Windows Analysis Report
20241031_42900.pdf

Overview

General Information

Sample name:	20241031_42900.pdf
Analysis ID:	1546301
MD5:	cca597e3e7b890b53f618a0799b1e35a
SHA1:	9b58671cb688100522ddef83f326ed2b52aaf4bc
SHA256:	4b06469b825e5012974fc3df431bd4206acf9555e704c90bf39df8482aa2526d
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs DNS queries)

Suricata IDS alerts with low severity for network traffic

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Suricata IDS alerts with low severity for network traffic

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.16:49708
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.16:49712

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: bab99d41-6718-42b2-b1ab-abf2c0e21347.tmp.3.dr, f713f0b9-8d73-4f28-9f63-9826d0d14eef.tmp.3.dr	String found in binary or memory: https://chrome.cloudflare-dns.com

Source: classification engine

Classification label: clean1.winPDF@15/48@3/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5724

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-31 13-44-55-651.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\20241031_42900.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1568 --field-trial-handle=1548,i,14624209966910695298,13864274561464179367,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1568 --field-trial-handle=1548,i,14624209966910695298,13864274561464179367,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 20241031_42900.pdf	Initial sample: PDF keyword /JS count = 0
Source: 20241031_42900.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: 20241031_42900.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1546301
Product:	CloudBasic
Start time:	18:44:23
Start date:	31.10.2024
Sample:	20241031_42900.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	cca597e3e7b890b53f618a0799b1e35a
SHA1:	9b58671cb688100522ddef83f326ed2b52aaf4bc
SHA256:	4b06469b825e5012974fc3df431bd4206acf9555e704c90bf39df8482aa2526d
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	F407D73E886E8EB384F1169F31D310C0	470107CEAF1D3F57587541480B660A23A756FBFA	F033A365FC2A0B9F4A8A5446681BD8ED72B906B8C9D462C4BA6C216EC8CB63A3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	F407D73E886E8EB384F1169F31D310C0	470107CEAF1D3F57587541480B660A23A756FBFA	F033A365FC2A0B9F4A8A5446681BD8ED72B906B8C9D462C4BA6C216EC8CB63A3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	4A3A9889039815F1292E6498515C3D61	2D4B57C63C3782A4ED4948C1AA2CF7DF212AC148	47B6E9C901AD52B0F1EB95227EE647E701D0C15AD2355A57085A1B04D91FE76A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	4A3A9889039815F1292E6498515C3D61	2D4B57C63C3782A4ED4948C1AA2CF7DF212AC148	47B6E9C901AD52B0F1EB95227EE647E701D0C15AD2355A57085A1B04D91FE76A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3efba8.TMP (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\bab99d41-6718-42b2-b1ab-abf2c0e21347.tmp	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f713f0b9-8d73-4f28-9f63-9826d0d14eef.tmp	JSON data	6941C741320C8C02DD1C27299347054E	64C4F59C5644F808E47842B3064BC37760F5C33C	003FB7FC5C700CBF57AF5D0A1E6C3957CF565F3F1982CD480DB71BEFFDB1B71C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	0B2D9428762015A7FF18EB415B96CF2B	93C8405404405B535493D0F02D51036BEE5A6F40	66A0D9C0FE8518D0A918D4D370B4D3689BA54E1A73B51E64A60154C523FB4512
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	0FC5274758D86B81577A14DB93B3843E	8C6A05CEA60585D3284CFFB0227AD794E4B81278	941C895567E0B2E86A3952AADC137271D8A791F14CA8A94FEBE6DAE2A616648F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	0FC5274758D86B81577A14DB93B3843E	8C6A05CEA60585D3284CFFB0227AD794E4B81278	941C895567E0B2E86A3952AADC137271D8A791F14CA8A94FEBE6DAE2A616648F
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241031174457Z-158.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	8CD83CDDA77F824B7830E91375AEA0E2	439D4CBCFE7371E19CDF92CB4BE58D0DF9C26D5D	59D56F94DE54A826E22BA7E6EB129A53E119E4652F07CB66F27E37472C533E9A
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2	A4D5FECEFE05F21D6F81ACF4D9A788CF	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	107D18C6641D12D2C8144F4736DCF7B5	4D8783A93207025F4833B807FD12A859F1FC453B	C496644408CDB675C89148627316775526A0494C2F8A4BD3BE30E7D6A507CDA9
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	DE8418CD11417B3CBD0E028F3707821B	DE17BABE9DDFAABCB7D4125D38D499BCE24CD9EE	C25822B013246B63C15209BBAD0D7E8411532F8EF6CA7E96C4BC5C4DC70FF97E
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	1068A96F978FE1AECBD8B06E933C8D7F	0A2D8BB28A8C4EB8BA609F05917CC7C90DC61FCF	CED33FFA9D952E8FAA422E615EFF542595E0EB74E8D11E676708CA399C6189F6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5724	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	3330E02CAD9D3A52E2A00348F3A6C24D	DCD36C2CCCA695EF716DABD37781B6487E07D9DD	754A60C07F6A3BAA855E3A1087DE1F11049EAED9D8DC9DF139FC9D98359E4C41
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	13A01E06FDC174F0E047ADD6CCFC78A7	2693E5BB5C30F5E23B01CEFCD29DF34E6FE5F569	D9FB7EB2CB12F88131EACAB6F66CB2B0C14BDC80506AF619BBCF05028C68FE74
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	410196683B63CA6BC8E0FF247215B4C9	E1EE228E4E7A13077B98A6F0381F9105B2E7227C	3C086C7F70B3D4D3460B26C78BFA51EC4C29043615A0AF9D50827870E9C7A333
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	01406E2E1DF80B7A1B6153958B4E5CAE	72281E99A588F8C63EBDE510A36BAA2E4EECF567	1586702FB402A288517CF495A7551DD5C8FD2E528E0A500A30FCB97596451253
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	75F22C3727E9265F375CEE4612A78C58	7A5BC7D0618B0F448B0B46530B0C6C8B8302206D	F0373F5D2EB8F552FA823332B8370A85E81F176AF73B018817369294D3299E41
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	55729AFE5F5754816D7856757EE93590	A01732242F796BE8A2098C50860DBEE9AD15AC44	80B96E30161E09EEE39227044A86789194C68E49EA2D52B34B7AA6FCE7B21471
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	AFD25A2F3FC1063BED4FDCF96E576EBC	89B450F4BBB1E70C6BB5F8DCB44CB9749A18A533	A12467FDC8AC86B2D5B7012109E7C87B6F195E508AA1181C8F64499804E5F520
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	C88C61660D82D36F869BDD89B4A0915A	635D35685B72393FADFC51D0CC786BB595E45DD8	D642140AB72AE1A208F66A20E59E411096C1BCF8324D2E294DCE03876BD625D1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	92793320D9C7526B291A18B545759C75	B4F6C1C13586E8060A408F996622BB8E76EDC234	8DADA336703439CD8BE1C31FDFC9DB12758C44329720B604F360A9B5E9A6165A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	16719424A84AD5B4D5F0AE68713BAC3C	F7D369BA14FB0D44B2D7AA8516FB8EBB0E1C4CB9	ACBE48B4D30F3236AC240A7336604E097429709503FF39E036160562EAE4E490
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	E7766630A51DBB8E155F0A74EB11B845	BB390E3962F4A4D341DA373D31A9CC40584317C2	827C9E187DB8A1F539E6CA55A6F93D7A930225BFAF33E85908280E39286327E9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	2B092EFF8972AF3AF7B2BF8BC54A044F	8C0818968A2B9973ED1664EAE32DCA61C0CBB128	8D092C987DB1422392882A435A3F760B3D6AD2B250B1D3D5E5F694A3612DA67A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	8BE9B87713D37FC4074C9710B3CC140C	5A5A87BC23A723B0A789EA87BD9372936E6EFEFF	A4012E4C9751499F59073E8BE115A1F636F43AE3F468A7AB461028508D296033
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	629B4B4B332C88E337E91B9CB5BB3FD8	53DA2D059529832C7399C041E5D94BB2BD5F1717	78550C1A71686AB171D0856C1C08637BB294AEF02958FFB0A6D60E081470549F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	7453B206A8EBCDB3E611F07F40AF970D	8C4420EE41E284B89E3D91013BEE413830656762	370415D5490D45360CE5D09A20FA97535B8CA57AE57CC29E6CE89B4C39F938CA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	82E8C4FFB4772D72C29A6CCFD7C63018	B4D48DFFF54674C75621A0D94B2FE386B34B71E4	F0772894C43B6DD5090B89E6502FAD7F9F3DE58A940C23909E30438381FEC791
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	6BB38229B451B74DC662D4430C054D74	A21F7AD14247A9F90CADE82989904211D25168E7	7E907AF6812031EB892D416AC5E870D70C6CFDB18AB97BA6FFA0B55BCC35A630
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	B6948181AA9D73C856761AD315723EC7	AFCEC4D1F98E0A37C9262A4AC4074EA44D707258	C4FCB0678CF793DCA7B33645DB065BE9563D6A8FE1F7F504EFA91128B85FA11F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	80B624F035590FB21304C3C7695A1B02	DEFE1986636E86967FBA6C75C2BF6F129564C31F	3551995692D587850E3C014D5455E071874AEE89BE1AB5AA2CF4471226AD7419
C:\Users\user\AppData\Local\Temp\MSIdeda3.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	8307292472D605B0F70307573186DD25	615873F70549B49C4EF6547E2F073CFDC0771656	C1BEA4CE0E3ACD9C1E8475A8B31580594D21ACE5FC426886A946940B7BB3C179
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-31 13-44-55-651.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	8F49703DCE537D71CF81050D618ED43E	9BCAE2DD6A1FF66C69200AAD9954843FFBB90565	C715D0834AC782B3B85D78B969BFF185568085601E875F7854C433F520E1850E
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	F748DB95A5DA4C1BDEAAB4F77D56A133	0CC1F9EE7EC133A0BD60CF096F77C17EC06C19BD	ABCA690E7DDBB002105B5C0A5A1DAD6ABEC0C221B790494B2E510627031F3A27
C:\Users\user\AppData\Local\Temp\acrocef_low\75362736-b3ea-443c-aad8-5a82bd51640a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\b921ff39-54d2-4219-9812-93cab3bc40e8.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	0A347312E361322436D1AF1D5145D2AB	1D6C06A274705F8A295F62AD90CF8CA27555C226	094501B3CA4E93F626ABFCAE800645C533B61409DC3D1D233F4D053CE6A124D7
C:\Users\user\AppData\Local\Temp\acrocef_low\c2f2b907-69f6-4dcb-9dff-ab17c46d5d1a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	CB76E9A61C184BA39F3357E92A06D56D	02E3C29B8BFDA91130E8975E604A5F4ACA9C85E1	36A3CE95D2D6431192EF083A36D43F98FAE4FD40392D5B29B598548D86183378
C:\Users\user\AppData\Local\Temp\acrocef_low\cbc164a4-cd20-4d1a-968f-9faa19d917a9.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B

Windows Analysis Report
20241031_42900.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report 20241031_42900.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
20241031_42900.pdf