Windows Analysis Report
0011_001.pdf

Overview

General Information

Sample name:	0011_001.pdf
Analysis ID:	1541158
MD5:	0884793e0cfe4c8c2d9cb0f0450f06de
SHA1:	9e07f5f1a537008ccbf02b015e1bc1b58d7f6c2e
SHA256:	f70c6cf59fe4a62067080f047a6bdf913510e343da20ee270434a9a04e973c92
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs DNS queries)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: 314b8fa9-78dd-4d0a-8a8a-0a456fd7696d.tmp.3.dr, 28f20374-d610-4809-b027-4c3c56f96bfb.tmp.3.dr	String found in binary or memory: https://chrome.cloudflare-dns.com

Source: classification engine

Classification label: clean0.winPDF@15/48@1/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6864

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-24 08-13-54-412.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\0011_001.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1628 --field-trial-handle=1584,i,10091206223282908299,13148888076212320205,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1628 --field-trial-handle=1584,i,10091206223282908299,13148888076212320205,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 0011_001.pdf	Initial sample: PDF keyword /JS count = 0
Source: 0011_001.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: 0011_001.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.214.172	true
x1.i.lencr.org	unknown	unknown

ID:	1541158
Product:	CloudBasic
Start time:	14:13:17
Start date:	24.10.2024
Sample:	0011_001.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	0884793e0cfe4c8c2d9cb0f0450f06de
SHA1:	9e07f5f1a537008ccbf02b015e1bc1b58d7f6c2e
SHA256:	f70c6cf59fe4a62067080f047a6bdf913510e343da20ee270434a9a04e973c92
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	6DC96BF7D76EB2218377B8AEEE43278A	AD24649DF1CD0F74347EA20BF801F7CDCD137DF4	FE8219074275E3EE6D4BAE0B790E1221ABB6D777D491C34E5882DBF8CCB6DC95
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	6DC96BF7D76EB2218377B8AEEE43278A	AD24649DF1CD0F74347EA20BF801F7CDCD137DF4	FE8219074275E3EE6D4BAE0B790E1221ABB6D777D491C34E5882DBF8CCB6DC95
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	B9B72EE13F9B4792F8DB2377A68D7EF5	06AAD74709C9A9D9127BF3B4591A78C0DFF22021	BDD5EFF0E1C8D40742E73AD42AF20C6C0D8B8C9A17E3E99CBB7B4B6E0375D3F4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	B9B72EE13F9B4792F8DB2377A68D7EF5	06AAD74709C9A9D9127BF3B4591A78C0DFF22021	BDD5EFF0E1C8D40742E73AD42AF20C6C0D8B8C9A17E3E99CBB7B4B6E0375D3F4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\28f20374-d610-4809-b027-4c3c56f96bfb.tmp	JSON data	962308D4FE67BE878E7A4DFEABB9480B	64A6AB39A7F45DF5FB0A4D089396760BF03A203B	EED65F7CA393FF5ED125B0CC58F047F17F45E4726FB51B47A675544C63202378
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\314b8fa9-78dd-4d0a-8a8a-0a456fd7696d.tmp	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF53b8ad.TMP (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	5BC351487C52FBFF7C7F53E4E40FA360	F65FA602FF57FCEC3AE220E0630FFE779321B33C	F59A99C35A28D2EF671FF869AA614A9FECEA1B66EFC576FE7C0D743A34033F00
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	170F1B7CF65582CECF2E059FC42DCFE5	C905C06548A123F73BC6053D5453813FF70FE1B4	6894B891BBEF99FE88EA930082F86F3652EA2953FF696A6439DD91D9BFCD1A93
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	170F1B7CF65582CECF2E059FC42DCFE5	C905C06548A123F73BC6053D5453813FF70FE1B4	6894B891BBEF99FE88EA930082F86F3652EA2953FF696A6439DD91D9BFCD1A93
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241024121356Z-160.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	1C765938DFA4D7315F0334BEC0A068CD	9E70F32604D8CFC2C2AF32DD52B2AD1CB0D1EA5D	B3A3EE673C126C04AB6CE9AA4A33D8F7CCA7C8D6E63205EFB21A60E01DD689FA
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2	A4D5FECEFE05F21D6F81ACF4D9A788CF	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	7207779BCD726290C7CDCE1F19C93269	EF034F26456CCE68922535EA932F56FC14614A51	DD29F8C8095B6CB16A9FE08841FDDBC5B0FD4D57E029B2D8663151670DBC193F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	2A6323F5CC0BE0D5F09E5C5DCEAD65DF	8A3F0E612CBE9ADEBDD222C75CD53659AB70D415	6FD947C75889474122CC780DC685FC67C86C9193F0BE5547612247C545654FAF
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	4C6C54242F17BBBAF3F25B70F4AFA7F7	FA4E6283FF946326DC04FFE4BEAA97C5172686CD	35CF00BF96C21E0F839D10B1A4EDCD47B3107DED0E0DE49C85CB406BE6ABEFC8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6864	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	D40DC9779B18CCF66867446860DF90FE	A9D4F2E874C3B9E2345D0AC39A9641C67C9F2A98	73411E233768D821C85260C943792B21DEAC259032CC973B6BA2419E513F2620
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	6B63FFE71819F09CCF19164EFEFFF5B4	7AC22C4F9CC5462E231DB9B555232BE0CAEDAF17	29D3F237E1A5154BA8F55C3E43DD7C924094AA723EE03090617158E41E58C113
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	995A8E8A80DE7BE2C8D35938C4592C31	A5E5A6AE1ED145643386E07A2DEB1561DD47FA79	2BA8A0E7F2068E1D29FF80D922300FA04EE8E248051A4D92FEA072925B038CA3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	E176DB15B43F3A1734242E66CE82824C	0D3CCD7953B0821535D91E6648D628A4261AEB5F	7B3612DE2F7BD9FF8783A21A82CCBB4C4B12EF4A2CE548568802337C65CE0186
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	2588F8F96B6EDE39EB81327AAB3426A1	681D2191ADF5854CF330EB0CEB050E96C6BE62E7	E9F50ED6D77B3A6A9CE4464E953042AAEE9D9FB4E15F040B31246A7B6450623C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	488BC33298D6A45F5C9B5D9DB326A149	57D991CEAA7A7D62F7B6282DF6C0E20CD0DE0740	24F14FA9E928CF2174C9BFA3ACE535E5F67BDFCB9396FC84236BF1E51D4D58AA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	8686C7491D169B06112089F6D0BE0036	983B9E33C268A52782494FCD6890DD0CD59D4088	3A168F7D79D2B37FF3BEFF5D6BC4A72D87C1BA7838A5C74E2B05F717D789DFD9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	1750EE3FAFFA9DBC6C6CBCB13575F8ED	A52394A57B715F7434897C2302DFEBA53F7DF398	612AC439F0FB83A22395F602A9AF432BFCAAB0BF52C274872945951003DAAD8D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	3D6CDDAC35E0C7C8C4F92729003B4C35	ABCA737D9F1A2B241784810945577D8CDDFE14E7	F5C8995E87FB80A2F1B9BD3520C2E7EDF41EE3968EDF2184B820C095EACCCC21
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	1710C4497916A31D92C8BA82CA26F68B	D6F349E0EDD5418D7E6B69DCD597C47E07A6A6AA	59D71480B006BA09064335921590BFC468E068C05A1E53B543DA120C5C61F3FB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	2E6A1CAE3D0F176C5A6DEE6115BC202F	60DBADCC0CF5B7712FC2A1E2298116A84D1184CE	6B7D75E4BBF5711DE313E8D459E82B46BB08AB1CD5666A38949775E853A2C7B0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	0641D06D4330062B0E561FD7AA2260C5	6B10D37BB312E2F0C6A97B9636614676474DC217	035C6792040FDF5819395FAA7B5E1BEDAFEF8A59F13D98F85FBDF5AD127CAB38
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	3B52C997AE062BE832A0B00F371C4B56	B883931328E58193D48B48055F55B0324ECA9723	F4148D50FF8479DB2669724E08D76125B89043570A22A9127655509C35436DBE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	8F41E50CCADF8758FF5E91F515DDD533	D69B607C274C6D4FF1CFED563D0188D837ADECC0	71ED84FEFB7E094EAE6C55E4F8F4C0DA33511D57684C1A27E83E8F83F8D8C0E4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	BCF6F124CE5610A2B31FE9E12FA805E7	A5179D72A9D0961D89840801881B7B745BB67A55	6038AF940AA6260DBC33CB97AD5B6E000433CFEC6B78A5F8019E354F90C9CFDC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	C1C906ED36E6B39C37E4F6887897BF96	9C047D1267AB9BD211EFC58C6D0A19BCA117EC61	C78DABF0D945C6C530F11539A1377854B615B5AF1C9D46BAC2E32A65B71FC9F5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	181C994E175B133E45164AFC6B94B211	F51A1DBD1763F97C464DC5F50AECE3F8DA746B5A	C10DABF4C3BE6A4AAE51465C4DF95B483F697B4ACB03BE00264604BC319AE895
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	3AB0949ADADBCE1E5BD80A6908498098	894028DB62C76E0244E2E612867197092EBF4B37	556F04478D33759B80FAB709F38930DFA15707248E374375ADF891130A391EAB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	752616599E2EE7F0CD8A4835EBCBD7CA	8385D3C007F4555611D3C4686429483AA9F0DD6E	3F68E34B6958D03DE49B4C2235C9BC51E304739F5DD325153CD62C111B72E5FE
C:\Users\user\AppData\Local\Temp\MSI2ab93.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	814976DDF49F8EB0B9486733EC851C84	90FBEF87D2E685F9BE130F9996AE4E9D3BEBC0CC	1BFE76F925FB82EC180B0CD12E2490FD6950F180F685CEE46EFDBB8A035B6332
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-24 08-13-54-412.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	4E5D5EAD405657A44C3E43B28017B1F7	2BC76636EA94C33F82B24C5060410FEDF2D9C23E	508AC808B964B595F32572D8C0B9AC10B69CBB541F64177754ADD8C4F239256D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	270A432B97A71D483C2AAADE8D3521BA	1134C68872E1BF7E21FEAEAC337A971A59F5C56C	41C00A9939109F8A7D4F5E38D4ACBECD49636B52FDFAC1D9E98C1728B0A8E421
C:\Users\user\AppData\Local\Temp\acrocef_low\119487d6-400e-4147-8e41-91e68de7491b.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\a27277fb-007a-4324-8d33-eb86988271cc.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	1A39CAAE4C5F8AD2A98F0756FFCBA562	279F2B503A0B10E257674D31532B01EA7DE0473F	57D198C7BDB9B002B8C9C1E1CCFABFE81C00FE0A1E30A237196A7C133237AA95
C:\Users\user\AppData\Local\Temp\acrocef_low\b32d8246-31f7-4394-8ee1-6dc1a5d05243.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\cdfef78f-a40d-4d3a-8d40-76cfa2e99846.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	716C2C392DCD15C95BBD760EEBABFCD0	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8

Windows Analysis Report
0011_001.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report 0011_001.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
0011_001.pdf