Windows Analysis Report
64800000797_IMO SYMBOLS.pdf

Overview

General Information

Sample name:	64800000797_IMO SYMBOLS.pdf
Analysis ID:	1430760
MD5:	2289f869ef41ed8a006e2833dfe50006
SHA1:	4d28aac128e97d27d7a4160a836f4a3700f1d4d5
SHA256:	0eda3c0fd6b9a7d00b65d3f7610156fa55cdffae450b4873a8ca8df17f1ee5a8
Tags:	jar
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 23.200.60.110:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 23.200.60.110:443 -> 192.168.2.7:49710
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 23.200.60.110:443 -> 192.168.2.7:49710
Source: global traffic	TCP traffic: 23.200.60.110:443 -> 192.168.2.7:49710
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 23.200.60.110:443 -> 192.168.2.7:49710
Source: global traffic	TCP traffic: 23.200.60.110:443 -> 192.168.2.7:49710
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 23.200.60.110:443 -> 192.168.2.7:49710
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 23.200.60.110:443 -> 192.168.2.7:49710
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 23.200.60.110:443 -> 192.168.2.7:49710
Source: global traffic	TCP traffic: 23.200.60.110:443 -> 192.168.2.7:49710
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 23.200.60.110:443
Source: global traffic	TCP traffic: 23.200.60.110:443 -> 192.168.2.7:49710

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.60.110
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.60.110
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.60.110
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.60.110
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.60.110
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.60.110
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.60.110
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.60.110
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.60.110
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.60.110
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.60.110

Source: global traffic

Source: ReaderMessages.0.dr

String found in binary or memory: https://www.adobe.co

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710

Source: classification engine

Classification label: clean1.winPDF@14/44@0/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-24 06-54-55-647.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\64800000797_IMO SYMBOLS.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1640,i,2043785905118560439,8266881311133419412,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1640,i,2043785905118560439,8266881311133419412,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 64800000797_IMO SYMBOLS.pdf	Initial sample: PDF keyword /JS count = 0
Source: 64800000797_IMO SYMBOLS.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: 64800000797_IMO SYMBOLS.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.200.60.110	unknown	United States		16625	AKAMAI-ASUS	false

ID:	1430760
Product:	CloudBasic
Start time:	06:54:00
Start date:	24.04.2024
Sample:	64800000797_IMO SYMBOLS.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	2289f869ef41ed8a006e2833dfe50006
SHA1:	4d28aac128e97d27d7a4160a836f4a3700f1d4d5
SHA256:	0eda3c0fd6b9a7d00b65d3f7610156fa55cdffae450b4873a8ca8df17f1ee5a8
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	66910B15A9D61E5D830E34BFDE00FC8B	1D2D9B7DA64091EDE0994891BCD54686D88229B4	42994DE3492696B1FE604D40B77C074FA904A91F1B1803D6C3221AD95540F7F8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	66910B15A9D61E5D830E34BFDE00FC8B	1D2D9B7DA64091EDE0994891BCD54686D88229B4	42994DE3492696B1FE604D40B77C074FA904A91F1B1803D6C3221AD95540F7F8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	825F5239BCC0D96D4F380C38B0749214	4F06CEC2E921A216259F2610A528CF29351E7B09	33E7715AE779ABBCF86C66C9849113B6E1834FC4D1B0FCF767AEDBF42B49D091
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	825F5239BCC0D96D4F380C38B0749214	4F06CEC2E921A216259F2610A528CF29351E7B09	33E7715AE779ABBCF86C66C9849113B6E1834FC4D1B0FCF767AEDBF42B49D091
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5f92fab1-e169-479a-977d-86660c41d274.tmp	JSON data	7966899905BFEA351E6ECAE3D375AC30	60A4637F223B28A95EBDB1D1A85F0FAF8D16A261	1904DCEEDA3F544091815C426F9BDACEC7441024BFA7027FD5CF40B88FDBD57D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	7966899905BFEA351E6ECAE3D375AC30	60A4637F223B28A95EBDB1D1A85F0FAF8D16A261	1904DCEEDA3F544091815C426F9BDACEC7441024BFA7027FD5CF40B88FDBD57D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	BA441B60910A953B3215BE38FEB6AF64	046E86DB6828C3586768A8596A883CD169E47772	A41F2090DEA35789684F488B281D1442F9F408809E8A09DAD18A2591CD1CB238
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	E8C51AEF7A4F98AF4EAA03C1EC767EE7	568E3A3E5065E28E24464241E861FEB5C6EC88A2	EC5271247A5A5A4DD6B0BB6F22894D1D0DCDC33102A692D86CB3B1FB111FA89A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	E8C51AEF7A4F98AF4EAA03C1EC767EE7	568E3A3E5065E28E24464241E861FEB5C6EC88A2	EC5271247A5A5A4DD6B0BB6F22894D1D0DCDC33102A692D86CB3B1FB111FA89A
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240424045457Z-170.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	9D63F181A2F48F88F3F9B5FFA0AA2ACD	B908F260800B42987FF242D1FD743DB28FE240F4	B1A12579931237066124966EAC67969FDC3A55436A8BA298F3D4E7E548A1ADD6
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	26533B7F3B29311E05E944A1B06480F2	4574763470D8C1E39C841690E2EB34471E46603F	D99F14C602ABFC3E2876FDF05E44E855A19793EE2A49E2A282D7E0C9E21751DB
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	61777F8415D0ED27D79FBCB59D1011A0	7C93B575D4E93EF0AFBF5DCA03195FF5F6873D46	363CF50B2B8B9AF7755B01B5151FDF4205ADDA37F13DA4F913123F760655000B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5832	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	C11248DE3EDEB5F39EE8D1E2C1FFE7D8	7EC6B85BDB7C99BA691BB08A051EF7C4D4A43231	57612AEEE8F8E8471B730963F8E111C9890F83D8120380A6FF0676A3814A4B41
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	B74652D9C7C0E496CC27F0864FCD8ED0	C49704B866156AE07DA45EB5ED986EB32E030466	0718AD5B4C1AFDFBD25CF90BEC510D3F30EFDF6BBF5782CD9E5FA44F447285AF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	445E7B1A2C1520A7CC32D4C9F51594D7	D58042D9D77F723A55F6FD898FB5DD5668D748DA	530A3BBB4A0609FC9EA2F52123C0EB7D60B78F309E59A3ADE29A72B90BF1BB83
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	E062933111C4D78FE3EB8D79561E7E76	45A0059FB7E22C6288492C2BF9D3BE66549642A0	59E3582FE3091DA20B1311183757B970F0B58625D9D44E8BA8BEC38DE71FD621
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	1D045A1AD508F771F10A1372D162127C	5DF1FCDF4C578EEAF609C188AD1FB71AF025034D	3C4E8FB9336F05D226F9547A50BA17CFE9C5112B0DE8D9E4C8E2DCADBB46B98A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	69116463896EAC019A8206C541CC8709	E64AC182767485160A589CC7DC863144FFC6B824	9EBA97F52077BBDF9B554CD6E8D146AE9DEF4B8CD051C3A4BD3A0A90C58B020A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	68D6332B06FEA0BFCE9D1A5677DC5165	FEA0026AF180830BD2953B78AA9592A219D04190	05F490D25430C4F70085465F20758EB6015CCD31DF51E7084CC7827100887069
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	3D004F6912D96FEB9351D2825E8C9F1D	B4739B8C4BAD92FDDEE85C4532627E0C406289C5	824E96FF9C8FE60B89E23D5C2CC7CDED7443ED05FED187AFCB6E9B8A064019A9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	EDB01FF897C170F7F2BEA30241BB118D	0E8B3CF8BF01319F49B2DF88A2F6BED21F5F3E3E	5830B845F64B23F435D035788279FDC3E326EB94C903EBBA3C556B788D13290F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	903BF02D7B327BB7F6214ADC5B391209	0122E1F1727CB7E2FA506973052C5C205DE82FA1	F3D0EECB870B7790BC8B08DB076F2240B2B563B42221471B0E80FF60B0D1E563
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	6CB730C42CDE05CF2C8F4791E43BA521	A9610C550205435742CE345158F25B7F9A096261	D9C77207D385BB16A6A6F7ED02E0101F328837268845377E8012CF27B38230E1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	DD85B4631CFCFE638D4C1EEB8A65C2B0	70A982296899D3778F421F321F0F6FD48C8A7728	EFE3DC64341E1079129075DC706402CFDDD08B7085E52A880316135BA9C300F6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	823A45A4EB4786F5F03F59EDF7A2F8EB	B5644C9978904CE8D517B27849E5BA5CE47CC838	25A2B6703943E24E2E5D547F72E17AC2D0A7586F5EE173F97CB5D3BACEBF64D8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	199C061655FD57C90B4B1A55D6D65A2A	D60003C69C8619D7CC1243769581812C5C35E86A	59C5C6A8062D9424F1A5BBE1D4BDE174D4D710304A349B0E66874DF4A7D4B64C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	5DFC6D538A045527613058537C5E38DD	1CC64A557F5385D4DB2D39CB336BFCF2AE50E83D	598FFC627E7DD1D2031C6207A61950910D651FC044B1EACF449992082D7A5563
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	F28963CDED63212D10F085DD36DA1F34	BD400C67FECEE82FE9BC71C0B59C2922248B6BCB	71B3FF667D055B3413EFA09B3B5FF0E92883433657C8A1A67E229EA6686D0A6B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	592519C37C4055F1EF5B538CBA657894	A67B03671A43267DAB4507AA0F5A58E1CEE99E0B	71C092AEF1C140C3CCA721B2CE2C78199C40D12FCAE44EB6AC5F06687A8C5686
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	F21160EF2C95DA42CA7A16F15A81D5E8	94AD9CCD3026E88D5260E955B175F7F433A675BE	DEA780091954D5E3E8DD2DD0E41037721149C7F83F95FE793BE64572CE5B38B3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	83ED044B40A984B399272B49EF4E816B	A7DE0B04D29FD075699B63A23075C98DE512DAF1	894F0C9745E87204E7AFE14A7EFC6D625BD80EBEDD2610B1EDA1A23A1F361B87
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	C012566CBC75ABB46F857E6EF424FD4B	D1A44D1350E76461FB351C9739217A15D8E0D2D3	F36FB1DF893767C65063D4E253D55BE6CA0216BA6648934E0271501F59A9EE95
C:\Users\user\AppData\Local\Temp\MSI42ef6.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	9A47125F4E98502B411774CB07FA66D2	444C19B72F0E372E77CCD3667476CC53444BD172	749415118CC1F40E0D6D56FA22D383133E654C8B0BB4C58FC76A70AACF46FCEE
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-24 06-54-55-647.log	ASCII text, with very long lines (393)	F49CA270724D610D1589E217EA78D6D1	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-24 08-25-02-815.log	ASCII text, with very long lines (393)	20E6FAA1E16CF5326B8B3F5109F3B2CF	70ABF3212748D65B166757CCFF4AE0E5DD949228	69FA369171471A88D9ED967FFBCDEE66D0268AF153E49B852CFD75BDEBA134BC
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with CRLF line terminators	773557F1DDE57418AA9AE99D1BF7DD7E	9D697C019B260AD21DCEFF423B9A3946E3E2FCFF	A59D8D339A7DE9D1D5D3F33970E315C03CBC7BB595FB4260DDA6A319266E685F
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	B23E05B71AF1675602D27B0991E389B6	908521E8F5BBEA676A567AC10739CE4C27155EB3	2E9CCC9071628E62999C64BC26EFA0332CABFE020C64F7E36818FC28374BB45D
C:\Users\user\AppData\Local\Temp\acrocef_low\06604954-ea1d-40a8-bbbc-96397dc29507.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	95F182500FC92778102336D2D5AADCC8	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
C:\Users\user\AppData\Local\Temp\acrocef_low\ca55f51e-3a64-4673-8c94-eb07ec37a0fe.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\cfd082d5-af35-4c81-adcc-15cf6dc2c672.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\d05c265e-8647-499e-ad80-f86190860e74.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685

Windows Analysis Report
64800000797_IMO SYMBOLS.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report 64800000797_IMO SYMBOLS.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
64800000797_IMO SYMBOLS.pdf