Windows Analysis Report
BRNB4220046D2EC_004113.pdf

Overview

General Information

Sample name:	BRNB4220046D2EC_004113.pdf
Analysis ID:	1560181
MD5:	a3b90129336364fe04a62672bec5bac2
SHA1:	de0d07aff56bc86c34e47c87f6aca19123828437
SHA256:	6580703f8adcba9ad7214b8d5be3ec7091351a8f1c0dea71024183adf2f5d486
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs DNS queries)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: clean0.winPDF@14/52@1/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-21 08-19-59-033.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\BRNB4220046D2EC_004113.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1564,i,18300350310385928855,1257340988202054605,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1564,i,18300350310385928855,1257340988202054605,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: BRNB4220046D2EC_004113.pdf	Initial sample: PDF keyword /JS count = 0
Source: BRNB4220046D2EC_004113.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: BRNB4220046D2EC_004113.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.214.172	true
x1.i.lencr.org	unknown	unknown

ID:	1560181
Product:	CloudBasic
Start time:	14:19:00
Start date:	21.11.2024
Sample:	BRNB4220046D2EC_004113.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	a3b90129336364fe04a62672bec5bac2
SHA1:	de0d07aff56bc86c34e47c87f6aca19123828437
SHA256:	6580703f8adcba9ad7214b8d5be3ec7091351a8f1c0dea71024183adf2f5d486
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	B36CFF45E4607F9641CD4B4218668DCC	F1FBEFA10A072199CC28D6307C5571D31AD61F2A	3E0E3E658F36510A47251DEF3A65328E80F332815D36510426B74D1E7344FD1F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	B36CFF45E4607F9641CD4B4218668DCC	F1FBEFA10A072199CC28D6307C5571D31AD61F2A	3E0E3E658F36510A47251DEF3A65328E80F332815D36510426B74D1E7344FD1F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	2A4ABA06B841D07A0A6D4B604FB9D682	44C41882670C6FC21D3FB66D8F63DE860BEF085D	455FA1C300161DFB6954B167432F765749D309CB1A05F54C5E6084D4771D1AD2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	2A4ABA06B841D07A0A6D4B604FB9D682	44C41882670C6FC21D3FB66D8F63DE860BEF085D	455FA1C300161DFB6954B167432F765749D309CB1A05F54C5E6084D4771D1AD2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3c910f6d-04cd-4ce2-84b1-750cc6801fa5.tmp	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF423130.TMP (copy)	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\eb1acd8d-42b1-4ef0-b505-8d5377240aa4.tmp	JSON data	5B0D1D422CF465FD69C41E007D523A78	EC498C995628D352D32DD510883DDC584EB142B4	991BC1FDEC24B3F548E3311FA0003E7793568AA55C0BAE3E5DF1AB85EBD2EFF1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	01F64B08563FAFDB2012E6BFCE3E2EC0	59CCC4FA0650D92C17300E924BC60F9C6DD39ECF	1ED6770B41D7A76141C245F10B4308C95AD7ABC6649CE2D4F9BB356549161E4E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	C0FD855F5AED1A1D0A0E07CB85575E59	E7984F73C2CBCF839C42036B21677725DB07041C	5187879B2057AAB126056862367F36001D8B52B9BB8D35A8A11BC48E42CC58B8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	C0FD855F5AED1A1D0A0E07CB85575E59	E7984F73C2CBCF839C42036B21677725DB07041C	5187879B2057AAB126056862367F36001D8B52B9BB8D35A8A11BC48E42CC58B8
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241121132000Z-151.bmp	PC bitmap, Windows 3.x format, 106 x -152 x 32, cbSize 64502, bits offset 54	1BA56C13DF444ECF590B6F31E53D4266	79E48DFE2BC86B90349727CDE0945DC7B2893FC6	CC9959CE06C1AC449734D60223457977D69E43F77B1FCBA17B17C322369654F7
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	93DA9EA704CF34F9BC9D7794C93AA893	797FB2261C91E84B40A8C09BBDBC5FC10CADECBF	42D0142117C35C79A5DA77C20D160DC8805D810518CA2CB7347FC34C202BBD3E
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	12CF60B5A61AFAE7C09D1C30A7D5CBB8	174BF4FAA38BB2F7F57703ACEABF6CDA1F5BB548	57E5DBB49DC8AF35962F5E8642BBB43AB03E888D051DD76E5A21AF1EDE0C3F0E
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	715EAC09B7F180428552CFB6D65952E7	A6218E7B3D7C36119F180895DD1ED124949B8B88	4AE010AF54229D75AE4F5A61787F44E2DE856F6298282A461D7A72117D376F09
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	065B91F2AAF0A199E1DAAB96F6351A57	08863FC469D23136B2F4BF69D042E6A62A2B5ECD	16FF6883C5F82C914E914F69FC9357B0815BDEE278330B2633BA4DA2ED6EE2FC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7352	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7352	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	36C1A5C3D4CAA7FA38F5F0C714764D2E	F3AD77FA6E03E24D48C3A884FFD2E343C58C65B6	C1BCD6F606A0742AE981A7D47ABB2267EE181800E60EB16CD2FA38EA770998F5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	CA8EC443DE98C15071ADBCBA977CD0CA	AF346690E9AF341E594AE6CDFBE205CB538FBAD8	76E501651D96713FD29C575D4CFA38049EDCF3B77AA719607FA3C98F8709A1EB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	0CF89C1C11EDC1F04E18F19127D2CD27	7539C514DAD2B905B6C742D49EFBDDE884E7AA40	30DC96D82D0EA16AACCEAFFFA058CDF16F0FDAB3C6928538991390638D20FA1D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	A61CD03FB08B07A796771506B857B648	28EDA9CC8F4B2693F2597C3F1BF2B0D35CE5813B	C1DC1B703A6F249EB47BCE76C80033E0531773A2B3BA3F1AE2EC86ED78EA62DB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	912F3BBA8942BA86B00A458F6FBB5BA5	20AB3AEE3981F2E3A4C081106AD188C7F29E0A78	8BEB855521DFE813EFC8DCA47E56992995B4FB039EB03277BA5C7E9CD56B4BB5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	5BCE874BB9D6447E9732F9F0EE2CC98F	59CDA6F65E1449CE199F6A45F080852CE91D85BF	B7662EDDCC39C3CC9DFE304677D733505BD10A42256BC552ACD22CAB8B1E88D8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	E38D0321AFDC0C699B6090FCA298914C	B4135C2DDA3F3FEAC9318618465655EEEDFE61D1	17EEE783FF32E8C7F64DCCA2E9879BE4E3FFD36B166B205F0ADE179FB5900CD9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	04F3B961C96668FEA7075CDB4C7E6589	4D5251AD0D6F119DA4BF6ECBF09E1ADE6E37FE6C	BC7CC96BF882DB8DED76404C8DD9BD07104EEAFA7EF9EB14CEDB89459FAC07D3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	7E5132082507CA5B71CBDC45A2F773B7	AF3698B2EC8D9057491B626DEE11372DB4E36CD4	076FD5797DD5813F5489516CD16F52AE06832B7123F0C0094EFC62067542F621
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	2C69C0C62A871AC8CA448634C2E713E3	3CE41B923241B15897545D83B795647C9C201516	A8F04D1D366D62B61B2AADFD14508423D9314763929C09B6E43322578EC0D61B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	F8625534024651CF82EEF2779FA15121	A7EFAEE2E3F7776866030D199A259E0D46D4D3D6	42EACEBBEF6937E08CAA4C5CF88A579AB7120CE26C79A0EC0FDCB4991A603B50
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	3A8E773CDE5A32D5DEEBAD70FA26B149	A97381C8F866CB08FA2A95DBBDB93E5C10CC4829	8CB2C97DA38AE40FDDECCBE86C35C585B827C8F93313337EDC4B36FD5760AF93
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	163799B569D2AA7D5DE52DA74CBC91E5	4A89A95458CED7A2107E54EBDB2BC1CF2CE0C41E	0D1431D916C4249B9B5DD399FE4AABCAF69D1610D7BFF64C8B883CAEE0849698
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	EC5458E9A866864BDD3A9568BE7F3D3F	E9E01241D59910AB77D97D82952DBA06F463A4BD	D53715743FF38C66C9E5C62623CE73BB90BA29820E5FBF3F1D76A1699F2CF2F6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	041CF67101E99396D9CDD9DC04A6BF2E	0458CB49737B95F6D68F8A209E98D254B6BD9C13	8F5F9F5001156490A453E75694AD3EED4342B0B00A1FA0098FD22A121BFC3FE4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	704EED59E0B343E392AD8D563537571B	85529A2A2A226BE9FFC141BF2E7AF4C9099E8BC8	37AA3AB17A318180352071935FC982899CC0D403E40372D80E31E86A688ACA33
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	3604F6083531DD39D79FD6310E11D7BC	879E48B56275306FCCA582D7883825222C3F2F4A	950A03418382B63DF98F13573B5A791C2D434E670809EBCE5D151570CB844D58
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	EA513956192DECE08A2DDCAF9BEF9689	9DFBE2388B15B8B800B8267B8A98128A527F2C48	A4E94021F0479368F63A799EA7C153E1A1AF672ED29DE8FB8A3B39C6B5B8EDCA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	C1DF16D302363483A9FDF28ED12A0E37	5A74CFB17C510E8086998EAEE31E85A2D10A02F3	FE95768D3689CA5B43DA1F26748B99ADC5C70757727CF91E581E7C1E6C12E098
C:\Users\user\AppData\Local\Temp\MSI1f3d9.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	3D405EB0E53037D6E09A5B86823805E1	C94697F53196D96923C9548113E753154B7FC422	AFBA6FAD672928D2C15D217A5EE85DE61B2FE097D257DF22E4F79D237985C560
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-21 08-19-59-033.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	FD92ED35B7CDA21EFAAA39728B1CCACD	17142E61D509D81002160199FD96AE83E6A510CD	95E278A9B0AC6552A13D80680C2B897E79E38D07A10B5025AA53CBD0C4D8A29A
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	F36CF0B80F5613F931C9B166919304F3	A039C62D009B1EDD3FBED5D25DC2A9EB7CBC402A	4C78A429038828CE51147DBE33F391D936D326B62505525C8124DDC2BFCC3F74
C:\Users\user\AppData\Local\Temp\acrocef_low\56af6d5b-f96b-4d19-b18b-dd56e0f024ac.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	95F182500FC92778102336D2D5AADCC8	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
C:\Users\user\AppData\Local\Temp\acrocef_low\6369a0c6-4071-4887-abb8-bd75720cc77a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\858f2a39-fa45-4380-9b98-a154d027427e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\9a1b76c2-a50f-4d7d-b82b-c7c8f39d9d32.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685

Windows Analysis Report
BRNB4220046D2EC_004113.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report BRNB4220046D2EC_004113.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
BRNB4220046D2EC_004113.pdf