Windows Analysis Report
Pay Stub .pdf

Overview

General Information

Sample name:	Pay Stub .pdf
Analysis ID:	1528308
MD5:	9abafe3432608a88c8786540512f9696
SHA1:	d9192ddd916d2b3a09eece3498c86eac5e3d3125
SHA256:	c9f6afa2a0221680f98c6893e48c45701d6e80a100a05179fb8a6a9ccbad382e

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 23.203.104.175:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.16:49717 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.16:49717
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49718
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49718
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49718
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49718
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49718
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49718
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49718
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49718
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49718
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49718

Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: classification engine

Classification label: clean1.winPDF@20/39@1/16

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6984

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-07 13-08-24-439.log

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Pay Stub .pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2056 --field-trial-handle=1568,i,12771086922530842713,2068329658079769137,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 7BC9975AAC5B89F538735CFBEA8992A0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2056 --field-trial-handle=1568,i,12771086922530842713,2068329658079769137,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Pay Stub .pdf	Initial sample: PDF keyword /JS count = 0
Source: Pay Stub .pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Pay Stub .pdf

Initial sample: PDF keyword stream count = 21

Source: Pay Stub .pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
2.23.197.184	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
52.202.204.11	unknown	United States	14618	AMAZON-AESUS	false
54.144.73.197	unknown	United States	14618	AMAZON-AESUS	false
184.28.88.176	unknown	United States	16625	AKAMAI-ASUS	false
23.203.104.175	unknown	United States	16625	AKAMAI-ASUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
87.248.204.0	windowsupdatebg.s.llnwi.net	United Kingdom	22822	LLNWUS	false

Contacted Domains

Name	IP	Active
windowsupdatebg.s.llnwi.net	87.248.204.0	true
x1.i.lencr.org	unknown	unknown

ID:	1528308
Product:	CloudBasic
Start time:	19:07:51
Start date:	07.10.2024
Sample:	Pay Stub .pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	9abafe3432608a88c8786540512f9696
SHA1:	d9192ddd916d2b3a09eece3498c86eac5e3d3125
SHA256:	c9f6afa2a0221680f98c6893e48c45701d6e80a100a05179fb8a6a9ccbad382e
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	54BEF284D0AB6A8D1039C88FECBAC81A	35697A9CA3F83D3A0DD8F79B598566774D55692B	F96F06E639D743DACDC950B28253DDD65E9ADBA4D4E82C6C0792623A788ADAD2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	CD3BD24E1D3FAD41179411D74AED32B0	8E1BDF26DF31ADAB028B96839440F092F6682320	CAF9905DB5064CA02434F5729C6F3CB7FC0BCDFCB56D553159AFE78377373AD8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	CB9CF2DB78F2EC83B1955935579C0106	709441C35FC1DC2E27A6DB55988ABB0629355985	574BA2616F3120338DFD2DE4371D923919E3E5D839E68B2266A27767D1C2ADC4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	0B1E37C3F82B13EAF2F81531AC31071B	E3D125A9C3847C2BBFC7B3E33D00BBBEC26016E6	7CED27844EC4C80B8B4A252B6C51D1977D15F289EE9F5E2722100830860383BE
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241007170827Z-207.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	54C738F7F0A84969BF04F13DDD0E9A06	0919BB4572DEFF946F3A5739F21DC759AE275B4E	9F68421D216467466167EC80EBE52C44A1465288D841CD53CBF8D586D53E57AE
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2	A4D5FECEFE05F21D6F81ACF4D9A788CF	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	9FFBE4B7A7D2396A7225F26A7F3AA4B1	D5EA6367DAD5C38FE5739CB31D0167039F327A3E	DFC338354206AD15923FFD66AB0FD8166CFEAC5BC4A0B0F1925EF2BB5D4C2CE7
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	66A74723957B6BF3BD9939ABED3CFDF3	DC4F8CBC53221B26E23822112B9993C051387ECC	263CA4C183E8DBFAE16862F2C77841E0FC933E5E2E2597085565286E9D2F6EA1
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	EDEF2BEF86B468B8B584543F4399661A	933A5341E438BF858ABA09CC739C36924C951B99	3510A0D67059F0F486E48136DA34F841F7BB6E3AED27F526629AE2614DC19A2B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6984	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	A3E11ADF7592C269EFC50241C1D495ED	613BEE0968B9D0961934C97D5459AFA4F67520A1	4BFE8A8E1C12A3445E98C3102B6EF0104B868DD77C716BAA4A3D07C8724625E1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	4D2C763D02FE89A70ECD2CC5EC6AB42D	DD01EC98C31628CF0E5218C1158D8921FB355D2A	22584A0051EB64BA9763D5340800A89E1636E031DC52FAC6D201DF5C4B092E64
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	57ACEEAA593AC87ACA7786C3A5129607	67DE492DB149545493A9D10B23C071519CD2D42E	A03C4AB7C7AD5F804E7AFF74097F39DFA73EDB9E32CB7CC75042E331392E4E6C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	31B778A5EDF4F67F6CF6CDD04878C196	713BA481E510459354CB5209F9D4FCBB8FAC0077	36A213D8BBD5A90DDCF836C94300839B1A1B983DB3AB37FEAC94E17917598C4E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	7115EB7478E3A175EA9D9E550CB34E9B	F54C79CC59A25554EA5E806A7F08151881AF9E64	07F83C1DCF7A93F9B5DC8BC385AC2541D138AE524ED605A15E60FF2B2CCF6154
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	D32D100905B6291DFC07F2EC94AA42BF	8A04AEC45740B7D7CAA382A01BFB7D8B70E6FB91	446FB4AFB1B4008B4BB08E3F3F7EA6E568C4448FC51E6E1D9D4ABEAC67DED9DA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	C30AE23191EBD7F9E1D678DC25B53A67	FCE87721164E75B4605A1B578F5446A803A9713E	729F43CAF31BDC5D155A6D2CA8C8225E8CD41C91B1F535A1C2DD4C798B164F4A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	81F4B99FFDCC29605998755DF37A66ED	8881B6C58E44F80C76F02AC814757040A0BAC055	4A9C22E75E134C7DEC77631DEA3D926931215624BEAB89B7BBC14669F065A857
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	E2C5B9248E74BB343B888C49F43254F6	ABA336EFE2038284BE2D0A8645CDC214C76A2A0A	A1BA3C43822E890A07C99BA209060ACE886CA60B0062A3C5AF24A13CEB10AF07
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	C336CFB8ABA2735134F08039D827C9F7	B5BE8CF92A5E1F10309453603A3D8DA9B3954332	CC15C3E31458E0565EB7A68267094CEA9BF12E14668360F43BA242419A3CA437
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	9883E51FB3183ABBBB87B197F4699DFE	31AECA2DC9310549BE54830A3A272207CB6C3DAF	68E557E04723F7C59DC2D0A8A183C66FF99DAC6BD86A2832310EE12B581E621E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	B8D6D42102B8A5EAD8D143500219F29F	F818A68E3C171BE08FEEC3E963097EBCB0C446FB	EC7BC73AD022DEEAC4E53D077B2CC2E4E66A48DC216EF282D3DEE944EF0A0465
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	1DC40A18EC58C017AD6CC269B61D318E	F11C219E3421200B0A19FEACB73465B290B73309	2470B93A097BBF75CD3CA4F21C708517CE301A9FB534DCB87D56C52CCACAA9B0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	52B7471975875D569912D56B12A414B0	5DD953DAC68912A3ED184706EE707986856AAD8D	E0B3A7F562A64B770E4A7177F1F7A2574D5204FB2E0F2B4F8823B73424B7698D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	BC4B6ADC9FC14E27FECB120C3B7C7962	11689C4D286C3D838A7DF5752E9EF71AE19D4E27	D82F94A22869E18EA8B02EBEC518113456CC951FADE14C60B0DB308C4D7E5465
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	D2CADBECCAD07CB1A28BF84DDFC4CDDE	C7DA2354E0CF699C0274500E3BD7C5B17820E206	0DA522E12428E7FEFFC46961C999B7815DCC36DF82796D9B23CD7BCC1EFD0F1A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	005CD296963B6665A157A234011BD094	283F6CC86EAFA44D43F2F758073B6FA1A78899E6	1254D777773E88F1D742957E75C81DA6F4A395CC37F388EA0D01B2D39F9B69C2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	194E1C0ACC414A36669E215BFC128D9B	B1A52DFB5EC486852E08F47CA41E77B51A2E8424	F4AB857C3B0FB495660263BE005E7714DEA599462EC483F8D443038257ACBC88
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	E51CB909662732EBA5FD7A88291F6251	5EB722D6DA9C18347EFC7308F1C7E8AF0C1291E7	A28AEBA2CE806EEB10D011C91E5160F39B1796473C966F8C18331DB01748E656
C:\Users\user\AppData\Local\Temp\MSI86795.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	0A31A67230A3ABD8A515422B482E6335	4E1D12F9367AC21480CC500401B4B826414654F0	4B247E69A4EABDFBCFA5867BC11C6CE6215DF876DD2A66E68E4C052200C95C82
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-07 13-08-24-439.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	92DA63C660CD646DA3A59C6CB9F684F9	0E5E5B0E028F00A606E9207B5A7F2B2C157B624F	BC968D543A64CAFC75070FEDD43F5FF114D8EE036634A6772FCC0AABFD92C769
C:\Users\user\AppData\Local\Temp\acrocef_low\11c1fa4f-3075-4c75-8e8d-b410efee1c8d.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\51b8d127-9e66-4a2f-a0b0-a6bdb9c67fe3.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\8a8fec2e-7f4f-476f-98bc-ef2bbb65e397.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	716C2C392DCD15C95BBD760EEBABFCD0	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
C:\Users\user\AppData\Local\Temp\acrocef_low\d981f384-3c34-4709-8b5d-5ecd5874d4ea.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	0A347312E361322436D1AF1D5145D2AB	1D6C06A274705F8A295F62AD90CF8CA27555C226	094501B3CA4E93F626ABFCAE800645C533B61409DC3D1D233F4D053CE6A124D7

Windows Analysis Report
Pay Stub .pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report Pay Stub .pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
Pay Stub .pdf