Windows Analysis Report
CRANSTONJONATHAN.pdf

Overview

General Information

Sample name:	CRANSTONJONATHAN.pdf
Analysis ID:	1525186
MD5:	acfd79294b7a2b428b071bb757328866
SHA1:	08e80fdedbd891ab484c05e65e77f69bf8b36684
SHA256:	61353ab9c07351dd768f95a2c39d71d109c75f2e9227b2eef6bd26283cd8ed87
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.41.168.139:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.6:49729
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.6:49729
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.6:49729
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.6:49729
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.6:49729
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.6:49729
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.6:49729
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.6:49729
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.6:49729
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.6:49729

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.41.168.139 23.41.168.139

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729

Source: classification engine

Classification label: clean2.winPDF@14/46@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-03 14-44-01-611.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\CRANSTONJONATHAN.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2204 --field-trial-handle=1588,i,12537562669909444829,16526735775559190256,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2204 --field-trial-handle=1588,i,12537562669909444829,16526735775559190256,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: CRANSTONJONATHAN.pdf	Initial sample: PDF keyword /JS count = 0
Source: CRANSTONJONATHAN.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A919hrw6g_14yuoh7_22o.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A919hrw6g_14yuoh7_22o.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: CRANSTONJONATHAN.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.41.168.139	unknown	United States		6461	ZAYO-6461US	false

Contacted Domains

Name	IP	Active
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.34	true
x1.i.lencr.org	unknown	unknown

ID:	1525186
Product:	CloudBasic
Start time:	20:42:56
Start date:	03.10.2024
Sample:	CRANSTONJONATHAN.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	acfd79294b7a2b428b071bb757328866
SHA1:	08e80fdedbd891ab484c05e65e77f69bf8b36684
SHA256:	61353ab9c07351dd768f95a2c39d71d109c75f2e9227b2eef6bd26283cd8ed87
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	431758562A4ECAEB2D831D1A85973AEE	FB301A58C0520C1C773D661305F61BC08474DC8F	73BDB676C21A0D361EF33947BD4253D78F44EA10070505787B8BBBE159BA7FDE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	431758562A4ECAEB2D831D1A85973AEE	FB301A58C0520C1C773D661305F61BC08474DC8F	73BDB676C21A0D361EF33947BD4253D78F44EA10070505787B8BBBE159BA7FDE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	DE8AD3B89449A762C4C54D7291F579BA	1AD87E783CDD90DC1098B7F801AE199E5DF427F8	B2B1E30C7F96C1A4F27F1FC3D5E298781E64C4AE2DC93D9351DF08B23520E551
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	DE8AD3B89449A762C4C54D7291F579BA	1AD87E783CDD90DC1098B7F801AE199E5DF427F8	B2B1E30C7F96C1A4F27F1FC3D5E298781E64C4AE2DC93D9351DF08B23520E551
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	CAC0EBD8FA16118F4BA2A7C01E59610F	003CE17C70A5C14EEC4E18CF655A1B56CE511378	9EA13965D66D9DA926DE04C79D9F686DFBC47E9A33ABC4CB2183D5C6E3E02C73
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f255c1af-ab5b-4ea7-81a2-73bc3578dac4.tmp	JSON data	CAC0EBD8FA16118F4BA2A7C01E59610F	003CE17C70A5C14EEC4E18CF655A1B56CE511378	9EA13965D66D9DA926DE04C79D9F686DFBC47E9A33ABC4CB2183D5C6E3E02C73
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	89DC024E42542F58DEB46FC86EF1FA9C	9D133C68115E6A9C358DD54875C0387B0D9E6989	34C1D9786DA04D01E986966CA8F7CB750086FA222F0C9989F7F32DC8DC692089
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	AD9E2022422D8802127B3DBB4C071A50	A75E557E8C215E78278BF74267D79CEA865A0700	07BF7EFA0B6AA47822CD80DBC834CF6D749E64302124D9E2FD6EB2625A9DC179
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	AD9E2022422D8802127B3DBB4C071A50	A75E557E8C215E78278BF74267D79CEA865A0700	07BF7EFA0B6AA47822CD80DBC834CF6D749E64302124D9E2FD6EB2625A9DC179
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241003184404Z-169.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	938ED2CF7753BC9B484B6241A41C2AA2	7AA5A65432A2205F7968C69E8EEC901E121CE301	01A3ECFC805580ABB4DF13A4E8E4FA90E644D8BE23EB9EB770637D6C92F18F29
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11	6760E33366A7833EA20024F92BA28651	8D1E009F29319E59C1424AF710D54D8ACA778DD7	4E78936FE334AD6D344F62E6F1D8CCB7D8E0F42A524211608FE492FB48CB6D10
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	7FBBA7AB7EE7B637D2FCD851D2ACAE1E	3001BDEE08D0AA0AC6B6614D8746A1796B2AF14F	594D414867D3D50267599CE3547F9F9FB9C25300FED17A3A59D86F44D18092F5
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	8099FE7B0CAFE44FE345308FFD556BA0	DB7496E5DD6D03A8CED988ED568969746B152042	4B2A80DDAAD9E114FEE4DDD2CEA4E0FA54D8E46791179FF17E33EBF59496C570
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	1F628C9883F5169E0D28BDEB2BB8A040	81075EC88311DBF38F8FDB9B0722793E6D41044C	2D0D3C70AC84037264D8C15A658921C1A9634969266812D1D79F75C3991FC87A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	265E3E1166312A864FB63291EA661C6A	80DFF3187FF929596EB22E1DB9021BAD6F97178C	C13E08B1887A4E44DC39609D7234E8D732A6BC11313B55D6F4ECFB060CD87728
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	2AF7F7DEEE5F15BE84BB2EBD1004ED3D	F2A8CA4000EC3D9719870B830F718F36061B499B	972AFA1A855850B7866F85756F948FF09DD10BCF6886024D44F078E6B5CFED57
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	FC3306A44D222A8283B6459187BACC29	62C0A0EB5AB057EC982529F542DDB6F4CD1549DB	0E6D732E75B49310CED74E15654835EB6D6A867FA04116B939EA6DE808A407AD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	55D60E4C7E7E3735FA879D103D15711F	FF1A51D479FA5013137B21D4A7996E6AA9F7F6FF	D18FFA3C66D1479D8CA7437260BA874EA9921C52B537442A5960A45183DE33A7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	BB63D5EFE0D96DC4094E774EFC832C42	40FBCC3FE7A2621704280B2B3604D9F6621ADC45	37C67F06D755D436C63DB1795E4F6E216998F7E90A337FABAD0BDA20F908B5C0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	CB2D9F69958420DCCF93B46882AE96F9	F12BC8AB8996B83A7802331BB3A556A7648A08AD	53CC29E09190B01BE9288E37D6950F7BE114182F39CA3350E1DC6AFDF47F4E1D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	C9AD8AE72D23BE8A3F4EDE4782FC6C00	BCF951452F5800CAF138B67981D2CE94557B7489	E360F7A50EFE60B0244C57E5EB3547C2A4DC27D4D293CFB1AB8388F66529DD35
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	4B2A775813BEEB58236F2141CF5A2EFE	E92E52A15EBBF4FB7A88FF5445D465048EE846F6	7DE92A24A89E3D21D81F500F8DBB2999A23C993395EAAEFAB81D4D9AC12EF3F5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	409ED9BD8CAC8FD2D94682A1A2E7BAAB	489DCE24A0D07BA7D833E126108E4A35C4BC93AF	B29F8C82204407DDFE54DFFCD810CC3C33750ED59763ACD5060669FB3BD96D19
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	24AB42B85317EE1D9AF3626C9DA2C6A9	DF1E71F4499F4D2C303CA395324D2FBCF4EDCDAA	E478697FBFE78F3ACD33850E21C9CCB8FD83438E416A552F68DB73A6F75FA57C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	CFC9A6F5156317E62BC046BA6971FB07	8618D1515650324286EAE3176F5CB53FDC2881DB	65453B7B58DEF884816B3A8AA478CF6759B1FF97116446439889920D0A4C3B1B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	A39F82030F835233D0AFE9989CC57600	2B2F1181EC86426A4F2AAC31CF738AB2CAF4E1F0	80D6195C16EE6854AAF08241EEF802BF83949E81D2DEC0BB9DAFC5C4DA6B7C98
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	8FB0E667A2303A0E88EE9F2B378E8268	73425126C0AC275C737CEDD956877FE1D41D6929	C40AA2399A6D59B82A676409367494F9F199C569272A5CE0A6DA227589FD4CD0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	F79D2C86668302B4D6AC437CD763D77D	FCC21A91A7C74DFC8F533A8CA6EBA28F3A744958	12E9E49F5C4EC7F7E3510EF7D9DF23DAA49D90A039ADC0CF60ECBB1486FE04DB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	771C9B1822FC865988AF1A2361AFC6FF	06B868AF9422CB7AD6F9A1D30E811828570A16E9	7F8274DD9A9668460EEFE3813C9EF4ACF6976827296DC5EA51880A1880F12377
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	E372765EAAF21C240C1F7FF51503E3D6	EB4C5ED5CCD63B8975D536935792EEAF8E6BDDDB	4BA01901F122D28BBFF292A76842983433AC94FC34DB66B8549052D7E4DE9B93
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	1E9950327F2DCAF46F048848CE6A1FFC	221AADC4A35986ED8A094DB447AD035A00123B9B	977AD2BD6F920EC27CBB576646605A2318F47BB3ABD9711C29EA5379270E8991
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	666D2D0269515DB60F4ED999D5D54935	84DF2FDA56B9A24FFC58058D74DA5CC1E8290FFD	36EB36C51DA1405FE429D82BEE3F99F76D694C4A15840AABC1C49376997CB52F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24	13C64C17561002C9E1737BA774883920	B5F11504FAF821FADA1C02E8E557465355C6EB45	BC215D01D211054D535E52B838D6A1536EF66B97F480F7D88ACC5D183B4ED671
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	001587ED14C7518016EDAA199CA8B789	5F4D32E28FEE0937398A3636F50C9FA00685B53A	6A844A3B6519E6C6D49EDC74BC2E7BC8495E4229BAADDEAFBB051B94287CB598
C:\Users\user\AppData\Local\Temp\MSI3cbf7.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	80D025FBD889C32AE41AB4E1EA1A11FF	2E5163E9D3A0749D073A7613648AEE4584F6E303	C0EF13AA7CB5F7BDC319890245E57B2B950B2484E6D6FEC58E98BFDC8F970AE5
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A919hrw6g_14yuoh7_22o.tmp	PDF document, version 1.6, 0 pages	989565DE40604F8931EA662AEE06C626	F951533527CE4DC73EEC55DEBAF5AA942C5E74FE	FC1E84522B5BB62448B81685336C73970EF88D53DC587AC6E330555D9145F45F
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-03 14-44-01-611.log	ASCII text, with very long lines (393)	128A51060103D95314048C2F32A15C66	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	53C2CBD6155BBCCCDAA991802B490181	DC132ED2E1025CC2DA8D6B1E7AEC0720233DE683	ACB23290BDD17B95666CA0B86B2A9B22696998828051A63BC86CA166BA1BC22F
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	8FD4AE976A770A79FC82132A9587F35D	653DC594ACADEC8CB7114DE7AED2013A096CA58A	8184D726E84A38BFA661114948256A6B27CD3C1C2C6AD22AE0A29CA53872C584
C:\Users\user\AppData\Local\Temp\acrocef_low\214117c8-e7b6-43d6-904f-9f1afc2f78aa.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\6215ddd6-a2bc-4dea-8cd2-5d1347211bed.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\90bf3d38-30cf-45d2-b07c-e7b6ea51d87a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\f56d499a-5862-40c9-8876-bd0c66d4b213.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685

Windows Analysis Report
CRANSTONJONATHAN.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report CRANSTONJONATHAN.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
CRANSTONJONATHAN.pdf