Windows Analysis Report
CH _ MEP.pdf

Overview

General Information

Sample name:	CH _ MEP.pdf renamed because original name is a hash value
Original sample name:	ADDEND #1 - M-101 - JR&S - 880 THIRD AVE - 4TH - PREBUILD - TK_CD00_ISSUED FOR ADDENDUM NO. 1 10.11.24 ARCH _ MEP.pdf
Analysis ID:	1546275
MD5:	0d4821dea7f4b34b5a2a21aacf494bd0
SHA1:	14bbe13a4b90e80b244f00f515c2cb09dc5fc5c0
SHA256:	28764ccd3adc74789bd468edac38bdaf8e2da4e029fe0d77db4fb54452425906
Infos:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.17:49714 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.17:49714 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.17:49714 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.17:49714 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.17:49714 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.17:49714 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.17:49714 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.17:49714 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.17:49714 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.17:49714 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.17:49714 -> 96.7.168.138:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.17:49714 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49714
Source: global traffic	TCP traffic: 192.168.2.17:49714 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 192.168.2.17:49714 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49714
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49714
Source: global traffic	TCP traffic: 192.168.2.17:49714 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49714
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49714
Source: global traffic	TCP traffic: 192.168.2.17:49714 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.17:49714 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49714
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 192.168.2.17:49714 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49714
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.17:49714 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49714
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49714
Source: global traffic	TCP traffic: 192.168.2.17:49714 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.17:49714 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49714
Source: global traffic	TCP traffic: 192.168.2.17:49714 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49714

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 96.7.168.138 96.7.168.138

Suricata IDS alerts with low severity for network traffic

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.17:49707
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.17:49718

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: classification engine

Classification label: clean3.winPDF@20/73@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-31 12-50-12-965.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\CH _ MEP.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1580,i,618128829641308069,12324996105360670069,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe" --type=compute-only-broker --ipc-rdr-channel=ko.8320e781.b4ef9eb8.2 --ipc-co-channel=ko.a009a94d.40722085.1 --proc=5 --helperprocpid=6880 --channeltype=2 /CR
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe" --type=compute-only-renderer --ipc-rdr-channel=ko.8320e781.b4ef9eb8.2 --ipc-co-channel=ko.a009a94d.40722085.1 --proc=5 --helperprocpid=6880 --channeltype=2 /n /prefetch:2 /CR
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe" --type=compute-only-broker --ipc-rdr-channel=ko.8320e781.b4ef9eb8.2 --ipc-co-channel=ko.a009a94d.40722085.1 --proc=5 --helperprocpid=6880 --channeltype=2 /CR	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1580,i,618128829641308069,12324996105360670069,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe" --type=compute-only-renderer --ipc-rdr-channel=ko.8320e781.b4ef9eb8.2 --ipc-co-channel=ko.a009a94d.40722085.1 --proc=5 --helperprocpid=6880 --channeltype=2 /n /prefetch:2 /CR	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: CH _ MEP.pdf	Initial sample: PDF keyword /JS count = 0
Source: CH _ MEP.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: CH _ MEP.pdf

Initial sample: PDF keyword stream count = 26

Source: CH _ MEP.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: CH _ MEP.pdf

Initial sample: PDF keyword /ObjStm count = 7

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
96.7.168.138	unknown	United States		262589	INTERNEXABRASILOPERADORADETELECOMUNICACOESSABR	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.214.172	true
x1.i.lencr.org	unknown	unknown

ID:	1546275
Product:	CloudBasic
Start time:	17:49:33
Start date:	31.10.2024
Sample:	CH _ MEP.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	0d4821dea7f4b34b5a2a21aacf494bd0
SHA1:	14bbe13a4b90e80b244f00f515c2cb09dc5fc5c0
SHA256:	28764ccd3adc74789bd468edac38bdaf8e2da4e029fe0d77db4fb54452425906
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	9900AFAA2388A0ED5E7073071F40C3EC	FB65ACD2F513A70EC87A002224DAAF79AAE6B7AB	2E686DF679CC56B332CE4513AF28883A47843E08C4EE50528D07144E77B60D48
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	9900AFAA2388A0ED5E7073071F40C3EC	FB65ACD2F513A70EC87A002224DAAF79AAE6B7AB	2E686DF679CC56B332CE4513AF28883A47843E08C4EE50528D07144E77B60D48
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	BA844537FCFBD6D85CD81BBFB2521D93	970F38074D07EE474C6E16EB405F4655BF7A4B04	F5B47BFD1CF084CBBEDA4982DD0CC97D2248692E70724E9BB8D049FD0902DCE9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	BA844537FCFBD6D85CD81BBFB2521D93	970F38074D07EE474C6E16EB405F4655BF7A4B04	F5B47BFD1CF084CBBEDA4982DD0CC97D2248692E70724E9BB8D049FD0902DCE9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4c325830-6988-46bb-bf5e-e0d1f2d221ff.tmp	JSON data	2F90417B9D5E29A216DE8C6314BF501E	3D08938970384CB22D810A9CA943D6418B306877	9C3664408D22111C424E9A6EC863CEC23D6475013AF7B656CB7FD57B227F223B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	2F90417B9D5E29A216DE8C6314BF501E	3D08938970384CB22D810A9CA943D6418B306877	9C3664408D22111C424E9A6EC863CEC23D6475013AF7B656CB7FD57B227F223B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	4215E830BB48E55138BAE1501F964DC2	714D5474D9BBE1A4FCC055A34157A0703C77C5A6	AC4F6D6A3FF7FA1B2CACEFD976DDAC938F57795153DEBA58B6F5E30E5C84CE59
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	6727F1CBD3F173FEC13D9E1EF537A991	04D137436966FDB39EB8EDE5D265516D699C4907	FD90A1B056CC5F3D06A2AE939724A3F5362367A21D8A18C3F513C514EA070439
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	6727F1CBD3F173FEC13D9E1EF537A991	04D137436966FDB39EB8EDE5D265516D699C4907	FD90A1B056CC5F3D06A2AE939724A3F5362367A21D8A18C3F513C514EA070439
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000001.dbtmp	ASCII text	46295CAC801E5D4857D09837238A6394	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log	data	9D45211DA6A03F33BA978A031D06096D	45895EC65F3F6B76ECC16F52380D3DEB36D032E1	84BE4AB298F4A99A1C54F7C41C4CC4438FC9BAB14F5986FC31D280AD0D5F9D7C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\CURRENT (copy)	ASCII text	46295CAC801E5D4857D09837238A6394	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG	ASCII text	BF39843683DC22A5999E88183DEA3FAA	5B501A1204783E9BCC6BA6FAD56641A4FF0D743B	F46AB8C06557CF63B8219707EA97E5D2AEE702FFD7C36F6C992E74AA074B922C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\MANIFEST-000001	OpenPGP Secret Key	5AF87DFD673BA2115E2FCF5CFDB727AB	D5B5BBF396DC291274584EF71F444F420B6056F1	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000001.dbtmp	ASCII text	46295CAC801E5D4857D09837238A6394	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log	data	A05963DD9E2C7C3F13C18A9245AD5934	15A87493591860C6C22499DF3A705ACB3CB466BD	F40B7EF0FE0B676871403B8DD21CE42AF8E482DC8B81F09D93CB2C48CCD112B4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\CURRENT (copy)	ASCII text	46295CAC801E5D4857D09837238A6394	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG	ASCII text	5DA9B498D581DDF25F2CE715897A868F	3C98A27D39DA6AC92EC0913265A0EDED1012C2F4	B2602FBC579BF023BB828EE3F0BBD9C043FBA20D31FD7287825B648DB2972A1C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\MANIFEST-000001	OpenPGP Secret Key	5AF87DFD673BA2115E2FCF5CFDB727AB	D5B5BBF396DC291274584EF71F444F420B6056F1	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241031165014Z-187.bmp	PC bitmap, Windows 3.x format, 164 x -109 x 32, cbSize 71558, bits offset 54	EF5204FDC23B5A956BA25E978FCC4703	8033CFA7AE1ABD330055B32D1A387B57B7D202CC	4589A4BF8E9708C31359C26EC329FE106A1AF741431E6C4BCC1CCBE1C1245A97
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11	0B72A1B23500BB23C4A601B8800FCDF1	12DEB410040826A93108A9A6E581BD2C0B75B03E	2C7EE2E6896671E903B7617E6CAAEF108DB65AE92ADCD92C25DFACB99BEE3B7C
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	E301DF3D83B0A9AF013147E0CF11A774	95BD4AEE9E2595640E77E73F252DB52868C0D31F	8AD066A7FECC9DE6ABCB51F8BC76285548B2242AF9BCDB8AA68609B5CDCA757D
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Search\402eb33653842c4b902fa9b7151145eb.idx	data	B192B7A5F69AB7CC583DF9E2975942FA	CC520874581D726A7AFB740618940721CACAF201	07704177913284CB4BD0A43625D0CF70E173AF11B03C3655BF880B9A8B708C40
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	45E8807A864857045ED248D21812CF3F	69D5D0E0B38A15D1CABA6F9EC5FA9F03533FD85A	6B22E27E5927915A4EB74FC28053CA695BADECE5A2ADF1FF0BA228B68E350B5B
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	CD311953BE19780718DADDC15949E030	4809758D7506684EB8F5BA4A453B6410AD201BD4	AEEBC08CD89A9C4E6742AFE2A42B971901F0E00BA63C23D112C07605AA225FB5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	C002BF5BFC9DB09A3A3B75833CE7EE0C	601BE2D95723040AA775BF0DB1B24812060F285A	CF727BF9F94AD8D1C872C5E067FB56E2B6B8EB93B020BFD200001B22A2EEADA4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	D4773AF1BA6ACD96CDD151551BC6F4A6	75B2D1D60748B43099BE825071F282C99139EE28	91A4E0B9D3E4CB42EE605683F9026B9B164883549621651A856473C946690D95
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	12F9DBF360D15AB6A9F0BC06D64871A5	F06B85328520EF59FCD93BE4F853D66BBEDCAD18	CAF7A0A62102EFF56925D093B57FBFE97E93F7ED7E2764890CD7650D2DD4A10D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	CC8570AC86BC9483E31A1AACFBD597F2	4974376581B15D7475B9C9F77AA6EEB4B6CC5938	DA012CB9BD337BC9C3EDA1CD42C1E1A9D98101DF723D726170565FDEFAEAB3BB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	43CC9E27CD046E9A528D572695F8B866	CD6F22CC1EF5E2C425A8767B9A51178B54FF3126	62F032B49CAB8957F3380822FC04865AA3C3E90D5BF9005B648F3B6DDA36086D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	BEA495F0C862EAB273A54ED1945C8E65	EAA53D0615B5A224DF47AA58AEBDCE91663B9B39	86CAFF72C72BD4FCD4107B08B4604BDB81E50F8DCD1D963C25884035AD6C9C43
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	4347CAF0E3F90EF6FE08F9604BAD06F2	1F16C03588E133957E361C809398D8BC9AC3CE1E	E5F38B1880C8D88FBB3D0D96901D52B6670EA51D6D36D80C286A2C4E93879BEA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	E5CA4B3B03FD5123BC62BE5196188A69	C5AD381510232F4F93DB64B29607602B4D38F232	66A8F2A816E027EA6018FE135DF3B5241315ABAD7C8996098374C714CF79EDFC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	53B6C276D539BD6CEF7F7C0B8B44F5B6	FC0C891D6912885FF7C232CFEE74DFC5315E8115	E4624FC95D52489AFAD657F421EAF9377582FCC8B14A995B216229ED0EBCA59F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	8E95AA6875E582568518AA7FB1044EA4	70EA1ACF446073755713851BA33AA55AB3A661D2	F42A99F99388015679D85DBF4057E740F7F5AAACB75C3D9F9421A11FCCA483EA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	C4788F9E661E52B1CA3C2FE832D2D557	2D17D6C7359F43E9CEAAFF241CEFBF3482D77B10	020D4AFD6FEADA4B223892699AED3912EA1FB347F3BDD5766C47CFDE4799CDC3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	BF9976D7673643C7BD960F98DF2355A6	E47DF61468E6EF7B7A85A8B04788F3D6BAB29A1D	0F21C7BAE8806A802904B70A875AABD6F67CF37E86606C743EAD887F80F116AE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	3F996C7DF216523E014DB86974985091	7F2E18D8EDAAD92646DC0EA8FA750913F1EC7C0E	F8DEB7791BD9CD6262319E2FD44075D0F96F39BF38CBF1E5B03B4065C56222B7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	E0830428ADED15D2182B7DB505031E1F	CDCAD72981D0407E01EBE8BE319B42105E357245	F33061B9DB848B1752A3B3A818E24D7A7587C1AEEA0979079D49B69742C05F54
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	1EC68097AC84374115BCB8AAF98BE55A	9F94EA621F9517F0F229428B5530EB51D977468C	556C6ACDDAB6AAE40980D5217E5D233E95822FFC192811203F792722B3DB927E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	6DA2D1A6E7538DE63B11595AAE3FC9D4	45A23D966D5CDA605487477A83CD0661C479008C	507B077286664909EE31FB330F64F09F2D84F5D6891E5905E901148D70D0B977
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	C4443CB53FD18AA8EC2F5BA8AAAA2F15	2105361900D7DFBAAAABA5C1479ED5BFDAC09A6B	5971AEC6F71B72CC6254B7630F6EDDDF0850DC871425D39F42FF7CB8C4E08CBF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 23, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 23	5748D9BB43CF0AB0985A619078EF24E4	0659BDD38EC8E80A3347AB83BC54526EA87E76A7	728466AFD799E3DEF2AD1A35AF7099121344A4FAB1031998CEC71BA431971863
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	A716642316DB7BA603F515EDD6BE4D93	E78DE0A6B310A1976228E45EA130612BE4C64090	9CDB3FADC859C648EE608C95675BC4A704722DF9D7149B7B2381F24CECE933E5
C:\Users\user\AppData\Local\Temp\MSIc5022.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	0AD4C5E4D077057A9CE94392E4585D7C	A302ACE9ADBBE10E823B0341C8391AF6E0A82982	2B90AC80D63E753B6A30ECD587F2117B8E7B5B24634947422E82488E969F374E
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-31 12-50-12-965.log	ASCII text, with very long lines (393)	06DEAEDB81D09FD8FB5FF668D8E09CB2	28A02BCBD5975117B97A08AFB049F2C94F334726	D98DE785425112A2D7A41B16073812FA4FA4955F2D5139AE87C9A5FBC4717D64
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	25D2346D0E7850E13D1D29B671C4A236	B1166CE39B307618DDE574BB69FF2DC9DA8DD849	0BE21FBC5498C144E1D70E7F067DD469C751BD3A21ED7C995B1543B2E2AA8CAE
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	3214AE9AC3AC543C000A1E8688442EF6	6C8C56E48068679EC325F34EA1366BFE8D6E5FFA	E8693F2CF4AB8A27441A668480029C2C3CECBECC64FB8FA3EA062CE21BB1A71E
C:\Users\user\AppData\Local\Temp\acrocef_low\05a23d4e-49aa-4800-9ebd-d456c3bf4470.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	BC2B4B8EFC05ACC59FBE8E09760D53DC	621852ED2EE8264AAC1B25DBABDD6692C44429CE	2375BBCC12DC3ECDFAEDA891AD37689377C73FEB8E52AB4520D93CF116D20646
C:\Users\user\AppData\Local\Temp\acrocef_low\105ffe12-9a19-4b72-9464-162650dd955e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	13F55292D0735B9ABD4259B225D210FC	810CC5D545BFA11D2825F6E1DFA69176794DA7EC	8C3FFEA68963D108599E8C5AE20DE6E9C473BF33197A03A9A7DDCD0F25A6C7F6
C:\Users\user\AppData\Local\Temp\acrocef_low\1ff37967-30cf-41be-bfa1-d449b511639c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	1D64D25345DD73F100517644279994E6	DE807F82098D469302955DCBE1A963CD6E887737	0A05C4CE0C4D8527D79A3C9CEE2A8B73475F53E18544622E4656C598BC814DFC
C:\Users\user\AppData\Local\Temp\acrocef_low\2101c37a-407e-4f8c-9da2-26a5ef972d9f.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\f3912de1-2cc7-4c5a-b8a4-a7c9f8fda4b0.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 160932	5B21A6981E55EF9576D169BBED44BCDB	B3A14100B7E7C2C01D61B010A54937952D111E20	9555E661370D1DC26605DAE88BDBC1ABA68038C769BF6E354A256B1A1C4C110E
C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\T0.tmp	data	C3BDFB7D9E32A2096B95EFB2F1469139	59B52EB37C07F533CC3E0A08F7DCF0C123BB9D03	3BC097A8333C871DFAF93D95333D7A938F95D863DCB7ACE05B5ECDDB633396F0
C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\T1.tmp	data	F9AA24F97EA3A3D6F1C59E68F58F9B07	3504A64BE6F4FB4779D3797C265C8BAE02D97656	76BAB6405DF6FE61EF5262083804E5019E07BBF7520D452FF8BC1E3DDD9EFBA0
C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\T10.tmp	SVr3 curses screen image, big-endian	1F242764AC688A62F6DCF6A04D0547B5	01CBADADEC7428BE3CBCF90566A2DD6B7C8F3183	7D6160FBFA39A866BE9450C6E46390961F807A66C6B5C31089E4AC38F3EAC8B7
C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\T11.tmp	data	F9F08DAB02914D4FC4A93DB72303C026	037D7B9D36D9FA613584082ADC3A6118945F2D40	C137995F210625E2C75CCC9A3A90BEFFA61C1BF63042CE717791E3C5D863E23E
C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\T12.tmp	data	274EDB5762C3A851FA051653F6B90D8E	1AC91731621D52241336EF4AD68219FB10869864	B25E9C0405C3E242E2CC960E143C5FCD2CD27A9FB90EDE4F47737C9CECA8ACE9
C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\T13.tmp	data	BAAF6D47871CDAF9C4BA5665BDAED1A6	F0E503D64603919D38930990E43131D7EA32FB66	F39E1FE1873B7E91DECDF5BB47957774DB3E4C223202C4574CBC8A906DEA5094
C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\T2.tmp	data	80E08202751BC62FAC161ECDB1F44B3E	4B8F6C590378402752C5980D8659BEA45447A4C4	45C214796A6269D49ED0B37A8017A64364144C596903C14780C74293B0B45F0D
C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\T3.tmp	data	28BEE590C9AA9385B88895E9809572DF	7ADD3DC316F58285727C3FBEBA9F8B88522248A6	8344BDB9AE6D9766EE6628EF6E7FD71EA1480A58BE4745C7E827FA9F80836544
C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\T4.tmp	data	82C4EA24F9FA74FFB8D91735A4CD3ADE	6D7C6F53841151C7F8B8A12E75FDE2F29283579F	812F00B7EC4702F786554933602273D076DA21590010ECFF221FDEC4BF56507D
C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\T5.tmp	data	1B1C0071CE1F1C69A1DF81D19EA9C936	BD4869AABB8CE6202C73FD292CA147E0847FAB15	604E22B7793E8AFFAC74DE14E79E9BC2F7E8247E9EB6F04E7D0E9A51645898C8
C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\T6.tmp	data	B98F0FC5124C313FC28F4AAE6C629461	E4896C4090CEECB92DD81B21FA41BCDC9D1AB616	76349CF64B11C9DCD512D5A09E6198AFF9804F5378CCFC3862322DC969EAFBA8
C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\T7.tmp	DIY-Thermocam raw data (Lepton 2.x), scale 0-8, spot sensor temperature 0.000000, unit celsius, color scheme 0, show scale bar, calibration: offset 0.000000, slope 142336.000000	3FFA695796246CEC9DFB3787BAD1504F	E1DFD1E03B80F9DD667DD096E93B329756EEE4C6	A33AC578F1102AE32EB79CC543756C88BAAD32001B87FB790F7147319D9D4455
C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\T8.tmp	data	64B85250F0284AD0DCE12FCA81C10C66	4309BF61B461B7C131F4550390D7E8F8FCF7D0EE	3C6CEB1BD491DE5F0C900EA7D24DE8714DB116E48B4792FDFDC49055EBE5AD9B
C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\T9.tmp	OpenPGP Secret Key	B8D30E96AD875591E3658B4E09D59418	643430554C4EE8874BA96428DD9EFC0DB935B767	499DCD1E36550333614D849923622EEC11DDA01A6ECCE1E33AD868E7D3E0A098
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\Annss.dat	data	387EE29C632670A2507D6D09FCA1CB86	0FC370B1F21FE8D893FE1623AB23C9C18A00886D	90DAA9CFC92D38B04C5F1C66706C3923511F79162585AE0D64EAA7F7CBDB3E5A
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\Annssi.dat	data	2731BF37F083F2A2922FBC209CBE76D2	D404D7375FF5E28DD65EB614AFA6C9D337A826C5	98410ABB7CCEB5503F94BB1F13852F1A6204AD6506DE2DB69DFBCE98C5229008
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\Annssk.dat	data	FB515CD3C1F717C7AA950E3CD25661D9	A215C05AF6CC125FA6A2845A4AEBA7ACC18ACB0F	BB28D4BD22091B2745753C7175E6CDC2AEEA62C9BC1730514DC71868B1B36819

Windows Analysis Report
CH _ MEP.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report CH _ MEP.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
CH _ MEP.pdf