Windows Analysis Report
maddenkaren.pdf

Overview

General Information

Sample name:	maddenkaren.pdf
Analysis ID:	1529320
MD5:	35b6cfe3b13a2bd85e65eabe3ddc2fc9
SHA1:	b5f9c1a46dd94f6d3131103fd98dd0a8bf0023be
SHA256:	7ec25e118a44d3cda260ab58b6f3ea582f299abec8d8e04f740a4d8273ddb1b0
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.41.168.139 23.41.168.139

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F8008506.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748

Source: classification engine

Classification label: clean2.winPDF@14/46@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-08 15-03-30-191.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\maddenkaren.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1540,i,14558515021297885011,1916620480571538016,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1540,i,14558515021297885011,1916620480571538016,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: maddenkaren.pdf	Initial sample: PDF keyword /JS count = 0
Source: maddenkaren.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A91c4hkem_1ome6tu_3qs.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A91c4hkem_1ome6tu_3qs.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: maddenkaren.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.41.168.139	unknown	United States		6461	ZAYO-6461US	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.214.172	true
x1.i.lencr.org	unknown	unknown

ID:	1529320
Product:	CloudBasic
Start time:	21:02:24
Start date:	08.10.2024
Sample:	maddenkaren.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	35b6cfe3b13a2bd85e65eabe3ddc2fc9
SHA1:	b5f9c1a46dd94f6d3131103fd98dd0a8bf0023be
SHA256:	7ec25e118a44d3cda260ab58b6f3ea582f299abec8d8e04f740a4d8273ddb1b0
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	9281496CFA039D3FD841773FF81A1498	C8B6A3925D99786C498D13DACB1B9F2889EC2608	9FF2EE30F2B1BD0B864B6D916DD0C9D696AFA20CBBBCF93F43F57484F9C618F1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	9281496CFA039D3FD841773FF81A1498	C8B6A3925D99786C498D13DACB1B9F2889EC2608	9FF2EE30F2B1BD0B864B6D916DD0C9D696AFA20CBBBCF93F43F57484F9C618F1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	166DEE70E521626AB0A8295AF76E4B31	BC9A0B78E2EE3DACBC3C5B906C63D4E6C90FEF89	B471B25FADBC848732A68A66A20D98C799ADF43BD97BBBF3FF855506112534AB
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	166DEE70E521626AB0A8295AF76E4B31	BC9A0B78E2EE3DACBC3C5B906C63D4E6C90FEF89	B471B25FADBC848732A68A66A20D98C799ADF43BD97BBBF3FF855506112534AB
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\60e0b8b9-29ea-483b-8396-e6e4d341b611.tmp	JSON data	69E4FA4FE50488F4AE541A79E7D7DF3C	579CB4BF8E555BE911564984B1B6D6341A5D4933	473C39367585A69FA8A0A0984CA7913B7A5E244D37C207FC210621C65B3E2752
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	69E4FA4FE50488F4AE541A79E7D7DF3C	579CB4BF8E555BE911564984B1B6D6341A5D4933	473C39367585A69FA8A0A0984CA7913B7A5E244D37C207FC210621C65B3E2752
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	8FE8CB66ADA44280F7F6ECDEB6A9ACBA	FE9385B4A023B0029A25936802989F637E0FCB18	1EE948A069E46109D895A8482B694C70A4922DF3BAADB768680F7FE8755A5E27
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	3B31A14A1B0D5E43B7E2CC2E29FAC406	72C3F7B17F77ABF48E75316F228E427890A07963	13DEF52B47DFA5413F38C737A88C136D2BEA9F31BC248566C64389BFF6494E40
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	3B31A14A1B0D5E43B7E2CC2E29FAC406	72C3F7B17F77ABF48E75316F228E427890A07963	13DEF52B47DFA5413F38C737A88C136D2BEA9F31BC248566C64389BFF6494E40
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241008190333Z-191.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	EFCFC3658B8A92AF8E682C9A58326A8F	1DF36F121AB41531C6A65CB8E4D3317DB4CBB040	EF1FF3A012CB1BF7DE0CD452360C30F8D8AEC2542583C2CA926E95180AAB9DA9
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	BD5AC1999D756D905FC3D35A7EB04E6E	AB2D57AB2BA3409001EC9BCC000114688478846A	C4E5923F626414E9507270F68B7C96860608B8FEABE767381EAD41152CBF20A0
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	FAD03D6F068876362D35FA5785A78243	28881C73CD1794FEB4B1589C088E4476673D14C8	FE377D54D182F125C570E3A6A80F4353C67595F23BFC59BAF9BD77578B2B5FC8
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	226F7AD120BB42D5A72D7165A6111A6E	F6FEECC5AC45096BD801E74C7150B9605AD061EF	E71019FFFDE4E85A1E065F98189D865AEA6C224D4D375E54FA4E257E826753F8
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	C1EDFAEC0A1882BB9919B4985118F08D	69B16469AB20A584312F085582940AA9023818DC	B1D645201F5946E7D3CEB08B1AEEC170FC6AB2227FA984CA6D4527928EF9F42C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	C9B139DB0F832E3049E352EB59E2EBD5	F2DE8752663D968E4F8C0A3C9809D7A984B8F302	AC5002077C7DA2D721B3A77A2C418CC3965E5F50088728274A59EA5070F1B631
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	EEDB7B77AFA022BE9269EEDF74328F5E	DC73D34C06335C53378AFD6E2F7588814FB6A107	2535097A5D59DCFF07B4465137B2364EDD5C7C8FAB8B4ABF166CFB3C7FDC0D9C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	D02EBF5BC7D55EFDF01B06D2E8F6E3D3	6E7191D0F5E4EA27D3FBBDFCDEB441F9003539CC	951965E26B6A0CAC0F8CCFBA28EA9AB3891AF37AF16841DE2F4C3C7D42321DB0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	D74D659D51A5D2DAED50493DA8426C5A	E9656AC6EC79331AF148B91E4A66B3173D26100A	B264D6CC80CD0F01F65CC977A373D25195A93F36DBBBD439691B584CE54BCAB0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	A158A12AEC38F628CBE9BBABB1581615	7D5113447F69CAC52CB007BAA9235B57619D1212	1CB1F6A16B5969B41BC285130990ABD73A9F724B047A0323D5AFE9B082518990
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	670D0301F7EA3ADA0B81DFCCB7DB82CB	DFB11B6C173BB4C1E61CD7F52DA5B69CA5CB4728	8C8754DCFB1ADA2BCB7139C3B5E20B0A7EA984BC5C82048E7944AFD3034F9EC6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	A7746CBE94E0A190CC461F861CC80D8B	9947AE9BABD621F1D5A611526C8EF60D48DE5447	8A47B79E73B48E3BAE8718F82A1205F09420997B3B9937C3E334FA589DC96FD2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	58FE027DFB442482A887295E1D95207F	9687D4E43DFF67A624FADD2ABF7B041479197AD1	6FE3B7765D9224740C8255A529500C74D3DA60E3FE3263B7851BBA392EF0E7CF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	F14C6C6213EA488A6C58DB7C96E8C290	6539669402967A942E07A8121ADCE5A053680671	472F557E293D699DCB8E211E3024E164EE500A0CCADA9666E1D1859BCCB47F78
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	546BC3818098027F0A732D4F6382A035	457B71B3BC664FE516E9DCB6E65FDD47A6D52FE5	D4C83418D95A7E6D0B62C84BE6D7522EA878F81DAF437D820EEEE422B578B5B1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	5C07533A947BF5B5A88BA4448383822E	78E5E75300651B161D1EDDD9C21F6DD1FF14D44E	4C4B35C8612C3E3EC631D18C19135655D593F2B009DD3B69DC8E9E89733E68C0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	0EB2E77B39D7A24C3E130D881DAA6BE4	F76561FF6F02059CEE1C017C7131DC113538ED9B	79BC2FF1F9E7C43E0494163A0A50A634AEBB7834B509F167A355654E1C29343A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	6E24322A0FB7F1D96CD844AB61248E02	337DF53E047ED9215BB50424B7F3C4B67BBB54E4	0E8A6571A40FDE801EA5D7321D2BADDA11645FA1588B71BF9C8891DD788182AB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	136D687B94B87213CA32362A2E81AB36	BD09A73BBA48BC8C10CA033F73A79503E33DCED2	51E70F28BEC0E4C751538284CC1379A2CEA061F966C65E12B178DAE02F2708FA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	E2AACED5F35AAB2F8F1AA1CD666D49AD	3EF6FB71F72D865E5D98C3B828CD4FA6B068CABF	8E50868B08D5ACDB739FC05EF531D039E6800BFBA445B907850A7CE929A3251E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	6AE850312B884E23271251D85A9D54DA	46D6D31437C26C2BE6D2D1E6707DD7852840AC92	ED87B5050E069888DDE70CA4BCEC5A67B70EEE30311837C5BD256908235A904A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	9BDC4D942B3D53E48F7563D94A2BCF4F	C59C55E42848865EFA7318EE0F95B62B3D8AD534	22CD0CD1BAF70AA8C7295B3CB4DE3425624732EF3DF058A222B628CFB9195E32
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	3279B028A23E27CEDD863A9A88B59EBD	86BDFA698AFE12A425D9CE5EA752C9009629F2D9	0A32624280957B12153CDD4A1630CD734B78374046FA9C07B5C23D385FB083AA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	93D83D544A6E17548656FEF590A6F8D4	A7B28CD70AFCBB9CB25F76BCB1FDCB020138325D	5BBD60BA06A645E3FCA7F40108DB87B933CD8159A1C7F087BCD832D809F8242D
C:\Users\user\AppData\Local\Temp\MSIe8478.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	57A2AA6AF4069D02694DF4B5EF523919	1755FD18C9F1C62448E53AAC1B838EADE7B46687	00527BAFE8F3FC67694835640F8C5D3663C7312864A7DA88A86B4E22A742C134
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91c4hkem_1ome6tu_3qs.tmp	PDF document, version 1.6, 0 pages	23C8BB526FA769F029119AA93F9C1331	EB6A07C781B80BC17614F1949896DEA2826C5A91	3BA3FD18EF46F60BC4B7CFDE2372A425835BAFC6E761BDB0E303EE6C689BFD26
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-08 15-03-30-191.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	7054185BCCB43F13F6C257C44AD635DA	D4FB9E11DF1B25298FF1757B9595DB99B0E4D0BE	5956C701A9FEAA939389798B1C1C6AA31BE34669C892919FC7B194BAB001B124
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	2B71954F0A4D29F52F7EFB49597942A4	C2C98AA9D34687BD9E1EB58441A25B11801950AC	21BF4F20DFF6786D534C3F0B662D3E0E3246B5827BAD6A28BEFF8B57F400C531
C:\Users\user\AppData\Local\Temp\acrocef_low\3f6c9a37-b3a8-4737-8c46-627a4eeecdb2.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	95F182500FC92778102336D2D5AADCC8	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
C:\Users\user\AppData\Local\Temp\acrocef_low\9b732cf7-8066-4eea-a0fc-9c967ff75dae.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\bf8f4a97-0973-4cf4-9dfc-03a475b08894.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360	610F67CA7BF7414A832DADE2BC59812B	A48604555055D42843FFF3F89D31DDAA44EC5AC8	28BDAA6B112AE9DF7AB1E30FBC6AF46E49C2EA5C92C4A177AB08A230180BF1B6
C:\Users\user\AppData\Local\Temp\acrocef_low\db493644-fbab-4fd7-a915-b03dc7aa148e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B

Windows Analysis Report
maddenkaren.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report maddenkaren.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
maddenkaren.pdf