Windows Analysis Report
1844-24 Ellis Crossing EC - Meritage Job #70122449950.pdf

Overview

General Information

Sample name:	1844-24 Ellis Crossing EC - Meritage Job #70122449950.pdf
Analysis ID:	1592057
MD5:	da12f982b24cf7c7f33cce769b557a57
SHA1:	22af9b6b85c890c0b39c58bca10198b5cdeaa1f3
SHA256:	821370b70b6254ee195bccdf44d289075198471e92c173444e33cb23c866712d
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs DNS queries)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: clean0.winPDF@14/50@1/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7132

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-15 12-01-38-286.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\1844-24 Ellis Crossing EC - Meritage Job #70122449950.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1640,i,7775810533559986121,11897258665540467222,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1640,i,7775810533559986121,11897258665540467222,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 1844-24 Ellis Crossing EC - Meritage Job #70122449950.pdf	Initial sample: PDF keyword /JS count = 0
Source: 1844-24 Ellis Crossing EC - Meritage Job #70122449950.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: 1844-24 Ellis Crossing EC - Meritage Job #70122449950.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1592057
Product:	CloudBasic
Start time:	18:00:37
Start date:	15.01.2025
Sample:	1844-24 Ellis Crossing EC - Meritage Job #70122449950.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	da12f982b24cf7c7f33cce769b557a57
SHA1:	22af9b6b85c890c0b39c58bca10198b5cdeaa1f3
SHA256:	821370b70b6254ee195bccdf44d289075198471e92c173444e33cb23c866712d
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	6C4A87F04B033C8BD80C19C28C07B2F1	BAB4947B6D5647E7BF5EF9E926C54D68263A5DDC	45B75AE16D2D196F355E889B3E2D978624F0947AA306B56159E1AAFE2748040F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	6C4A87F04B033C8BD80C19C28C07B2F1	BAB4947B6D5647E7BF5EF9E926C54D68263A5DDC	45B75AE16D2D196F355E889B3E2D978624F0947AA306B56159E1AAFE2748040F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	CEF6A301FE52A876C5092DCD27656166	38E9F5CDF2732588DB74E2F97BBDC7CFEEAF2C60	15F16D5D0D133AE7A4054A0352C3D214421BC5DBBF648A298FADA73EEB036FC8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	CEF6A301FE52A876C5092DCD27656166	38E9F5CDF2732588DB74E2F97BBDC7CFEEAF2C60	15F16D5D0D133AE7A4054A0352C3D214421BC5DBBF648A298FADA73EEB036FC8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	F11CC87C6E6807EBBD69D97FD5EDE505	8E80A4F4E237D2B78F76F1BFCD6D36CAF43AAE7F	8CCD13EED09B160D53AC218CBB221B2421A390876061576D4438655E921A44F5
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ae56acd4-60b0-4e5e-a072-e027c52a162c.tmp	JSON data	F11CC87C6E6807EBBD69D97FD5EDE505	8E80A4F4E237D2B78F76F1BFCD6D36CAF43AAE7F	8CCD13EED09B160D53AC218CBB221B2421A390876061576D4438655E921A44F5
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	6ADB99AFD478EECF3A2CD1E6461797B6	2CAA1B7C237F4905EEEBB364F64CF76B01E86BF1	709CDC4F70CAB9CD9D5F01D19F28C8E955000F1BDE994749FA489FFD1BD08E96
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	1AC7A1B130C65A422499123B84AE7421	5671485E0B15CBF735B481EFC82979B3911921FC	914BBE4BEBD31E873953CD7CCAF0BEF1D17538499F9496E8AC8395579866353F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	1AC7A1B130C65A422499123B84AE7421	5671485E0B15CBF735B481EFC82979B3911921FC	914BBE4BEBD31E873953CD7CCAF0BEF1D17538499F9496E8AC8395579866353F
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250115170140Z-156.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	58DDE6F4B5EF66CEA69A0B741A474CB2	5A1EF93C27D0290BD740A341AD14108DA038FACC	D93A35D15DB7B849D65A62BD68A5F45B0C9CF72EAA75DD76A3007E01479E51BA
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	37743981E30E04F08AF5C98E3B926250	72948E038D1A61EB6B9076BC6707BD7F1086E74D	4217C30A683B4582ECA1FA991E9661A99B045451F6547F193E0D730E797896E3
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	9D75530C15E54B97485ADABD3BE4B644	F278D1AEA3F3E2F1D8A20FCAEEB31084B477919A	5FDCCA3EC30C0EC35CCF80E45C88B1E74C8B86A3D400BDEAC1E98E47D593F388
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	CD193424A2D76ED545692AF4E791BA51	567BF24C6E716D99D04624B7BA276EE3E85B0495	3B4F7C896517ABC92A9C6145ECE681527E8F4A93A52C7D5FE303D4AB9BF1070A
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	DF858991438518B5DB0FFAA839347C20	9E6EABC146542A343153899DD1CC58508BC04124	69D8319C217C8EC3C527D895976C51F8A48FD00B012538E597AFAC63C4F0D2FC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7132	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7132	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	316170A93A561EBDFFD08997CE2CA2AA	6A78593A7D48494735E02541C4B5EBD1B23CA172	A0E932EE31A64D6A6BB534291DDB8AB0D0D3AAB99587A292D5BC8EC2E8A440E9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	BFD222016688232718EC46E1EFFDCEE3	99DFFC17BE686926F70ABACDB5364BEF1C15CC3B	5985435B2206EFDAFFD1303F66B7A36A3B1DD57F5D9865B078EBE300A34C09C4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	8849977D78B28B6701061D47B113CC71	8E97DD0810EFA89F2C40AE692C89BDF7C7A3BD94	4560181CBAAAFAC5F70F58E9654CAE208F133BBF42336AEB36B9A5CE911B65FB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	DD0AD46717209CE73339B636F528C597	6753908440E5AA56188CFE9ACEFCA0AC6E3E4F78	FA06284905674FD5441D66221427361D5CC5E5AD133C4CD58D064B6E2A0E97A6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	B691768D355ACD3B2317C467258009C9	E2E4CBA89B36BDF62FBAB7FDA52BB9A062F624BE	06D3CD6C6554E1CF9F62572BC6A7B21E1C62B636B472A00F281DF96E7EF9BA7D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	BEC962A8FB016465802DEE7EBCA0B4F4	60773A9DA0F74B9EFDF6973CD78D04C33F31E143	E92D1AFE89FBD83E67496D4B184B948D7607473B247ED3AED41167A5CD208B95
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	7246FD17373621BD421F04700BC2782A	664537805DC783C3C0C4582B710BB2B00E814F98	43447B041073A8A435DD202C015B1764E1E1F40BE3028422BDA88F8F7792A962
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	68F282EF701186AC7E87D7609F200B2A	5107515F9B0FE97BD9735F2DA45BB3EC6BAF76C9	2599466C1240C8E917B0E6B76410E8DB12CADD8E07AF1EA5D634F951C755A6B4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	BD8558D4FC4A517120B52A4CD251E7CE	D90A2AD2B563566D35A9F34303C55CCBD5E348FE	3C5B709C2A7523434431D8975537FA653B979796D03B7FDC4CAB8579A167DE25
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	8892D905CB05643AF91C8FB6672B61E1	38C1982D7AADFA50FB93C714F8A65C9FCF52DDA9	014DC51B2FD3831D4214A366FC636974877F6F9569E2DE0507087F10EE874F0D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	CCF5739C07D14EA8C12C457078A30549	8C7F32078979CDBB755CB0B945AEF9C6DC5054F4	A2873B2FB47BF5E336CB7F037CD18D37F4901A00BBEB488DDED3078CEE05D7D0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	0FA4043BD22E4F7467533E2C64E95982	1501454BABF7F55620FC29B2E0E4D807CDC58105	6416A7855033FD8279124D2FF2ED04A808D92DB1256E0B74039E4FCB029E5556
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	809295E8554D618E8B65F4BE9DA5C551	BDB043CADCB35D1174678FFA456366FBED5B67DE	D28D08150853291DC8D295888A00D2EE1A5375A25D46675111BE477FD489DE68
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	6423595F04091FFA7C5D4427C4211A29	50427A2B8BA32914025E062611D1B2751CB43C74	093774500C338944F84074E57D5B076F69AA453601EBDDCD36EC97DA8E95820B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	FD1C4EBC3DD95E56FEA09526A68C67F6	15BA260A2596675443E8CD507CB1BC79802F26AD	A4B0858E77F63A14877ACD4ED376E22EC56AE42970F5CC1316DE8765D46DFE1D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	3C97621067919F6725689D5277EF5DE9	585F5C97C25F21BBA325532B8FA7F6E7282F8531	D9D839FD86B5481CC89AE1B46C5BD06E96DCD98620718A4CE739253C8C5EBFDB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	4873EE0D3C9ED341D4E1F7207EDFA455	00D63675B0F63CA958F2A74DC73B9102BDF7DB15	BA79ABB91DABEDA716E62239A1AC0297096D9E3FA3E96783B85D5FEDF9C2104C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	428EA755FD240482D421E271D1BC2DA6	10691A199099B777EE25E9CAFB1AE2E0DE12C70B	A83C9D229DF29210F96B1E83567FCBEC55C4984CC4144923CD02D07625E93980
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	9B1CAC14316969CD2DC7C0E723EA5CD3	F872DC1C37629AB0F78D74DC50E693B85DE493F1	3C09D8F7D0BE0B4CD1299C32F9EDE9040169824925B7763D3DBC0D4F069FE55C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	B900437F448B8AF9539BB6021503CB18	A6E63A40B7B0C753B9AA3A40D27743D80569D918	C065A5884C4946916C5C00F6B9C97F750188E0E647BDCBBFD7AAF6B576B13556
C:\Users\user\AppData\Local\Temp\MSI5761a.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	2ECAA527D2059ED93DCE2C7C6C671395	AE35B8A227BD7BD4BA8A8AF4906BEBF614F810F0	9B987DF7B21223A97E2BF1A856CFEB3F5269D0DFCADE29FD018CF1D70FA1FDC6
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-15 12-01-38-286.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	69CC3EC764312B0A5DB2889C6BE738AA	7A5A5269815DE15571515E0820D7A49630734BCB	43452C9D5319C815D19C6D0EACA6B244E309879D86830163A650991EE109C27F
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	C6E5F81AA60F02DCC1DDD7CE44C14A86	858C27107A354C58561DDF0D91E9219B334E4BD3	106B7D155E76BF0F2006A199E1EDE3A289266275023DFD625D7B1871C3ADB001
C:\Users\user\AppData\Local\Temp\acrocef_low\1e97c42b-05ff-46f1-88c1-147b3f8b853e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\25fc9337-8cf8-488b-8181-2589ee8ebe5b.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\6bcda706-65a5-47fe-b898-87366f51f8dd.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	8B9FA2EC5118087D19CFDB20DA7C4C26	E32D6A1829B18717EF1455B73E88D36E0410EF93	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
C:\Users\user\AppData\Local\Temp\acrocef_low\ec1bc940-7ed6-45fe-9e4d-feeea113136b.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	13F55292D0735B9ABD4259B225D210FC	810CC5D545BFA11D2825F6E1DFA69176794DA7EC	8C3FFEA68963D108599E8C5AE20DE6E9C473BF33197A03A9A7DDCD0F25A6C7F6

Windows Analysis Report
1844-24 Ellis Crossing EC - Meritage Job #70122449950.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report 1844-24 Ellis Crossing EC - Meritage Job #70122449950.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
1844-24 Ellis Crossing EC - Meritage Job #70122449950.pdf