Windows Analysis Report
AlisonMarshall.pdf

Overview

General Information

Sample name:	AlisonMarshall.pdf
Analysis ID:	1541311
MD5:	0daf716d2a8903b2d4ea1d979fd8b496
SHA1:	cd700bc3ee2c28c20ec178db9c6fa49d6083175d
SHA256:	8938dbda5acf5d8870d745181731a016fe8fbafa881ea572f3a2b44ec3fd3992
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.7:49734 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.7:49734 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.7:49734 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.7:49734 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.7:49734 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.7:49734 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.7:49734 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.7:49734 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.7:49734 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.7:49734 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.7:49734 -> 96.7.168.138:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.7:49734 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.7:49734
Source: global traffic	TCP traffic: 192.168.2.7:49734 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.7:49734 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.7:49734
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.7:49734
Source: global traffic	TCP traffic: 192.168.2.7:49734 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.7:49734
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.7:49734
Source: global traffic	TCP traffic: 192.168.2.7:49734 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.7:49734 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.7:49734
Source: global traffic	TCP traffic: 192.168.2.7:49734 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.7:49734
Source: global traffic	TCP traffic: 192.168.2.7:49734 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.7:49734
Source: global traffic	TCP traffic: 192.168.2.7:49734 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.7:49734
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.7:49734
Source: global traffic	TCP traffic: 192.168.2.7:49734 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.7:49734 -> 96.7.168.138:443

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 96.7.168.138 96.7.168.138

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.4.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.4.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: ReaderMessages.0.dr	String found in binary or memory: https://www.adobe.co

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: classification engine

Classification label: clean2.winPDF@14/46@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-24 11-23-48-356.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\AlisonMarshall.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1364,i,7330972416840462097,15245140379851579721,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1364,i,7330972416840462097,15245140379851579721,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: AlisonMarshall.pdf	Initial sample: PDF keyword /JS count = 0
Source: AlisonMarshall.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A913k6tiu_19unl2h_2xo.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A913k6tiu_19unl2h_2xo.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: AlisonMarshall.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
96.7.168.138	unknown	United States		262589	INTERNEXABRASILOPERADORADETELECOMUNICACOESSABR	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.210.172	true
x1.i.lencr.org	unknown	unknown

ID:	1541311
Product:	CloudBasic
Start time:	17:22:49
Start date:	24.10.2024
Sample:	AlisonMarshall.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	0daf716d2a8903b2d4ea1d979fd8b496
SHA1:	cd700bc3ee2c28c20ec178db9c6fa49d6083175d
SHA256:	8938dbda5acf5d8870d745181731a016fe8fbafa881ea572f3a2b44ec3fd3992
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	FAE9ABB8D6AE1676EEA4CB092AA32D8A	464C4BEA152D44969E677159D2583BB7DC2B1148	4DEB6C0B4C5ECEEDA6CA1AED2E631F3E79D0C6947510E93A3D677AD768484A8F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	FAE9ABB8D6AE1676EEA4CB092AA32D8A	464C4BEA152D44969E677159D2583BB7DC2B1148	4DEB6C0B4C5ECEEDA6CA1AED2E631F3E79D0C6947510E93A3D677AD768484A8F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	4134F243302513DB27EEFA95BCB8536F	23E4A0696EF3E0B43E3C5B85585E3989766C664F	3CC66E38FD750C987EAEE600AFEA5D0543B1076BF73906682A54B49D50354DA0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	4134F243302513DB27EEFA95BCB8536F	23E4A0696EF3E0B43E3C5B85585E3989766C664F	3CC66E38FD750C987EAEE600AFEA5D0543B1076BF73906682A54B49D50354DA0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	16FF9A5F20D1B5B99587E5027B043DBA	EC9F335AE38264CBD609C11498A59B3E91C159F9	400A7C1E950AE99B4ECCF43BBDF0616E93EAE3D14B0B06D84E0CB70F704AA653
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d6f999eb-de21-4289-ad87-f127ebdbd442.tmp	JSON data	16FF9A5F20D1B5B99587E5027B043DBA	EC9F335AE38264CBD609C11498A59B3E91C159F9	400A7C1E950AE99B4ECCF43BBDF0616E93EAE3D14B0B06D84E0CB70F704AA653
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	2780C3602BAB264A824D078D3D8B043A	9BF3978E2053BDC47C61D5D407A3BAAB33EC35DE	51CB5D5B0E9B96E3F9EC078931E26BADF01C9BB71620E37202EA49F33E9D12D8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	D2B0CBBA31BFD00E86A5E45725DB796C	1EBCA0B6C2947DE5D8BC486DF8DDC6E9D0A2468F	3E3729F6B66723B764DCFBA2E8D940CEACFB2580386E055DB1D60B929B5B0B8E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	D2B0CBBA31BFD00E86A5E45725DB796C	1EBCA0B6C2947DE5D8BC486DF8DDC6E9D0A2468F	3E3729F6B66723B764DCFBA2E8D940CEACFB2580386E055DB1D60B929B5B0B8E
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241024152350Z-169.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	D4976C0357F1C2BF3BFC45214D63064A	730C46DB4F21E8F0B0BBFFC95BA99F3609A71794	7016B238B8674A556189E86762C0FF4942A824E61B025238B77E7C727209B118
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	22541FA9610CBB97CF17B97199B6B762	865A8C42B6C6894718F4A5BB7EAD7C100C3F1312	B6135CC264FEF86A2FFA8D4066655CC6A1D310289E28C15AF102E91320C463CD
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	621101D427C973ED8B648DF1BF16E6CF	370AA791847333E38D6DAB061F9D870C90C76C9E	7FA18462A8A9F79017124F93C1C5BAC2E02EEA08737D31EDBF655CDEFE71E552
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	951BB10F85381854DE302C5F45EF25C8	68C9E1B25DCACAE19CDDEAF22487E3ACF4C71FE1	D347F2DC62EB43B81E75D5C83215AC959E5D7634A0992ED01EBCBCC21DD74741
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	DD87C410168A190D29C0925F10E6F524	5A44199042BE403BA688557387A1C188911B3EF8	13313A0B0FDBFC4B53AF1D56CE931649EDBC384B9A459195167EFA8697D752C0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	C11248DE3EDEB5F39EE8D1E2C1FFE7D8	7EC6B85BDB7C99BA691BB08A051EF7C4D4A43231	57612AEEE8F8E8471B730963F8E111C9890F83D8120380A6FF0676A3814A4B41
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	FF98DFECE8DC4DE0CBA3CD075F15AA01	77C9F7EAEAE8CCC50F2DBE7C746F0C60A1D987EC	AD366ED845D6D18E43ECD6D18CAF93F02B029AD02A051643F301305ACB204F87
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	9FA58BEF05E8E426B66DBB213328EC2E	553513A7ADEB9835BEB5071654D34D6801AF047E	053CA2ED1E9D5454DFECB3A0680B5554C1BE5E4A93B4CFC8FDFA3AD574AE6BBF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	C67B71D2C7748C3BE611E9312293F612	489D81D63167CCCC374E2F9241915632BA876B6F	F012CD57E310A1354725EFC7627CBC5CBC97E1046432936492BAED0376BECB1B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	1598184E269F2D41244B32F5C234197E	10FF1A90603055C53A3DAA3D7ADD9BFC847E1936	6938CF65F4FCD55B7E3B5424C5B8FA72B8DB9F0440392782A871A5D24D2955FF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	421DB58F3BD9D122D699C1F06E3EDB98	864BFF4F80DE4FFB5DBC837234A6699D1A5EF773	0EFE9BD17742972F934EA55BF0109C729195C942D7EE1F358EA6AA5AF6549256
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	61DB5720A61D1A20BE5C0A5CAFEA7005	85ACE28539F5F9312E5B3527B1A9CAEDB80BEF19	30CDFA4B3730419F61136E4411258469E05D6A3A581DA0B4762D605B64C19385
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	459A3B162BD7A9FCC66EB591A1B1BD2C	C52E0FC15B5B6C4FDB86FF2DB388BAC16BD5548F	C4365A1FC2BB5037E93F05E4A2550D0667E5F0E0B5B54C215565A48331CFDB16
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	69B1A15F46B154F7B639E7B7138AC46F	4D47C293482EE34F396DEB1B924BFAFF7AC5FB76	568D9D72067ECCE0B9BB49C0E0631C02D7747E0C5FFC958CFA5B97354BA255F6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	575906F8FC888973211A451F365BFC10	1F64CF750F761BB5C12DDA079B7B6D48DB0B3BE4	257ECADAFEFEB86E414F8CF6172B9731CC7513BADCE72E81E958D78D5B2072A3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	C16692BBF685AFD8BE4DA2202F1706DE	21BA7BA8A50D340641BA34451191F36EF375E05D	C8B8D8B68B94A6D7ACE375E1DCDE7ECAC0E623E2C5CB4E2F8578A3091E2B1B91
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	8CBE050568F8294C7CC9B1711169947B	EF91543FA594998471E886209B1EB88C697FD496	2965EB07D68186FA7FEDFE7C8132598AA5C12D59D6831F1E9A44B8F51F10EA2A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	0B9BEE36BDA5375FA685FF87777E8BB8	96EA5270E47035B96782AE2352B708073A0C30EF	5FD64C31E1CE82556B133C004DFA3601E6DDE7306CF2605F197007168D7C1492
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	C4E9F284850A38E032BBDF0A9BC4D75B	307F242CD0A1901008E883D426065F606F2DFCA6	D74881663FB02938263892BAFB9169776844C49EBB807D515A81998B781E65B4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	2285F28F03A46E3BE17ADFDA640D4672	71D9088E95D739D90CE70F4EA79BCBAB6B93A5A2	A6A4FF5E8968783C35425915101F2D0C9D43636F4C6074EAF99062D6E70B9BF6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	CCB764E209C612732B94DF4A08B6348C	264ACDC3CFD24C9B6807B6E6B8F908FC81598A1B	C6A4AC2BDC1B41CDEB54910A8BD0A8E7025CA6BAA715C3E619009D5A59AFC003
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	FDD7928DF2C14FFAC4AA0E75468A78EB	B4EED54A44A8501EDA29431FC02EB6879903EE2E	B1DE9BE2B042D8EA228BA9158019031991909DCF83A7333012253C7ACADD3470
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	4E9B4A74B7E3B05C180BC959974D2B42	877ADA5F03A1E7C6C8FCAD79854AA0725D4D5710	920F3F04AE67660C07ACD4F2A1A863D33AB54D341C891C5C1C151CF1279549F3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	D2945AA9F2D815AD22386A4A84297C5F	5B45180A92D7844E3D2DFE0ED3188C4EDB0F7148	4AD7CF8309F074E53BCDA1F6B4E7FC7B8BC71141186F4124927653CA134D90ED
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	FF20E3D4517F124397A488D76D8EF6AD	DD3EAA80295E2606F9D8CF3B3F8E82D2C2201D50	60A31A159A30CEC7374D2410B6ED75E2DD9E058970E7A18255BEC41E305C8F38
C:\Users\user\AppData\Local\Temp\MSIcd4f2.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	F4CCB36665CB272AF29B57CBF8253DCF	C96B7A33414167A1837AB5BD5D8163ADAF5A42E6	67EC8061E31DB575BBFE6BB68CE8470DBA0B161FBF94B9228274D07ECEB9A972
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A913k6tiu_19unl2h_2xo.tmp	PDF document, version 1.6, 0 pages	0802A8C752F694D540F21CD8135BF352	3856FDE80102A4D6F897788E34A5BBB40B41D540	6600CFFC66A61B416DA44218A1D04EEE2473A0F64611FFA422A508422F097616
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-24 11-23-48-356.log	ASCII text, with very long lines (393)	F49CA270724D610D1589E217EA78D6D1	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	4938BDD679A486714BCA64EA051ECCE1	9D10A7D186ED32E92858A4958F8880E3D546E45B	01E5775323F8766EADFCC8D8B1A584C10AA1C185EDD8219789F258C560DD893F
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	ACBCF8555277DAC27D172FA05B01B42B	78CED2504D4CF06B1E7D2B7FD667F1E22CB98280	302958792912F831FB4228BFA86F750CB1E9DF919320D58C0CBCC8337389A858
C:\Users\user\AppData\Local\Temp\acrocef_low\07299f1b-2b12-4bf0-8abc-ea683e8a774c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\1fef49e9-b490-4b53-af15-54eef6de9467.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\847ed7b4-e6f4-4610-bff7-c4dc0598d467.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	C267C8C3D4A0DBACC06F3737E1784EB3	D798A10176D979377257977E896C8D332B785F23	B5B5EF233AADF8F9C3509CDE98C7A9885D0E1B4938CD2A0676170BC8B30855F4
C:\Users\user\AppData\Local\Temp\acrocef_low\ce8d313f-d1ac-4245-a762-0259ce6927cd.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE

Windows Analysis Report
AlisonMarshall.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report AlisonMarshall.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
AlisonMarshall.pdf