Windows Analysis Report
PPI Submittal.pdf

Overview

General Information

Sample name:	PPI Submittal.pdf
Analysis ID:	1537104
MD5:	c5e6ae17541577544d9c46e54544a51c
SHA1:	b1afa092b7ce35f99f71a8c4814c5e708aa424e4
SHA256:	1ee9855f10e199576a49f318eed6f3a3bd4fb523b4a28464cc28c5ad6b14cfed
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 96.7.168.138:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 96.7.168.138:443

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 96.7.168.138 96.7.168.138

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748

Source: classification engine

Classification label: clean2.winPDF@14/49@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3900

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-18 09-13-42-710.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\PPI Submittal.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1552,i,9938820051784610952,14837667456933209763,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1552,i,9938820051784610952,14837667456933209763,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: PPI Submittal.pdf

Static file information: File size 7218070 > 6291456

Source: PPI Submittal.pdf	Initial sample: PDF keyword /JS count = 0
Source: PPI Submittal.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: PPI Submittal.pdf

Initial sample: PDF keyword stream count = 477

Source: PPI Submittal.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: PPI Submittal.pdf

Initial sample: PDF keyword endobj count = 478

Source: PPI Submittal.pdf

Initial sample: PDF keyword endstream count = 477

Source: PPI Submittal.pdf

Initial sample: PDF keyword obj count = 479

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
96.7.168.138	unknown	United States		262589	INTERNEXABRASILOPERADORADETELECOMUNICACOESSABR	false

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1537104
Product:	CloudBasic
Start time:	15:12:28
Start date:	18.10.2024
Sample:	PPI Submittal.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	c5e6ae17541577544d9c46e54544a51c
SHA1:	b1afa092b7ce35f99f71a8c4814c5e708aa424e4
SHA256:	1ee9855f10e199576a49f318eed6f3a3bd4fb523b4a28464cc28c5ad6b14cfed
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	DFB30FFD81A480165864787971A26C98	2D7F26B0F021DED1E58A1C8F03E6F05783FC53BD	34B2E43A517899A3D8EE271A785ED178052B9516A07B0DDCF9B96198090F4041
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	DFB30FFD81A480165864787971A26C98	2D7F26B0F021DED1E58A1C8F03E6F05783FC53BD	34B2E43A517899A3D8EE271A785ED178052B9516A07B0DDCF9B96198090F4041
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	2A919FD9E07D50334984DCDB0A6D0231	CC5C876D4923EBF20A929C572F181EE62710DEDD	D09AF33D82981F5D240D6198B1BA5CB18B818CC24E901F8CCDACFC342413ED15
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	2A919FD9E07D50334984DCDB0A6D0231	CC5C876D4923EBF20A929C572F181EE62710DEDD	D09AF33D82981F5D240D6198B1BA5CB18B818CC24E901F8CCDACFC342413ED15
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\24d854f3-7389-4c99-843d-157744a8f3ef.tmp	JSON data	2B2DD4FFCADFFFA544C423CE65A911E2	3C690C4670D732A1F54C5BD0B93A7CFF6CA96720	7ACAC2E53C854E8000F43FE4CB549E82A2B9F6A957366C429ABB730EE326CBD0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\49ee5304-188b-4d74-ac9d-bbb20753f5dd.tmp	JSON data	1A0D4E683BC4FF4649D2D5456038E9C4	3262B724FE45D87672715795B9AF16044B9C1C6F	55B3D5A8A0B0EBB4501A9154439B00E8BEA5CF46A8A60866A60F00D7A6F39E1F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	2B2DD4FFCADFFFA544C423CE65A911E2	3C690C4670D732A1F54C5BD0B93A7CFF6CA96720	7ACAC2E53C854E8000F43FE4CB549E82A2B9F6A957366C429ABB730EE326CBD0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF431622.TMP (copy)	JSON data	2B2DD4FFCADFFFA544C423CE65A911E2	3C690C4670D732A1F54C5BD0B93A7CFF6CA96720	7ACAC2E53C854E8000F43FE4CB549E82A2B9F6A957366C429ABB730EE326CBD0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	198EC196E416F9CC66C550B234F00D37	8639E844899B4B8CC483A900DC76F90C1BB8F6F7	93678923220719499E01CFDAF210A3A33D0FBFEB8DF665C863407D4C73799097
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	38B25F7707753D2F119B9DBE8251282B	697F1C2B09C17CDF6348D0818AC10F3751373B26	81D566DFC49B2E427966C52EB5C5DD131024D6F741B90641732CFDBC54E20538
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	38B25F7707753D2F119B9DBE8251282B	697F1C2B09C17CDF6348D0818AC10F3751373B26	81D566DFC49B2E427966C52EB5C5DD131024D6F741B90641732CFDBC54E20538
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241018131345Z-172.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	73B49C1E01421F4916A3704B77E2BB4A	E11AED10A7D81A4F9A84905F10B90CF1B45C10A2	CD526270886938EC1D6976D2B7DBEDB58DA56DD937DF0FB15D6D51E2C58E7AA9
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	64069A7DFE8525C37AF9C51DEA3912E0	02233DBB946A04F086736DF03F8B98513C626C60	26110EB594E587C459CC59FEF40AB1BC170D5931AB12DB4DCF563C4A4AA2C09F
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	60BAB892675744E5B969CFA295603533	1E7E4EC295F0FD7B1AA317D16EABA42CC1CD019B	9DEA10E4A23148341BF82CDBBF41C285EBFB8637092260F187A2C99BF248050C
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	07D115F5514E91D4AF4F493A9D9C03D8	CC8FEA5DEAEB7905790594CEAA79E3FFBFB2FD82	D941D0D490609C2AD6199AA773699F99841D448603BB9196833B4502AB45C3D0
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	9DBC7E6E22DD21BCF0C50DABE8B30841	CE6E7E85857CDBB11C9007BCDC936710CE108D73	44E7263B9FAE241CFEFD223DE7CEF32676367D0B4066AFC1B92CA8BFBE53368C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3900	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	09AFD079BD52D770B8D9A3A608420B1A	2D592590CDC453FF78D9C06EB4E5687473B0B424	E913198B63D57EF067A3B10E2283E0D3A91555D13D4906931382C2A35C1A1185
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	FF84C248417BFC7A740417C68EA63580	400267A6BC9405044D7A0683C560242892025B08	A721647494B401C9524010527991A9E0718B6C1CC92992E2F67FE1CD2F982168
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	4399A78A059C3F9646C1786F552C77BF	884E8C16B505545837D9BAE2C3B092554CFB4F30	10158D09297CF8ED532B9A5587F5AE1331E00B9AA32412BD4ED3EFEDB2F94F1F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	0709B46AA506B9537D571C475372FF06	03AA01379255343DE1D921A4CD498E4799197106	D76731D66F74F0A7032ED62850FDB0336D792C57CB470782596BC110F89DDD33
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	81DAB6EE610AD7536B0DF5239D576EED	D2E4AD98B3403F349A8370A4694E5977ED97A8AA	A3148149214456B3DF35C62A0279E2B3952F4D6364C1842F9FEAAF7C3F14F7EF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	2EF5E83C1683295871478D5B6E70A39C	FD76FECECF06DCBC5DA5AA3F713A38588BE09C14	0E4686AD7B8A6C99D109AF5E4093165C277ED99AD5DB51113E0F5E980526C114
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	82A2667CF75D8C03E7BF4F73D628D35F	38A856E3A3981EB6BC0E22C96F532648EBE36D0C	EACC930671B7B3A872235CE4102174192C3CBDDB7EDA12A3EC139BDB97EB428A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	D826380FC9542AAAF87578AC8E7BF76E	54BBB25FE9CA88727D0F4F5C63042EFBAFB3568A	62017940D6344EC25EDCE62F88EC5489F15B56BA9F98E05626F517C6E6AA0696
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	9898BC3548514AFB17093FD2418DB991	1DE0F91C04B9B4F1214B874364952F9E2E1BD43E	5BF37E6A24983D7B0546AA21EFC9628CBE129029EB91C452E802CFB7E0F38F5F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	EE2ECBA9011173E13D40527A001707AD	3CA7EF8E763065AA3F008326AF36FF3C3D80C3A4	F31A69AD8AA14AADBDAEDC4AF973E18CF6E513D5E0A3C1E233922A9E94D2DCFD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	4EB3326ADDE179599A336B0836E0D132	FD0EC55265DC48D4E649F6908D38DD749BF1A9BD	23A1A342DD5F4915815941671895E71BE9B505077E60587DCBFD237C4EEF8F4C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	B2F465978D211EEAF4B1C903AB90B224	518B85D63EE178687C44932136B153DB6ECB43D5	938D498522B592248AC92B9CA1B99954725AE59300E1C322E835CDDCF716F140
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	194BDE8DFFF88FBCDBFE8467367288E3	B1F2CF5467A8D9EAFFAEA5C0C465C432A705693B	33406ADAC12764D8E01ACDE704E62BCA3152558793B45498EE6275FB0F836483
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	A6B97EB079FCA3E7A9E95BA7C1C7BA17	DD5DBE9D32F3A61BB84565ACFFB5E540B9A0C39A	429B5602F292D7122311CD0265C56A893C7C16DC355A09BA9AE0E134B2E144F3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	19D42D74FF79D2B923FD75F1084E9F53	2A17819E2FA2EFA0D659F27419A1526979C2CEC2	1C2C232B49C5DBBBC511020398C88952E62711F4CEE1C857F287DAB5650DD742
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	83311A7BDA7EF657F5E45A4AB603587C	19296295F3B6D5741CF00C87AB95FC6C9AF3CD0A	00B9413275B619841DCE2B1B4112DAA1DDAFD4BFD4ACAE4826C9059910B5DE63
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	F1D30E3317D3DF4349009C89EBDB19F5	8E854F1E238410ACEE3464E7374092E3F2635F40	3637B5B4CE9AE1ACED4D45AA63B1B864B624EF043203926D560A2C48436C05D9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	F55C23444821A6C89A61D46E3F22BB36	7B8A74FA189E631EDCC61145AF4F623CA65C2D65	7DBE64722EF669C9DDDF6936069F7724A5D4751E0DA09DDFF1881D7DE6F237A1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	B0C6C06288FADD14A2CFD0B955F8B8D2	3D9E6F80AE753A3D6FE0E34636A5841FAAD767BE	DF0A20FB6929A00972BF437C1F0747F016F0FBC4D6723DA13950D648ABC825D0
C:\Users\user\AppData\Local\Temp\MSI2637b.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	43EFB73DE58414B1F217B09D1F71A11F	26B3F3D86E8D82BD834763C94B74E76BBE86A863	99DBF566FBC55614102D99736349664388FA959A2E8C75E705BDAACF415414E4
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-18 09-13-42-710.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	EFE7893E462057E468718E07BAEBBF12	EF0F5092CAD6ECAC6E71F317B32480ECD0B9C3DF	AD7368323AC13F6086E1B09758E1B0635FBD4FE3FD3EC1BBE0FEA738CDAE78C6
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	3E99D21CE7CAF378C8DCD22EC090E77C	F9BBC14A0482A29EDFB9D3CAB21D1C7BFCDA9818	C3897AF2DA2C70B73BD7B54AACB19110DCD11FECA3AFB0A497A5D70DE04EF804
C:\Users\user\AppData\Local\Temp\acrocef_low\7d93cc9f-635e-4e4b-99c8-61dd7b1f4075.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\a3c585e6-cb84-40fb-b418-7e19df104f37.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	9D85D4B75E446857CE3D750299B2AF1A	3CD9576D0A07B9E4454F4FF4DDF8D18EFBB764B4	D3C44F50FD2912C92DAF009689B221515709E00C839A8DA425078C96F2D6053A
C:\Users\user\AppData\Local\Temp\acrocef_low\cfae7385-994b-46eb-83c6-ce3821df1268.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\ffcffb80-9e84-4d07-ac2f-65219f7e0244.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B

Windows Analysis Report
PPI Submittal.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report PPI Submittal.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
PPI Submittal.pdf