Windows Analysis Report
uPXZIHuz.pdf

Overview

General Information

Sample name:	uPXZIHuz.pdf
Analysis ID:	1524321
MD5:	629274c10e2539158d124e150add83e8
SHA1:	2572737c016f6ef291f19e32a47d2d59b9bb036f
SHA256:	c2608132fded62398f96c8cd497e21b88f6f50cc69ff03d22d7575448902ff94
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.17:49711 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49711 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49711 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49711 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49711 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49711 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49711 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49711 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49711 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49711 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49711 -> 23.203.104.175:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.17:49711 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.17:49711
Source: global traffic	TCP traffic: 192.168.2.17:49711 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49711 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.17:49711
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.17:49711
Source: global traffic	TCP traffic: 192.168.2.17:49711 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.17:49711
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.17:49711
Source: global traffic	TCP traffic: 192.168.2.17:49711 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49711 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49711 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.17:49711
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.17:49711
Source: global traffic	TCP traffic: 192.168.2.17:49711 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.17:49711
Source: global traffic	TCP traffic: 192.168.2.17:49711 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.17:49711
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.17:49711
Source: global traffic	TCP traffic: 192.168.2.17:49711 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49711 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.17:49711

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.203.104.175 23.203.104.175

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443

Source: classification engine

Classification label: clean2.winPDF@16/55@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-02 11-23-34-758.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\uPXZIHuz.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1724 --field-trial-handle=1568,i,17717744455474703836,17105930129994550002,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1724 --field-trial-handle=1568,i,17717744455474703836,17105930129994550002,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: uPXZIHuz.pdf	Initial sample: PDF keyword /JS count = 0
Source: uPXZIHuz.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: uPXZIHuz.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: uPXZIHuz.pdf

Initial sample: PDF keyword obj count = 56

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.203.104.175	unknown	United States		16625	AKAMAI-ASUS	false

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1524321
Product:	CloudBasic
Start time:	17:23:01
Start date:	02.10.2024
Sample:	uPXZIHuz.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	629274c10e2539158d124e150add83e8
SHA1:	2572737c016f6ef291f19e32a47d2d59b9bb036f
SHA256:	c2608132fded62398f96c8cd497e21b88f6f50cc69ff03d22d7575448902ff94
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	2A919BFA3AFDF97FBEA9D87098BAC804	657704B1EF9E6BF5DC3C750F6FD528FDEBC32DE1	E721F63330D663DB3C909123D6B28E5E626B546A32967075BE9DDAC13E008803
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	2A919BFA3AFDF97FBEA9D87098BAC804	657704B1EF9E6BF5DC3C750F6FD528FDEBC32DE1	E721F63330D663DB3C909123D6B28E5E626B546A32967075BE9DDAC13E008803
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	29E89960807CAF936A6374AB57BD39C1	688043CB598BDC202614AB3C07AA3BBE393BB4DC	97615CED328B0F9B7928933946D9B659B072375BB6B06DFB9B6E7A44179D7F64
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	29E89960807CAF936A6374AB57BD39C1	688043CB598BDC202614AB3C07AA3BBE393BB4DC	97615CED328B0F9B7928933946D9B659B072375BB6B06DFB9B6E7A44179D7F64
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	1C143C7888510EEF2D70C65A73C5EEF5	1AC2851C35A50DE8E2B3B47100CEAC47792F87F9	3C3D7D733B7954734D5C71C11F8C3703B531CEC66CB4E293443848A0650E8062
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d1f47bfb-a32a-489f-a4c0-37ea1a1e0ce5.tmp	JSON data	1C143C7888510EEF2D70C65A73C5EEF5	1AC2851C35A50DE8E2B3B47100CEAC47792F87F9	3C3D7D733B7954734D5C71C11F8C3703B531CEC66CB4E293443848A0650E8062
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	349334FACDDDDFED9DCFF03D66776C5B	381FA38FD190A022A3144F1BFEABD4575858F58A	EA3C54A2BAFE58611665865579BBAEF332EB1CE7403CC03F649F0DB676B5FA9F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	333194D23AAE482AC2A3D8FBB43F77FB	BDA27DFC089728D08AEF96E603EFC571BFE43F5B	3190CE91604D0DB02891E08B724B204876E5976109EE3C0BCFDE252DF213F074
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	333194D23AAE482AC2A3D8FBB43F77FB	BDA27DFC089728D08AEF96E603EFC571BFE43F5B	3190CE91604D0DB02891E08B724B204876E5976109EE3C0BCFDE252DF213F074
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000001.dbtmp	ASCII text	46295CAC801E5D4857D09837238A6394	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log	data	F7AC3CE75325A2821BD3E073DAFBB968	0F0DC37BDB98FD4BC0ABC3410DEDB557EDA3190A	1A87D805B5F3C42726D96A40A5D1769426B7FF5EAF00F60BDD6D88A6E01B5ADA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\CURRENT (copy)	ASCII text	46295CAC801E5D4857D09837238A6394	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG	ASCII text	79DFA35F4244686D8D57AF23513E3ECF	66E279B1C2C3C96A111C9E19A18B3BBDEC3EBB37	6695327F7E5978B1580E1143C55BB6E2FDF3BE599C71F8C954BC5CBA6FDA7EDD
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\MANIFEST-000001	OpenPGP Secret Key	5AF87DFD673BA2115E2FCF5CFDB727AB	D5B5BBF396DC291274584EF71F444F420B6056F1	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000001.dbtmp	ASCII text	46295CAC801E5D4857D09837238A6394	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log	data	A05963DD9E2C7C3F13C18A9245AD5934	15A87493591860C6C22499DF3A705ACB3CB466BD	F40B7EF0FE0B676871403B8DD21CE42AF8E482DC8B81F09D93CB2C48CCD112B4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\CURRENT (copy)	ASCII text	46295CAC801E5D4857D09837238A6394	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG	ASCII text	9255041AED913F507305D7888CC9592D	C5AD4522FC65BB473060D34314FECDB2BF5068AA	8889E015F22590EF2F6EC3DC46CC6F09CC67C4B299FF2CE5AA3F1E0394CE48B8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\MANIFEST-000001	OpenPGP Secret Key	5AF87DFD673BA2115E2FCF5CFDB727AB	D5B5BBF396DC291274584EF71F444F420B6056F1	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241002152336Z-168.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	274DB4789949E95359564F1EAAA9CC4A	06058DA86F195DE98031C7B67AAFC3F84B4FDBB7	56B0508F5C7667063622306C74D690CF218D7920C29C09508624F806EBBDDF62
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11	BD0696CD0A8236EFD30BAC0BDC66AD68	2DA1E3562A02935629EFD529F0BF7F7E3089F84A	AE93AF97CD9467236F5B38E263CBF71F82DF2AA8D99D9D11692384F4FB7D7BAC
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	EBAAA96FA4C7233BB76447F91A060A09	D0B63320FEA9EC0A393CB43935335348F38D65A5	1D87492E6DDAAB23862281994FE054F51FA8D7E0B2988C2D2A67A6216DA14394
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	D50C0E6A59D6A78CB0218B16BF6A4DEA	C5E27CC33FE405D2CB7E650B559F7E1716CF78AB	059810C64514373103042CD85D3706E679EF05651CF01107A3525954BA9E29BF
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	1A892FFE1E374A5EA9BC70F36EDCA3A1	DA5A9EDBFF4BB71656D6F459DFCFFAD52D5CEB8E	0D76643E35EB4B255E06CFF1BD5FDDD9D58C24678CF78427143B646AE2F84B45
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	5EE6D8F8A34D1DEFB3FA9B58A17A11AF	F7119F528E68782EAF5D14E3F8637386D8B6C8C9	675DD905579A63996D60675C8D8DDB0CE3344D5C75D78BFC22F860BADB860C9E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	319F893138537A8E373B5BA33BE0C3CA	4F6CC4BF26B0850D99DEDECB10F2FFC77025B148	6FB46BE9F67593D174449F77736EA9BAFED45EF7E78419000C4E10B52C1DB4AE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	08B8C658C5F5440136FC9D893FA9AAD7	4499079E9F45B2BDD774DC2488E00C6F2DA53315	30CB6DB2A0689EE3450F322B2DCD62FB4F60639D1F5E7A523FB87C603FBBD78A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	C4BE41159189B11CB4330FF37BB8B0E2	DA6CBAC475C454647555AABA4138190B043C452B	D625C795B0F557D327F9C170D94A7D2D025D14293F0047C0B575B171FE4528AD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	96C3D0B65B80C2034EEF704B28860A07	DF5E0607D7A97048799AA72733363E3955B8E5A0	DE8E3646A74BFEF60E18BE69D4ABFC84B7D24F6ADA10D23A6F56DD2697E3D700
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	3ED33E409AB213DC654119A5B96ED550	585A41A3D4D7DA487189CFA7441278A33897F26E	B7A42FBBC49C17B5D1EB4C1E6C36D8FB909AED0C8EA089DF88186446FB86BD8A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	B1E21CA664EF6D4958E0CFB3C1EC2E94	4A61EA4CCA377A36E7CF977A52A01D3B151E8416	812C00B47001278F9FF672D3CA4E4406F4B6A620BE04887BF28237F262DA4BDE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	B2391FA0C4C3EDAA561DD84A162F3F36	B85B5B6DF24F91C7ADFC53EAB9C2487B08C5D349	B3EE8DF45ECD3A9381E7DC5ABB51E68B8A935DAAF827903EB37B58C509929E3E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	EDE60AD3FDB647850988E708D925136C	4B697D9BE3AF5B32D7E33B73B4F9ADE173F4D82B	CA66CE4AA042AC25CC5AF2BDC20E903056581910E6A8182E7FAB62BBC2361F57
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	078C8AAD9C3BF78254531010ED54A0EA	D86B255DF232100BA2ED1C9FE0FA623AAADEA165	ED2E37CB0E305026D698CB78FB97F71FCCAB588B773DFAF5C0717D6F2C6C86AD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	C1C2A475BC8589101C6834CB8E8DCA50	98553370EE563F2CE57F6E6C9F34D6A09A095276	0D81A8D1C1065BAE4ED24E3C33193FA57EE474DB7FD841BE8BBED8CB219F96E8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	D5CC9499679EF6727A52602532790F62	C066D930DC31A9A48A206B5A22D9878CF6003787	965395AED5A9E8F73AFC34EEADA9C6DD99FDF91637CBB3979FA193A4D4762CD3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	48DFB332A29FD1D9C3B6259CC0AADE17	5792F0228E7CCB79AC223A064EC8022D544ABE85	EFBA86B29C9D414245650B7ED2A86B2F17DAD8AB0AB41D8865211751C70BD248
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	2816D2022AFB16321674C0F328AA566F	22414363CD662B35B36194241709D9F382290500	03D8A3DDC3DF2C3A46DA87CAE31BAE881248A101A15D71101DF573563EC9F5CC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	46E248EAAD6A5E581ADCDC62884C4111	34A88898055AF0B67566484FA8CAF05D68825E60	9D7F1F4188D3FEEC141510272550F526AEB9B2D25DA7F14CC2C23638192735D1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	CC771CFB99FCC0DD5ECE975A3BB46768	BAD3654D0681379D03B72C4A4AC3B7359BC8D671	C9F4C59CE0BF96DB571361ABF72BAF2B26F3A8432E796A0C10F71A67257DBE50
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	F15349031EC09091FD54C1708C0B448F	3074DBE7ED01872C7A01F50BE113702F980D0684	7288A40C1A197962D84EACBC31A9708DE0FB3CBDAA40B38383D9DABA07DEA6A3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 23, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 23	AAAA5186F1E6F0E0582A54D182A2CA3C	6E573D6C2DB14AC03A3F98E131FB62E545E492D2	393A24932034C9F9795C9CD73A78AD551319F25B9194252691DA73B13C7970E3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	8A9AA076137A177B1778321EA3E73620	038611598DC9D3F7C722E13DC995742AF6189191	E996FC75DDA2C9C8B15D59F493C46093A084DABC13E774F94E04C8E5DC4DA586
C:\Users\user\AppData\Local\Temp\MSI67270.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	16E4F47AA7F9B70D8CF7B546DC1C0552	C38DAD7534E288996F813CB88BBF82872F025506	B8596578DE1A8F27DD5BC6391337D403604117A41396C3290959F623FF539CB8
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-02 11-23-34-758.log	ASCII text, with very long lines (393)	06DEAEDB81D09FD8FB5FF668D8E09CB2	28A02BCBD5975117B97A08AFB049F2C94F334726	D98DE785425112A2D7A41B16073812FA4FA4955F2D5139AE87C9A5FBC4717D64
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	F9A5478CD1E76F64E1D5876883CC1213	8FEA69F779AED428A494C8328C6A05A0B4A5D35B	18392835E8EA4CA601F3AF62461495DE181770D1A04550F74276ECD5B300D67D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	E92D367EC746F73040A48BE3AC76BFA7	46956987C4B5370631F20F4C063E489E79FC4DE2	851746040D3AB06A57FBA36A16F008544D6C4892F95624F7E742CE9A69D542C3
C:\Users\user\AppData\Local\Temp\acrocef_low\16ef93ac-0d17-4e7f-8f3f-3c3e3601f8b0.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 160932	5B21A6981E55EF9576D169BBED44BCDB	B3A14100B7E7C2C01D61B010A54937952D111E20	9555E661370D1DC26605DAE88BDBC1ABA68038C769BF6E354A256B1A1C4C110E
C:\Users\user\AppData\Local\Temp\acrocef_low\1a95317d-3051-4c82-8793-f5f7afccf412.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	1D64D25345DD73F100517644279994E6	DE807F82098D469302955DCBE1A963CD6E887737	0A05C4CE0C4D8527D79A3C9CEE2A8B73475F53E18544622E4656C598BC814DFC
C:\Users\user\AppData\Local\Temp\acrocef_low\22a8e6cb-8efd-426e-8c56-d9b1b032587d.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\43b2e73b-1620-4ccb-8e9f-c1c31493f8c5.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\d14aa7c1-6a5c-4e24-b145-951371f663a8.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	FFA982D6F2F9B46A1DECDD28BF3EF0E1	B1D05ED9BD6A80BD0E3377E9F62B47EF83FCC0C8	93D954FA4BBEDCDFBC7BF14FA1BB3986056261F4A5035C3CFF229FF16D12B78B

Windows Analysis Report
uPXZIHuz.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report uPXZIHuz.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
uPXZIHuz.pdf