Windows Analysis Report
User Manual.pdf

Overview

General Information

Sample name:	User Manual.pdf
Analysis ID:	1417300
MD5:	4e5167220439be2577e98d0d0e0f1b10
SHA1:	6ba9cee542a830ae2f1f8e246b6b0a4e1f5b9514
SHA256:	0dd816a9b2c428509e3bf91e66ed601e65d93b5d96180427ea121258225926eb
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global traffic	TCP traffic: 23.223.252.145:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global traffic	TCP traffic: 23.223.252.145:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 23.223.252.145:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global traffic	TCP traffic: 23.223.252.145:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 23.223.252.145:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global traffic	TCP traffic: 23.223.252.145:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global traffic	TCP traffic: 23.223.252.145:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global traffic	TCP traffic: 23.223.252.145:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 23.223.252.145:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global traffic	TCP traffic: 23.223.252.145:443 -> 192.168.2.5:49715

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.223.252.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.223.252.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.223.252.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.223.252.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.223.252.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.223.252.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.223.252.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.223.252.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.223.252.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.223.252.145

Source: global traffic

Source: User Manual.pdf

String found in binary or memory: http://hddscan.com/)

Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715

Source: classification engine

Classification label: clean1.winPDF@14/45@0/1

Source: User Manual.pdf

Initial sample: http://hddscan.com/

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6776

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-03-28 22-23-53-758.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\User Manual.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1572,i,7330846989784507453,3868889862558952675,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1572,i,7330846989784507453,3868889862558952675,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: User Manual.pdf	Initial sample: PDF keyword /JS count = 0
Source: User Manual.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: User Manual.pdf

Initial sample: PDF keyword /Page count = 24

Source: User Manual.pdf

Initial sample: PDF keyword stream count = 49

Source: User Manual.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: User Manual.pdf

Initial sample: PDF keyword obj count = 98

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.223.252.145	unknown	United States		16625	AKAMAI-ASUS	false

ID:	1417300
Product:	CloudBasic
Start time:	22:23:03
Start date:	28.03.2024
Sample:	User Manual.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	4e5167220439be2577e98d0d0e0f1b10
SHA1:	6ba9cee542a830ae2f1f8e246b6b0a4e1f5b9514
SHA256:	0dd816a9b2c428509e3bf91e66ed601e65d93b5d96180427ea121258225926eb
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	2E8FBD4AF70A3EB7CF9AF12536ED6565	DC712183D855B6430F431ED1A9188B28F95C3D8A	313AC78EEF3E3C368A076D2E6CAD564717E47189784C3A9157A2B96CDC476A43
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	2E8FBD4AF70A3EB7CF9AF12536ED6565	DC712183D855B6430F431ED1A9188B28F95C3D8A	313AC78EEF3E3C368A076D2E6CAD564717E47189784C3A9157A2B96CDC476A43
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	065698984CB088A1D98BD9A8093098F1	3CE1E48F4EECAEF239092E52F2151932AA21F671	F0C43B12A6B39CF5088FAB456F53EACB1DB40A9505C8797870A93A819370ECCF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	065698984CB088A1D98BD9A8093098F1	3CE1E48F4EECAEF239092E52F2151932AA21F671	F0C43B12A6B39CF5088FAB456F53EACB1DB40A9505C8797870A93A819370ECCF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	C99380396BB412BE5355ECDADD7B48CB	12C608E8FFA5B66E37FDBB0C47D0A648AC474FDB	273530BB25D40B0969823291060FBA7EB394692DFF9D685B1C1AB0CC4F9BE572
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f69e8f6a-aad8-4114-b43f-63e734951d0b.tmp	JSON data	C99380396BB412BE5355ECDADD7B48CB	12C608E8FFA5B66E37FDBB0C47D0A648AC474FDB	273530BB25D40B0969823291060FBA7EB394692DFF9D685B1C1AB0CC4F9BE572
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	2175739EA0A4AFB5C2EE0116F8AB575B	3C83293147FCB136BAA726B5E644D2BE75C9B26A	A7C5ED83A13EEBA23E46D077F434D539756363EB1BBBD14575F3448FC6936B9A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	50E9DCB68CFE16183926723AC21987A1	6A98C969E47AC588249D5C4A979D9856812EA0CF	CCAC87EAC54D347728AC4BA2854191D5339EF35DED2570841AA46093D7B7BA29
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	50E9DCB68CFE16183926723AC21987A1	6A98C969E47AC588249D5C4A979D9856812EA0CF	CCAC87EAC54D347728AC4BA2854191D5339EF35DED2570841AA46093D7B7BA29
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240328212355Z-148.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	59F43ED39BDC6BDC175D0B5FCBD6BFEB	ED07F723EB6ACEC01A72DEB3BDCB3CE8439778D8	585DA6234D1C73FE27FC8CD0F1AEAC87BA49182275D4EA4BD2550D08DC3B5A75
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6776	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6776	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	87EDBEE38F56C20298F25D5D3D4D1B5C	7F904E9615AC3186A87472EF366DD8202855B0B7	A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	370C70B9BF88FE99DBEBEFC1249794A0	4A87E5C03E5FE84BAF1ADE11361CD65C65F30AC8	63423E92E3DC3A545FA2268B1417AA268B88EE2FAF669D09CC9B93A683AD10E0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	3F0B906D873A2051D9C006319D45A5FE	F39FB1968B37544F6E61114EC9DB86F95ADC5F78	168529D6FF34D4BE129CA6FAF0C7D040E5B7095ED2A4B79B28738C909906EB77
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	0BB821F4BCF5DF0F04D41D8597D75FA3	4775E688BD95349DBA5DBDB7EA5847F1272E3AE2	71B42DB6AEAD6742A03C752FEC34CB157456CCE4D2388AD0C381F625D0522FBB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	641A6A9EDB319BFB1F19910CA6701B1C	A2AF35F66BC4DA4E6907CC65C8E419DEC56ADC3F	27B30F056F725B7860B28177A45E6B1E15B122E83B730F28749FB4B0F791A98B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	11925D38C9FBB9E60B6375F72446D74D	9817074CFEBBA49FAAB956CBD13313EF1A79C89C	75306C577073EAEB5EA26FBA3E81FAF902F9F42B4ED21A3EC81CECD3521B3969
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	77FFE61339A67CAA738613D289E18648	822F870556A3C5762ED3886E97884F19E1C15E52	666F64BD59D2B0C3F9C1B512F5EFCAC01115712A51096DC3816AD8574F8197DA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	B226F6FD4D602D78B638461A0FC4DB14	48DF769F68BC3D96FF8E6A1CEB01D18D66111E16	90132348D9E0EA9C8DF6BA7F6533EE31B050CEDA1E6D74223B2CEE5625CBADA9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	3A4F28E1CE7550DD5096A7CB8B8640A1	0F5F4EE73A180D4892B62386C3CA5E53541BB2AA	CCFD90EF79AB8050740074F3D59D95EA5CA6F6A635520E3B7062A367B806E5BF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	AD47717272D9237A98F2A34369FFB89A	8A9846015E1F373FBEEC957EEFAAE21AD9356E1E	42B0651310BCAF06CE7F42E6B7C8420D80C3DB79E5A43DBC8EAC37E04797CF09
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	B323AFAF3EFD30D1C4ED2C6C56EB5F23	1C9B0D80BD490031739FBB5D3455514B167BC736	07B93D6AEAA460CCD844A1F95BB8A0B5EA772BAA761DDB6915C01F378AD1643F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	77D64719292B1502FF87EA65CE802F2B	469BD833AE981D639F51A80B15A712FD8BB236BB	55019AAEC59C93F5971C118845E0F3677BE3D67C0637E893036A4EC170E92170
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	E2A5255A397C1B5EC23AD1A0E3661B78	9E8AF0B32625B4570F3CEB7FFA86147308719AC1	93F9E03187295D3B6598B41A6E05EF1E43525BD1984B4AB30A0FF9F0644A8E77
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	8D4787BEFAD2EAA45E80C584B3A2B5BB	6A51215654AEA4A1078E3924837A73DC46E98C9B	B7B6DC9A4926FCE528B635985396A6263E0492FFECD636C1BEFAC5D6F6CFDA2F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	60432BCEAA334C7A4195D0EF935E9041	D63F9CB1958D28225DEAE82BD95A848D90535982	D7428A55531777B319F67B82FE794DC633A62DD77528251BE01DF6CEA95D97DD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	F9D968FBADD3E1D13D55899887F51DA8	E1AAD5E75F13A9B5E7E9AAE735720734829096F9	8BA8391157C6CAC951943966B15AA3550B70789B2D86F09C416EEA3029D975DC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	F1E093B8145BEDC883ED4E971AEF39BB	2493B5E1CA05679DA30642F5842708B4E9F3FE0E	23CCEDE5ED2E481D77E083B0BAD89EC5D1645B326849669E200C5D6962AE0DA4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	88ABE94345434523D6E2F645455DD322	632B5F2927DF5841D3524D7A690D1F323ABC784F	7C3182AAB23512C9D4952F81EAFFAD454AEB5D899B40FF89D7FE7B7136B59CA5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	6A5AABE911A18FA57F29D7DE187F4425	8E49DD14483108BDA5E01D83C12A78CF4A70BC7F	6745114848B727346347288D5DC3A647436EEC9D4DA6BA0331F725B318309A80
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	607A5E1E2CD5764F6F59D12B31D33468	5982565B6C1CF439C933A9EC5EC7C2419F3DF25C	FBF83B60B4844E1B319530C383B44FB6F6D87C1B5BAC3B45AA4954D50A18A4DD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	6CFCF9E42F45436710A640C78E7C13D9	5FE2D3EFFF66719227D98E78F688DD77334F8354	063E92B05D17831D4B35E29B9018227B82916EAA153B5973E694F74A9F67957C
C:\Users\user\AppData\Local\Temp\MSIc4b6c.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	B30680B5C144D30D9F0EA009983236A5	60125BD18AA7A49045C1A417BFD268EAFC5747D9	781BAAAD262A4AE4E8E28C03B1603341C29E85F6129789DEEAA071E7AA22C98C
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-03-28 22-23-53-758.log	ASCII text, with very long lines (393)	1336667A75083BF81E2632FABAA88B67	46E40800B27D95DAED0DBB830E0D0BA85C031D40	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	84B10B5A1AD583A623DAF4A90F7A5942	61A007A6635AA232FAD4801EE9013E30841729B5	B508131A111D12D6DA36D74167A60287F939E2CD44CB4DF8C3192135E6D0EE06
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	7503CB28A4A852A2AE59BA6E1CA5E494	6E1A76E77B3FBAC08CD7AA3C335E4A4FB51553C7	B70DF5F6B583B1FDEC9C5AF254EDFB940EA7EC3EF55BF37DDF27115483E44A1A
C:\Users\user\AppData\Local\Temp\acrocef_low\2602cabf-04e7-45de-a3e9-46de3da8bb25.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\3cbaa7ac-6889-4821-b50d-2448e3d65828.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	AB9AB7524370F33FCB9DC48C196C6192	C0EB3BBE2884C9D081F2D09310D71F381818DDFD	BBE7F54A87E89788FA9E2DEB351A34B8DD5D2F4789EF86D13FE5B0C7450F8213
C:\Users\user\AppData\Local\Temp\acrocef_low\b7b086a4-96bf-4323-800d-46c1cceca49d.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\e7eb40e7-4557-47b6-af19-66f76afb60ab.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	22B260CB8C51C0D68C6550E4B061E25A	DF9A5999C58A8D5ADBB3F8D1111EAB9E4778637E	DAB1231CC22DAB591EBB91C853E3EE41C10D3DA85D2EFAB67E9A52CCB3A3A5A0

Windows Analysis Report
User Manual.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report User Manual.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
User Manual.pdf