Windows Analysis Report
19194R21.pdf

Overview

General Information

Sample name:	19194R21.pdf
Analysis ID:	1537093
MD5:	8523b894e3341389e8b0f8f46d84fb3b
SHA1:	b2c37f027bd960ebae79e32984d81a1e4b8720eb
SHA256:	58031f56fff1a6b777cda8244e8acad871b5c247c1ec3f7ed468baba820fbe63
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.10:49801 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.10:49801 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.10:49801 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.10:49801 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.10:49801 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.10:49801 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.10:49801 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.10:49801 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.10:49801 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.10:49801 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.10:49801 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.10:49801 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.10:49801 -> 96.7.168.138:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.10:49801 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.10:49801
Source: global traffic	TCP traffic: 192.168.2.10:49801 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.10:49801 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.10:49801
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.10:49801
Source: global traffic	TCP traffic: 192.168.2.10:49801 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.10:49801
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.10:49801
Source: global traffic	TCP traffic: 192.168.2.10:49801 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.10:49801 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.10:49801 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.10:49801
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.10:49801
Source: global traffic	TCP traffic: 192.168.2.10:49801 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.10:49801
Source: global traffic	TCP traffic: 192.168.2.10:49801 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.10:49801
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.10:49801
Source: global traffic	TCP traffic: 192.168.2.10:49801 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.10:49801 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.10:49801
Source: global traffic	TCP traffic: 192.168.2.10:49801 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.10:49801 -> 96.7.168.138:443

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 96.7.168.138 96.7.168.138

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: ReaderMessages.0.dr	String found in binary or memory: https://www.adobe.co

Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801

Source: classification engine

Classification label: clean2.winPDF@14/47@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-18 09-02-42-871.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\19194R21.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1764,i,10077426381922765570,14877554498585215772,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1764,i,10077426381922765570,14877554498585215772,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 19194R21.pdf	Initial sample: PDF keyword /JS count = 0
Source: 19194R21.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: 19194R21.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: 19194R21.pdf

Initial sample: PDF keyword obj count = 59

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
96.7.168.138	unknown	United States		262589	INTERNEXABRASILOPERADORADETELECOMUNICACOESSABR	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.214.172	true
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true
x1.i.lencr.org	unknown	unknown

ID:	1537093
Product:	CloudBasic
Start time:	15:01:43
Start date:	18.10.2024
Sample:	19194R21.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	8523b894e3341389e8b0f8f46d84fb3b
SHA1:	b2c37f027bd960ebae79e32984d81a1e4b8720eb
SHA256:	58031f56fff1a6b777cda8244e8acad871b5c247c1ec3f7ed468baba820fbe63
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	5D1680252F13217969B6786A5EBC35FA	864F2C8F2E7823ABA350D70CE76D616CED7B4749	FBBE88A7AD0E7BA9359928775D17A4FE51BE01E6DF209FF6DEF9F64040A54880
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	5D1680252F13217969B6786A5EBC35FA	864F2C8F2E7823ABA350D70CE76D616CED7B4749	FBBE88A7AD0E7BA9359928775D17A4FE51BE01E6DF209FF6DEF9F64040A54880
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	923CD39DF5C089F7E847D699EE90578D	6D8851ABFC5FC58C4ED04000C4569BEBC2497E3B	6884B00533A95D5EC3BD907D14759E220F0298D9B38362C0ABA0105536F92907
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	923CD39DF5C089F7E847D699EE90578D	6D8851ABFC5FC58C4ED04000C4569BEBC2497E3B	6884B00533A95D5EC3BD907D14759E220F0298D9B38362C0ABA0105536F92907
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\02a9a8b1-912e-4a33-81e7-364fa74e7b3b.tmp	JSON data	20D6B0600BEB35EE5889B0AD8553BB71	93854468C27D242FF722B0E0BD4D6213872C0E13	E45552FF308916A9DF32E65841CD96FD702A2FCB12F301579CFB23B6D5641858
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	20D6B0600BEB35EE5889B0AD8553BB71	93854468C27D242FF722B0E0BD4D6213872C0E13	E45552FF308916A9DF32E65841CD96FD702A2FCB12F301579CFB23B6D5641858
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	C77041D07443ABF02CB54CF44D1E085B	660543DCFC2254DBFE9958879FD46BDC882D6B08	FDB8B20127ADD8D5DC46EE740208E345984D2AC65AD9AE67BA35C9DC61FF32A1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	4FD0D996740D9F147620252A90532A98	FA10F8724420E54D97D5302AED4EF1F36317BD3E	08B083754F8D7D833CB689D2C29CD9BDD5D0D3E6834C7FE25062791704595BAB
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	4FD0D996740D9F147620252A90532A98	FA10F8724420E54D97D5302AED4EF1F36317BD3E	08B083754F8D7D833CB689D2C29CD9BDD5D0D3E6834C7FE25062791704595BAB
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241018130245Z-167.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	3CD6CF8C3F33E012CCDF668401ADF719	7D0E921FCAE594324CA5A36B59875F042FEFC846	702A1FB8F0D4A8D156CD4E848347AA888C0102BD75BF6FA77B85936B340D76FD
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	4602E1DDC472CA001FBC5C360ECDC5CE	A878CDE58338E32D93CE36E0632F517EBF4F08FB	322C7EBCC7A59B304EDBA61798C4F49E191C6331D39B5CA866954D36FEB7BDA6
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	4D540D2E62DDDB53E4F4906AC8E3FC43	5C81888B4BB2A4FE97FE97DBD64E7C4CCF31F368	FE8C389CE507E22EE58AF85569877D19D51F3DFBE9B770E09C0AACFB44138D93
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	0891E7CAE5D9A9A50E99E98A2F17972B	BEEFBAD0D55939F81240EE801289476EECF148F8	EFDAC6EEAE7F4B213D056932BB5472E2768A1843803C0C5CFF5F2DCBA2303DF0
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	01C60A3166B786762626328538402F3D	3682BF019754168E57F6762652ADC84FD86C7974	9B47C9278903B886B897420BF51F6B8A8110AD85DA5F084E22D9B16A6CD57051
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7808	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	265E3E1166312A864FB63291EA661C6A	80DFF3187FF929596EB22E1DB9021BAD6F97178C	C13E08B1887A4E44DC39609D7234E8D732A6BC11313B55D6F4ECFB060CD87728
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	7ECD6198E7F754DF2A93F7725E54D743	EA403C72D1B1022FDC7D6F72A938EAB61FC43F35	85B0C25C6FA5E1DC5213C273384F45277DD78437A42E5F1E25E09B1F89DF45E6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	E3106BD01081EB32EB3E4037154CF28D	494DF36C920127AD9FFBB48250E8B5EAF40E24CA	56C3F08622D089E097664EF1186A57DD679534C18EDFF431C9E4179FA8DBBB36
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	CC8A17193F84396758196BEBBF351E3F	DC1FC37B0B063360A7CB59A7E32DBE73CF48D8A1	935B83E7767BF99701038BF214A8CFD33396BAE1C77C07F8348D4F94179C0F5E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	45966DA0B72E7AF1C8955B7299749655	B88EEEC655C0AD9BE5BB3B10181998801516D631	5884A905DE4542CD3D9C85B0B7ABDA4071398532BE837DEE05843B442C832CBC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	EEC313074F2EBBF6EA08463F1CD08FFE	0259E601A60DE98CA607C176D300E90BCA382FD5	E171155B22C72CC60AC31FF508F49BB1533B913A517C8012744C7121F6FA9451
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	30063E2CC35712D14934BA195721B3AA	CB68E8584DB4E18C46973034641156337A93EFC1	8FD013B0D606999A7ECFFFF07D56E2868147A88104D2AFABA2810CC02F7F8935
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	35B0EEB96BA39D968C0983766D25A17C	A93D16C4D801B8D3B8BD31E822263956FF712A36	4CD65ABED6683EBB6F93C4BC5B90A729317621E15A25F723E34AD98A6B7791FB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	4FCCF9BE7F03B8981DEDF6D0D6C71562	8BC9F3978F7C2444FEF4BF622D9C128C33F4BBDF	EC107AC1241AC897EAF603AB6FA4D6E35A40383D61A6A9254B6BD6503761981C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	98F243987064BF2921B5F20AED32A992	1A341C083405873694ED6ADC36BAAD721051125E	7983E7E964C288CF8E9469894A85664F8CF7CF0315BE2C916D33CA9F99A9D6A9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	73FEABE5D2E803FBB8CCD9A4BA0BD044	7ED8D6CDAC74E14848497FD7A7BD2EE1E1D56A62	CB7B42B19BC3FD1C819FB063A73D6AC2EF8B000F805966ED938CCFC2BCDF5BD0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	EAAF4ED9AAB0909AF729DDA9F4C665F9	8A4F6D5F603F16E951218CEA3D8F38748924FE56	1CFD6EB869EDF911DC9D40906788A02172C0E94FE9531BBC3DC23B5392D6B6D2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	79C5665DC4EA95B1D1B96884C4D7713B	1089DE8937D8500C3A05875AD843EAD22F25439E	E47016CFF847EEAED48C0DFDCF946FD7528BEE6490850903CE6194A449E60040
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	1488F4255B9487955804B19F62F93162	4FD53A3815FB2260BC0CD7AB26796B2D1E4F0AC4	9A126A6689C19D12B806908BD3FDF78ECD75A89648C6C2A0716735EED13F4D2B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	80C8FB428D10213114A5634DF350A1BB	A49272B79DF3E5FE85329F72C4CFF68D902C6EA3	9E55599F3AB59A375428574328355F91D55D0EB985C032D3A5668FD2A5C19B0D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	7496960EF5586832CADA69C786699561	98A70E0AE816A819C44EABF6751578E2D19411C3	084277DFB7449BB371303B5655C2F138768A8264EA1A8FEACDA1D03A97A3B701
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	0905C81FA65B438C642DD4C96F7E9988	71E63AF2D040647609517C1133658BF15305A763	95DB0B5968F59EB52382520C8DC3EA4CA2E0140209901CE90BBC87C8744DC35A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	8FC305E6EB412164B1917E1AE7FCDCF9	1C851ECA5B7E5A8CC80FE9D0498AD0859A375191	90E2D310D77E874CAD8AD0AE646CA4B8F67ABE2BCFD2F8F392BC41A9C90BFE56
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	1BE7D034A789E0FC10B7237371653A4C	4AD9B620FC19E11BDC2FA53A930AC65B1ECE49D5	1E8FEBE7ABD927E5FDFA33C31C91608AD493C2934E0455E895CDC95419CE7567
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	2E7E5B18967C5AFF6C5DE4E073207B79	380C472C7B4A13E7237A61C081C10B8130F64306	AB732FC61517B93379A2642CCEE5C23C00B3EBCC99163057D0BF0BE1D2D385CC
C:\Users\user\AppData\Local\Temp\MSI4afe.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	E30E4E473D09DE2A777749855D9ACE71	A4B126600E8A368CFF3F3D8A7C8186D4E0945A83	3F3E619D2AC947431BEF2A45BB4982E5A61D0C29E897113BE51E70DE032B9D00
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-18 09-02-42-871.log	ASCII text, with very long lines (393)	70A2D078BEFD5E910EE035832171B399	1AB91914ECD7852E512C73437D30013594A16FB0	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	AE42EB25C36A841152E846F2028ACB8A	1AEFF3FCD94E1155A75DDCA3B69054D91D62C1E3	9F91C593F4C668004CBB5FB9C446E34CD3405FE213F11D005A7D01C7B238B6D7
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	4C27844A20E14750E3F985093395ECC6	AE957F3DFA540CC4A175B4765B1E85991316DE83	73BCF9C215F4A0F9D3B45D776244CAB96208358CF39802C702D3CD61CC8F1288
C:\Users\user\AppData\Local\Temp\acrocef_low\167b2b5f-83d9-4fd0-88ed-8851adc1535f.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	FFA982D6F2F9B46A1DECDD28BF3EF0E1	B1D05ED9BD6A80BD0E3377E9F62B47EF83FCC0C8	93D954FA4BBEDCDFBC7BF14FA1BB3986056261F4A5035C3CFF229FF16D12B78B
C:\Users\user\AppData\Local\Temp\acrocef_low\61834a42-a782-4a63-8c9c-08ef17c5e6d0.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	8C8568A58ECA8E12112C68780B16ECCF	189D30BA5ED9573B214DDEE80D3A388223DF62FD	265A47203CC1D71634C35CA728DCE541C04B7215704CAB627560B3D27B25A88A
C:\Users\user\AppData\Local\Temp\acrocef_low\cee77bad-c575-4a2f-9e1b-f1ab9842665a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\f744bcb9-9cfc-4dff-a3ae-80cecf3e4ab7.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B

Windows Analysis Report
19194R21.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report 19194R21.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
19194R21.pdf