Windows Analysis Report
RB Install Guide v7.1.3.pdf

Overview

General Information

Sample name:	RB Install Guide v7.1.3.pdf
Analysis ID:	1417376
MD5:	ca3fa4e536c92e32e500d89dbea24d80
SHA1:	c44b6cdb680d29a663d044f662c65acd32757231
SHA256:	2b690527c73a7b55b436f75397129cf9a513a17c4f98bc580290a353f02ca3dc
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.45.148.189:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.5:49715

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189

Source: global traffic

Source: RB Install Guide v7.1.3.pdf	String found in binary or memory: https://appuals.com/fix-windows-error-2-occurred-loading-java-vm/)
Source: RB Install Guide v7.1.3.pdf	String found in binary or memory: https://service.blpprofessional.com/portal/docs/dl)
Source: RB Install Guide v7.1.3.pdf	String found in binary or memory: https://www.oracle.com/java/technologies/downloads/)

Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715

Source: classification engine

Classification label: clean1.winPDF@14/46@0/1

Source: RB Install Guide v7.1.3.pdf	Initial sample: https://service.blpprofessional.com/portal/docs/dl
Source: RB Install Guide v7.1.3.pdf	Initial sample: https://www.oracle.com/java/technologies/downloads/
Source: RB Install Guide v7.1.3.pdf	Initial sample: https://appuals.com/fix-windows-error-2-occurred-loading-java-vm/

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-03-29 06-49-26-477.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\RB Install Guide v7.1.3.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2068 --field-trial-handle=1588,i,5543546582769599615,17805600638138278847,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2068 --field-trial-handle=1588,i,5543546582769599615,17805600638138278847,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: RB Install Guide v7.1.3.pdf	Initial sample: PDF keyword /JS count = 0
Source: RB Install Guide v7.1.3.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A91qyslrr_kxlefp_22g.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A91qyslrr_kxlefp_22g.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: RB Install Guide v7.1.3.pdf

Initial sample: PDF keyword /Page count = 12

Source: RB Install Guide v7.1.3.pdf

Initial sample: PDF keyword stream count = 39

Source: RB Install Guide v7.1.3.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: RB Install Guide v7.1.3.pdf

Initial sample: PDF keyword obj count = 98

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.45.148.189	unknown	United States		9498	BBIL-APBHARTIAirtelLtdIN	false

ID:	1417376
Product:	CloudBasic
Start time:	06:48:38
Start date:	29.03.2024
Sample:	RB Install Guide v7.1.3.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	ca3fa4e536c92e32e500d89dbea24d80
SHA1:	c44b6cdb680d29a663d044f662c65acd32757231
SHA256:	2b690527c73a7b55b436f75397129cf9a513a17c4f98bc580290a353f02ca3dc
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	2CD93ACAB9268D418236B5F75A354156	FD4A35D00D6BA2CE86562E8342385F94B26B5626	26332D77B3C70343AEB2B1DCC1B472583934DE415DCEC841918878D56738ECC6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	2CD93ACAB9268D418236B5F75A354156	FD4A35D00D6BA2CE86562E8342385F94B26B5626	26332D77B3C70343AEB2B1DCC1B472583934DE415DCEC841918878D56738ECC6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	5BD31CA2AF93D3754D12295294B1EBB4	4CFF65E5A3958C299D29376F1841FA02C4103E32	F39E2F34E85D0608C668D70485229780FA9E952937A63D638C445BE4750A992D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	5BD31CA2AF93D3754D12295294B1EBB4	4CFF65E5A3958C299D29376F1841FA02C4103E32	F39E2F34E85D0608C668D70485229780FA9E952937A63D638C445BE4750A992D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\45586a9e-cc2d-4100-adce-4836a2a4724e.tmp	JSON data	B08F6E8C4B67387CE9D8D83BDA2383CD	8AB1C734167C3F0A4854B0BF79FCD8E3CF89A7E8	87CE93F83D97D0676A4DD05EDC019380FCBADB9EA5B0CDF8D32FB7B05619E153
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	B08F6E8C4B67387CE9D8D83BDA2383CD	8AB1C734167C3F0A4854B0BF79FCD8E3CF89A7E8	87CE93F83D97D0676A4DD05EDC019380FCBADB9EA5B0CDF8D32FB7B05619E153
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	6BEA03EB8F9E56F805035DA17074881C	90C1F31C548D4CAE13D4627D4CAE729B5A37F820	4168A5FF6C43A0D11852413CC4E3E9F2DA4AEE4840B6ABA9AB9563A401EB3766
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	D012BF5A9376F552E93F71F58DA75B99	37170344063DCB33F7D069A68BC1A2C77707D545	F0C8AD2EF1C8C3FE2CB0AEFDF848F7496120953BE5D50AC93A9141008E4520EB
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	D012BF5A9376F552E93F71F58DA75B99	37170344063DCB33F7D069A68BC1A2C77707D545	F0C8AD2EF1C8C3FE2CB0AEFDF848F7496120953BE5D50AC93A9141008E4520EB
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240329054928Z-155.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	CA2C3518E9D46647EF6D78D8178F17BC	F893C8CAB8355060A103E1613A7D56EDF9BF09CE	6F36E9BFC297AFB674D62E1E8B11625458898AEAC3156DEE83F91E5DDDACDD02
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2680	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2680	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	87EDBEE38F56C20298F25D5D3D4D1B5C	7F904E9615AC3186A87472EF366DD8202855B0B7	A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	6327E2968A4A6C69DD3705D6D8755D07	B47FB14B3F86A6533A8CC4B04DB5E42D097CB002	A47AEAF8BF4C3B76BB420E3CFDD1AB26E41D40B4B6A8F96445129CF6E1A3F4BA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	34AC88C0D7832E922503B487F3D2FFC5	8DCD88286F467327374146D7B564031792CBF069	C41DDA826C304BE0DFA31935807CF8F93FD56E4CC5FA0A48CDC855D10D7AF0CB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	653F9D8FE1222494509C884972C53DB4	7BF139A6918FC4EA4CB36468EC17E787AAB9F1C9	2B19F7426437D58BEA91488D25EEAE3CF72FBC39424DCF9C415F7950557DFE0F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	80F3EF7E74E8ED4BB4CB4A4C927FF73E	BBD533706375FAD19DE7E5128A375BB71895538C	EECDDC71BC070462499DE22299A682F9273C51275887D8D0774723FAE6CF7C63
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	E3E070892DAB9F976CE62298F64CD0B2	5F3A8031745EFE4BDDE5E21B3578E4D1D27D463F	9031B8AE53F21EAFF1DCA07A684286C484B4145E46999D1DC226943CEF1ADE02
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	C4908A2E65979A696FC14BEAED901AC5	1E1F5DA7F88C0238A892F92D185D0BDA7F61CFE2	827953837E9F31909B742AFF330691C7540FFCA60A3126D45FD0D0B07E7B906D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	6C6990EF3F66F2EAE3F2EA2CFB3ADBDB	C47734D33BA546F704DA394F6E2DCF83967DB47D	985B090F134F0F62AB943A40CB215E0D35FA1835C3FD0420D7733BC469A95820
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	C458AACD690E154C71C42ACE6459DD09	EB7739ED55A2E54A9B4F0E3977CFABBD7CFCE57B	B61CFD74AC425F406CAD3FDF7017C3236E4A99A6ABFA112930121180C814B9F0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	3016F07A022AD8ACABFF6267630EB0A1	CDCAC69AF14E9F19D8B44D80A908F427212BB391	081FB1468D538C463E8FB8C9AD59D4EDFCF1D81B220B4DDA2225CAF5771F6F7A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	1590A3D7B6E53E928B03C684C3472B6C	8FB8CB7C5070C5B43FCD1D50A3FC07A5E85A4B66	A2C609E8F86DA6728D8B692C4092B0DA9F59CA22644F5D771755C234572EC759
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	D8E2F593171A383F20EA8754EAB2E1EB	A40BD228F93EB5053D23A81E276A9CC563455520	B3CC7B0301A58E34E41AE1BD3CEA39CBB34F0CC331E94E21AFCA7D3FDA92DEED
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	64A2D266B4D172FF863D441D4DCA0D32	504ABB458BEAB11DB4E0FB087E669F231EBFC91F	75717A0B03B93153A80A4875D4ECCA8C0141D51A2F61027294B0AF184A622FCD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	FB08EC70CAB921DEB86F49CACA71DA3B	750499EA2EE22398DC9A4BF7190E20168AC22E82	384DEBB90D590A5C71DF1089970F7CB0C9DC62D81393DEEBF9E8F266468D83B1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	00B0482026E0E2A34334BF2CBBBFBF7E	D8C7FF4EE44BB9D42E92B79352571CE57E2F1D2A	539B49226F18EE03DEC4AA9B66E0C2BCA20EEA57F4D3167AA7F95C2ECD3E7286
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	1CC341EE947B89985DA0218F6BE5D9B8	4CE8D00D35A8D925539D303CC0C94A592957BC97	158CD72B6C9C015516AF94AF03CEAF4A21F18C85C96D1102F4C073FDE91D5DA1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	4CEC7CEA9C40F9C3BA13DC7EA437D601	6794B590C711E07E3E1018C6D1C656E43B5193F0	6CFFFACA2CAD0FD2D01BD75F7C97385EF2AC6EB656465BB833C4CE697DB359F7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	B0524408FD65F3B4E1ECE22D7F755E7A	4C40864198149F01FFDEBC12F595C8B06363C460	A4126680830D729FF75382C7002B8CD02DC3713C1A13EC9D491BC5D1E383C242
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	12C7B62D733F8BF94D35F32C63CF279A	6499573883F988807FC84658D99FCEDD7E34C80B	767D794B0A4EB7CF2C203D756B7ECBA2FC87B3B143006B099DB3F11FC6B8896D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	B11980903FDC089BD0FDF224C1425000	72C22DF1F067F5AD40FC1761852AE2F7CB5D41C8	EACB7358A4CCE29FEC48054AED29DE91B1295C8A6319BF7F8371E1BB0B5C9D85
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	1FB1C8C0E0C1BE1EEF8DBAA7CF272C94	2355EB55D82AEDABD3ED1EC3A9F235E9145371C7	E548C4EDFA95F3F660DC18BD75C83CEC4FA94853969A61838DA4E065AA4CC09D
C:\Users\user\AppData\Local\Temp\MSIbae68.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	566A910EF5BB5FE492987702CBBB78F5	B50075DE838EE7DE5A72F757A585BA6815A436B8	123553ABF4A7215007164FC86D076C37773E08EDD202AAEA4E397667FC14D1D5
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91qyslrr_kxlefp_22g.tmp	PDF document, version 1.6, 0 pages	5B475DB023D386278FCDA898793F1EE8	E143446513CAF4A329045D452A772B2C8910FA9B	3B74AF45862B439B1FF488A9B81B9B7A6509923122AA33023DE9043FCF892F29
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-03-29 06-49-26-477.log	ASCII text, with very long lines (393)	1336667A75083BF81E2632FABAA88B67	46E40800B27D95DAED0DBB830E0D0BA85C031D40	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	8B02E6B45531C69F0C5EA939C4C05299	C8BF33BCF689A3F32BF271AD4B167552AB99BFFD	2A63A2CF222FCB636438FC303F84FCABE9A6DD689EA801A11274C207981A7B47
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	B8ABCF6EE28A92FF32BD2A032D24B72F	B2A228D76ADB49B0931B05D2227614ED97DF0A5E	72D7540277CDA652F3CF5A4554F403DDE68A55FEF0827FB1AF68E90FECAF6561
C:\Users\user\AppData\Local\Temp\acrocef_low\23f920a2-b26a-4491-b91e-831a62295f8c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\267e7177-b381-4a4c-953c-0da00f06dff6.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\3a836c82-6f82-4be3-8b08-f3347e43c66a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\bc857bbb-492a-46a4-a9a9-d02927672cf5.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE

Windows Analysis Report
RB Install Guide v7.1.3.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report RB Install Guide v7.1.3.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
RB Install Guide v7.1.3.pdf