Windows Analysis Report
Declaratie 147379 - Exter B.V. - Exter DSM.pdf

Overview

General Information

Sample name:	Declaratie 147379 - Exter B.V. - Exter DSM.pdf
Analysis ID:	1541153
MD5:	cb4810250c6e6aadac1c9a9f8999f46c
SHA1:	ce55b6c83d7d6ccb6307dbab3ec17d42872494b3
SHA256:	094e423e7aa1aeadc7df3d206ba7737a92665c53a73c02eeb8b7df505855c870
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.8:49724 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.8:49724 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.8:49724 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.8:49724 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.8:49724 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.8:49724 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.8:49724 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.8:49724 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.8:49724 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.8:49724 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.8:49724 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.8:49724 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.8:49724 -> 96.7.168.138:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.8:49724 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.8:49724
Source: global traffic	TCP traffic: 192.168.2.8:49724 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.8:49724 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.8:49724
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.8:49724
Source: global traffic	TCP traffic: 192.168.2.8:49724 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.8:49724
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.8:49724
Source: global traffic	TCP traffic: 192.168.2.8:49724 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.8:49724 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.8:49724
Source: global traffic	TCP traffic: 192.168.2.8:49724 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.8:49724
Source: global traffic	TCP traffic: 192.168.2.8:49724 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.8:49724
Source: global traffic	TCP traffic: 192.168.2.8:49724 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.8:49724
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.8:49724
Source: global traffic	TCP traffic: 192.168.2.8:49724 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.8:49724 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.8:49724
Source: global traffic	TCP traffic: 192.168.2.8:49724 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.8:49724 -> 96.7.168.138:443

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 96.7.168.138 96.7.168.138

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: classification engine

Classification label: clean2.winPDF@14/47@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4508

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-24 08-11-03-476.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Declaratie 147379 - Exter B.V. - Exter DSM.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1624,i,18207051628461340091,6838274000774451513,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1624,i,18207051628461340091,6838274000774451513,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Declaratie 147379 - Exter B.V. - Exter DSM.pdf	Initial sample: PDF keyword /JS count = 0
Source: Declaratie 147379 - Exter B.V. - Exter DSM.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Declaratie 147379 - Exter B.V. - Exter DSM.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
96.7.168.138	unknown	United States		262589	INTERNEXABRASILOPERADORADETELECOMUNICACOESSABR	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.214.172	true
x1.i.lencr.org	unknown	unknown

ID:	1541153
Product:	CloudBasic
Start time:	14:09:37
Start date:	24.10.2024
Sample:	Declaratie 147379 - Exter B.V. - Exter DSM.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	cb4810250c6e6aadac1c9a9f8999f46c
SHA1:	ce55b6c83d7d6ccb6307dbab3ec17d42872494b3
SHA256:	094e423e7aa1aeadc7df3d206ba7737a92665c53a73c02eeb8b7df505855c870
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	AAD510A37AAD50ED0C9434300F8454AC	0C7B819B3F31758C3BB30C1F8EC5FF7DF61EC45B	F65AF610A83D0F2DA8830E61310D3476EDA5BC599541564710972BBB25049648
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	AAD510A37AAD50ED0C9434300F8454AC	0C7B819B3F31758C3BB30C1F8EC5FF7DF61EC45B	F65AF610A83D0F2DA8830E61310D3476EDA5BC599541564710972BBB25049648
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	CC45D23FC123663190D979A75F27F6A1	0B630F1B203CA4A42E6F1B1425006FD4FF9979C9	7AB7EDD517A1DFB2FDA0A9B92CDD488601CEC17532A71D6F5B0DE4A1F4EE38E5
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	CC45D23FC123663190D979A75F27F6A1	0B630F1B203CA4A42E6F1B1425006FD4FF9979C9	7AB7EDD517A1DFB2FDA0A9B92CDD488601CEC17532A71D6F5B0DE4A1F4EE38E5
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	D25A82831FBAAB53DA0A9FF676399C18	350EFB0B2B56CC8B0F650B34B59C0A705A4B2309	F20CB8DC5F98FBEB8B0AB91BDABB2A1D09EF0D927241321034284592013693E3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3f92b8.TMP (copy)	JSON data	D25A82831FBAAB53DA0A9FF676399C18	350EFB0B2B56CC8B0F650B34B59C0A705A4B2309	F20CB8DC5F98FBEB8B0AB91BDABB2A1D09EF0D927241321034284592013693E3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a3077105-57fa-49c2-9a2f-237344705b39.tmp	JSON data	D25A82831FBAAB53DA0A9FF676399C18	350EFB0B2B56CC8B0F650B34B59C0A705A4B2309	F20CB8DC5F98FBEB8B0AB91BDABB2A1D09EF0D927241321034284592013693E3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ddc4509a-daea-4306-9d74-bc88cb7fce2b.tmp	JSON data	4B26BED9BEE624446CDEB94BCC119674	B077FF05B7BEE72A439E04596CCA8AEF932D9C6D	C24545CD1712447AB0BC41E53E801108A369ECA554196741E392057248CD1E52
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	28F903BB5E646F6BD53988FD4964F1B9	025DDA36032D60C2045571537E44FD6B74FEFCF1	EFBC7141D41B817F4DE102B53970AD59F8910ABA13ECE2066ECBADBD7D853A19
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	BBDBD8421E3F3EF77F8D885004EA999D	9B6D75B56A83A37E2829E26509DDC444C0AF00F3	D71311D019DE8CED259CA217E65A1F720975669020AEC356CF5BE3CE741C30EF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	BBDBD8421E3F3EF77F8D885004EA999D	9B6D75B56A83A37E2829E26509DDC444C0AF00F3	D71311D019DE8CED259CA217E65A1F720975669020AEC356CF5BE3CE741C30EF
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241024121105Z-157.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	1D93E002166026E8A4380955176DA0BA	CC47329714582207CA7F86641589FC929B8F33D8	79A6603CDF9DA24D72D02DF56CF0BF34B48292F5BB0D9CD7DE57D12EFCDB3067
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	503E676D8C7E4F7E74629D7084DB795B	8D042951DC248B1E1BCEDEEDE6DF63BBA6C480C7	DF973AF28E518B92BB8A7BE1E82F0D6BCD4FAACC7C78CDFEF377AC5C3190BED8
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	B67B1B04F42D81EEF5554BE10DFD4B87	DF986F55E995409F24A5E69B542FF107A595B2E8	7FF83B8073E905FBAED8D753725A2226D501675CC6D4EB747E6A7ABA92D72025
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4508	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	27094DF6D14B4D6728D59FFC4E31294B	CC768A8693F9C122496C2BE949E13F0C36AE7888	B26846BECCDB3792F05A996D2863C7A1D286BD9F997DBC2112604EBDD206FEAC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	168EEC34814DFB8685AAD36E13C2DD43	39BED427123B6CA868E159DDD8BD688EF258683F	452ABAE1D1247E92C313D7166C775F51EC46CDCBF7B7B2E83B1AE2953645EC83
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	4D1D075CCE8BD3CB7B12493EA94587C9	D48984CF52A46B52BC2241CBD1972435268E87F2	4A28D31CCC036D6A7858E34853527645FC6A02069A3CE32592A1BB1B789877B4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	5DFAA762FB18F463A679C6B8724E2EBD	1B983424AFD9EB9932C71CFEB1556A042F88C10D	34E0AA0441990B9D6D9359F4BEED7467F4E5C917B72AFFA58ACAB94748B1BC9D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	874D40F79880E774539FD21C08E496C1	5A3F42DB91A2CDE40D1394C662A4F200C8C98166	1228E7DC78F54F2C3875299812F9CEC5C1512B4BD1E4CFDE6823DCAA87BA2C24
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	54679E96C6FCECA0A7E5D4AABCCA0A6F	AB4123DC0B856A1007CBE1C88BECDB1B1553C877	7CF2A5FC3682EF400FD127F9D11663B81F6F9519247F96977CD596BE31955641
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	3011FBB654C493A3FC1DBF2ECDC4555F	D4C16F28593F5B8F8D3E1793065574FF440DF706	5193A14E4A3429EA4D9BF5DB1E9BC2A213E19D587484F6EE05821C56EC31E801
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	DEB6D012B6AA612D0A1C7D06BE2FA799	304D35B30A792AF4B11ABA0D6A00FD4575D4A8A6	C2A08C641665D82A5F79B3CA820F2032858516EFB93D46F84F783C065AFD92FA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	5B907255F63C19C597A3133B7842E94B	FF185901B71250D65E535152625F0D576811F99B	C59D82C1B83F62ABBABD1B950F42F11CDF9E4FFC896E74A2C4031FE1F5D8133D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	8D6CCEC0E9291FAB94A121BDA6F4A2B4	57451BA0A89B7E363D8D7F365EBE35D0EFF6641E	65DC8A9AAE5E8FD22F818E65DE241F9523E785FB8C25E28C7ABD5EA3374CC970
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	614CA7861CEAA25C6CF7036D730D137A	0DD4E0398C26E1DEA9FAB4DCE3CA13CD14DA1CD7	5962E9CD25001BF9E8833E7D21F95D42E7476CC1E1D9CE6C4B070BE4CABA7363
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	C424F2A49F0AE279D46822DE52C3659E	95900035F9860D29A9CDDB20B4181B885B4F6A54	1C9144BB525194AE17D4D4220064C2CBD7E5F9FCAD69A242FC8BFC9D69C8A997
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	A642FF1F5AC6A88A4A15B5F51AE8F1AC	03AA1CBB2515FEFBFDCF0126A63D2A296C77DD05	4357CA66F725DADD6EE7CF341501BB09562DA5400811EB5CB8BDE50A43256D56
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	8E40D9E2A79AA53DE702B821EC9DB32D	DD9AB5ADCFAF8A6FC4237BBA608E55247471154F	88589E9F17620B378C7BCD5033BB519BBB4B0780F12DA4A66610C0C0EF8C703E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	CF1C2D2A91FCDE38C09E5B4B7488F738	218630BE8CB4710B4382A2B7811E9147421A7A4C	037DA36F36D0BE3C08D6CA0B54B4E187D5A8B8D67DCE9D629AACF27D9F32E28E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	F291A6CEFA49C4CC0DC1A9FB4D207922	A860FE2E4F2B2AC642BB06B9C47471498FD852B3	926B102BFAFEB803632DFD9B64E5AD43F481BE89ED74C95883622422F3D80E9B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	7681DCFE7433D47750AEDA4FF24075B8	E16750C44FA396562625905C9FA9A95BA0ABCC0C	C85572172B07828786555B383A8B839FAAA4BEA539C60E4878FABFBAEF370B40
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	BCEAE372FC649D5D46F2AC7F90CE035C	0AB69835D6B353F9CA436A0475223CC285D044F8	697771CAF4F270737CC91A7F050B545CDBDFDB871E90EDF480C2C8D9B6F0705A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	1A54D2B2E91DE1EE0D0B84AF8B173F58	FEB7E041D24764160A9ED4AA88F7000DDEF86CFF	3D8C5FE3583F4653F7AC6F6B2BCEAF32DED60267A833842653BB8A5E86EB37BE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	62D0BB28D6AC3FA1165B538EDE3D6632	FE4F7F3BD2BD6187B08DCA24A8095C03C9CD2EC1	AF3BC7F1432980A8113F747881858E075C40B09598022952BD7B7D70C56A0463
C:\Users\user\AppData\Local\Temp\MSIf5512.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	4C01736BC18D94AFDC2D824438D52650	46FD5816CB5107294D7D0AB036C7D00008888188	0E0093E0D09E9F5D7A98BE0758062361DF6EAB06BB486EAECACF4DBBEE8AC33B
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-24 08-11-03-476.log	ASCII text, with very long lines (393)	C3FEDB046D1699616E22C50131AAF109	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	8FDA7EDFA22C678CCA94BB43A9BFA479	E49C26235C53F4791671EFAFA05BB1CE16FCC885	FE59B7D44FA3724E02B7A76F44ADB51BF09CC08A3806DC2809AB2A5583BFF640
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	60A142E6EE464E24ACC8BDAB4EC038D3	CCBB8DE011A4068591714DF1151699BB95CB719E	4C9FAB87837077F9348E58C21779B1B19CE557C1C021FCB883ED7A3C608C672F
C:\Users\user\AppData\Local\Temp\acrocef_low\2a2ebc55-c12e-4ca6-9686-1ee5dd93265b.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\5273b4b2-a6d7-4430-808e-9c50c0dd230f.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	217ABC57FA3F0D90BF80A43AC782AB59	FB0F16B823FA9B34F7F8B104A429C0768BE56121	837573D29AD478BA777C839D363206CA89E1E71B6740489FEA59E40E6CD866B0
C:\Users\user\AppData\Local\Temp\acrocef_low\54eb0025-b04c-4a71-a4af-a08f99b55f11.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\5c07850b-c976-4c3a-a37b-aa13ec213f0b.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685

Windows Analysis Report
Declaratie 147379 - Exter B.V. - Exter DSM.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report Declaratie 147379 - Exter B.V. - Exter DSM.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
Declaratie 147379 - Exter B.V. - Exter DSM.pdf