Windows Analysis Report
0260719760_9057987504_20241014041558.PDF

Overview

General Information

Sample name:	0260719760_9057987504_20241014041558.PDF
Analysis ID:	1533058
MD5:	91f21cd7cf5808b061c4dc014e1ebec1
SHA1:	5d494095492db13c0bc90dfbe91fe2ee848d2b33
SHA256:	dec493278736e87e3d6a2acd329b86f79c7a7f92b63480abf0bed4baddba47d6
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 104.77.220.172:443 -> 192.168.2.4:49747
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 104.77.220.172:443 -> 192.168.2.4:49747
Source: global traffic	TCP traffic: 104.77.220.172:443 -> 192.168.2.4:49747
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 104.77.220.172:443 -> 192.168.2.4:49747
Source: global traffic	TCP traffic: 104.77.220.172:443 -> 192.168.2.4:49747
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 104.77.220.172:443 -> 192.168.2.4:49747
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 104.77.220.172:443 -> 192.168.2.4:49747
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 104.77.220.172:443 -> 192.168.2.4:49747
Source: global traffic	TCP traffic: 104.77.220.172:443 -> 192.168.2.4:49747
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 104.77.220.172:443 -> 192.168.2.4:49747
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 104.77.220.172 104.77.220.172

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr

String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747

Source: classification engine

Classification label: clean2.winPDF@14/45@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2132

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-14 05-33-58-650.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\0260719760_9057987504_20241014041558.PDF"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1536,i,8389459400494429931,13337519352966136629,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1536,i,8389459400494429931,13337519352966136629,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 0260719760_9057987504_20241014041558.PDF	Initial sample: PDF keyword /JS count = 0
Source: 0260719760_9057987504_20241014041558.PDF	Initial sample: PDF keyword /JavaScript count = 0

Source: 0260719760_9057987504_20241014041558.PDF

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: 0260719760_9057987504_20241014041558.PDF

Initial sample: PDF keyword /ObjStm count = 6

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.77.220.172	unknown	United States		16625	AKAMAI-ASUS	false

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1533058
Product:	CloudBasic
Start time:	11:32:58
Start date:	14.10.2024
Sample:	0260719760_9057987504_20241014041558.PDF
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	91f21cd7cf5808b061c4dc014e1ebec1
SHA1:	5d494095492db13c0bc90dfbe91fe2ee848d2b33
SHA256:	dec493278736e87e3d6a2acd329b86f79c7a7f92b63480abf0bed4baddba47d6
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	0EA6CCFC82DFC6CAA134AA1D27B87CA5	2FB4254896E78E768829421987D2D4CBA32A3CFD	C33DD14B4D36F7809541A6BB33C84E3DB42DF8F9FF37FE3ABC3FA44301EAC404
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	0EA6CCFC82DFC6CAA134AA1D27B87CA5	2FB4254896E78E768829421987D2D4CBA32A3CFD	C33DD14B4D36F7809541A6BB33C84E3DB42DF8F9FF37FE3ABC3FA44301EAC404
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	B71F982FD8A804ECD0670BB3808D393B	5CFA302F68EDAAFA5EE1E5FE168D75CD84333694	517F4A961346800417178C2F81C239C676B3EEBE7A5B8971105AD094BA0D2835
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	B71F982FD8A804ECD0670BB3808D393B	5CFA302F68EDAAFA5EE1E5FE168D75CD84333694	517F4A961346800417178C2F81C239C676B3EEBE7A5B8971105AD094BA0D2835
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1048533b-f509-4d56-a6fe-d5e01c38f8b1.tmp	JSON data	C5EB356AF4D7BD50BADD50EF33C520A1	0EFD0B7AE77385927526E3BDF8E7BD00394C55B0	89EABD79394EA3214B7DD092CAF5B3167E82FEC285F0665BE2198714763ABEDB
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	C5EB356AF4D7BD50BADD50EF33C520A1	0EFD0B7AE77385927526E3BDF8E7BD00394C55B0	89EABD79394EA3214B7DD092CAF5B3167E82FEC285F0665BE2198714763ABEDB
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	D8A5D5AD260D0FFDFFAF5387768BABB6	A71D2B0291F8FB02C650EE40F35B3E53D88C811A	378E24276FA90E327B5BFBE14DC21BE81DAD59811BDB637B6812C7CA576EC1F1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	57E6D253490EFFAD35745568AE0DFBEA	D7CE92FACF8B2A9F3AF5DC12E08F54EBCA2F04C1	9F91731695CCCF628E2B3E63ADBA048101034BF7F67AB6970593C9630033088B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	57E6D253490EFFAD35745568AE0DFBEA	D7CE92FACF8B2A9F3AF5DC12E08F54EBCA2F04C1	9F91731695CCCF628E2B3E63ADBA048101034BF7F67AB6970593C9630033088B
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241014093400Z-165.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	69E1571B9E1852E3B7EECA46FDE63BD5	D58F1A075265DAC6C933E847BB9BC72F1A995334	DD9BC66C59F3E6A03434A27EC7A4260B05B555B1412ACDE94595BCA751CC0F2C
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	E911AB6384A275050E01CE9678E66865	55051C3B73D5A41C792EA9B731CDC73AC9C647C3	56D171B5518DD17BD8F13AFF027792977079EE323AAB0FEE0A52740BAEB99B5A
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	7F313771A09068976F92FF260F0A3946	46210AC172345F4409B9DF66D8504B68A636B0DF	25378D61ECDB322C44B7E036DA1C92CB857B9D3FAF4B7E3216F0239BD6BFFA04
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	DA6DCF4AA849EEB0C909CE49608F0756	D957E493611D50CAE8548B169F5142D567043149	219AEC938CA4D4372117465F48937318698F5E8CD9E1C64627CA519087867AB8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2132	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	47C23A19FF3DADF1EEFA4F1D2F59AA49	883C2E8FDD2741C11B0B5C6DD01ED234A4408DCD	DAEE8E6232BF2337C78FB308EC5DE413BC820114AB9A8245651B2CBDD28EE49F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	C05A45EB9DE9EF1607518BC411A806DE	334804B018671524C31C6C2F345269D56A0889E5	349A2B1850D66C3A54D207766BC5B9336AB8CAEAA1AF99C8C9E8B2CB8BA3A49A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	9B3FF898957AB6E6673AE2ABB396E7A5	BB1433B5EBD50350549D4C07A6573751DCADAB95	3A3039E4A761C4962CB99E228EFE7AAD1694601858418751C4DE1A1EBB517C20
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	DF1A1636C6685C56E50450BA3308F47F	F92AF7A3AD96E011E4AB67C9DE38027232A64347	AC8849922C9635320E15AC2F707DD46980A7EB16E57469CAC221FD5CCF6A3940
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	29530580A9518AADAA6B8DD05CB4E11D	9089A7E4D0359E62B95A55673C984EE31C901AFE	69BF174A5DEE9D182D72ED85554777F53CF1C6D358530E38D22B2ADF5AF1BA85
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	F7BCCD9F7A415FE4CE6AEDFDBCD6C7C2	8900462ACAB3F67F9B1206B5FF7CF38EC7455F6D	3A1AB6EF3CF5FE06F18A5ED3A5EE4EC258227FB9AAACB40E289A9770F516AFD2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	1BEB333CB3E03A9B1FD7AB49EC2B178B	8188376D9A219630AA35F338A7D3A4F69E113310	2C43F4DDBF542756C7269541BE6D9E5A0B6554A590F2221EA04C9B7029D89FC2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	168963991A62F0257C6923DA2B53AF75	330C33ECFEEC682CA9D9118B70482C9CF39866C2	76F8A9E86C00437CD31059F6DB5E97CCC0E44A420C9B34D785ED0AC9411331A4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	E2A6D96694A190513AECD0F4DDDF063A	F5600D55927C0B0D3FC592DBEB8FB23AB3116753	4A004D5ED6B7D43797C2792C10EBAA641D3F4A6C44A31EC9C29CF96D099BA6B6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	EB470EFB97715092DE1F121FF2071534	E9798E2DE7C6A58BEAE48B6DC53777947856A69C	5ADC424236377B90EE88888BDF948F5A8FF3B6FAF200EE748FDD69049812137D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	8BE8696D8D24E44EEA94355F2F8F983C	3677EF8DDDA41EC27494473414FE08EEA9ECE4FA	A1FF1082823D2CABF32E7740F671A93BB5F94DD26B5A59D388B4DD743A5E7E45
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	66BB0958B6AEC6BB93DADE6E34D06E6A	0939979970081F334A7B3E8841E9FF32A77C0144	562884D8C8904B0EF74DD398097F8C5A49030465328EB72DEFFFA948DD6F2779
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	81DB483C2C0F6F888D80002F72E21D51	31505DF241D88E885C236B7AD72175322817E7EC	1F30244611970A765E613C7339AD38533451F866F2B804BEB71F391F2750A412
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	C81ECB2E1ADAE7031F63566CE773F2E5	9D82AB0D26AF0246CBDF4356254989DE8560BD4B	9BDD7F11C8515F77B424B5FA4B55BDE9763743809C0734A40E88FBEE71C5F0CE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	2ADA1DAFDE7D5F3EF9042C085A241100	41310BF876FF71CD48BDE0860E3636C2FEB03067	FB7D103702360D2E78E02DABC9681CD39768480FC80FBF2C80E0944125C05D9B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	C5D0442B2710F4878FA2806B8B6B3AA3	1748AC297D32398E9DF2B4880993372C49B01BFE	CB6FDD9ECFD479059CF6AB66AAA657842E2F6245D8B3B2E8BBF5E057048D98D7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	96C163C277220FE2995CBD98AB3E66F8	6684410C4B44F876F4DC9B802DAF3E9595E09373	BEFCA691110140774247DD94CC57A4F2DCEBC61C8459B22187DF14B93CD63093
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	1297DB09A5BDD7ADF55D72750B3D555A	5BA4692A26A2BC4663BFB42147DC658DBA77C3F0	76018E43C1A08F6CF5B9BC358D99CE7A895DA99F1D10925BEA48F5DA89475C29
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	72A7B9023552B3C69344C502D3C086E0	D7A58B609BD832389CA00DE73238920D175D4681	0DBF3680907B5E042F18AEDA1AAC0DE74C06C6A209EBC90391E32A156CD6D351
C:\Users\user\AppData\Local\Temp\MSI711ea.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	368B69CD3A99E4AE9C1D82CC1A436105	1CCA210C7EA35CF007A92566F07063B8BD505C88	DDEC6F8C4EBCFA8030568194574C4679381F9A0E00C3D0E5CFBF134B4D51EBF3
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-14 05-33-58-650.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	E1B89BCCE9D40DD42E242B58BF694886	2B4743EEB1ABE8289E41638DF19319678C41790D	AB727CD62B7C1050FD2DD295BB397B391F1C356767569394A993C2AFE691A35C
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	925506B218D4DF3BAABD4141933DF5FF	7A8DDC99903AF309EB2E0B4D6C8A636BE5E18BB1	2F8B3F2F2EC8039E288371F5B21F0C9374EAF5DB76C36CF594331305EADC6CE6
C:\Users\user\AppData\Local\Temp\acrocef_low\0419b4e6-2a51-48cb-bbc9-49803013987a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	716C2C392DCD15C95BBD760EEBABFCD0	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
C:\Users\user\AppData\Local\Temp\acrocef_low\58a9816b-85f4-48f5-aba6-606d94b97768.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\666385fa-bcc7-4ffb-9e2d-eb654cf1f1bd.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\e63c19fd-bd5c-4e9d-8077-4cdb278c9591.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE

Windows Analysis Report
0260719760_9057987504_20241014041558.PDF

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report 0260719760_9057987504_20241014041558.PDF

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
0260719760_9057987504_20241014041558.PDF