Windows Analysis Report
Summary.pdf

Overview

General Information

Sample name:	Summary.pdf
Analysis ID:	1543856
MD5:	2828be795a4940ac1f0dfdca2defd5f2
SHA1:	4248cbff8bf936fa8958ecb0687fb3500cbd4595
SHA256:	6528651a41307cad2ec1b88ea458f673cbf435ea239232b829f32b89f302d1f5
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.7:49721 -> 96.6.168.143:443
Source: global traffic	TCP traffic: 192.168.2.7:49721 -> 96.6.168.143:443
Source: global traffic	TCP traffic: 192.168.2.7:49721 -> 96.6.168.143:443
Source: global traffic	TCP traffic: 192.168.2.7:49721 -> 96.6.168.143:443
Source: global traffic	TCP traffic: 192.168.2.7:49721 -> 96.6.168.143:443
Source: global traffic	TCP traffic: 192.168.2.7:49721 -> 96.6.168.143:443
Source: global traffic	TCP traffic: 192.168.2.7:49721 -> 96.6.168.143:443
Source: global traffic	TCP traffic: 192.168.2.7:49721 -> 96.6.168.143:443
Source: global traffic	TCP traffic: 192.168.2.7:49721 -> 96.6.168.143:443
Source: global traffic	TCP traffic: 192.168.2.7:49721 -> 96.6.168.143:443
Source: global traffic	TCP traffic: 192.168.2.7:49721 -> 96.6.168.143:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.7:49721 -> 96.6.168.143:443
Source: global traffic	TCP traffic: 96.6.168.143:443 -> 192.168.2.7:49721
Source: global traffic	TCP traffic: 192.168.2.7:49721 -> 96.6.168.143:443
Source: global traffic	TCP traffic: 192.168.2.7:49721 -> 96.6.168.143:443
Source: global traffic	TCP traffic: 96.6.168.143:443 -> 192.168.2.7:49721
Source: global traffic	TCP traffic: 96.6.168.143:443 -> 192.168.2.7:49721
Source: global traffic	TCP traffic: 192.168.2.7:49721 -> 96.6.168.143:443
Source: global traffic	TCP traffic: 96.6.168.143:443 -> 192.168.2.7:49721
Source: global traffic	TCP traffic: 96.6.168.143:443 -> 192.168.2.7:49721
Source: global traffic	TCP traffic: 192.168.2.7:49721 -> 96.6.168.143:443
Source: global traffic	TCP traffic: 192.168.2.7:49721 -> 96.6.168.143:443
Source: global traffic	TCP traffic: 96.6.168.143:443 -> 192.168.2.7:49721
Source: global traffic	TCP traffic: 192.168.2.7:49721 -> 96.6.168.143:443
Source: global traffic	TCP traffic: 96.6.168.143:443 -> 192.168.2.7:49721
Source: global traffic	TCP traffic: 192.168.2.7:49721 -> 96.6.168.143:443
Source: global traffic	TCP traffic: 96.6.168.143:443 -> 192.168.2.7:49721
Source: global traffic	TCP traffic: 192.168.2.7:49721 -> 96.6.168.143:443
Source: global traffic	TCP traffic: 96.6.168.143:443 -> 192.168.2.7:49721
Source: global traffic	TCP traffic: 96.6.168.143:443 -> 192.168.2.7:49721
Source: global traffic	TCP traffic: 192.168.2.7:49721 -> 96.6.168.143:443
Source: global traffic	TCP traffic: 192.168.2.7:49721 -> 96.6.168.143:443
Source: global traffic	TCP traffic: 96.6.168.143:443 -> 192.168.2.7:49721

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.168.143
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.168.143
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.168.143
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.168.143
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.168.143
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.168.143
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.168.143
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.168.143
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.168.143
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.168.143
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.168.143
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: Summary.pdf	String found in binary or memory: https://support.docusign.com/guides/signer-guide-signing-system-requirements)
Source: ReaderMessages.0.dr	String found in binary or memory: https://www.adobe.co

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443

Source: classification engine

Classification label: clean2.winPDF@14/49@1/1

Source: Summary.pdf

Initial sample: https://support.docusign.com/guides/signer-guide-signing-system-requirements

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7548

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-28 10-07-20-820.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Summary.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2040 --field-trial-handle=1636,i,16405949658811608484,8588834111336071474,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2040 --field-trial-handle=1636,i,16405949658811608484,8588834111336071474,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Summary.pdf	Initial sample: PDF keyword /JS count = 0
Source: Summary.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A9l8ak7n_1637gp_5to.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A9l8ak7n_1637gp_5to.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: Summary.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Summary.pdf

Initial sample: PDF keyword obj count = 50

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
96.6.168.143	unknown	United States		16625	AKAMAI-ASUS	false

Contacted Domains

Name	IP	Active
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.35	true
x1.i.lencr.org	unknown	unknown

ID:	1543856
Product:	CloudBasic
Start time:	15:06:08
Start date:	28.10.2024
Sample:	Summary.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	2828be795a4940ac1f0dfdca2defd5f2
SHA1:	4248cbff8bf936fa8958ecb0687fb3500cbd4595
SHA256:	6528651a41307cad2ec1b88ea458f673cbf435ea239232b829f32b89f302d1f5
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	B2C054D9B9ABEC0E19A1EA7A952CE34E	3322000A4F508802C3F42F8967163F8622DC08E4	10890563A7C740B5525EE7F5FBA9EA7C0A6B7E2F12C656337DF4506A420016ED
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	B2C054D9B9ABEC0E19A1EA7A952CE34E	3322000A4F508802C3F42F8967163F8622DC08E4	10890563A7C740B5525EE7F5FBA9EA7C0A6B7E2F12C656337DF4506A420016ED
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	3F21FD9706583014134E7935581D69B1	455F8E94680C05C451C426010CF2BB7604F30097	1B430ABE68E09753666EBC649486AA70D13B563557B089554B8D5311A5619522
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	3F21FD9706583014134E7935581D69B1	455F8E94680C05C451C426010CF2BB7604F30097	1B430ABE68E09753666EBC649486AA70D13B563557B089554B8D5311A5619522
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\82b2649a-57c7-4f76-98c9-e608d39a3aa9.tmp	JSON data	7BE9C8316EB1B7252CB363207744A145	57861355BE6541501AED40F896891579DCF473BF	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	7BE9C8316EB1B7252CB363207744A145	57861355BE6541501AED40F896891579DCF473BF	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6ac485.TMP (copy)	JSON data	7BE9C8316EB1B7252CB363207744A145	57861355BE6541501AED40F896891579DCF473BF	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f6d02bcb-acd3-403c-b480-301da542ce90.tmp	JSON data	9933765721FC22D60538A34720B80C75	DF1A57B656703EA26DD39C81502A6B958F74072D	36DCBB191D2EA3E0EB81B8DFD8712F9D5D2DA862DC227AB58E216EB4C8FCA61F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	3A94ED8580420D6D6058A9E939428498	B438BB639D078F45415DA2354DBDEC20E5FC9F3A	9742A26CED5AE0155C458793FEB27AA13240E6198FC29143D904D2D9C1E6CB5B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	70B50EE95CB75C86E99F281085561090	12071613A61BD436F36F29BD62C3E0B92030AE53	F9EBF28BD3A85A8763B787E3B628D97BDB02D70C2838B98FD7B1E8D9F394026A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	70B50EE95CB75C86E99F281085561090	12071613A61BD436F36F29BD62C3E0B92030AE53	F9EBF28BD3A85A8763B787E3B628D97BDB02D70C2838B98FD7B1E8D9F394026A
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241028140723Z-198.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	59A4EA587F48433F1AB7927F24E1C8EC	DC6F41DA89854B1BAFA59EB8954688306A1646B9	CC8BDD12C7F5BD0A214EA84B845389FE2CF000C8D4A5396384211B0ABAAA52C3
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	8342D4D1DCF3024BE39A074F6F201A08	6BA8FF2FC91A91D5F1EFFC3A6C166E58D77F91CA	110BE94180E18EA9BE57101F56CC6621B8B17D8ED7F185F7BFFF1A1C3E87875D
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	BB629AE3FDB081DB9215BF8352A984D0	97A4481249E511A4443AD0326E0E522F7E74620A	A7A0A87A329BF55B816FEA50508C1AD4973CBE3E1278FFD0EC5D08E9577B678C
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	2CB192AAE83D4208D66C29B7AC352788	C64A93122ECD204E13EFA3BD5732E40A8EE88817	9ADC04325824C7CBD8F07234B1B72DE9E2D4CEADB633E4C43ECB8D35BBE8DA09
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	F93236BE7CC84AC0D52A3AB5D4A1E6DC	E09375EEE4E315A9526DFAEE8A40D390FC0BEDAD	C19FD3AE9AF231DE3F844BCE2E57C6265563F701A54A5ACEB2D384A81DD4F17A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7548	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	69F81AD328AACA8E15A105320638D480	C49E95EE88F16DE03EF555765281998DB90EB1A9	089D0D1849519CAE42669A28056AE3BF53B00233F1CFEB06FB80B9A20E6F0650
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	6FE935EF8C79A47E51D6311D17FE3C52	87B4F76861EE64AD1C56AF506C1BF150DE3D642A	E326C45500E2A3A29C072308C85BCB419F35700B64319A62461745C628AF5406
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	BA7C33BE413DA3AF31E89F134B2DDA24	BB4B755D4D7271CF3BB0A9C882DF8E1DB465348A	0318DB0F4CA0AC68928346A502268F334CCEB6A42C4BAAA13475B120DA9C1C99
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	3D5681F4B791C709E0F2DD1B7A6D2439	C813DA46902251878F004A9E2D61ED08178F98DF	09141FC7A90938F15127CD1B129772E7A0576A2322E1C4181ACCBB75FD9B085E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	F42A2C3467F1561B83416AD0C81E08AE	D4A23D9201738651CAF765054AB70D3ABBA26C52	B2C2940120F6CDD86BCB408A6613F7F28BF75413370B745E09B9C12FFC6B1333
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	0E6197CDD4315CB93534A9AADC69ABBE	475150A6373BE3C0A59EC3D06B752BEC29B6B636	4830AD732E0637E1472623B86C48FDE41575DF4188551D37B5A58F34D68DC9BE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	2FCBD1085C233AD1A9DB7389232B3669	694425C10C729A54C69B773851AB08DCACDE74A6	75678E2A42EEB4B84AF4F85D2BB790C4605D386DDA08F54D0BCCF8DD2879FAB5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	BC1026C765F86E3E42984064C417FA4E	CA964A0CD7B9BBAF76DB75725C5541CAD6029E0F	A1C1CAB22DE40EFA5A0522EFA242C60622E54259C4AEBA2949CA6676CF046A17
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	CE3C8213CBEF810F408D0B357A417271	18E24B8713D1B7011B549F87439EA3CAB73C0BA3	5106A81A271C53C0854F64B2A6601FE379B361D65B23D55E9FFEC6E399598AD8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	E5C6FCC6919BE0BAB5BAC5039A00FF86	EF29EAA7F55A5A34229BC870ACA7AA78BCC4B90D	CD1C73D500A9292DF40E84B350C9587AD4E95A792A5009094867C8E104010323
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	B4E8CFB461BB63E9EC406589D1B8B823	D67ECE37C1E05512AE636C97F0440B0A4F551F28	0806B13694E4893394F0CF4FC97BBE944DC6E38CAEC4AE7C0725AC583992EC97
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	5C58680B34B24C9E445F04BC4DF8953F	88F826F221F4AB15322FF20423AD3C1171469CA1	ADAC19CC0F016B9D44E2E722422A77D298BB40FC3685697A9137C50206309547
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	72EA6F574F0167FCB1ECA7EB579DB085	A16D52ECCC8580EB2139F6FCF04629CBADF0140F	B58172940C133B20C2A7583754546234B657DA3A6CD0B89F0EE4834DEBA2599A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	B3E20972086AE0E6A7886A5DAFEC985F	3301BEE0EB1A7375CED62CF5A78DA4D32AAF578E	7492C5B4307D015A1D10579693529AD84B47B61A872B460350713651D38FB6B1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	139ACD0D8F5970E9EB632467039274E9	74808F24532877BDA911DC231C86D4B8AD734BA7	2189603D4303E0B1842B29588BDCF46923AE03B5C7444559ADBA6D78D3480CA3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	EB7AD73357F2ED5F47A6395AB9E812FB	0002B168E1BC6F4D16AF7E73BD1810A569D536B5	146E784941F658EA2A027F65E7EA2A60412FC601D82FE92852CE4F93F071778E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	D87D60759FA4C71BE81AAD1F975F96AF	7EF17431150D00F7B20698D37B5A773F8E6AAA2D	06EE2FF68CC4BAF3715E3589DD5C8400F3C89B32768E54B0CFF201DA7E733EAA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	43BE99FEFA5C4982CD09F1409F4D958F	18935A2A08C4DE6AF99377DB751B8FA66BD8D97C	40E3601FF7CD2C2C81FAD90A03457763F11B9585CF5E19CD9BB14E957A003022
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	76C76BFA5613799B1346AEC8CF5FDC38	A38FC8FFD04CEA3663E53541F5320762515C087D	69C677C5B9FED4C3E3B799CCE89652AFE889E5F58F0D7D4347B7083CA1E526F5
C:\Users\user\AppData\Local\Temp\MSIa85c6.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	EAA7E7AD1B8F1AFA62E52341F997FC59	90A571380B15CE64B62B50BCAB36F9621DD8C8BE	61D6A51277C47C7C8CFCF3C38DC3A419540BFBD5B929C07F98BDE24D15F23DFA
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9l8ak7n_1637gp_5to.tmp	PDF document, version 1.6, 0 pages	23C6AF8630E3E6EBE792812BCFEA8AD8	C5D5062063602023E0AFD60D948342B336DE30A7	49BFABEE7288542EFF2416A3BE61366B687F1DD5A03222138639D483952C6E75
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-28 10-07-20-820.log	ASCII text, with very long lines (393)	F49CA270724D610D1589E217EA78D6D1	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	E2F892AC2C8AF42DB07DF1EB939C758A	7B3CCD60A93FBCB73AA621D38C51CD881F6B6705	A5EBED1B85348A097EE319BB4377471893A5EF10FF8CE64491C37E44D9273D28
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	59ED86306E6C59B86E6121F59789EEA9	EEEDCF09240D81FEF6C50E8CD433A915B94971D9	A6385B905166F006A4DFED9700B3C64CDE7CC8F976A7D7369BE5492D9F9F674D
C:\Users\user\AppData\Local\Temp\acrocef_low\133a0210-81b3-494d-ba39-4b3eba6ccae3.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\3c62372b-6bf5-4625-b0f7-cc6313329a47.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\74c08ed1-b7f8-4215-8ed7-02f43cf49801.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\ae815b1a-cdc6-47ee-9ae9-0747ddc436dc.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	EC8D4FAB55F24C0E344D263724846C4A	5444D90F86D68A23AF7FB5434DEAE740D57D0312	E489C11D38BFF8F1F51351BAEBEE9F723A5C036DA0B0CB9C82306251017054EE

Windows Analysis Report
Summary.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report Summary.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
Summary.pdf