Windows Analysis Report
Inv. 7315 Techtronic 10.04.2024.pdf

Overview

General Information

Sample name:	Inv. 7315 Techtronic 10.04.2024.pdf
Analysis ID:	1529332
MD5:	cb63ab3c6aec0a326c132c26c6da48b8
SHA1:	887db00c0c7f88d87ae2f9426ba3f33e08b508cd
SHA256:	4d77d92b6edf33f3310ef7e6729822a6cccd6f9e967491248d1df58db72ce02c
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.200.196.138:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.200.196.138:443

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.200.196.138 23.200.196.138

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443

Source: classification engine

Classification label: clean2.winPDF@14/46@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2120

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-08 15-21-09-490.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Inv. 7315 Techtronic 10.04.2024.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1748,i,11195147955471208410,11915245055929868640,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1748,i,11195147955471208410,11915245055929868640,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Inv. 7315 Techtronic 10.04.2024.pdf	Initial sample: PDF keyword /JS count = 0
Source: Inv. 7315 Techtronic 10.04.2024.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Inv. 7315 Techtronic 10.04.2024.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.200.196.138	unknown	United States		2860	NOS_COMUNICACOESPT	false

Contacted Domains

Name	IP	Active
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.59.35	true
x1.i.lencr.org	unknown	unknown

ID:	1529332
Product:	CloudBasic
Start time:	21:20:11
Start date:	08.10.2024
Sample:	Inv. 7315 Techtronic 10.04.2024.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	cb63ab3c6aec0a326c132c26c6da48b8
SHA1:	887db00c0c7f88d87ae2f9426ba3f33e08b508cd
SHA256:	4d77d92b6edf33f3310ef7e6729822a6cccd6f9e967491248d1df58db72ce02c
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	F62770E8E0EFD434F915B20FA79FC469	CD871B349FA9EDAE9ABFB00A4C7207418398D817	770E9920280E572563962D94C17294EDA600595CF557CDF68C968967B88AD072
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	F62770E8E0EFD434F915B20FA79FC469	CD871B349FA9EDAE9ABFB00A4C7207418398D817	770E9920280E572563962D94C17294EDA600595CF557CDF68C968967B88AD072
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	727E1771119F0DEDD46177621F7CC4C9	32B5E8632CD7C77C8775862E636AF0C74C3CF08F	199CA92BB69F847A13EB2B505378AFD16AD6DFF6C96BB554635EAE7EA4A52AE6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	727E1771119F0DEDD46177621F7CC4C9	32B5E8632CD7C77C8775862E636AF0C74C3CF08F	199CA92BB69F847A13EB2B505378AFD16AD6DFF6C96BB554635EAE7EA4A52AE6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\97d9a5e5-adb0-4a91-96d1-210fa05b61f4.tmp	JSON data	DABB1E4F981DA0C528E9A034F98FF29C	1B96FD614BA404E795F78056AF3269386EBA87D1	7D5547FA9C5FFF332040E2226D7D51C66EDBA08CC79B5479987D2B3591D2CEFA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	DABB1E4F981DA0C528E9A034F98FF29C	1B96FD614BA404E795F78056AF3269386EBA87D1	7D5547FA9C5FFF332040E2226D7D51C66EDBA08CC79B5479987D2B3591D2CEFA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	CF6F1DC8ADFF6D039DD722EAE4C2C2AA	676C835604F9411082EE1AD8FFEC10E200B1A2EC	2E32921F2991534B7808C0826922BCBAD67635B54A70A45D56AC954D2A6AFBDC
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	5FED927BF7C3407A71C9D46C7772212A	5502F5485CE8ABE528BD22DB5A0BA72471D482D9	6F3851B47B0DDC38FD015C2FFAB042EFDB47F4281CC7F19CCD1AD90986D7BF40
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	5FED927BF7C3407A71C9D46C7772212A	5502F5485CE8ABE528BD22DB5A0BA72471D482D9	6F3851B47B0DDC38FD015C2FFAB042EFDB47F4281CC7F19CCD1AD90986D7BF40
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241008192111Z-150.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	387DD3C2A69E9DF42421598CBE601926	3DC14502DE0F9A05872B306F5AE54FCF7494A5DA	90D58E74BF6FB9AABC24274E80336356DEEDA98F573AAEE05418544F75FB1C67
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	AD5ED9C2F72E492505FF36CA10E832B3	D287D88A1EFDBDCED4B2ABAD6C2F1E9F3B274168	3EB9518C2F0E1E0ACBD30FCE034D160E0BA7E1C27BA46D048D1A666C41AD712D
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	18AE3C39A6C88293C5507621D3FCF583	D3E739E997C4BFC9331570516488259F20D8A615	C796F131F91589CF29192D6FF6942514D79CB015B8BB16D14C284A63F2A3C088
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	58EC59FA0BB76515BFDB501C5D56C9F9	0A970DEA2829B2986FE2C72CE177502F352FCCE2	53BCF40A1E8CC96736310B38C19B403DEB11ECB688ACFE72EEFA86F08AE8F721
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	A8E59D463C5768CBACD73D3934B57F05	DE782EFC190AE4D083FE1701E1C3CF73F76F6D55	0C756EE10E04013624A31EC4FFCBDC951E0CABCD77D7E527CE3B3EE5FF5FEE36
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2120	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	08E51183675E53154BFC8CD188A4FCC4	CD3B0FFDC85993E970E582486F9169734681E3DE	CB69A4AE27F8DDC87A72B1C5A4170358F7EB4EC9B07CCB3B05DB5226A11B37DD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	E9EDA397CA48918DAEFEC7DD1C555D13	5BB44D7C3A6101B18EFE80A3279D0424BFE09FF7	35E6B5FA716A7F5ABCF1C6C732F054405C5578D96565514C448C5DAB976D0949
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	53C5776BFAA018D67025DCA47B3DB70D	AA16CC492C7E70430FF352101E6CBCCB69B88DA0	BAF101B7BFE42DCDE77429C6353BA7093016D9134C79A99D8B8425BA7F8DC3B0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	FCA05606816429FC346A2E581AB46DAB	EE9EC8421D120AA843794D53BB64DB06F65DC6A9	BC59D4E8242758025A0E3C0A71EE03CEF6C1859DC3C54CAED580E1D25F697550
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	90F18AE574CED299A21E9BF761E3A0C6	501DE0F1E2A8CED032D19C5B461476FAD81AAF6B	47A9F33ABC540F09E607AC36E5F92C5D19B0A8260CFE636029C6E0695CE2ECBA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	0535722BF40E87FA47AF12CF92AB8E33	5F32825C297B511E87660173EDC231B0C9587DCD	65AB2A21A8B6A7F08752D7AF6CA768281AD7B9D94388745C20231AD1D4FB25F2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	409BA1DC832B0AADD37FCED103867292	D73F5E08065CF2031C8713D536E9B441893D1283	586CE05BB97E930DBA1E63042C043F7FBC64F856B786B0CA31B39262C97833EC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	6FF7632ABD75FAD668D4FCFCE6386EBC	DB5BE2E5CCAEAB04311F494A4E40DBFE56929C90	1028F519391D84E5868B2E88C72111ED5AAB873E6B32822FF09C06DCAAF9C9EC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	902DA212BE175250CE2321D0950CA4E1	0509A8816B8F3BD6241E75EC29A35EAC996C59FB	68B1B4D0849AD76986352074C7D4BA3E366E51112B8BE3BF203E255D0B965560
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	66B74A7497062FE833A2A732B9CBA10D	B25AD805C95A50CD19285A7201662D7D7D1ED53C	53600D113D78A3E8C1762BCC03C738054928D966446BF2EA910DC124A5B0F57E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	100B1DAB64C10A941D47E393E103A85F	427AFB6C4AA62416CA7975D32FB2DFFAA48F6614	E662F67C40D5F54C8AB134DB26C6718FE45A925C560CADF219987AB9CACF4163
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	947BE5032064054A6D076DCF5992B420	A8661457AA3D617673DE3590DFF0363C72F96FEF	74736E854099DFDF4E7A221DD0E9D99FE9B6B60285CBBE73DC48A2BE3D82D8DB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	671A668F3D90406E2E61D2AE554D5751	FF229014A15ED87CC8FBC4481EF265201EFFE54C	445A7CF02B61E28F0838E9E10F1F735BA7F17283DE751DCDCC1C112EF15E8F07
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	A19A3416973939CD2F8C6CE72123D6AE	7A730EE64B790501122F07207A3CE795CFE81362	C6A2C2BB7CB129E18787C417536FAB7AB24967DE82A79A6BACF0577256C63012
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	480654CC82FEA8B3065867F0F41EF3EE	75E70CB1DB321FB42FE226A12FE512824E5195A1	79717F9FE32A082A052E0B5D2A19DDEAF2CD88734419432B7444D9F4DF0B80CE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	89CF5B8C729200418FE7F8AEADBED647	A501FADC8F97B06FF1813F7A6149CA7A8264F158	D809C11B467E85D1CFAF63F9135F830FC3ECE80532D5944C0A7431E891E76306
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	942A96E5DFE840AA225BABA02455339B	C11E91DD65FECFBD76B734359140FBE18AE6B995	B9F1D9838A1F8E5377689B68C98267C5524B4532BC38497A8600769B44B6B07E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	287B811AD295919221E17148580BA854	B29F33A395EDDE166FB7F93D61D66C98D4032BF6	2B2CA08B29F4385BA55A5988D11A502123735392E3B34AEC0E7EE84AB71A3E6D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	5F6BE7FF03A5F148C1381FC91AD4EEC0	7CD7E71DDC600CD5B415EDB86BBAD73261F728B4	552793FE569FD97CA1585D7DDFAF56ABE8B6217AA10092C972D8CE2F4DC1C887
C:\Users\user\AppData\Local\Temp\MSI18c26.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	868F82B922DF3AAA3658D588BDB9C5E5	855571A59C6D26FFA3B9FEC3375792B08C7C72A8	4876ACD3DA1E4F9ACC5FDEA36416005E2A19807ABDA81F38B7F2971A80E186EC
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-08 15-21-09-490.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	CD517DDEB32771037FF0C87F9CF03193	B5DB40BB2F494824650186E15961A86DFA7639ED	1A52C51C7BE57730821DB3AC8132160286B3199B5D317CF53D65E22B2DFF7D87
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	855F4F08939E43D301FFF12E152BF2DB	7A35550CBBC9C132CD2221064897F33A1943388E	FD3B7D92EAB5A7CECAB8201D3E07EF3DCBAE50798E29324A228299FAA42B5F67
C:\Users\user\AppData\Local\Temp\acrocef_low\28acff8e-f196-470b-bd3f-0e2cddea2942.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\493a2d44-8a14-412b-bb51-7f1a6e410ebf.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	1D64D25345DD73F100517644279994E6	DE807F82098D469302955DCBE1A963CD6E887737	0A05C4CE0C4D8527D79A3C9CEE2A8B73475F53E18544622E4656C598BC814DFC
C:\Users\user\AppData\Local\Temp\acrocef_low\b4d1dc5f-b609-4cb0-8ebe-89e95da87e75.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	AE1E8A5D3E7B2198980A0CA16DE5F3D3	A1DB2C58AFC81E6A114A8EB47BE0243956F79460	8C2E1B13F6658714D51737D6745FE065B87497923945AB3028706A4171C8328F
C:\Users\user\AppData\Local\Temp\acrocef_low\c8534a64-b329-47d9-a331-b740c215c5dd.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B

Windows Analysis Report
Inv. 7315 Techtronic 10.04.2024.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report Inv. 7315 Techtronic 10.04.2024.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
Inv. 7315 Techtronic 10.04.2024.pdf