351860D1F262F695DF4745738CC1F0137CD4F0F307595401AC7
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	5CBAE0C72CF927FF9E65EB86F3E453E4	3F7F0FB522336A9A26C6C30FBB332DFFFD93BA77	BCAA911C7BFBB773B58144EF45DC64C36736ABD87763814631DFC4FD5B969F34
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	9C33EC59752716629740A129206839E6	F61B1502D9C5D3C4820C81848383A8EB2F3B50DD	91DE56A5CC0A219B97F22DB566D04771452BE69ADA7E6F344F4C0CF00D00BD89
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	C3020EDC0640529B167D1C8E3D25D4F0	1FC5E03824F256962D3CF92223A0AA2FB9E110EA	223721EA66D3245F10026AC00BED6EBFD7AFB1DC12D8776880BE38BE63A8F1A3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	DA7FB6247FD4159F242AB1A224954B11	B6E8565C6A22B0757249D0882E7A2695F07CB58C	12E38FA4E5E771FE4F373B1E73422B52E258E2DBAA1F143EEB3A3D452DAF10C6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	E8D365A9C9173C66381DB9ADEEC8A162	E827F5D68618201AAAC216AF0EA9D64F1CB98CF3	4F0CEDB868E7885BFF40071C44D978A1F5ED359D449E899699154E8A3AD2CF32
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	8CEB67D254286DCDB74D0AA372F454AE	1015EB4DD88FC0DF0D002F4283E65DA80F8DBF6D	5607C99F863F51A6AE191A1C14FC35F1F7A75F1EDC2D710CE6EDA66A013254B5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	7659D627E0E2E87B45D03D4E620A9300	3AED1389E61608E6A47605068385944383069923	3651194120A6895EE1ACEEAAFAB2C4C75E31C007F2A9C51C0501691A20343EC4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	611B1AF8EC4E12C52B497208EBF863A1	A36B89BF1CD8021C9CAC6F78FA02C5B64948A95A	879A28C5240EDB7B82E8A4498A9417A46A27BCBDAE2BE93F7EBE892847FA3309
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	F867508452C7ED4975BA63BDCD7F9070	5FF282367808285B494FD43C6CF3DAA83AB3F50B	9A577C45EF60340A2E90EE70928E82A0E4EAA0CDDA51A7087515140659A93817
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	88D75C7613B2A03252D3B144B3511C3A	AD8E17AB4C4C9B064CE3B91B19B94CFA12530287	3B45A9DCF7DE93033071429C0247B36054DE91633C7A6810D65056F08C43FE22
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	FF44EBA1A9F0C1C5E78622F122F3882D	7DDEEE0447590E0CF157E3C6A2825EDDB8848D0A	DB0DF971E52FD3FCCBE343329C0E3132C9256337873C138CD95577B807C67BD6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	F1B48F068F40FF82890F3D71B3478C4C	DB19661975AEF8A2DFBF40A48CCDDFBA40712283	7EF1380D314AEC3FC579065DF80F7C1249E9FAF8836FAB719C4A6A4F8443C493
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	AD7A2DA1D6A4605F676EA50E66FE67AE	BA4A55913C420661524E30B53AEB11BDBB0BA09B	FB46F4686FA2F664A151F30593E2EA4D7272A3120272BF9203A74E50336E13A8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	0F65CA0FCFD750B00262AC43D581A1D1	4DE1F80FEF19E30759CE179A5DBDF746BE128402	AAA90295645229BBB5EBD0135F80693AD403E89AC84C120A0B9F90A7308F534D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	4B416F046E0B305C764AB3D6F47F379D	550C91FFAAEB8E88A6E7E5E86BCCA5563AD46C65	CE2E3560D5D05F73F45ABDF9ADE4664D1DEF777B259A45E4875BE348434D9C46
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	C9E1C83919618C29A361837E91616963	5D492E584ADC102454A7A9C46DD46D128A460E0E	A7532F29D54748F69E81E05B19C43CEA0CF3D345ACA32E9D0CC98615C2DAB389
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	7174E46C9D27E84A57F77A6213993EB8	4A69F38D10654ED075CF1580CE6A288378521A39	8C3E1C3EF6B2CB863C451AEA8EF7B1A20D6BF8CE1659EF398DCA9F90A06DC181
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	3A4FAE69618531A69A81C4AE03063305	D3F8B0C50BEB9275B0C1803B08A10030DC06656B	A8108564CAD0A951D2485267F1D0EBA8F56A101343763CFD80A7B3E524D7BD5E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	DB88137BF4AA4508545E4DE7CB8352CA	0D1AA01A1C6F2D81AABB2EE634EBA798A1E4032B	B343954FF135E186C2ADADCD0AD94474126F08C0402285F200F61D7AA6E079CD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	5CB903205C6485B6458A5DA6B9273CA6	A8755B387BD2D11F1E600BC09D37FE546C384330	41FFA3C78B1AC067628AF08488BA7E6A43D54CDAB5F557D88A813F12C1C6973D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	E9D5DF51ECF6AD02CF69D8EAD4D3AAFF	286C61FDE1BBA89ECE2A88371BE3F4E69520EDF4	D62C5FD36306EB49B27A1B8EBD0538DCD76E7CC66F2D71B056987A23DFB4EFAE
C:\Users\user\AppData\Local\Temp\MSI92e2.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	0F04594B91958050ACD343A0450618CC	9C382C9BF84DEF956E24CAA1C5F9DAB74295E2B4	5ABC1BF0B860642946D8C11D594A08DAF6671549FA8ACE4BFB24E7508FF138B4
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A918tlxlq_1mcjvdm_4wg.tmp	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)	BA1716D4FB435DA6C47CE77E3667E6A8	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-20 03-26-31-498.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	6057C4241B107AFDDF3CF35C37E4461E	1086046F2FC8296A5DE7671ED9F766B96E2616B4	1DC6AE111E55054CAC625198A933B4A726C60F3DEAB6A16FC491658FD623F11A
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	5C2E94CB7E9A0DBE8A6C4658840B4601	970C32F277EB6CADF100B544CCCC70E7D0C0E216	CA9F9192AB6A827D1DE5EE047C4BD9633EE63453065C6A3A8995702725109F04
C:\Users\user\AppData\Local\Temp\acrocef_low\48337638-229e-4e46-ab1d-f02e200399aa.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\795bea45-3a08-4982-b40a-f8980a55b98b.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837	6455D4D4FB0840FC05FEC57993FD113B	E4115E9861BCCD2595E12947BCE232E89F589775	7E396DED5CA9391334E4A4C39700F25D6DACEBBD80E63E1D4A19275165523916
C:\Users\user\AppData\Local\Temp\acrocef_low\ba581a31-ddb3-469f-ad37-a6142b33d364.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	59EE5E2FB56A099CAA8EDFD7AF821ED6	F5DC4F876768D57B69EC894ADE0A66E813BFED92	E100AAAA4FB2B3D78E3B6475C3B48BE189C5A39F73CFC2D22423F2CE928D3E75
C:\Users\user\AppData\Local\Temp\acrocef_low\fb348676-7424-490f-9136-6111d72e73a5.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	8B9FA2EC5118087D19CFDB20DA7C4C26	E32D6A1829B18717EF1455B73E88D36E0410EF93	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl	data	7113425405A05E110DC458BBF93F608A	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl	data	5274D23C3AB7C3D5A4F3F86D4249A545	8A3778F5083169B281B610F2036E79AEA3020192	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata	ISO-8859 text, with very long lines (3486), with CRLF, CR line terminators	32FCA302C8B872738373D7CCB1E75FD4	DA85FAF24ED0ECFD5D69CCFD6286D8B77D7EB4F1	CD0DD26304B88C20801FE80B33C49C009E2E5D4411B5D7F83252E1D90CD461C6

Windows Analysis Report
Resume - Ms. Nilar Htet.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report Resume - Ms. Nilar Htet.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
Resume - Ms. Nilar Htet.pdf