Windows Analysis Report
AC0fd2c0cf3abf2f5620667e2e79b270cf-2024-09-IVb259e02787a5bfa24f06d0c81101aff78115640656826087324.pdf

Overview

General Information

Sample name:	AC0fd2c0cf3abf2f5620667e2e79b270cf-2024-09-IVb259e02787a5bfa24f06d0c81101aff78115640656826087324.pdf
Analysis ID:	1528323
MD5:	753cf6d7cfd7752e032aadc9d90ab1f1
SHA1:	c64edc3c1f71a5b577b8d911ba4857b6327a65d4
SHA256:	f71e519d33533311e32a03dcef0fc597164e69400b5c18aafbbe7c89f4ba4dd8

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs DNS queries)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: classification engine

Classification label: clean0.winPDF@17/42@1/53

Source: AC0fd2c0cf3abf2f5620667e2e79b270cf-2024-09-IVb259e02787a5bfa24f06d0c81101aff78115640656826087324.pdf	Initial sample: https://www.twilio.com/console/billing/preferences
Source: AC0fd2c0cf3abf2f5620667e2e79b270cf-2024-09-IVb259e02787a5bfa24f06d0c81101aff78115640656826087324.pdf	Initial sample: https://support.twilio.com/hc/en-us/articles/360025603913-invoicefrontpage-reading-your-twilio-invoice
Source: AC0fd2c0cf3abf2f5620667e2e79b270cf-2024-09-IVb259e02787a5bfa24f06d0c81101aff78115640656826087324.pdf	Initial sample: https://support.twilio.com/hc/en-us/categories/203267647-Billing-Pricing
Source: AC0fd2c0cf3abf2f5620667e2e79b270cf-2024-09-IVb259e02787a5bfa24f06d0c81101aff78115640656826087324.pdf	Initial sample: https://support.twilio.com/hc/en-us/articles/360022524974-InvoiceFrontPage-How-do-I-Update-my-Billing-Settings-
Source: AC0fd2c0cf3abf2f5620667e2e79b270cf-2024-09-IVb259e02787a5bfa24f06d0c81101aff78115640656826087324.pdf	Initial sample: https://www.twilio.com/console/billing/
Source: AC0fd2c0cf3abf2f5620667e2e79b270cf-2024-09-IVb259e02787a5bfa24f06d0c81101aff78115640656826087324.pdf	Initial sample: https://support.twilio.com/hc/en-us/articles/360022561474-UsageDetails-How-to-Read-the-Twilio-Invoice-CSV-Supplement
Source: AC0fd2c0cf3abf2f5620667e2e79b270cf-2024-09-IVb259e02787a5bfa24f06d0c81101aff78115640656826087324.pdf	Initial sample: https://support.twilio.com/hc/en-us/articles/360025603913-InvoiceFrontPage-Reading-your-Twilio-Invoice
Source: AC0fd2c0cf3abf2f5620667e2e79b270cf-2024-09-IVb259e02787a5bfa24f06d0c81101aff78115640656826087324.pdf	Initial sample: https://support.twilio.com/hc/en-us/articles/360022524974-invoicefrontpage-how-do-i-update-my-billing-settings-
Source: AC0fd2c0cf3abf2f5620667e2e79b270cf-2024-09-IVb259e02787a5bfa24f06d0c81101aff78115640656826087324.pdf	Initial sample: https://support.twilio.com/hc/en-us/articles/360042138913-invoiceinstructions-payment-options-for-twilio-invoices
Source: AC0fd2c0cf3abf2f5620667e2e79b270cf-2024-09-IVb259e02787a5bfa24f06d0c81101aff78115640656826087324.pdf	Initial sample: https://support.twilio.com/hc/en-us/categories/203267647-billing-pricing
Source: AC0fd2c0cf3abf2f5620667e2e79b270cf-2024-09-IVb259e02787a5bfa24f06d0c81101aff78115640656826087324.pdf	Initial sample: remittance@twilio.com
Source: AC0fd2c0cf3abf2f5620667e2e79b270cf-2024-09-IVb259e02787a5bfa24f06d0c81101aff78115640656826087324.pdf	Initial sample: https://support.twilio.com/hc/en-us/articles/360042138913-InvoiceInstructions-Payment-Options-for-Twilio-Invoices
Source: AC0fd2c0cf3abf2f5620667e2e79b270cf-2024-09-IVb259e02787a5bfa24f06d0c81101aff78115640656826087324.pdf	Initial sample: https://support.twilio.com/hc/en-us/articles/360022561474-usagedetails-how-to-read-the-twilio-invoice-csv-supplement

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-07 13-20-58-721.log

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\AC0fd2c0cf3abf2f5620667e2e79b270cf-2024-09-IVb259e02787a5bfa24f06d0c81101aff78115640656826087324.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1564,i,2100869641541677731,2839004751507369714,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding A321031F7DB06867927B45B267C21287
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1564,i,2100869641541677731,2839004751507369714,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: AC0fd2c0cf3abf2f5620667e2e79b270cf-2024-09-IVb259e02787a5bfa24f06d0c81101aff78115640656826087324.pdf	Initial sample: PDF keyword /JS count = 0
Source: AC0fd2c0cf3abf2f5620667e2e79b270cf-2024-09-IVb259e02787a5bfa24f06d0c81101aff78115640656826087324.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: AC0fd2c0cf3abf2f5620667e2e79b270cf-2024-09-IVb259e02787a5bfa24f06d0c81101aff78115640656826087324.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
2.23.197.184	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
184.28.88.176	unknown	United States	16625	AKAMAI-ASUS	false
2.16.100.168	unknown	European Union	20940	AKAMAI-ASN1EU	false
107.22.247.231	unknown	United States	14618	AMAZON-AESUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.210.172	true
windowsupdatebg.s.llnwi.net	87.248.204.0	true
x1.i.lencr.org	unknown	unknown

ID:	1528323
Product:	CloudBasic
Start time:	19:20:15
Start date:	07.10.2024
Sample:	AC0fd2c0cf3abf2f5620667e2e79b270cf-2024-09-IVb259e02787a5bfa24f06d0c81101aff78115640656826087324.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	753cf6d7cfd7752e032aadc9d90ab1f1
SHA1:	c64edc3c1f71a5b577b8d911ba4857b6327a65d4
SHA256:	f71e519d33533311e32a03dcef0fc597164e69400b5c18aafbbe7c89f4ba4dd8
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	F0261DE29C2B640ADDD5384166129E3A	2BFA3D5C2A1B3EF34B097A640C1C94CA1D3295B2	131F1FFC30C6819352B262AD927199EC7C9904ADA3D49D53D9DBCC91CF0A7DD0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	6E5D40AA035B9D3B8C2E3EF86D9E7E1A	3367612C3A63270A14B691D41D389AEB7A9B313B	A6810C64690F7D953FF13B756A04DB841509AEC4752392AFCDC56BC70E9ED00E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF487178.TMP (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\aa7858b8-41d4-4971-b311-d90fd8f58ad9.tmp	JSON data	173DC84B0E0BB3D8D46C97CC8D6CFED2	F6FE3F64C3CD0E1928961633550573660B1DCDDA	414C8C77FC1AD8805E73788A83C799CB3E405BA2DE467E24B48C6A1545BC9FC1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c1fd999d-8c58-4e71-9645-7a12333e0d72.tmp	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	ED51985659D2E18814A14D4357F345FD	46B75EAA6A43D3D88461E19EBFF54135E87BF8B8	41F6078EAA110B8AE1CBC947B346D0752F1034B6739B20381808836890377BC2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	B98DD647BCE3898071170A5116C52AB6	64D5CF8245031CDA9DA1534F2286533BF1AC344D	E95A81D23EAFF262F2867EA44F6554D759EA39FEC23ADC08BDA696DE2D2A1477
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241007172100Z-167.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	A5DAC6C83F18AEEE86380E64F75F0801	D9CD2206B14DA57A4BD954D74E76FC68411ED07A	B2FE39203340BA431A25020D3CF483BB0776A3B8C821B228A59C12AC8C030CE3
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2	A4D5FECEFE05F21D6F81ACF4D9A788CF	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	B20B0CBB1EB915DDB02AED460D920AB8	B4724D1B4CC9D3292C08D6C2E49FAE4F1D129D0A	D38D5A550D38FD85CA4A6DEE3E18C2743F77E6C802B17AFD72F44823DF61B80C
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	1ECACA9D8460A0C863382A4B8D57641E	840A00F0C7619B861A6D765187E2268514D44F06	8177C09254CF19DB9BC9B5CD995C5AC23B598AE3AC27FD89DFC725539D7155CD
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	1CE0D279C42304EFE087AED9C15640F8	6B3FF7AA9645569932F27D0C4AB3B91D6A2F2D24	A35215B7FB9965C08773D28170FADC5125A72D8070BF4E3B843430630061AB29
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	176A46B18CBC64FF097E5621C3636F19	E89D09C7C2DB8F40226F026BBA09610C5E6EB73F	F1049377763398A5D507A37197286C5D8D193521AD2848F23006249835FA25D7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	618248B937B815C0C42FDF2C47FD3016	7E863704EE9206C6C39BDE137696A30D7625FCE8	382DA3FCAA039B815EFFEB0396D177BBC388BAE04983A01797660FABF7188FDD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	E937E21535112F1CB498601E3C60CD97	DE1843A296CD12367DC259CE26BF26C4706AE3D4	7475F20DCC8B8EA163F3D56BA335DDB784154558DAE83F12B39B684452640A47
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	7428D0C1E78664789BCA43E2293FBAF3	CA9490F7533013ACD37993AAF9C6720E2EC134A6	A556833F643AB2B05535A789797000C4CBE43F3E58D2E8CCA56FCDBD6822EE3C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	04F5271B315D2BC1837A2670F62B3C99	8AF846C8FCA54E961331B85419D6E7859E777F25	D34F4B204C6FDD46DC7E2E59B60A99F54B9A066E3298A8BC7875ADB9FA20DADB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	0545292FF66934B5AF861A5E6A5EB8E0	74BC7D7650C133C1F99C8D8FD7DAD732A7F0E8BC	A2FDE146D76A382586C35AC2391388EC5A9A8CD2BBF384556C6E4F202200877F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	E6A7E823F53B2CBE699D111BF85D4949	75FC318E1C27E1C6D68F29B266D3B3AFE227F919	87ED42E1588C51E30D64ED7287094784FF812BA2B3AFE6F61D6058D7D65143EC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	512C9AFF10FC8DE74EA2C220655F6344	63D2296EF968ACF4C4EF1183AE1AF65056C16740	FD9A891740804825C24BAED5E1735DF999FB2D4C0411F4AA5B8025F9C92F4BFE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	0EAD656822EFE378589DA74A8B07E5B6	8898EBF9A0D60A664BA961749FFB25D80174C4CE	BDE18DF5EBFC751695DB5BA7D0CC8F7F06111B1E2B9F8BEDE6610ED689B673B3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	B9A5D787DEEE03E495E55BBCE90B5876	314F81A2103CE23C3148A8FB049BA9E39E3F073E	FC82224B9B30011F47C231D8F98F60FC24CA19575875E4B611E1EA59F49E51EA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	CEAEBF7A9CCA8EA100EC3B751E778DA0	0A8C0AA43C853CCF81059686164306ED5FCC401B	9A7F31838C123DD50EADF67D59B21147981717D6B0060CF43B8309BB42C95435
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	9C5DE88AE39211995A29A847F9061CB7	9C5F85F7C12DF1715AD87C42ED7527BFF340AA96	6529B662D05BEEBF3F4859FEBDED042B437FD62B6B381E1401D75DDBC6B53EF0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	929D6189DBFA72C2D30F03FB41CB2C3E	A8CD0A700B63A036C88C0C2AE25ABC39F367BB92	155DC169F81510283B601B1B2EF83ED5E46D7312B70FBC54B79762319846606F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	D3BB47C5C4F092D5579F1A2901DAB84E	51D109E3FB457386F97F1C32EDCC7ACC00A18AC8	5562CEE2AB303A93E32AA60E2F397D777FCA5E63479C7DCC9F3CEE04598FC608
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	49F84411CCCD7C858B74D3BA7F3D254F	98A80DFBBACC53FC0A63D314F98492ACF2226920	73C36E463A1F079338DE910B85BA8AA51283F695F5DAFCD3A4D9FB56AA263283
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	F3B9DB57BC5843FCA8B3B93DED87CE7A	FF0FAE62A923DD382B86453FA04C417DB7181DCB	897AC841057EAD438C62E76591EF9D730758848790FC928C9D7E7D5EF994E116
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	8FD100768659C97D3D17E0ED6D600584	1E61BDF1189F442774271AD76FA5FCFF8C3E267D	56AF7A51592E27DDDB8EB92F7FE73E4E957BA354B14ADBDDC42583BC0978AE2C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	59FEE994C8165461E9730FD850812F61	52E677BD92414219B8D8C65230AAC05A3EA3B891	6F964E8EE6E8D83070D7AE5B9ED42BFA073F5A48D69D3A890C685F9665A53DF1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	B6AE232BC7A130CC4D6E8C2B9DE64962	C4D9312C4B67C083824998A2B2B23FADD813A995	AB0BF9737790E6F5FFB94FC4542798FFB7D19D892E0777AA373550F7E38BCF4C
C:\Users\user\AppData\Local\Temp\MSI764ea.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	03E09B9C04CE3A1C65FBD645074418E7	9064FAEA796B19ECE5873C15241BDA9D0DF61EFB	8534C021046F510DFA3B8D3C58B4325845328FD40986DA9E41B105C8A96D7E95
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-07 13-20-58-721.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	440D4D771F08E245E8EDD32CF3FCC588	2EFAF92A9F295BAFB3844FA409CC7AFF6AE44C73	A95B9CDA7905A2C7E5F4AB2648012B9C814B196E2662E7BA92687EABEAAE4F70
C:\Users\user\AppData\Local\Temp\acrocef_low\090431a3-13f7-4ee5-9638-d237d89f811f.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	1D64D25345DD73F100517644279994E6	DE807F82098D469302955DCBE1A963CD6E887737	0A05C4CE0C4D8527D79A3C9CEE2A8B73475F53E18544622E4656C598BC814DFC
C:\Users\user\AppData\Local\Temp\acrocef_low\8a0f7221-b922-4c96-94de-0fe5cbc0cf16.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	733564CE55672FD4189BEC28E939DE63	EFD2F3DFF9E49EF5324F67B6937E792BB8D277DF	3EFFA15F3CECA764012CAC27DA2F856F533D444FE35650AAC9CA555DF13E6903
C:\Users\user\AppData\Local\Temp\acrocef_low\b0a8962f-0971-4c53-a5fd-1a9a006f07be.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\df8b133d-6f20-4855-a259-a227951d6bf9.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B

Windows Analysis Report
AC0fd2c0cf3abf2f5620667e2e79b270cf-2024-09-IVb259e02787a5bfa24f06d0c81101aff78115640656826087324.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report AC0fd2c0cf3abf2f5620667e2e79b270cf-2024-09-IVb259e02787a5bfa24f06d0c81101aff78115640656826087324.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
AC0fd2c0cf3abf2f5620667e2e79b270cf-2024-09-IVb259e02787a5bfa24f06d0c81101aff78115640656826087324.pdf