Windows Analysis Report
RadProCalculatorUpdates.pdf

Overview

General Information

Sample name:	RadProCalculatorUpdates.pdf
Analysis ID:	1524333
MD5:	17c5701f6fec5fc71dc4fe829345f88e
SHA1:	56211a667d1e53a6c6e111a6e291b9a36b2c1b4f
SHA256:	9d193d86b06a17eceeae4fce87eed0116ff01ad16ac2f05c8c7a4c09338ab78b
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global traffic	TCP traffic: 104.126.112.182:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global traffic	TCP traffic: 104.126.112.182:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 104.126.112.182:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global traffic	TCP traffic: 104.126.112.182:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 104.126.112.182:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global traffic	TCP traffic: 104.126.112.182:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global traffic	TCP traffic: 104.126.112.182:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global traffic	TCP traffic: 104.126.112.182:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 104.126.112.182:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global traffic	TCP traffic: 104.126.112.182:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 104.126.112.182 104.126.112.182

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443

Source: classification engine

Classification label: clean2.winPDF@14/48@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3924

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-02 11-33-34-473.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\RadProCalculatorUpdates.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1540,i,16482645188541234527,6887169318165601849,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1540,i,16482645188541234527,6887169318165601849,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: RadProCalculatorUpdates.pdf	Initial sample: PDF keyword /JS count = 0
Source: RadProCalculatorUpdates.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A91lqvsya_c9jk18_310.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A91lqvsya_c9jk18_310.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: RadProCalculatorUpdates.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.126.112.182	unknown	United States		16625	AKAMAI-ASUS	false

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1524333
Product:	CloudBasic
Start time:	17:32:32
Start date:	02.10.2024
Sample:	RadProCalculatorUpdates.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	17c5701f6fec5fc71dc4fe829345f88e
SHA1:	56211a667d1e53a6c6e111a6e291b9a36b2c1b4f
SHA256:	9d193d86b06a17eceeae4fce87eed0116ff01ad16ac2f05c8c7a4c09338ab78b
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	D8FD6DA1D01D08939EA863EE03D2401D	58A49F70D8C7555C3850B53D2CE6EE7FA671DC51	01EF428FE30DE3DC4AB6D5E7DCD8F4A692C747419EF78B1D66E572448037A355
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	D8FD6DA1D01D08939EA863EE03D2401D	58A49F70D8C7555C3850B53D2CE6EE7FA671DC51	01EF428FE30DE3DC4AB6D5E7DCD8F4A692C747419EF78B1D66E572448037A355
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	689E75E9832B342AB1E3FFC56A3E6820	DBE97310982387967D3279501509742D2799218D	B0C6BB2494D6E7408A51FA79C6E9E0CB43DC7B1CBAB37AD0707665C93AE99F2E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	689E75E9832B342AB1E3FFC56A3E6820	DBE97310982387967D3279501509742D2799218D	B0C6BB2494D6E7408A51FA79C6E9E0CB43DC7B1CBAB37AD0707665C93AE99F2E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1ded9e02-845e-4d3f-be2b-db1aa5314bfd.tmp	JSON data	55D63ABA9062B03570C6709A9C012392	F0D88CDB182C1CB86CB2E35505E627592990A848	AD1FAD4F63AE32D4A0535ABD5D0241EE6F6D9B0FA241D0D683EF1FCFA2AFBC15
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	70321A46A77A3C2465E2F031754B3E06	5E7E713285D36F12ACFC68A34D8A34FD33C96B34	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF61a3ba.TMP (copy)	JSON data	70321A46A77A3C2465E2F031754B3E06	5E7E713285D36F12ACFC68A34D8A34FD33C96B34	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cab57eb1-b1f4-4918-895a-8f128a86844e.tmp	JSON data	70321A46A77A3C2465E2F031754B3E06	5E7E713285D36F12ACFC68A34D8A34FD33C96B34	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	E9DBC33297689064330A90EEBE0DF5C6	C126FCE080647A9C6631C6E8C7491B30A4164CCD	AC89C86F7F2E5B86A946C761BB54E23E21CCB82A25F5A67891E0F367C5745F2E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	C89AA092ECFB2591DACA3A4EE600EBCE	341F1A8B07E99F86CD7E35F1A92842B793C0D5F7	14F283403768F0541EB7C39FD228EF64A9E9E04FA080DC66D15D6BF43AB6CDC2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	C89AA092ECFB2591DACA3A4EE600EBCE	341F1A8B07E99F86CD7E35F1A92842B793C0D5F7	14F283403768F0541EB7C39FD228EF64A9E9E04FA080DC66D15D6BF43AB6CDC2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241002153336Z-161.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	347D88AEB7B5324FA50C5784E6A8B4F2	0CCE3B42760A7D5321EE93D4EB55A73CD18AB647	D09AEE97D356B1C6A5FBA75855BB3110D9F4985575C9251B852C386B7CA1FCA0
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	640CE885567FFC4F3C7F5E3922EA9669	206E21039C051BA88C1C037F7CB8E4698F97CE6B	EF515BEFA7B4BD81E218E5DF27405EB83C0CF4455FFF69E7D8D0FA372860DD71
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	0480E19D2238A104889E8B496AEEC314	E8A134FB78E4926D0679830416ACB265F74A0174	AB1F895AE6DE83F66C123EA82A674477A13C9C28EB51AC0A8B9F4ABF1DF5838B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3924	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	87EDBEE38F56C20298F25D5D3D4D1B5C	7F904E9615AC3186A87472EF366DD8202855B0B7	A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	4793335010F86F9B14C70CA999F38664	3659CC60D532A70F3A65BE0917BFFA773F212A9F	25AC5C016D79322C855B4B5D640B03E51705F63E035C384CF1081F9CD810D6BF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	C929DDBFC4FB2A2150390F6FA0ECAAEA	55A9D836728FF45CE10A507D30765282BC6695F6	719E461A49971AF38334CA5D4A4E3511C1B69CC46DCB5DCB1AA00B87312F0ABB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	0D86D0734722734EA0796C2B1EB2EA0D	03118B871E969D7982A029D13A79327D6B8624C8	C3B9A9B17A148E168D6C1C0BD409B8727B081E58C383779599B32854C84707FC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	3212252CBECE179C255E7977355E9069	06B3B987AD33456BF70EBB34B24528F024861FBD	D5E1DB66EE493FF529B4A6D3A8A31EF4FF63F7F4C5EDB23CA6EF6991F5215385
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	60EDA5A97D0031DC093486FBD64F82E4	F15DE37BC46B49796A65C906B9D8E1BC7A81F30D	E19F84A7CD64B1CD9E75F15AC5E4A9FF5279A6EC705049CD8AF756E05D944897
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	F9029B8C608503B940E79225D9486DDB	BC794ADDD2AFD3A3753C4D106ED1E2729A243450	D579E4A5E4A7F9B41ABFF5937B9189F0EF8D3819B83DEEEA69640FE2C14F5423
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	A4A1398695EDBCE7C4B34E6655E304B2	798F1EA9EC18E4445E7146469364382B203A7F70	2815D37882970A4395CAE27823D2ED63246EDB875D9BCB3E29DD396742CC6478
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	E94A83DE76EFC3236576AD6C35549F47	5982F8DFF278F2BF9AE63344C21B7BC4FDB58126	CE3AEDAB3295FCBF506651B9A1B83A7A7AFD777763903C706B233F6A1218D8C3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	AA9C73398E61A436CF0DF64C1B8A2AA1	41058D0E298EB2916BD2674A2B8B8796BD302D5E	3E86A36E8E662796381D8DD32563607ACBE1504F11B9FE8E8D7869B422DC1709
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	78B3855736D467FD88802F100A5C554E	63E99BC80EF138ED69F78562F5606CAC5CD0F99F	51DFCB9EE00AEBA11AE0893A94A7120CABC35D8E27FF857014BDAC0EB34C0154
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	E579CFDD0ECBE6D0E51C97E36B852593	5610120E531D9299A57A648ACBDCB0FFC9C1DF8E	21EB30A04C01C22082837307A60830277B7D2AF33B1CABAE5A8D7C14DC02AD37
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	AFAB2A96C6B5F8A27AFC11E5A9977A5B	6B1729D013478ED95ECA9F21A1657F4E40C90759	04A57EDA61041591E7EFC1413FB9FDBE3F636B2B717E99E62813DA8FF703EAD2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	DD108361BAE6F7899BAE1185BDF59BB1	17ABE48DFFE0322D2A83723FAFB38A4FE65324A6	A017BCC87EACE7306A95FE1C4D9E28F29CC134C77EEFA03035C775E46F58BDB4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	39421B1A24E96A26F0DF16C98FA1C70A	130AF4D5332714A292340CDC06A5365FE0EF317C	A171A985F95FE294B7877A68E1B3D8864CB4B8582D41B3FF44C66DC298C75C46
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	4D3343A6F5805235DCC83E42849210F0	4DF20B6B4F8247CDAE81E698CAA223A842BD6627	770603F26ADF2F07A624891FAF8A13BEE1BD1AA64CA1477595CF133B7D5650DD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	58FFA1580B67D802D1D0B22E1532E85C	DA1F6E5022B32440A9A0516B3B4E33D5C81C22EE	23C6611C96262EF51FB56B92DF38D2EFBBB15CF578F0CE4361DAF14B78449A5B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	CCAD07A7DD942BFCF90FA57ADF54F277	1771CF9B624B4CED8B2DE11BC66DD02BFC3160EF	7CB5E2EB132C06178002B04EAE929F1B1271448CC245DBB98DEEFF490A356309
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	962C378E3360CBDB89EBF9DE55C8EBAF	2765E8F3C8C6899654C63544179DBA4AD7475A5D	AECE846B1BACDC1282EDB79143783FD2A59615EBA6C6E3FB596F5A99609C54AE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	B8EED175FD82241BB509759E63CEEDD7	8300B8CB4738CE538A62CCE81F5CA60FB064EC7A	B3184B096ACA4A0CF4080A1712EE530537F02653B6212FEF22D78FA9DA52C6B0
C:\Users\user\AppData\Local\Temp\MSI17121.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	164B809EC4735C0B015F3CC9515889DB	620344A305390E1BDF066722DAF97A4EBE0F5885	5C86EACED917456F8D218A2556845211DDC663214AB42978159FA4473D22504B
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91lqvsya_c9jk18_310.tmp	PDF document, version 1.6, 0 pages	04BF659A1D0AB26A23B7733C8153DEF2	49C91CCEA355FC2857E5F81E1B84808072C0FA16	FE542B914D74A3BAA9FC8DBE9E4E5D03A7528267708D0D52A113D5DDCE505D78
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-02 11-33-34-473.log	ASCII text, with very long lines (393)	1336667A75083BF81E2632FABAA88B67	46E40800B27D95DAED0DBB830E0D0BA85C031D40	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	77C225ECDE080C3B0E59E17C0CF6837E	0BCAD5FA8BC860CD935DF502D8A91D11A329F98D	070EC8FEC734A5271C55BD5126F49ECA7302AB003CEFAF136EB53B94DEB1FF0A
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	B5EE236F2C9E2938A3E9814CE9DF31F5	2B89CEC87A46F94918CF3133361EC46C69B6A3B4	D8FEAFFF5F7498AC7871790985587C6EECA7B72E34ED85E358FBB59D35E896D4
C:\Users\user\AppData\Local\Temp\acrocef_low\192b4b42-1dd6-4d80-a354-b4fc7c72dab8.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\2859a1c4-cb5b-4614-beb4-289634e77214.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\7fecc860-051a-478c-aafa-b97c29776605.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\cf97a0f5-13f6-4b11-ab0b-b8b907dfc1fe.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837	96E2EE6506759519A5E3E5E550F28388	477522A699526F3EC2270AD0B3D3B8D6609F8BBB	D135FEF8231B87D1F758B3D31FC5467BC933321F7E8EACB316F933DBA36474D5

Windows Analysis Report
RadProCalculatorUpdates.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report RadProCalculatorUpdates.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
RadProCalculatorUpdates.pdf