Windows Analysis Report
20250115_125836_lfg_Scan.pdf

Overview

General Information

Sample name:	20250115_125836_lfg_Scan.pdf
Analysis ID:	1592010
MD5:	97f7e77fa0950cce94bc87de36bdce3c
SHA1:	2d5a1af1e215f97323f1cbc9a83214c33c5c9b52
SHA256:	b26e0eb0f0214392b3aa8933021ea2c06947936f04b9ae902b1f63f2852f0163
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs DNS queries)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: clean0.winPDF@14/50@1/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5684

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-15 10-40-12-224.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\20250115_125836_lfg_Scan.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1688,i,8551639892096939581,17741161191712173287,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1688,i,8551639892096939581,17741161191712173287,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 20250115_125836_lfg_Scan.pdf	Initial sample: PDF keyword /JS count = 0
Source: 20250115_125836_lfg_Scan.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: 20250115_125836_lfg_Scan.pdf

Initial sample: PDF keyword /JBIG2Decode count = 1

Source: 20250115_125836_lfg_Scan.pdf

Initial sample: PDF keyword stream count = 22

Source: 20250115_125836_lfg_Scan.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.214.172	true
x1.i.lencr.org	unknown	unknown

ID:	1592010
Product:	CloudBasic
Start time:	16:39:12
Start date:	15.01.2025
Sample:	20250115_125836_lfg_Scan.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	97f7e77fa0950cce94bc87de36bdce3c
SHA1:	2d5a1af1e215f97323f1cbc9a83214c33c5c9b52
SHA256:	b26e0eb0f0214392b3aa8933021ea2c06947936f04b9ae902b1f63f2852f0163
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	8DD3EB8B3325A7A58B98D3B915F1903F	E31AF6C0B2DC114910EE897F42AF819F9405A698	10DF2CD490D67FDA065BBCFED8959917316160E2DD7BA732D8B3E33D7B5CFFDC
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	8DD3EB8B3325A7A58B98D3B915F1903F	E31AF6C0B2DC114910EE897F42AF819F9405A698	10DF2CD490D67FDA065BBCFED8959917316160E2DD7BA732D8B3E33D7B5CFFDC
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	9C78BB167236C8157E23DA17C9DFC607	FEA495189D9E3DD0F47AA95B8593BA9B5C4284CA	35C44BAE7186456940369C8C0735FF67CED391D729A8E1F3DD929400094CCD81
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	9C78BB167236C8157E23DA17C9DFC607	FEA495189D9E3DD0F47AA95B8593BA9B5C4284CA	35C44BAE7186456940369C8C0735FF67CED391D729A8E1F3DD929400094CCD81
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2806d613-a9e4-44f9-bf7f-41ae3b7e3599.tmp	JSON data	0C78952ED51DBE56DEBF5648EEF77501	8FD13CBCB121F81C0D20882C681F0D5E1051C595	7B60610A7D54F0E70E2F7A2EA68E38EA612285E5F27E9CA4B64C29A8E8FACE8E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	0C78952ED51DBE56DEBF5648EEF77501	8FD13CBCB121F81C0D20882C681F0D5E1051C595	7B60610A7D54F0E70E2F7A2EA68E38EA612285E5F27E9CA4B64C29A8E8FACE8E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	51688C35278CD43DC5BCD96D21856537	46269A713FD567EDB2E40309203B11574C131D09	5C521F4286C24BE8E5365759DCB311A0617D79332D13BBD66D6DB2BA30D171ED
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	FE2FA996771FF1E29C7BFF6A5E4DFC33	07662B18C695C1FDF17DC40B070F29E90B161362	5302765910CEDE2D112455AB8B0DBC3F49391EFFD86CB455B0F4CD6C41195272
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	FE2FA996771FF1E29C7BFF6A5E4DFC33	07662B18C695C1FDF17DC40B070F29E90B161362	5302765910CEDE2D112455AB8B0DBC3F49391EFFD86CB455B0F4CD6C41195272
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250115154015Z-195.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	F11E718D9572DF6E0DE3CEB1C2FAFDC5	990FD8BD505DF9243E4041E5F483EADC8C3133C8	DAABAF5161D97BCD7FDBE0571B00BDA7BEE3ABC28A249742E438AE92B4CAAF7E
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11	0561BE1F618B53A34C2AA57013A3B254	90F7BD8629A78E352C894EC34A2F53B583AA857E	01E2C0549A5E20C3E10BD22E138EE230184F3BBF232772B4928C4BF68E36F3D7
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	5A34BC5F49D78F76B52E8DEFAC2DD05F	41DDAF86C9AC3421FBE1FAA514DC719B0FC15DC9	4B1180FA96EB0CA3FD51F96F7A4AB3296146A5AD9995A7473F038CA216956FDC
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	7F38173383F88D5DA7A2AA9A8DA81D66	073AC5070FDB3DEA7E8B06E352E09D61919CE642	C82B9B9AB4F20280A0438C419C7AD37744E0741DDDF4C15E03CFE08F94EEFDE4
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	D234348ED0E83F53FCEC12E1DB9152EC	79AB9740C4147C2D57F4C7BB222B0897E7A8C1A7	63AB2E22E0986AC2D4404125CB4B3004F723153252FC90AF6837A747624649B3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5684	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5684	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	9BA9B525F8213AA2658B0E502630D4E2	AA4E652138E9FC5CB24E74711C21388D83C73337	488E418820A4D9838E9606439992B4F990217663A75AEF0CF30C0FAECFF8C2A0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	B01BE146CC0574231BB4D92F9DA9A69D	E8EE9E394984377FF44CBC9444FD59E34F5CAB70	6B524405DDF550297EC012C801A277A7B253410EB49F64B95FF1484DC03587D6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	1E5F31976A30E723FD74E4ED03C5325A	076E2992A823DFA15E9D4372199713AA7B9FDAA0	0A99AC78EF29EF5E56367DC4EF149AE9A423B296F02ADDACA3DBB007A6D8D4A4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	574E2F51CB1897A5F40A9D4039176DFC	F3EAA54BA72F3DF1CA62FF1CCCD95BFF498DA64E	EDE110D048A6BA491A0940C08D7B6F442A1EF500F2DF11C91D06974D840ECE0C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	730D8272B3B58252831B6221E434B910	DACD8618E4FC6426FBC433BA4859DFD800B0E37C	666CF5AD9E2FC2A6EDDC056A897BADFE325BE51F5A8655E550471260A8714BAD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	4C1F7E16D6A86EAD1AA422CB5752288D	F2A275F4964F9C0602348288172A205E936B9B9D	90F1D866AD2955FB18EDA7D64003BCE5CA4113896ADFF358ECB318F73BA0F5E1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	EA21CF65D57F93C7639095C9D5589BB6	89954FFFB19F7751F615D4CFB91C72E84971048D	099B68168300D0306C3D27FF303751EE85529C05573E433705269E4E848C04DC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	D642256F93EC6AEFD990D677E9819EB6	E0726EF00E3E2BCA71054F1F491782394EE345E3	8FB5CD35807D9A468BC8FB45F800699C146AD161876E91C50E5805591F4AFB69
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	66336BBE24721F5B8A7526A5B6ED3029	9FDFDFB807C9B28677F68D05C7831E2ACF0750FC	AC851E1A08360F7874CE5122A63A76DCB3E4EFFF6BD57A458EC0B43A14675695
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	02D7305947C7AB670427193273C61D99	3D443DD265E46446532B361814AA640CE4D459E4	029E856710C378BE042C030B65EAEAF97600C8C12D77814C62F0D98730202BEE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	0F3657F07FE09A760DC162F6D0861C65	02559212EDDE1923B2481DA0B0A1B4CFEB4E1BDA	81EEEDF26F8F838AEC0F73EF71D713B75B1DFB0E2CBFEB2679C4E34200261404
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	D1D2C8C8C71BDBC28E6E7614CAF5B63C	B689FC5E62364F82C68615A77F2326E184AF5F5B	6B6752B8E7491A2BBB1728A5DD3342203B3D9EA46395C6A78839B4918DFE4D1E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	72C1F5593853CE5FAE850729B0AC5FB3	10EFD2C870BB0835D7194700A204C165DF2793EB	D04B11627D629BD3FDBCB4FDA64ACB8218A85C1A82B50E8EF8157D5E7AD83C27
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	A7EB3CDF00D2E8AE540A8AB5BD63F595	E32A459C479139CF199FE6A4838BC3DB45A27398	31807EA750C03C598AD01FF92FCF3EA19DC65F8A9A48B3F0D576A471D70E07C7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	8735EF9FC2AE54B6E1459F2B66DAEE4B	CE67A9427B2E6663D14C746673B6BC3F39D8F1AE	0EE92E0856C6F04D8EB2AFD2A7367AB476793FE52E154CEC543082CF3EBA427F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	3705D52051D31B6B78CD52121F3A07EC	7BC8E5739C37F18868F5958A5723B0B06CF514FF	864741544BA258C9FC98B36148052BDE0B8E18B7016BCB029C84C42E80641ECC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	2B3A3F67FE179DD39FEB602A01508F4A	6403BE36EDFBE971BA4F2632D0B2B2592C2CBB4A	BD4CDCD244E75197C477669872A0DD922CFA376BF5B97906EB70563409EABB5A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24	99FBDB2A99F61AAA198FFC99CBF9EF20	187B850CA8FC5CD13FE20D51052A4C3196B25109	BA7A46AF2D982E0A7D68FF7966C38C69B12E8B1DC28FA20A2E3FAD6DC9A4BEBF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	91E42985C0C9DA8F3DAA3C0EC155FECA	B89D470C6CA2DDB03420F67BB43E59558D235762	8FD2F816416761413419D3604E27DB8251AFB973FE98904D9E337211A42C70AB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	4F3335D9A6340655B0CDC6769613CF0A	2457FD3442B8B8C81396101E20DCA8798E38DE0A	CE3A7A41F95621BA5417B4D0DBEA6AD15EBE44F55323CC41C3B26ED658E66F38
C:\Users\user\AppData\Local\Temp\MSI927f9.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	ACF0FC360C37F8C4A1407D7D8B1A7E66	AB56C15F73CD1A574A488B3DACE6638DF9F6C361	F98B0C34DED5AAA279DEBB1CAC07081F48951A779FDD75C9B146037D6A717197
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-15 10-40-12-224.log	ASCII text, with very long lines (393)	128A51060103D95314048C2F32A15C66	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	CD85867F35B4B4F1F4AB557E1B1A44FF	BCD6DDCD46C4AAF6F9E551D6FC4CF273EF036328	9F76F74D97CDB60F112FB54BCB735A826C064333A7487D3060E3927745D4E90A
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	44335C232CD4427F0FA5371F8501E7D3	3D66A9D0BE43D550016FDF784C788AEB5514ECFD	C8E5AA173AF3741FE2567299D2E1C3711CF98EB457D5DE2579390F3C1BA7E64F
C:\Users\user\AppData\Local\Temp\acrocef_low\2750764b-fd46-4676-bd3c-94a03befa7f7.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\319688a1-3308-4772-b2ac-3b7b6aa22e6a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\4624aaf9-fbf9-4ed4-b5bd-107efd8867fb.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\eec706d6-cce3-464b-9955-4cd99bbc9213.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B

Windows Analysis Report
20250115_125836_lfg_Scan.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report 20250115_125836_lfg_Scan.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
20250115_125836_lfg_Scan.pdf