Windows Analysis Report
68000000326_DP216G BRIDGE TEAM.pdf

Overview

General Information

Sample name:	68000000326_DP216G BRIDGE TEAM.pdf
Analysis ID:	1430758
MD5:	dcee8d79d72f4387ba6fd706085b99db
SHA1:	80e46020b630424d75ccd13f4c6a0bb329c1c91b
SHA256:	e0aeee30c87c458ba4d1c267f96c7b5911f8f2a3ccb61a113c45ee3a136ac057
Tags:	jar
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.6:49721 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 192.168.2.6:49721 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 192.168.2.6:49721 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 192.168.2.6:49721 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 192.168.2.6:49721 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 192.168.2.6:49721 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 192.168.2.6:49721 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 192.168.2.6:49721 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 192.168.2.6:49721 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 192.168.2.6:49721 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 192.168.2.6:49721 -> 23.200.60.110:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.6:49721 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 23.200.60.110:443 -> 192.168.2.6:49721
Source: global traffic	TCP traffic: 192.168.2.6:49721 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 192.168.2.6:49721 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 23.200.60.110:443 -> 192.168.2.6:49721
Source: global traffic	TCP traffic: 23.200.60.110:443 -> 192.168.2.6:49721
Source: global traffic	TCP traffic: 192.168.2.6:49721 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 23.200.60.110:443 -> 192.168.2.6:49721
Source: global traffic	TCP traffic: 23.200.60.110:443 -> 192.168.2.6:49721
Source: global traffic	TCP traffic: 192.168.2.6:49721 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 192.168.2.6:49721 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 23.200.60.110:443 -> 192.168.2.6:49721
Source: global traffic	TCP traffic: 192.168.2.6:49721 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 23.200.60.110:443 -> 192.168.2.6:49721
Source: global traffic	TCP traffic: 192.168.2.6:49721 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 23.200.60.110:443 -> 192.168.2.6:49721
Source: global traffic	TCP traffic: 192.168.2.6:49721 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 23.200.60.110:443 -> 192.168.2.6:49721
Source: global traffic	TCP traffic: 23.200.60.110:443 -> 192.168.2.6:49721
Source: global traffic	TCP traffic: 192.168.2.6:49721 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 192.168.2.6:49721 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 23.200.60.110:443 -> 192.168.2.6:49721

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.60.110
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.60.110
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.60.110
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.60.110
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.60.110
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.60.110
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.60.110
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.60.110
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.60.110
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.60.110
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.60.110

Source: global traffic

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443

Source: classification engine

Classification label: clean1.winPDF@14/43@0/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3544

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-24 06-54-11-494.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\68000000326_DP216G BRIDGE TEAM.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1736,i,13084496968196404414,16290530547830846755,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1736,i,13084496968196404414,16290530547830846755,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 68000000326_DP216G BRIDGE TEAM.pdf	Initial sample: PDF keyword /JS count = 0
Source: 68000000326_DP216G BRIDGE TEAM.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: 68000000326_DP216G BRIDGE TEAM.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.200.60.110	unknown	United States		16625	AKAMAI-ASUS	false

ID:	1430758
Product:	CloudBasic
Start time:	06:53:18
Start date:	24.04.2024
Sample:	68000000326_DP216G BRIDGE TEAM.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	dcee8d79d72f4387ba6fd706085b99db
SHA1:	80e46020b630424d75ccd13f4c6a0bb329c1c91b
SHA256:	e0aeee30c87c458ba4d1c267f96c7b5911f8f2a3ccb61a113c45ee3a136ac057
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	A608514B01496265C865776F65F3D7F6	9622D7B46EA4CC0D72238E27E0789B5912611CAA	69147CE5773661203112CE4A7F7DE7DE9536620A3BFEA46C949534E54A46185A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	A608514B01496265C865776F65F3D7F6	9622D7B46EA4CC0D72238E27E0789B5912611CAA	69147CE5773661203112CE4A7F7DE7DE9536620A3BFEA46C949534E54A46185A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	71EA2FA08676795E5760084558168B83	D64C2AA138EFDEF1307A9D55ED3B4992EB9F0ED4	3C4D7BE546AD0CD9EB057128BF523611523B5F81312FA83F884840B1CD7B1A06
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	71EA2FA08676795E5760084558168B83	D64C2AA138EFDEF1307A9D55ED3B4992EB9F0ED4	3C4D7BE546AD0CD9EB057128BF523611523B5F81312FA83F884840B1CD7B1A06
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\47c0f2ff-e4a5-4847-b15f-ebbf73dd0524.tmp	JSON data	356C8B3A53FE34081EBCA873785505A0	A2E39CF6E6F3AC3CE4680AADA5C54588A76DB66B	30E84F3C7F16B56B1A7A684F0C26E0455D9BE0A0292EAC8E20436AF5AF56226B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	356C8B3A53FE34081EBCA873785505A0	A2E39CF6E6F3AC3CE4680AADA5C54588A76DB66B	30E84F3C7F16B56B1A7A684F0C26E0455D9BE0A0292EAC8E20436AF5AF56226B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	C604CBE15F72FA7801AA2418F1E20134	3E53752AB7734A20821BA4B78147E8D651BFD4FD	FF2AD0C8F99884347C720D5F077767436AD41B4FB4BBF68B2B83D17CF45CB647
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	F77FE90C454292326FF839C4093EA5DE	21A91C1203ACD7D429F383C696434BCFE30D184D	6653343170BA3AC1B97F82DA5E5797612F54AC199D4E2DB8733ACEA9345B7F4C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	F77FE90C454292326FF839C4093EA5DE	21A91C1203ACD7D429F383C696434BCFE30D184D	6653343170BA3AC1B97F82DA5E5797612F54AC199D4E2DB8733ACEA9345B7F4C
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240424045413Z-151.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	20EA507F031DD4B42360419ABC0B9186	716C594287A7CED6309C6B0C263AE7048DA82789	9D5644F32F7DF7376F7518123E44A231E4CC9A4F10C0C35DC18278C9FB4E2BC1
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11	3ED0A829DF8CB812E6E8FFE92FC4C845	A817FF02768666FEFFD1486CA1B74DBEAFCC77C0	962B8EA056894F2AFC066EA3C55024B0B3BD72E90CB8F06CFD602436D6F3CC10
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	AE99C5CB8C0F52F9408A199EDF7EB2F0	9D53C6F90BD0A3789AB6C8B26F40F9AD322778F2	78F8937627573CD253152337179F5B4EA4F2E35A0904ABCF496636304BAF5573
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3544	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	265E3E1166312A864FB63291EA661C6A	80DFF3187FF929596EB22E1DB9021BAD6F97178C	C13E08B1887A4E44DC39609D7234E8D732A6BC11313B55D6F4ECFB060CD87728
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	C6819FE4AD5B0ADCB27B67E426947AA0	C7A338406CA46DD56DC79558AA51EFE5F798BE83	430F3819760B8C9AACF6CB844B760A39179E4F045798679264F3F78832347DE4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	F1C92B805E1EADEA1461D5A19DA397B8	8EC08B7A60804FFC3301A047CA41BA80FCA45D7E	73DCF72E250E82D1B2CA018FDED42DA00E69DFF83D5B32C090C6970AFFA6C6C1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	76B5F3214F842D2CF6D91BEA366D79E6	89C7675FD8B46D16F027D071CE042F6874BAA630	836400984B930E60569D64D64DD40B429CE5F12B38CF8269508BA2F9D34CF161
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	0B7CA564346FEFE28BBE2D6C2410B29A	2FC9B16D5DB18594A78BD31BE56CC76095B2514B	DC13EE34CCD3D84D784387E9AA495DDA81F73BCFB28958E29C45CB575799BAE5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	20AE871EF1E48FB6ED855B8F6A5E3D7C	F3C8E15DC40525B64DD22DFF1284151999A09196	18024CD3A55BD7A33ACDE971962204B7A95D5D352979DA02A9721D3669EC41E4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	84DEDD1A8D76D5EFB7581CD9DE5E9D5D	A820607DD2CBED556E64318590EEF413AFAC9D6F	FE556EBDBE577C9C79010144EDF9D4CE2B42407621755A7250400AAF0C243165
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	DD30599970BE003B5D0D054ED5618D39	7DF35947D23B397B45BAF986BB717D63B2150122	DA944FD509CD683E231D3CEC9634AAFF446B1FE1647DFB6B247B66D770FB528E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	07710C463C2765387E130683B04EE931	F98962893F63C0D4A6BA172434F68BD1F28AE2D9	4E30BC52FB5E3E9494BBACFA5336BFF3A7959646EC97DDDE7EA670B972D623A0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	B35962C355D4F66022FF77B8BE2A9141	4B8DB8E6DFB6E294BC456117B81560617949F52E	88D13D04D92F6ABA4D611952C7A999F056DDBE1AB9E51AC0D8DE67D251C54388
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	60DE1320D28373E157975D88CA521D1A	7326D12D22007E6B663E06A3D9F8228E9D6D545F	BD4C4204FA6285C15EE5FE5AD944935438A52C2953E899B1A932B5B05AB0F3CC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	4DC2E1EAF2FCDFE4F7408665F57764D6	54896DD371424F8FEFF43492C6298B2DF64C53CF	560B3620CA3E0F2DC44F49F0063F3B2E2C76A77E64DAD4D5BCC896D22093EFDB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	19FAE8A8DD8A87AF341FF4F78F2ECA54	CDD3087941AA86C65188A8F91DE72DE727FED91A	5C2141939258FB0C37D8F0763AAF6725F8719882E731A45DF19BC47EE5B50553
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	D332AF13669175779CE1E3AEA0C2F19B	22700BCCB88AB5C8E21778C66B53329A73869DFB	0101F3AD08C537B4C6255A5A16884C6A0B708167595C496E5217C2A6CA38885B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	FCE43AA76E5305BF73D008A6007F82CB	39C03E37027D11FBF2325CFECAD242503A15C171	B5E5791FAF990522B0F969D1CB4A7B25E153433F7DC2F3E27459C441E13299E0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	9B11A032C290CD7A10E1D7677B818A0B	62E66CC21487BFB39D1808BB41D876E07368D7F8	1590106D1BB3847355F8B4E35E889A36FC769170AB038B20FF11349F9488F468
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	42577E88006B7B57E3D78201703D01EA	8B74AF09966727126EC6B7BD90F321840CEDCD11	C1F87462AB0BD8EBFD4104DFFCA02C3CEA73AECE0D801BCB77BCFA1897AF4189
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	BBE96D9D95AC07897E9109C40E94041B	C961DA16ED44FF1D5D29D512BDCADEA5AB548598	3FDD5A222419DF05BB23EBC83C0BF0A96E1662AC2ADD5D7DE4371C72D7AA563A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24	3DCE9133CED325BF5BC5380B22F5D7BA	03333FC0046FD0EF255642F43CE321FF5339D035	7159942131F2EB53E335E0070585D2E7893DBBD5F9525D264406DACEE344FD8C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	E87DDC72FA3A1DC3C052BC1D2C731734	80C87435EB30CDC657F3DD471CAA8177685A7C15	BD42EE098FB34EEE8AEBAD2A70DC4A1034E1F1F591CEAE317F97DCA5BA035D5A
C:\Users\user\AppData\Local\Temp\MSI207af.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	C6661E0DBD30FDA24785D55F14887C18	350A440C94DF45275C210882A33F517ECBC835E0	1AD371D2094F4B7723CDEDA42E3671B6B0229ADB2FC4B80D8BBAE261CF653003
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-24 06-54-11-494.log	ASCII text, with very long lines (393)	128A51060103D95314048C2F32A15C66	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	1616C3681E410F15613139A81A285057	6864C6B4A3DF16688C851E5A6B46888EDE5C3AF7	D7A24EC322C3107EFD8654D15D2FE2A95FF124B407CC36CEAB8D773337334800
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	1232AD5AD23A2410953CF295DE69530A	471E27CFCFDC13948A41988C8038EA2E1DB0EDDA	78C0216E18D4C8CF223ABB43AF9D169F71C7047C7DF10D177A3C48CDDFA8CB29
C:\Users\user\AppData\Local\Temp\acrocef_low\6917d254-0939-490a-80e2-153ca9386d8d.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	22B260CB8C51C0D68C6550E4B061E25A	DF9A5999C58A8D5ADBB3F8D1111EAB9E4778637E	DAB1231CC22DAB591EBB91C853E3EE41C10D3DA85D2EFAB67E9A52CCB3A3A5A0
C:\Users\user\AppData\Local\Temp\acrocef_low\86e91a79-4803-44a4-a771-8a6d9b467abf.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\f3fe8d87-2bbc-43ef-b2a4-8c22f100bade.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\f6d07790-37b2-4fe5-baa9-07ce2bb89753.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE

Windows Analysis Report
68000000326_DP216G BRIDGE TEAM.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report 68000000326_DP216G BRIDGE TEAM.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
68000000326_DP216G BRIDGE TEAM.pdf