Windows Analysis Report
P.Adv Form TRC informatica S L.PDF

Overview

General Information

Sample name:	P.Adv Form TRC informatica S L.PDF
Analysis ID:	1579942
MD5:	338659c5c845c1b4ee71d329afca0111
SHA1:	674d363398114e54251bebcaa4318d4d1f1ffdc7
SHA256:	e26f58e78aec2dae8304aed66550caa4beb14f8a030e5b68ce9820d107ce40a9
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs DNS queries)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: clean0.winPDF@14/51@1/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-23 10-22-08-492.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\P.Adv Form TRC informatica S L.PDF"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1712,i,10649813687301408746,10568959059910481676,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1712,i,10649813687301408746,10568959059910481676,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: P.Adv Form TRC informatica S L.PDF	Initial sample: PDF keyword /JS count = 0
Source: P.Adv Form TRC informatica S L.PDF	Initial sample: PDF keyword /JavaScript count = 0

Source: P.Adv Form TRC informatica S L.PDF

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1579942
Product:	CloudBasic
Start time:	16:21:11
Start date:	23.12.2024
Sample:	P.Adv Form TRC informatica S L.PDF
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	338659c5c845c1b4ee71d329afca0111
SHA1:	674d363398114e54251bebcaa4318d4d1f1ffdc7
SHA256:	e26f58e78aec2dae8304aed66550caa4beb14f8a030e5b68ce9820d107ce40a9
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	9D431129AFBE6F3F2F52E7265AFA0E56	5FD4B099DA04145CA73EFB6336F8174987396854	B4F509AEB96775F011B9C39BB9BAA5D2CEC38F583CD7E2A0C2FBF1C5D43BEEC8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	9D431129AFBE6F3F2F52E7265AFA0E56	5FD4B099DA04145CA73EFB6336F8174987396854	B4F509AEB96775F011B9C39BB9BAA5D2CEC38F583CD7E2A0C2FBF1C5D43BEEC8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	62072559BFF713164B6AACBC71041A7B	F6B0543FBF2E85DD98AAAE3FEB2EA6E2F46B2DB7	E0F27915B59A140F9644A4209AE71247335C5CEA5399CF8090A40F1BD19214ED
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	62072559BFF713164B6AACBC71041A7B	F6B0543FBF2E85DD98AAAE3FEB2EA6E2F46B2DB7	E0F27915B59A140F9644A4209AE71247335C5CEA5399CF8090A40F1BD19214ED
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	70321A46A77A3C2465E2F031754B3E06	5E7E713285D36F12ACFC68A34D8A34FD33C96B34	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5c38e3.TMP (copy)	JSON data	70321A46A77A3C2465E2F031754B3E06	5E7E713285D36F12ACFC68A34D8A34FD33C96B34	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b9ea1759-22b8-4306-b4c6-0c0481f9ceea.tmp	JSON data	70321A46A77A3C2465E2F031754B3E06	5E7E713285D36F12ACFC68A34D8A34FD33C96B34	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\dbb934cf-841a-4c56-ba29-f161714f0a16.tmp	JSON data	BC1244A67D55E9A8538BFA2E2040EB48	478CB0DDAE73F6683B3C5153F2BA3979868B5FF8	9BF42183BB3890BC85580A0E917487DCF7D53BC58D3E0B304D4ED8E189FF1840
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	422CF260653579B032E130DC02F4E31F	2157EC6CCAC8DBF56E70240E2AA0F64978286763	12B7B21F293575CD45267B9773292EDC20DDBCC43586026898AD6B3B8B0FA435
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	9CED6211BE5FD5F9237D99EFA525454F	3E6F4E4000C6FF53BB1C3F82B8517D7FF5053A36	9334D016B9BA968B86D745F7B3556EFFDAEE77FD1465E2F14155C078C9768898
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	9CED6211BE5FD5F9237D99EFA525454F	3E6F4E4000C6FF53BB1C3F82B8517D7FF5053A36	9334D016B9BA968B86D745F7B3556EFFDAEE77FD1465E2F14155C078C9768898
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241223152210Z-157.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	D95792C74ED2C2C2A92C459C73423521	D45AE6EB05FE40778C2F0B779B7C15E20D806917	626C68CB32BED9CC3842C6A9E1B4EEC7C706E05DE881F97BB29DD136B29F70CF
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	ED3F0E0D486FA3D59D1E88BD83475192	3426E29D9EB76809269E8EA6F01AC3D60EA32A9E	CAE0819E2F3609E1951C3CD8C8C8A27FD9521B8B81BAA0D349C542C3436E4AAD
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	6B5AA5CD7D94D634A510ECA4D3DCC4B2	052E6830C7F736BD739FA6C5C2BB73C4969671B6	2E915818389167B2760B61CFE5D83BD975A9FDCBEB1E54A9A073EC67311A2645
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7116	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7116	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	87EDBEE38F56C20298F25D5D3D4D1B5C	7F904E9615AC3186A87472EF366DD8202855B0B7	A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	CECB26DADE3907B80C45347B1FFC2321	E33274C651902DD0A48D370C5D85F1EF65B74427	82AE6283F2B5313E5E898858FF873493B37480CB63AFE4C704BF5389957CE864
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	579478C941278C52B3A73915DDC86F31	9F931EE67A1FBFC52562A0687D1B1C61C313B807	C512603EBC2F20692A38447F46F74A3BA1BCE480E4A8B5A705D1C5C936BA1ABE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	3FA9DEE3592F2958D7DE56E81A1CC4C9	A649E632D324FB6437797127407755EC2449FBF8	6D0454CEF7AD0BB784C9C170E481BEB8C245F0F166CE44AE8110EC9EA37026DE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	2F6C0D433AFFC824551F1C5DC210ED1B	7894323B5905192FE0C592D4C26EDBC9626C91FE	F3174275D3F80DEE6D606906E2A98EFC8DAE44DAE96807F0E4CEBCE5F351DE8D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	CD25258D6AEB74B9D1EDADEF7F91C22E	A76C3C1C33F4C086E4384038339242FC501CA2EB	494800D0E223026EB044A9E6FAA10DC0BB429412E06460D12B45E95BFFF99564
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	31F50BE75C0B2F50C1026119BB685207	DC7B3ACF1336D3D5AE29B43F32A7FDDAC0D2127C	3C45B4A0E5B7590D5135D9D8107355EEB17B90D9393F2D3F13D24471DAD9219B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	E4A1A479777B6B52E06BBD8FAE5C7E1D	BFFA9D1D2006B90D040BE495CE5F08CDF4EDDB51	98D37604D4C805354A72644DACE41132A39452603A49720CD3068FEFA99EC60E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	610304F9C1B8799705C91ACC90893C78	FAE7FA412EF7C445F8B43E17BD9CDF67E1DEDA15	3862AABC2AF9CEE3CABDAE8E663CE168D75B8130721C8F9D4F4DBABE10BE01B5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	D5A5165685A71E6F30A452FD48666670	9EBE1C32F360945D3E7284F4B4AC9D9565AFE775	6B800844A7FF61B9A36A838E634B9DB181C62960685B0627AB52AD1E346DF863
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	DEAB7DBA5AFD23C6C005FEE0A6D28330	4E350A75016EF9CE1469A6966203C85CB1C4FEA7	856943C7E93695366EF18CDE51FDF59AC8CFC28D5AD2674A31023131D9E6AC9B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	B177846450DCA1FF32C459249F96EFA7	E1D6D5BCB7D02C6768800C44BDABF02E8A6C6E58	C8AA5F2287EED433CE31EF0C0AFB3C059B91D8099944334DF29902A32015072F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	C7525C7855BCFFA80675F3270197971E	1A56F8E54ECA3C2B93E265906501322FE7DBCFAA	B81D3F0D5AB88E3B6573789549D4D0AA495D73579621934BF97F77A2C6E8699E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	EEAA833F6854AB82F2F3FDCDA16C13D7	C25AD26486C67A21167030B7730BE98830B24074	2DD3180410764310ACBA37DD97B32EB1DA25E0156FB1B3101D0F165CAA58B2AC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	D95535F62379BDD220B90E2AB00001E7	3DFFE2F1B6B5C540B21743CCA967EA38056A9205	53B861CAC6FF6FCA7B0DBFC7C5505489A79586D99277B6D5D88483548CC12AE2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	5302B904901E30334270DE3ECB62CA78	7CACFB61C94A09BDE74E68465EB2F67C6EF081BB	A3B57B739A7A0A3A67BAD9EFB5074869C084EA56B98F55418A54858C8AE35228
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	09C192550B37728417828BDDAF12F24D	993B75B233E7890DA669D292C7AF67A71F8C421E	66F9A53307F085A9452FADD66CA3E5D46CEA6BC998A1ED0C473A1B4BC1ACDF2F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	B11EDAAAB4DB0ECB0B1703A0AD7A0006	00726DB97D50AF5EF41E2451A5424BFCDC00A3DC	D1BF0E225014785A71387F94915FE49255708FBF1C59098857C72E7215A9CF25
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	6909A25ED821D46FFAF474F91B11DD55	B5E3ADE060816213F9A95963C4A63CEB4456613A	8497AEEC2D2824E42E3225DC1F89EC24927E381F092A7B7ADD23A0B1B01412E3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	8B4D7A9CD571AAF6FA59A1EB0F7E2B5B	D2832221C63503DE9F262744BCB2766C63EA2D82	65EC9DD55E58237E8FA6FFD0399EE66192B81221047AE14D90747D0BBF141A21
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	4F98FCC4821409022C520CFB8CE4B356	E5BCB371F28711C69E4B684BBB81D4D066964F9A	EEABAEF9594E1A0BF3689D8F7C91D0DBC774E82A6B28DB6A84E6F0903AEA89B2
C:\Users\user\AppData\Local\Temp\MSIbfa34.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	399770E7A61C2B4205AD273AF6DFE9BB	FF22032F5C2A32A6A1AF8B143F0A8472F8FBB01C	8A1C97981EB7BA8B41BD082C55692966C38EC3BF0603D382E273E15C74F37E31
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-23 10-22-08-492.log	ASCII text, with very long lines (393)	1336667A75083BF81E2632FABAA88B67	46E40800B27D95DAED0DBB830E0D0BA85C031D40	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	E8927A3E921230DDC8912830E3FD161F	BB2B7673B51A0E6526EE85D5AC1B4BCE4A594B0A	E5462543C4ED0BAA42AEA1A8A72CCB08DE4D79F2A9E5441E7E5CDFB5F3AF970A
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	D7F6045F0551B4EE93BBA98CAF9E2DB4	45EF57EBF40FCC2EE5C46B0F34D37F7EB2844738	28A3546AD377AD64E8F006AD56C9D6E8D73DE127F6EE8ACAA7054C1A4D5754FF
C:\Users\user\AppData\Local\Temp\acrocef_low\12759d3f-fd24-4382-92de-68388f966ea3.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\56f9789f-39e8-4f38-801e-92e6349bdd74.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\5bc1107f-0757-40a6-b9ef-b73217833637.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	13F55292D0735B9ABD4259B225D210FC	810CC5D545BFA11D2825F6E1DFA69176794DA7EC	8C3FFEA68963D108599E8C5AE20DE6E9C473BF33197A03A9A7DDCD0F25A6C7F6
C:\Users\user\AppData\Local\Temp\acrocef_low\e269efca-0d63-461a-ab58-2021ad40e491.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE

Windows Analysis Report
P.Adv Form TRC informatica S L.PDF

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report P.Adv Form TRC informatica S L.PDF

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
P.Adv Form TRC informatica S L.PDF