Windows Analysis Report
5BPXX1HIGER9.pdf

Overview

General Information

Sample name:	5BPXX1HIGER9.pdf
Analysis ID:	1520635
MD5:	aa55b36be9bbd1bdb65a4b2741e70f8b
SHA1:	3953604d2ebf3bc6d692b2c186a0001c941cab27
SHA256:	80d1d9115bd719cec06ec131626f9f8721f8e9259d5aead43b8d20c24f6ce556
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.56.162.185 23.56.162.185

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443

Source: classification engine

Classification label: clean2.winPDF@14/44@2/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-09-27 11-36-22-743.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\5BPXX1HIGER9.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1556,i,2454859765742305140,6723875660102114181,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1556,i,2454859765742305140,6723875660102114181,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 5BPXX1HIGER9.pdf	Initial sample: PDF keyword /JS count = 0
Source: 5BPXX1HIGER9.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A91nc4ata_dakdrj_uk.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A91nc4ata_dakdrj_uk.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: 5BPXX1HIGER9.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.56.162.185	unknown	United States		16625	AKAMAI-ASUS	false

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1520635
Product:	CloudBasic
Start time:	17:35:27
Start date:	27.09.2024
Sample:	5BPXX1HIGER9.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	aa55b36be9bbd1bdb65a4b2741e70f8b
SHA1:	3953604d2ebf3bc6d692b2c186a0001c941cab27
SHA256:	80d1d9115bd719cec06ec131626f9f8721f8e9259d5aead43b8d20c24f6ce556
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	C7545697CE8704917D2ED5BC47ADC5FA	CBA8A973366C99299E41F37A6FF1F9D0F6F01209	8C5216515CDB8C7CE4EFAF25D7D2302B0EEF23A69C1D36F673A17F6909EAB77D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	C7545697CE8704917D2ED5BC47ADC5FA	CBA8A973366C99299E41F37A6FF1F9D0F6F01209	8C5216515CDB8C7CE4EFAF25D7D2302B0EEF23A69C1D36F673A17F6909EAB77D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	34A4E707E7120F6925D2BE43C0686D88	F9A50ABBD8C10DA18EBB841E2E56796817FA70BD	B3FB4526BF4B33714CC3B74ABF0AAE863B0CDF2749AF860823689FD67C018930
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	34A4E707E7120F6925D2BE43C0686D88	F9A50ABBD8C10DA18EBB841E2E56796817FA70BD	B3FB4526BF4B33714CC3B74ABF0AAE863B0CDF2749AF860823689FD67C018930
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	FCFC7929A6DA8D17F8416175B9B0983C	26E8568A72F46DBD0DB0240766F572B4DAB31A87	B68ADA877DC4606E4D3D8B21107149B13FD657C6182F81DFD8E80BBF5BFD31AB
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\efac3a12-5687-47bf-9ecf-d69b4cd64453.tmp	JSON data	FCFC7929A6DA8D17F8416175B9B0983C	26E8568A72F46DBD0DB0240766F572B4DAB31A87	B68ADA877DC4606E4D3D8B21107149B13FD657C6182F81DFD8E80BBF5BFD31AB
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	BF1A42ACC184760757826A5D4D6E6064	A799C98E4EB77B9ADE6F455C02788C4F59932477	1EA61AF4055640AD7659564813B27760BEA8CAA86DCAC54C8109EEAA865BAF5D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	6AEEA61E6CB92F7569D2F3CF72404FD1	F91EF624795BC1262B413A262B7B078C5A9CAF49	0E427BDC3276D65B355CFEA73C724B487937F40D4404A619CDC70C3C33F4D1AA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	6AEEA61E6CB92F7569D2F3CF72404FD1	F91EF624795BC1262B413A262B7B078C5A9CAF49	0E427BDC3276D65B355CFEA73C724B487937F40D4404A619CDC70C3C33F4D1AA
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240927153624Z-163.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	C5D6746889D1C6B83BB5F998FD0E9340	4F80DC977415A12140DCA98E4AE6A0C10AD03CC2	7051068E7F4F95422ECEBC7E793F0BD4512E9C7CA938AD23270BA2E34E0F1A37
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	AAB31FDBC3A05DCB7B9675FF4A49A398	48FF1F67B2CB521D485A55578B6ED6288F1F0025	3996D34C2A8D081AD5F5E14CD4D018F5938E1053E16A908CE9D056F6FAC43097
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	9583506BE77AB5802FAC94A368EB284F	CBD06EB03CC9D948DBCD2BDDFBB108710A943C99	D9756ECBDFAD7D66D057FD97E788F5D8B3A282DA3B1505CADD2B19D376323022
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	87EDBEE38F56C20298F25D5D3D4D1B5C	7F904E9615AC3186A87472EF366DD8202855B0B7	A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	2E457459430E4D6943E26602E22894D5	61799558AED523245186AEA43217AA8E07FF6291	7FA5765EC493633D77518417F39661F41945DCD37F4A7A6794E628F0F48AECD0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	F26574A9718D52370DA3B31B38894674	50616EDA4D74E6F451AC1A040612D9339903ED5F	AD8B124574AAC76FBABF3FDE5505A1F92CCA056F296CB751F0329329014021FA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	BA06E3FEAC3377A65837B7EA6BB84235	02C8196A06E5EAC4B92B1E99F44565E8FB1D4540	29B2CE171A1BDAA8607636A2F4DA1E73C451A9E38881557B499ADB631D3DF6D1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	D73E7612A1B0933E2664A53A84E889E0	95B6E2C93A667B51A988300FBC686C87C1C06814	6114A978817020AF7AB4E409DD11467AB6215239379AD18C60A6B570832357CD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	2060779D50501E5F02D706AD79BDCEFC	E1BD71527E911FD304052C243CA867BC0D4CB471	33B55F983C4A12A01C761DC323892DE834C4AD38DBE11FC25B6C8BED286C6727
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	7C5317DAE411B55395D9FE6334439B34	5714A2CC61F63E41C811F39752C589DAF473ED22	0D2804EE05B4D101A3EDACF75D4E3C35358D475C17A1BA1BFCA2118AE2F2E643
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	F754B36557CC5A647A9171A465B54759	036B0532E5E896B5BA3A4E707DD20AC022EE64EE	25038E7AF691E538F835665EFB75DBACD1F18DECE1295612FB7B042554B550BC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	936D13C4A10DFFC26898CE1BDB5D5A33	830AE6E9C94D97B8C3EAC82198672EB9C2B5580C	629593DEC914EA00DEE6A2DA7C87C15E2DF1DE769859CE2176FFCD6D5ACE6260
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	7E119A83E5B80D57D188F8A73907270B	00BABE474C1012C8A8A89BA4BE1C6FB0ED5ECAD1	76B582B30CEBFCD7F70B051E81753C7837C9E21A4D67BB8DC88BE314DE40CBDE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	2CF2A904F73D71292458D31282E6A584	C073D76CFDEFB39B7D3AB62464CE921FD7869E81	69BB8434D232E7226930F6CB7505AF3B091106C720B12F291B83CF75CE625C7A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	F4701E0782D3241AB84520E28802D6C3	2258FA630E47B9AA6CE784FA8BBB5A76373EE347	A1CD6CEF2BBA1EAA5CFA1E0A9FA51A51BB5469025886451E41B1F03B5D09216D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	35D65BF7704DE87F5523D0C1B8855BCB	9EB1982FBDF99C9AC85E7654A97CDE12AD327D2C	D6CE5414C615540593C265818CA261E676FF05A3C01509D0443CD783197444DC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	8E5D6530FDC86036B5E4CF40BE130FBB	C3CFC50DDAA001891D906740C4F30360E33C895F	74B8413220AEC148247545D41B9BE5F24DDD395E3C3A01BFE7450990FC95E5D7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	406F36241E2EDA48372CBDF00CEB0FB8	1F9C2DD9E372C51E3A8CCBB28AD9C09CAB6EEC71	75EA60AE325318EDD50123D4EC8D14CDEB923550622145F2A9A6509B85EBEA5B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	C58553D37F59FE60D6F0953BD8DB0FC3	7DB0C8DD858C07EA8F9F6B1CD955D0B0F1CBC17C	9F643CC8A6828643C93798785853ECA7ED1C4099AE4AADE11926EBD4FCD98A56
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	543E5F8DDB334D06A20141ABCEEC63FC	75835912AEFCDD9D6C65FE2C22C8DB6FF955D17F	CC55813299EC644A277B6BDCBE96FEFC9DE03B3CDC9FF2BB6905F4A521ECE691
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	B6855D21C1FD750C889796E37B31F80E	A3D73176C5E29A06D31A1B0DED8479CB7EED4613	80F26499FD56776C8866FDBE38877B1EFBD9540F2E59BA5D928039889217ECEE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	91DCF7A1E86A301BA93CE7366B3E5BB9	2300E84CE03E63EA30FB5FEFAC19B0633F98AC21	837D82B74D6D854C24D8B8648ED12047C939668A163559A0C468862953351951
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	A5E413E587264D88EDCD2324C9B2B503	D2AE4765569E38D9AAC13D8919C6C8E73460889D	CB4B8468A5814773513139E5DBFEDC5615157F49EAEDE40691E87C2ECCD53128
C:\Users\user\AppData\Local\Temp\MSI6c37e.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	9EA9816384D13C340E5978028FE5795D	7EAC3553E05FF7AB233763FA09000543CF606192	6893AFF66CA4D67635EC60A596E6095579C0C03D3D87CDDBF279943213C4B8A6
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91nc4ata_dakdrj_uk.tmp	PDF document, version 1.6, 0 pages	CC4EF60F8FB300E5A746E8A41C1C4688	95CED1E4E18C55E3E271D8AEC1298DBC0258FD26	1A36F2FED25B25A4A7C5A1C1C43082CC777E64A26525F106529864DA496E3CF4
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-09-27 11-36-22-743.log	ASCII text, with very long lines (393)	1336667A75083BF81E2632FABAA88B67	46E40800B27D95DAED0DBB830E0D0BA85C031D40	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	5EF356983D602C9C87C521AEB6057DC0	4CB04CA0B7F125936FBEC69BC6ED24BC9D2B7ABA	F887C0D45C9BCCA5E879F41DE953ED13AB24C84298FEE0FC575C021F8782047E
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	F86B0A155E992F8A82611D903856A308	A6A36A8A80EFC4CF4E4E5F5B06D339DBB4C8339C	33F3098CADEFC6C0C28A2A6D2E928179724DC1AA6538D1A55A2974C41ED57A3D
C:\Users\user\AppData\Local\Temp\acrocef_low\0c5510d1-db81-4e42-a692-9f9a294c94a9.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\2383a919-ce10-4541-a128-843455271905.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\8a9cbcb8-262d-4881-8b88-8b74090cc27c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\a2e131c7-8dff-45f8-9130-bb9684ea1ddd.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4

Windows Analysis Report
5BPXX1HIGER9.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report 5BPXX1HIGER9.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
5BPXX1HIGER9.pdf