Windows Analysis Report
lnv_00583971_Wellspringcg.pdf

Overview

General Information

Sample name:	lnv_00583971_Wellspringcg.pdf
Analysis ID:	1562747
MD5:	28a8d764ce2f1a851b078d93e86b1d6e
SHA1:	e81e88124d42717d316bc2dd3a86dc2303a9ca87
SHA256:	a30eee91a159de763b9afe6bdf37a73f5354baa561f780c01b07f55f75bfe2dc
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs DNS queries)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: clean0.winPDF@14/49@1/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-25 17-48-05-792.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\lnv_00583971_Wellspringcg.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1636,i,8433034692376904357,9430375110467447937,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1636,i,8433034692376904357,9430375110467447937,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: lnv_00583971_Wellspringcg.pdf	Initial sample: PDF keyword /JS count = 0
Source: lnv_00583971_Wellspringcg.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A9d4h4ul_iag12q_5ok.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A9d4h4ul_iag12q_5ok.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: lnv_00583971_Wellspringcg.pdf

Initial sample: PDF keyword stream count = 139

Source: lnv_00583971_Wellspringcg.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: lnv_00583971_Wellspringcg.pdf

Initial sample: PDF keyword endstream count = 139

Source: lnv_00583971_Wellspringcg.pdf

Initial sample: PDF keyword obj count = 178

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.210.172	true
x1.i.lencr.org	unknown	unknown

ID:	1562747
Product:	CloudBasic
Start time:	23:47:12
Start date:	25.11.2024
Sample:	lnv_00583971_Wellspringcg.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	28a8d764ce2f1a851b078d93e86b1d6e
SHA1:	e81e88124d42717d316bc2dd3a86dc2303a9ca87
SHA256:	a30eee91a159de763b9afe6bdf37a73f5354baa561f780c01b07f55f75bfe2dc
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	3B2D5A9F36CF77C7AFFB017D41625D37	F0C0EF456C8F2A18B6F0BA4D947017F178272780	119B5364F6B13C9A2A1D7C857B1D01F8051ABE64099CD8C0DD5B8A59C608E359
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	3B2D5A9F36CF77C7AFFB017D41625D37	F0C0EF456C8F2A18B6F0BA4D947017F178272780	119B5364F6B13C9A2A1D7C857B1D01F8051ABE64099CD8C0DD5B8A59C608E359
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	0B721E061155414A5E9A571207340D73	0692F8EC1DAA6D1891627E10380BF55886764BD2	10CF85801C92D0A2A94FC717A816D5173F11683153E5D0A225BAC27E6386A322
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	0B721E061155414A5E9A571207340D73	0692F8EC1DAA6D1891627E10380BF55886764BD2	10CF85801C92D0A2A94FC717A816D5173F11683153E5D0A225BAC27E6386A322
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1e462477-1e20-4f01-902c-f13ec8d8a6d4.tmp	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5f7282.TMP (copy)	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f4914aca-858b-4448-8be1-e514d1f29555.tmp	JSON data	360C9B574C8136E88945D2081F8D3D02	1B8897E9D4939ABD8BCFF166E695CE241382BE3C	E6F04E9A0A8C8C1DA880AEDFE5E610DFACF11229E9974D7CE2D51CBB78485793
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	BB31DA7A7284B94459746F646C8E25BC	589C5F9F541863EF68C2014F3883E9837261936D	B5DCB604E7F741497F9A01CB0DE1C1899EFF3F2500EB3159DA29E9BAF346FCE8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	D22903B4EA8D7CBD8D4E7D7C14707F83	A31EAD7F1EB908D3F4FEAB8DCD515B17DB1A6EDC	7D4AC4043D3D0DDF131670A50BBA2A7FF92C42A85056CC91A4F7B8C565EEBD45
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	D22903B4EA8D7CBD8D4E7D7C14707F83	A31EAD7F1EB908D3F4FEAB8DCD515B17DB1A6EDC	7D4AC4043D3D0DDF131670A50BBA2A7FF92C42A85056CC91A4F7B8C565EEBD45
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241125224807Z-161.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	1F0219C4974222E6D331AF300AC5B966	BC135AC44C93C90DE06FEEDBCDC648022AE66113	4AD7708D67A58916DF49E50183D260DBD48BE161C7E68B14A855A1BC6BC028E9
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	C49C506F4481DFE56C554048A3D82DF9	BCBBCC93C622EDF53F7B4607C0C72B1AF483E9BE	514C6B937A33A275BA4A10E88DA194C2E4DBB4E82F59A382168938B17927AACD
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	96DC641DA0CAA7C1E8FB70B3D49AD16B	959F2EDFEB09A74ED4F60EDDB7EDDAB1A4057A43	38D2A07A8542656D72F47CC8B433B9E276BAE5FCE9BDE2FDB4290366588D5B6A
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	5FB46437381FBF38E99C53E4E70A8A1B	1DD206096C970C118F3D6C7AF1E57F9BF8F8FBBC	512E456FEF0C8D1E11098E0A0C341B719F2FA16EB29A3F2653E447861CD99AE7
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	659C1F15231BC0E9C40FF8AE02861B0B	6A9507DE53A0D5769822F283F7E350741FDECCCF	8CAA76D278B20F3DF92E658FD8D63BC62C91BD92FC765C8C4104A3BE45566FD6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	0FE42657672CF421FE6B3CB854C81E83	72C5EFB62EAE1239ECAA7CD6128C8B6C916FD536	11F9884514EEC67C52A8A660132F10CB3BC7C98DA0AAA64ECD08A0EACA55C256
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	A7F1A531D9CED3121167AB87E7D263B8	71BCF9B161408979A99E360677B9F426B5B3C1AC	AE5EDF832F8B7ADEED88F245860D6AF177CED0174049A58502815B07FA1B7B9E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	61CA12320AC10DB63E18424647E6F8E6	C1B80FEB8F88779D2179CCE8579C65EBF643A13F	981DCBFB47215A9992DBF5D0FB26D92E6C4433EEAC259A466A3651EE4D134B52
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	D0330007B3DD69A7757B5A6E7D64643E	7DCD0E5D7C7BD48E29C86DB3AF8C366451E61F82	8DFE7111F5B273EF00CFF22B9630726C148FE4DCB620328AC824A1B17054A1A1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	4CCC002B1C7FBBDC50D554AD1655AB65	31CD7BF6F5B650334B094FD736FD13D97F9201EF	82CC6E753DE29B1F06C4BAF2D8D23F0AA9912A5C651055854241E18225E3ACA4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	0C92DE1D3C764380CA42D04C02F7B2DD	81D1C79E9E8DDC28983454E1739F87D289BA00E8	F4BB9BBF8253171B831281133B8467B7050A93FB5348944860800F6E7973B047
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	204E339CED1B81B6FC281F1D24C221E6	2886A29711A92C83389564FC997485C999507036	AB5AAE65CB84C328D4264E5E02513F4A0E980B35BCAF9351A30A1619F7304477
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	250602E94E2F9E943DFA12FF79C4A5BA	59DDE6165D84B427163D11614E984FEBC91AE5A7	3445C7FAA5E924F68BC14F4D3C8FDCEAD7FE9F174D16388936D5BE717D61E995
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	0041E1AF0E3B06F4736B72593A77F0C1	E10BE4DDF901E59650DD01A74DC6A8AF99AE4C14	A923A106B08C8E2B28D230902BA52BD7E7F019E0346DEC7590421CBE824A64A6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	12853ADA16084FBCD73F8A2008A57C9C	A16045C4A7B556FD74965B73B625D3BADD4E6427	EDC83A0D0D08560767C09B27E4DF7ECFBCA754327E91F99D1ABD263CE7AA71F9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	17281EC8B5D22B3F7E795166451AFDE0	C03E96410A7CC50AC9DF21BC5560330628AC4B39	FF7C5898B9F985DED9C4187847FD71D3E7DD7FF2C23027669F4291F1043719F9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	636408AFAE1560230F25493DA1089D6C	6DC7B2D0D1CC5DF34EAF70FD43D0160E0DA6BDB3	46DD1FF7EC7DD2CA75F7080942D39B6E3EEE295E27788EEFF1C46F15EADB1D2E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	50CA2B58386C810CEC55B2B6101BC2D6	0748F2FE8EBF28FBC05BD2B1AD3176F56F6F2F6E	C53AB92E783D7C82E663012AAF2243B0B991913EDE501BFFEFBCAF5B9AB828FB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	1FB6DAE66B9EF6DA09AA825F36A597A6	1B29745C85C1CD0B617ECACD1D401D27A2A0D56F	F7C9A2B1C05A02B46676CA421C76984203430324753F38418E4BC638805B5E00
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	17D0F7535195C1C85800122101BF1385	6B577F77A07CBCC44BCF9812FBE45C7E13643A21	BC678A7872FA41195F4579A90F97AB4EA221BABF99B9ADDC5AEFFD814486C34F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	4F491B47E1DE9F8149DE783D5FAED057	E87780738A6BF85D6D8C21F08632C68AB5E82F91	85925283AD5F6FB6491ECDBE226A8DCAC2011992C626D9DE6E0BCBD1629B9EE1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	D7F40FD977F9DE77A33FBB0F692ADD79	0737F63CCA03739A6531A7DFCCD89BA2160A787F	1CEB763DA813065E3A9149A63D9EA340BB7C4F10715B882D260B717B47E45D23
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	70ED99E811408F11B7B819EB11B78B2D	47D7D4A03C501192B3A121A2711EF7C45327D640	5B49AABEFD6D15505B037151C8007A76DA9D7236226DECBA12D3D00C75315817
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	3E355ABA6A9363581089E45A3DEA6F67	2DEC89A4580D056ED15672BEBAEE37600BFDD8E8	B98011550B78D31A457F61835F313672C00FD0B3977E9DB7B112B7511AF6728C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	EA2FB602F7427D01BE005E2563F2B3F1	E732BC54F5461AD7A60859CFB8EE2AB23522378D	66886791018A4BA02FDA4EA8469F83CD3FBCE884669DFFAE8FDCA31DDC2CAC12
C:\Users\user\AppData\Local\Temp\MSIf35b7.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	10C97271E6C5221160941CAB6327590E	42B9489A6DE77F57385C6244496C96700C44EA72	A36ECE2D68AE96FFF899D281156FF3B94E14678F1C2F879B3802E8335D17EBB8
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9d4h4ul_iag12q_5ok.tmp	PDF document, version 1.6, 0 pages	2C4B9BBE68E8367186CE5A48A5556E00	FB3C0E9B0B74DAC7653A3FB79733F32FE6AF4E31	D14984BDD4EB95B334C88E66FB696CC70CC30039E5F37A1B0655E2B00DF42C47
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-25 17-48-05-792.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	57A5A1CAB609CC5B327DD86DEC8E4B66	EA22B019A56C865B7A17D4CC528B995673626BED	C829714992E184A10545675071D04AC84830244490BCC6374143A368B3432851
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	9BF836E53A86BF32DC594E32A19CF499	B124413F4726818A20362B00750AA9F32538C8D8	DD5C95BD3EF7E9DAF003BF0D30047331B8255685B3CACBD98D1211CE6F07CE0D
C:\Users\user\AppData\Local\Temp\acrocef_low\330e34e0-776c-4cf9-921b-b8fbeb76a159.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\3807317d-071c-4513-a186-2aa434a6c089.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\5606d2e8-985b-471e-ba6e-0108ae92b86e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\d818ff8e-a4ec-44a8-af0a-3ae6e7f0e7a2.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	C6A2854D0D7C79FAB1B52BF642E2EF1D	353E0D975D75E75F843044604865FD4B0F349FBF	87A3A1210EB114B538EB0FC8700C0DF3835BFEC6E5B4A882B7D196DB345E2EC1

Windows Analysis Report
lnv_00583971_Wellspringcg.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report lnv_00583971_Wellspringcg.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
lnv_00583971_Wellspringcg.pdf