Windows Analysis Report
Marriott Departmenty.pdf

Overview

General Information

Sample name:	Marriott Departmenty.pdf
Analysis ID:	1560413
MD5:	9a311255ac82fd1928be703c8c7ceb5d
SHA1:	e0b27de62ebd34f8f3a7d68ded0d5059bb16f587
SHA256:	9c0afeb203d3dcbcf738504ce4ca767e6684104a47b2769b6e23104eff7e4ced

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.203.104.175:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49707
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49707
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49707
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49707
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49707
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49707
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49707
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49707
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49707
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49707
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49707

Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707

Source: classification engine

Classification label: clean1.winPDF@17/40@3/60

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-21 13-29-52-692.log

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Marriott Departmenty.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2256 --field-trial-handle=1592,i,17727387525867632632,3624650885936288626,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding ECC98F70ADF500C4F97AA2B5D92ED34A
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2256 --field-trial-handle=1592,i,17727387525867632632,3624650885936288626,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown

Source: Marriott Departmenty.pdf	Initial sample: PDF keyword /JS count = 0
Source: Marriott Departmenty.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Marriott Departmenty.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.22.254.206	unknown	United States	14618	AMAZON-AESUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
23.218.208.137	unknown	United States	6453	AS6453US	false
2.20.68.210	unknown	European Union	37457	Telkom-InternetZA	false
23.195.39.65	unknown	United States	20940	AKAMAI-ASN1EU	false
23.203.104.175	unknown	United States	16625	AKAMAI-ASUS	false

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1560413
Product:	CloudBasic
Start time:	19:29:20
Start date:	21.11.2024
Sample:	Marriott Departmenty.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	9a311255ac82fd1928be703c8c7ceb5d
SHA1:	e0b27de62ebd34f8f3a7d68ded0d5059bb16f587
SHA256:	9c0afeb203d3dcbcf738504ce4ca767e6684104a47b2769b6e23104eff7e4ced
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	F1E7C877A8F20F002A2249918988857D	1810D3CD24237860E360CE9660DCC329BAC65795	791C355A32C1C47E797F04767026023B9BEE0FF3D768176B9C066E4565E5F0F5
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	9E7A0152F05DCFAC0894549034E08259	C526BF19BC553632424FF00B37AACB497E4D32E5	10E09BDE43E66F135E42BDC5412E610FD04FEAD1C71BEFD9D4D5997E435091F0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8afd5ef0-f327-4b7f-a50c-be801cb82eb3.tmp	JSON data	7B23A862D80FE3523D8D30B5AA112F5A	13EAA90917A83B422971CA95B1236182AB10BD68	6C335DE73976DDA1AB6806E748A75B6E626987ABA04994CEAF032D105A685841
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	7B23A862D80FE3523D8D30B5AA112F5A	13EAA90917A83B422971CA95B1236182AB10BD68	6C335DE73976DDA1AB6806E748A75B6E626987ABA04994CEAF032D105A685841
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	869AD6F6B73B7E32AF76E7718E1274F5	66AB6A45CB80878B2B79A952B1EEAF59B7F0088E	D8A087F92D89DBC4F9454036FB66E80221F2B0146E75134AAB70AD3DFA06CFC2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	24B43679F7345A1749456CE391501FDC	7311269DEE2A7E3101AAF7BF675E5E0DF08A49BE	54F1A2B003475893D872D609A7792644E3A4257B59117137D29A2F7A3A8B2A5F
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2	A4D5FECEFE05F21D6F81ACF4D9A788CF	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	59BB9C44A29BB5207181B6FF798FA639	FF5AE2B635721812BF402C6926CAA0C53CB643A3	2799ECB020727F2E1597E06AAABAE90730A0D8EA066DBB065D49E296011BDA72
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	E0D06B4A67D5507E35913A176229F9EE	E754908E5F5B593BE748484759ABB3887D68FB27	8EC7327CDDC43912746FF5A1AB5DB915F88C8506B82596A1285588D6D20ED191
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	9038949AD9198F0D5BE75BCCA4D8CF46	354B0F565BC78AFCBD613FC7EF8CC08B68DE1100	F0374ED3004125870BB52531716219F1AF8D7C8E418BCD4EF9E19C044E1FAC93
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7040	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7040	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	E94AD26162D16EEDBCD93C037E13309F	20CF6F494876A72188AE36C409E8FF237028AE42	45ED84667D116FEB90A51206272C0B2D0127631AA4A30F49CC070B7FE7D09664
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	12FD99306B11F3EE0CC0BA408950D0C7	5A3253F3C450EAADC4C124B7A45B49863259CD25	4B8CEE91A3886EECEEDA870CB1634BF82343086F035BFE09C2EB30B70BF71E0F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	30420CB3BABAF7A2D37456E4BAA83BE8	628DAF626A3215C09E64AAE31EB7EB41BB47577A	363E7815AE7C5438FEDF73C7424C0E66CC0EC4D1E22E7EAC41EDD6332F2DCCFE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	3C255DD93CBC56296F7EA10A5350BDE4	D9EC208D6E7C12B32FF9CB36E6CA7D272B2549D0	C5C30EE810400D1470E4B36A108A9C78E9EDA9A06EDAD245EB5C56E218E0D961
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	65EA4C2A45E42900D51E8D787CFA038D	1CB3210705F845DFD44B53FE9DAAF3EA26D3BEC7	ABCEDD740BEAC17F7BEF851D644E86A02718300B5D3CCFC49857291B2B9C2D1F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	A4F8FBCB16F9695464997197BD3A6DF9	C2E876B5C452C781FF899B8F0FFA74F6273C42EF	E39D7D124EE72A360BC761AA4796FD2D5B8FBC6666AAE747999CEBD908CF89B9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	D8967C268A7D534C75682D028451E99B	6E1F70DFE8C783605E2BF0D1B55EE1D4B81E725E	528108B106B5343116D1094B8852E584235DB7FD919A88FEDB764DB025340DED
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	D55304809A4696777D48E7B375675EC4	DC643118BF7C23C328792B3E94B91C6EFFBD2DD1	CF3495EF8F1997DD0149A6E3253334B3C7D643250F342B0B777F19FD45B02B46
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	3E5756368119E4E8DF2E2D9CE7CC3535	E113E1EBCA04A6A2B17D765BF76D9E4FD85FAA0E	E597F1A5FB15A1EBE2BA4E573F2CB0514FF1F90DBEA1F72C3BF6217D3CB9143D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	6396143CD02024FA8DF8D938ECE8458F	32F1C800C1AEA8F18BE6FB6879ABE8EBC7D16E5C	382A2DA703556FD3470B3BA61E2D64EA82B6F4530BDC971803C992A714C54464
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	9111AED88FB63F559C8906B405FA7BCE	F6A59AFB360CB839A19D7BBCE7C8E633A5963418	CE9912AC9D5A60EB664BE651F66BBEAA55BEFE2625C279E7973CB0F1BFE7EED8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	358E3E86B00FC9E3E77A73D1DA3C2ABA	213C56524DB7D86969EF711CC232478CE2682106	822352CE49022EC9172C26EB83D7679FB30624BCBA5CDBCA4AD9997086A4612C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	BDCBF205BAA205B68647608E9D2B1960	E986A4969887A20EFAF65CCA68815AA6DD6E38FC	1C526B07FEFF35A2E9864A83364AB7B8C17D2AE06F640D5FA8D1E5E3D4E4642F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	D6F95D330310406CC2FB3694B470C10F	CD8C3786C2BFC093633E8158635AB40D8797BEC3	A190BD288FE2D11A638F5CD4AFBAE1BFDAFA3D76BC12AC54208A08E688D1E088
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	AF1C00996902C1FCCE2CAC240F51489B	42FC02D85EFBC0BE92F029BD3F77844EA897FA3C	4CE4C760291F29E6FD3D1753BBBBA03EE89577F9D39CCFE4DF87F346A955A0EA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	734C4B3E49DAC83D062BFC70BF400CA1	058E5E95980973C1D5906CC726517C2A10A6EB09	AB4576C5D2046620D3DB1671E7929940E1BB591738238BFA8127D089127CB85D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	A665D3D9268E9F871F426A6994EDE6DB	3DC6AF624486F7CF46A7DA6830FEA00861FB5C1D	A668B245B6D9189EFE172406D44DA3CE9FB0FB49BFE097D79AA3B74D31643237
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	A54232E17FAA6F2E16B040E0DC637698	DBF4BD2996086AA5B9918679BCB71DD49F527B85	07B3DA2DB43D38CDB5F8305E02FC49B45C9C5577A835CAAA4BBD1693507A0212
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	550D6D889E956B57E1A344D5878CC3F7	5A7F1B8312226F8F87A689EB73DFA0931DE3C341	62236A0B2192859F82E97D4416CC1EE61C46AE1960C08B1AFA79969762FD31A5
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-21 13-29-52-692.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	7BB1E751EB3D760E6F44FAB65B0F4ABB	999291C19BF711631A2DAC5A850DD942D4845464	663722619EB5FDEE8661B3FDF65DC12C5733CBD340C7CF315253BAB1B621BF38
C:\Users\user\AppData\Local\Temp\acrocef_low\416cdcfa-b224-4d24-84b7-85ff6d138495.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	8B9FA2EC5118087D19CFDB20DA7C4C26	E32D6A1829B18717EF1455B73E88D36E0410EF93	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
C:\Users\user\AppData\Local\Temp\acrocef_low\5e4d3790-ccb8-4984-9870-a8b897643804.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837	ECFA20D7144E6C6EDB6129A2266A8080	FF0C474BFF1FA6E59B8346345CBF60210C562E38	6E890EA390AE240E67BE50068F415F83B90730601D7B9A57D981236F5EE3E853
C:\Users\user\AppData\Local\Temp\acrocef_low\751574d2-8ab8-4e25-b962-f15cc11ee81e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\86711cc1-e37f-418c-a5a8-fcf647d03e67.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE

Windows Analysis Report
Marriott Departmenty.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report Marriott Departmenty.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
Marriott Departmenty.pdf