Windows Analysis Report
C0260-COUNCIL APPROVED PLANS - ISSUE D[74]-- Panels & Inverter layout .pdf

ID:	1543507
Product:	CloudBasic
Start time:	02:54:58
Start date:	28.10.2024
Sample:	C0260-COUNCIL APPROVED PLANS - ISSUE D[74]-- Panels & Inverter layout .pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	132ac7416a01418ff771ddaeb04e0e59
SHA1:	682ac89892ce4c10b5f7008ccf76018ae0485cd8
SHA256:	f921ad84ebb6c626c6d5aff981e0ecc25e37fcbbc4ea39c0d9b416ea63849546
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	668B696EB842C5E0DA3FB4F630CCE3A8	8DC4069EAFFB2480AB42DBD634A0E0E30D6E9E84	9CF10BEEB5F5877DECE8D0E3010C082E70A25BE628FC5C4DC551FF4FC9AEE2D6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	668B696EB842C5E0DA3FB4F630CCE3A8	8DC4069EAFFB2480AB42DBD634A0E0E30D6E9E84	9CF10BEEB5F5877DECE8D0E3010C082E70A25BE628FC5C4DC551FF4FC9AEE2D6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	A963CCDB58052A002ABA3E93D0A8BF18	7F1CC086908079C4E77B1917A4ADF456CF22CEE9	D30C0422A0F71023E9DE3A96353019D30668C02FD47DFA40FB79B1D66DF1D8AA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	A963CCDB58052A002ABA3E93D0A8BF18	7F1CC086908079C4E77B1917A4ADF456CF22CEE9	D30C0422A0F71023E9DE3A96353019D30668C02FD47DFA40FB79B1D66DF1D8AA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1cc4df5a-da30-47ee-979c-083f1802c5ef.tmp	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF465b2b.TMP (copy)	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f2609660-e1d7-415c-8330-bef3e2c7f13c.tmp	JSON data	05FA330361FE84815EA5D34558841AFF	14DE69F469B09F310760A5971829A6F3B44E3B58	B65730E92C77DC152052295E9D5F8CDA43CFBE3CB4B40D69D65BA5E061958EAE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	1094AD77A2017220674AE8F5E34F3945	D3D5D5B809EC5F5C6394C5B56738A90C39DE73EB	45E56003746CC1A788AB2C6F9E058EB0C91B11B29F0F2C45E18E510006D44426
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	D726AEF7A99286CBFDCFF02F4E4B6001	52D9BAE4080C3362A3CB137EC4236A6C9722B8AD	D23A695D8E6FD3CAF90F1032BAA99C875EF3DA4C5BF8CFBE715D9EAD729E125B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	D726AEF7A99286CBFDCFF02F4E4B6001	52D9BAE4080C3362A3CB137EC4236A6C9722B8AD	D23A695D8E6FD3CAF90F1032BAA99C875EF3DA4C5BF8CFBE715D9EAD729E125B
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241028015619Z-208.bmp	PC bitmap, Windows 3.x format, 164 x -115 x 32, cbSize 75494, bits offset 54	D4C9C3B4722C538A43DCC3BC70054307	D554F0C82CF8119CFC3366A0398D8F0B87E5E4EE	8F0267EB9AE887EC59A68794EF65F249892C6DD59FB38E4530E98071EA734F2D
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	77AEDCFD039769755D12A4394C065DB0	74780833B70B0441DB8BD9111EA76CED1578ABFD	6BCFD3EF89892B58E415C7B089A24675236DD4B120DE46303045EC8CAF1BF1DC
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	4A2B64332AAAB9E4D906DC5ED7DE01FB	8A59C792B60A81A9380E32365EFE64D0BB723B4B	CA4C832F4E8123B0937DD8969FE7050378E5F8D333633CCD2B5A224689AD09E8
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	5D6355DFAB0BED1C67B6176D3658FDF7	E4DB80D9E8DDCC0A86341F2B88DA5A4D0143F4BE	4360B227BB166F41FE4CD18B3985CD05450352D2984D0B406DC913CC1CEB2050
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	689AF9CDB0E60C97BF9B7BA9185558F7	45FBE26663A4EB66B4BFDC6B4BC55943271D29E5	96E84C924BDD81C6A2F3DC5D15C63F9D513199CADDE4744417778C031D5977A5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	814FD04B6B85546705E9C041AAF4E6BA	393C6C830C7C767B88BEEE07EE357BE18D1F8A19	183DA4F0EE8938F1A2872CC38FD104E6E94FE0CBD1A6DF7CBCE9FEE334CC0D22
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	F6776642FE2F27B0EFB8E566F99E5818	62430C1BD77EEB3B52110AAF8B16126AA06DE26D	1ABC18E579582E1AC1603A67F6F6AA016B8AF6994EE8C45C139AAA47DC1AA35B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	DC02F0B3CCE48DDC736C4D714E81CCF7	6608CBE67DDB7AB0FC4D8EA1F2309ED9D73F86D6	172955C76BA94A97B9F3350987F316A241AA05949981A5A44DE2B737886C42FE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	6E7664F05092C73536A989F41D113D6D	2BA05E307E4C186876DE08588D0E6DE05C11A99C	D26D844C43145186E8E4F8DA98228FE8A98F6C518336C7AE295D34ED470F4C81
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	936E713D4A810DC21ADBA7ABCC3C987F	6265665CC5B7D8A783B220BAFD335DA76858841E	7BFF82F3E15580CA1F7CCD5DDD4136D1851C52469E7E4041F0EBC0BAD6FE3AAC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	933358B3FC84FD9E7762449EB8CA27B2	41A848E669ABCA660A40FE261D5B505CFACDEA74	A35AB7E0BC674417077D536AC41BFB4A746B2FB6074B20B4B86C040E3FACA933
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	29F8BD47F23CCC53CDC4B028D2E0BA85	196878AD085611549E9F7A23C45A0B30DB18698A	C99604E958FE6E24B8B509A4A7195CFBDA650533F205A54EFF4D97F77AC3B195
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	4D4521C69A88D288584BE40EDB03AF9F	0AC12769DE8E742A7B5EA6BC18562FEC136C8747	234462F16B5D56B36583CDAF326FCC08DAEDD7E313FC1BA1F01997EED94A4979
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	CCF28E375031072F77B10468A6A86DD1	941F92C65647E88A982FA0148246B0311AE57B34	2DCB17B1658D36E45A43E674EA0D7930C9A1A74F44642E3C5E5D8278210C2E7D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	ED31C4BF86A1D59DE79C5AC49A75B7A5	AB268164E0D598DD4DF0FB28AB0B7DCF347208AB	129449C906A8473B6D23BF08A8AAD5EB6EEDD2D2070ED796BB95A273662A75D0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	1828C4FC106149C4E7BC1C15A435AF14	D932030FE955AB8155F80A1C39B46FC331E49162	74F61025C08E48B0E7518A6BA741B2CCF7F2218F5C27EA2B3A7C074EF5E79193
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	0387D061A1C3FF7460905BC634312933	FA7FB4224D33C18598910D8525BBF9D07DE62B3E	7F08048479834E2EE811E02FE8751C9DE19E5E61C8EB0E9299EFFD4DFF46CDC0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	94582459670E6C33BDC8089D0D900FB0	F746E0531F6D0DA637200C2680E995E7600BFD07	84D862D8A28298EB6D972C56F530D281BDD4C3269E7E6F5DEFF69B88624DED4E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	E2B79A5C64FC5655C4AAFA8610B597DD	AA94754DAE4ABF7219E9D35483596E9BCD5388D8	650A6602491FC1117EED027A2CEF54589A16B69D7A9ED39CA2EE59B26ABE78D6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	18E9213F0A742457EE3D2253485D06FE	DBC438A0B90B833FD7930C7BB53573D45472542E	37C61A5C11C0EB133EAB09304B8C5542556AB307E1AD514E8AE660E8F69B8D5F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	553E8B727A58AD3F60F296BEAC862E12	8289E4675311CBBFD5A16C48314C9BEF68F8C449	27F66FD6B75FF9DE6CDA6CAA0D09B4A717106F676825C32AFE049BD5882ACCCE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	647A5374DD6A144D62E76ED2611ADCF8	D14ADA580DAEE637F830ED60C62EA4853565303D	8236F0D900C28D9E9804BFA41C8F4F85816E3C321A3552AEB2EA05F4AD3DED8B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	18FD199BCB44425C28D513F3FC3DE68F	0588229937A1C58668BFC65890FA710842060801	D625FB1251D1FA3A019770E70B20D22B4BF40CD47759BD340541C6A71C60D004
C:\Users\user\AppData\Local\Temp\MSI5a8e2.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	A090B23959962C91469E1A7716430C6C	E26301D2754C8C6F23CE224B05EA861F87628809	2313CB490C88A0B4E0A4194A618B355989945B2F257C93A8AB42F4436D7907EB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-27 21-56-15-783.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	6D98E3E41A57F32A79466BC256A91B13	015FEB255D4355F3611A47A69CBA9026DABF4FC7	B0515A85F751D19730580B4CC89752AF3CDC73FE70341267EB4210D689425691
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	1128A84CDCC7E22994E9D90E1C7103F7	ED2C205521316EDD496DE6936E0E0A449D2ECDD2	17FABA482E765430308D985FDA7226430D393E949C372AEC06B07D7BF2098E05
C:\Users\user\AppData\Local\Temp\acrocef_low\38ad56b6-4de4-4c79-810e-61cb105666b1.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 634912	3F3CE9511FE8F6B4090401A7FBEC7989	5D55058222BDAB1EC47E6E1EA5ADADE9212C5253	D4CA9E0D68A78B2D460B60203EEA1F406FA3F512EB310A90E3686638DBCE03CC
C:\Users\user\AppData\Local\Temp\acrocef_low\ef420f76-c75a-4a6f-8b54-b2339a5f9394.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837	96E2EE6506759519A5E3E5E550F28388	477522A699526F3EC2270AD0B3D3B8D6609F8BBB	D135FEF8231B87D1F758B3D31FC5467BC933321F7E8EACB316F933DBA36474D5
C:\Users\user\AppData\Local\Temp\acrocef_low\f163f821-d6be-4495-9a0d-789b57417b2a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\f85b720d-df38-4818-b085-ff968564cf34.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B

Software Vulnerabilities

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 96.7.168.138:443

Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.4:49752
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.4:49752
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.4:49752
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.4:49752
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.4:49752
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.4:49752
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.4:49752
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.4:49752
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.4:49752
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.4:49752
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.4:49752
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 96.7.168.138:443

Networking

Source: Joe Sandbox View

IP Address: 96.7.168.138 96.7.168.138

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 2D85F72862B55C4EADD9E66E06947F3D0.3.dr

String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443

System Summary

Source: classification engine

Classification label: clean2.winPDF@14/44@2/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-27 21-56-15-783.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\C0260-COUNCIL APPROVED PLANS - ISSUE D[74]-- Panels & Inverter layout .pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1736,i,3149293254511597146,14732658930209850938,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1736,i,3149293254511597146,14732658930209850938,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C0260-COUNCIL APPROVED PLANS - ISSUE D[74]-- Panels & Inverter layout .pdf	Initial sample: PDF keyword /JS count = 0
Source: C0260-COUNCIL APPROVED PLANS - ISSUE D[74]-- Panels & Inverter layout .pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: C0260-COUNCIL APPROVED PLANS - ISSUE D[74]-- Panels & Inverter layout .pdf

Initial sample: PDF keyword /Page count = 16

Source: C0260-COUNCIL APPROVED PLANS - ISSUE D[74]-- Panels & Inverter layout .pdf

Initial sample: PDF keyword stream count = 121

Source: C0260-COUNCIL APPROVED PLANS - ISSUE D[74]-- Panels & Inverter layout .pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C0260-COUNCIL APPROVED PLANS - ISSUE D[74]-- Panels & Inverter layout .pdf

Initial sample: PDF keyword /ObjStm count = 21

Source: C0260-COUNCIL APPROVED PLANS - ISSUE D[74]-- Panels & Inverter layout .pdf

Initial sample: PDF keyword endstream count = 121

Source: C0260-COUNCIL APPROVED PLANS - ISSUE D[74]-- Panels & Inverter layout .pdf

Initial sample: PDF keyword obj count = 139

Hooking and other Techniques for Hiding and Protection

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior