Windows Analysis Report
50100294329071_1725252700898.pdf

ID:	1561656
Product:	CloudBasic
Start time:	03:23:14
Start date:	24.11.2024
Sample:	50100294329071_1725252700898.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	48c50c967ba832df78d45f5bd1e74cae
SHA1:	1cda91e564bb2e135baed988cdf5ec490f1c2867
SHA256:	cf38d600cb92dbf36e8cc7fe2ee960e0d7e1f855f02981c581e3c8a20e60bb16
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	C0B022BA7E05C8940DEDF6AC1984C799	210CAC482325AD59489CC437335D1C2A76E791AC	895A41202F1375559BFBCDED4E9C72359601E1A257D7708C41C97C0E59710AC9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	C392BCF9017D1427B8945ED9953B611F	542ADA4BC14887B914CD68E63049BF80CE571742	7D2A0E97ECA5907DC9DA45BCC34FBF8D77526B981AD185A0C64C0693BA8CD0CF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4d7a5d27-abd9-40ca-ba98-c698ac41833f.tmp	JSON data	404D5B89BF11100748BEAB8282FDF2D3	E20CF35E9AE667AECE6E8E7FD167B907980EDD58	A53A83DF01D2169DB4CBB3DAB0CA8CA51B865AEACFA35E44C72FE785AEE3BFEA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	404D5B89BF11100748BEAB8282FDF2D3	E20CF35E9AE667AECE6E8E7FD167B907980EDD58	A53A83DF01D2169DB4CBB3DAB0CA8CA51B865AEACFA35E44C72FE785AEE3BFEA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	1692315FCF6EDC3E066E8012E1A0FF8F	CC1F33B6E15A3EBA25B3B6770C681A4398B39139	BC9F365FF8B70330B264E7A890299547FD9431E631095C152F82A83E0304D564
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	6DAB106DF88B4A6B27B241927396B7AD	40490D15E08B5CD8865B8E00635D2E7747798789	2A410C544A441861478632092733C15BE48788DDDD94738823947168E63854AF
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241124022348Z-186.bmp	PC bitmap, Windows 3.x format, 115 x -152 x 32, cbSize 69974, bits offset 54	56DEDA00A352B9390BB6173FB6550493	96DF9D08B3ACB7F1832DF8D9201EE32E8D283154	048F0DE7D6ED944C03966B22ABB4E0940AA1D8FE0AF8294ECC82287EE60017F9
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2	A4D5FECEFE05F21D6F81ACF4D9A788CF	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	76997DC2B12C77BDD62AA2743D6C2EC3	678C31BFE7C2AD23BE5B2CB61417466A095A9798	8020E00AF3874A4BE247630C21A1F806F2ABB07C09BEE57DDC6BA5278C51067D
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	6D2B81FC12E094DA9D94EC55F7532BAD	230AFBE21CEE3DC62AF970C7348768B9F7A4F780	D00DB8C68BB6B728B268950D3423E6177F82DD8108218CF20FA44ADA706032EC
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	E46E04685372A0758CF8D3D259B94FC9	9B9332D6800ADE5E152947728719AD9767EB3638	6E260B0F7AD6A2454160AA03889849B98BBA520F6DBA513C7F92AC75C4B70478
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1996	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1996	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	B50C3F6EAA80FEB6DE68E83049A62CF2	E2F4814F928BF0D14C493370992B85A0B4372800	2FF21941E24339B0504DBF6F9D4E9B45EB5AD7ECCEC347FADF7336E8826D7AEE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	8E375D7EB5445196D6A2F8D84A46E625	93B80BFF25C24E3B97D3A049F00FF43E1255EBE8	FA829AE68C11D88FF37530E92DCD02A9ADA4A7C8F52F2C32CFB030D9AF3E3688
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	6FF2F358581FCF77D0091E1CCAA117D4	0E2CC496D680E1B0A0B646DDC5638497708FE96B	A8F177F98319354B371B009B348CF534273DE026585DE4895DA251F7C6EDEBA7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	7B9DA23BA36551117783406A140EFC8E	1800C22A00A8C6F5DDD67BA54B0CDB52BCA5F356	21F72F5F5C0A0336E9D19DFA8FD1ADEE72AE3439F10566F50197E10627DE8AE0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	B503093BFB15C5827961D16476F598AF	7BAC2B1F18CE0885A0665360B9BF785664B5B34F	BA3FEAB1B80B879DB391DB6CA1AF59DD6A2A1A202D958D7EFD8C1A5DCF0F8A01
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	A1F2E259FBB36026458E15016ED52D9E	A2BE81E8550BBFF7B7535410382D9CAF4CE9E3C1	2ECC104E9F95B6E54065576FCA0EA24D6FF9D01853441B624C8C3C09C60FA7A5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	B59BCC8A38371D6B5B91EF948E801174	E0F6ADD24FAAC03ED3437AC9775ADC196B3E35A5	DA05FCF302B3679ADD9DB056B25E6BF502EEDF5CED62F10C195E579C1AB4FCFB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	FB1AE9B768FFC8090E7FB2BFD3B846C7	1AF46DCE15F32B49FB6393EAEC30D505BF1196EF	FC976BE184D1B811B6EF3A15ABCD2B3EF4AFD9746C5F8595767BF75C20244F19
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	9CEAE119E97F0A71EDD9EE34C9EAAABC	3A937E334FD25EE822A252CEB62C8B3EA968C379	0649E6CC7DDDAAF4FE5DAF3DFCADBB5B54391D561A2CB7718C3BD852AEFFFE07
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	18823858277085295E1AF1E5121FF2BA	624DDA692DD2488F09BCF22A490D47C6812D4181	E10DA7C73F54FF29AEF3290FC1E3971E142D95BEAEF99925E87492F25478028D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	81663FE34F0C65EB9AB3E9AEC8D05E6E	1DE7F58C80A50646FE277BC9370763B612B067D0	20866D3999D80F6E43126BEFA23A44CE2C6CCB83881684B82401C196650D2ECD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	C931D7F62C8019335CD91F07486D7769	686DA7DA47041EE763386AE37CF28A5EAE947FE6	47614EA5E258A3CF64D3ED2B1E7AD9F122A126A753255FF70907DF6CDCF64437
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	03EB91F9459618B86A05805E041A9688	FC52677ED1C9DE71CA04A1692A267B85B5365319	B95E3C0620EB84D2971E64E6B418CF6AA4C7B7A44E768C27853FF9C538F0F6B9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	1E3E9811FBBF378D3C24A23392422CCA	D00A1714342C5E7719CD52C2FDE25D2AF5A64110	1A04726190EE8941C3C792C2CC9A65CBAFCC57E70508D43A47912731494550B8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	399AAA47525BD338900AF221442BE153	4F7EC30CD02ED15435490889C2015654C8E6C13C	7296677FCF87508766AB0B7749FE3FD97B6B97211E9A10F60C8016E814EE1DB8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	6E0DDDB2DE0662BF079DC8246069BA71	04E434E0CA92090A5136EE500723B5380DA5A781	265787619D80DA4CBC4EBE52F2AD03EE1B03E57A44BB6D567D1107F37F40F3C5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	F633D433A79243F00A30894F0D719C79	ACF3E9F8AC5A5DE35D786EB38009FBD7763C2FF0	A0687A3CB1F8245D56BFDED14CEB7CF0FC56712F2E45E5923F994C3E11D700F5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	53735E2B44FEFC79A0EEB4EDB5AD6454	20CA37C42D3977F0C295ED281A255FCAAB3E5617	255D1D13D4D90593422C3EE3379AE88F3E250623C189E1F070A822392F759CEB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	3F5E0903A3AD6788FABC8B0012509C9F	8AD2AE99AAC581EE50F2816C24D80642ABC6EC2B	3019702C42882440B09F9C74E3240C3DEF8649D0821A4B7D1C276DC3A42BFC57
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	802755AC57F4497A6097CF4B709E7AB5	4C655D0C6B25375BB25AA51E6829E5D6C22CDA3B	7CFC365A66B36DF8EEB5140AAC1B7DDF849FAA247AC6F204E0585ADA1B42E0B6
C:\Users\user\AppData\Local\Temp\MSI3fab5.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	AF0E7098BFF564A84C5DB13ECD2B0CEB	C0865512C64091E2EF051DAD6B57BE9A0FE78BCD	DCEAA863FE4128D1DBF272FF042CB94169A451419893FA9113A7C22190852918
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-23 21-23-45-633.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	6AED67D6D8ED9E1193F241C3DBF51FEE	0BA2690431B74F82D9E10D7DD9A7990B46820AC7	41B3A4F5E0DB6039970B650B54ACF1C16ED8252CECF32C6A10D704A02654777A
C:\Users\user\AppData\Local\Temp\acrocef_low\0a5f13f5-ca82-4012-bbbe-b07e73f0c4ae.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\2ed57905-f6d5-40b3-93e3-1f4217a7c029.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	B12D3B0AA42B279139A9F6E26C2C9B8B	D1DA3095C6BCC381675A441AE7A746EFFCE589AD	CCE2144135761D366D903449ADD12223E6CE743183543B17D336B3C5E13D5327
C:\Users\user\AppData\Local\Temp\acrocef_low\7d7d2731-0f79-409b-930c-33ae0525924c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\c0d0ebb2-3849-4436-9d75-279ba3c0d9b4.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	716C2C392DCD15C95BBD760EEBABFCD0	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8

Software Vulnerabilities

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 96.17.64.171:443

Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 96.17.64.171:443 -> 192.168.2.16:49708
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 96.17.64.171:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 96.17.64.171:443 -> 192.168.2.16:49708
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 96.17.64.171:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 96.17.64.171:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 96.17.64.171:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 96.17.64.171:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 96.17.64.171:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 96.17.64.171:443 -> 192.168.2.16:49708
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 96.17.64.171:443 -> 192.168.2.16:49708
Source: global traffic	TCP traffic: 96.17.64.171:443 -> 192.168.2.16:49708
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 96.17.64.171:443 -> 192.168.2.16:49708
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 96.17.64.171:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 96.17.64.171:443 -> 192.168.2.16:49708
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 96.17.64.171:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 96.17.64.171:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 96.17.64.171:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 96.17.64.171:443 -> 192.168.2.16:49708
Source: global traffic	TCP traffic: 96.17.64.171:443 -> 192.168.2.16:49708
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 96.17.64.171:443 -> 192.168.2.16:49708
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 96.17.64.171:443
Source: global traffic	TCP traffic: 96.17.64.171:443 -> 192.168.2.16:49708

Networking

Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.171

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708

System Summary

Source: classification engine

Classification label: clean2.winPDF@17/43@3/62

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1996

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-23 21-23-45-633.log

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\50100294329071_1725252700898.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1580 --field-trial-handle=1560,i,15579011386394989665,7113480420868027032,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding EF54C2A7CDD0321CF9CC0569582B9EB5
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1580 --field-trial-handle=1560,i,15579011386394989665,7113480420868027032,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 50100294329071_1725252700898.pdf	Initial sample: PDF keyword /JS count = 0
Source: 50100294329071_1725252700898.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: 50100294329071_1725252700898.pdf

Initial sample: PDF keyword /Encrypt count = 1

Source: 50100294329071_1725252700898.pdf

Initial sample: PDF keyword /Page count = 30

Source: 50100294329071_1725252700898.pdf

Initial sample: PDF keyword stream count = 31

Source: 50100294329071_1725252700898.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: 50100294329071_1725252700898.pdf

Initial sample: PDF keyword obj count = 69

Data Obfuscation

Source: 50100294329071_1725252700898.pdf

Initial sample: PDF keyword /Encrypt

Hooking and other Techniques for Hiding and Protection

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation