Windows Analysis Report
0060599005-A05-044-4.pdf

Overview

General Information

Sample name:	0060599005-A05-044-4.pdf
Analysis ID:	1431071
MD5:	14b75f6bde243c56d4722b98d6f00dc7
SHA1:	96af93817b8b854f0971b0413c26c54b3814376a
SHA256:	28483ec36620ebb5598948951422c000cf109d3b2b2f82644cf3ec933273df80
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.8:49720 -> 104.85.240.187:443
Source: global traffic	TCP traffic: 192.168.2.8:49720 -> 104.85.240.187:443
Source: global traffic	TCP traffic: 192.168.2.8:49720 -> 104.85.240.187:443
Source: global traffic	TCP traffic: 192.168.2.8:49720 -> 104.85.240.187:443
Source: global traffic	TCP traffic: 192.168.2.8:49720 -> 104.85.240.187:443
Source: global traffic	TCP traffic: 192.168.2.8:49720 -> 104.85.240.187:443
Source: global traffic	TCP traffic: 192.168.2.8:49720 -> 104.85.240.187:443
Source: global traffic	TCP traffic: 192.168.2.8:49720 -> 104.85.240.187:443
Source: global traffic	TCP traffic: 192.168.2.8:49720 -> 104.85.240.187:443
Source: global traffic	TCP traffic: 192.168.2.8:49720 -> 104.85.240.187:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.8:49720 -> 104.85.240.187:443
Source: global traffic	TCP traffic: 104.85.240.187:443 -> 192.168.2.8:49720
Source: global traffic	TCP traffic: 192.168.2.8:49720 -> 104.85.240.187:443
Source: global traffic	TCP traffic: 192.168.2.8:49720 -> 104.85.240.187:443
Source: global traffic	TCP traffic: 104.85.240.187:443 -> 192.168.2.8:49720
Source: global traffic	TCP traffic: 104.85.240.187:443 -> 192.168.2.8:49720
Source: global traffic	TCP traffic: 192.168.2.8:49720 -> 104.85.240.187:443
Source: global traffic	TCP traffic: 104.85.240.187:443 -> 192.168.2.8:49720
Source: global traffic	TCP traffic: 104.85.240.187:443 -> 192.168.2.8:49720
Source: global traffic	TCP traffic: 192.168.2.8:49720 -> 104.85.240.187:443
Source: global traffic	TCP traffic: 192.168.2.8:49720 -> 104.85.240.187:443
Source: global traffic	TCP traffic: 104.85.240.187:443 -> 192.168.2.8:49720
Source: global traffic	TCP traffic: 192.168.2.8:49720 -> 104.85.240.187:443
Source: global traffic	TCP traffic: 104.85.240.187:443 -> 192.168.2.8:49720
Source: global traffic	TCP traffic: 192.168.2.8:49720 -> 104.85.240.187:443
Source: global traffic	TCP traffic: 104.85.240.187:443 -> 192.168.2.8:49720
Source: global traffic	TCP traffic: 104.85.240.187:443 -> 192.168.2.8:49720
Source: global traffic	TCP traffic: 192.168.2.8:49720 -> 104.85.240.187:443
Source: global traffic	TCP traffic: 192.168.2.8:49720 -> 104.85.240.187:443
Source: global traffic	TCP traffic: 104.85.240.187:443 -> 192.168.2.8:49720

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 104.85.240.187
Source: unknown	TCP traffic detected without corresponding DNS query: 104.85.240.187
Source: unknown	TCP traffic detected without corresponding DNS query: 104.85.240.187
Source: unknown	TCP traffic detected without corresponding DNS query: 104.85.240.187
Source: unknown	TCP traffic detected without corresponding DNS query: 104.85.240.187
Source: unknown	TCP traffic detected without corresponding DNS query: 104.85.240.187
Source: unknown	TCP traffic detected without corresponding DNS query: 104.85.240.187
Source: unknown	TCP traffic detected without corresponding DNS query: 104.85.240.187
Source: unknown	TCP traffic detected without corresponding DNS query: 104.85.240.187
Source: unknown	TCP traffic detected without corresponding DNS query: 104.85.240.187

Source: global traffic

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443

Source: classification engine

Classification label: clean1.winPDF@14/41@0/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-24 14-35-53-200.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\0060599005-A05-044-4.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1612,i,17485125054673473956,11496295142460598225,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1612,i,17485125054673473956,11496295142460598225,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 0060599005-A05-044-4.pdf	Initial sample: PDF keyword /JS count = 0
Source: 0060599005-A05-044-4.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: 0060599005-A05-044-4.pdf

Initial sample: PDF keyword stream count = 55

Source: 0060599005-A05-044-4.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: 0060599005-A05-044-4.pdf

Initial sample: PDF keyword obj count = 56

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.85.240.187	unknown	United States		16625	AKAMAI-ASUS	false

ID:	1431071
Product:	CloudBasic
Start time:	14:34:33
Start date:	24.04.2024
Sample:	0060599005-A05-044-4.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	14b75f6bde243c56d4722b98d6f00dc7
SHA1:	96af93817b8b854f0971b0413c26c54b3814376a
SHA256:	28483ec36620ebb5598948951422c000cf109d3b2b2f82644cf3ec933273df80
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	4D683639A404E829EE4AF5B39BE170DC	28D13422CA477BFDF1C0E2978D0C6A19E8E285CD	AF981617CF551625E956202F1C01529B0EC49D4CD2E205AEE4161FD937D27472
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	4D683639A404E829EE4AF5B39BE170DC	28D13422CA477BFDF1C0E2978D0C6A19E8E285CD	AF981617CF551625E956202F1C01529B0EC49D4CD2E205AEE4161FD937D27472
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	05117CEC9D2ECCE4CB4B7E706AE8EE7C	1B733D58750F61DAE958C2911D44F584E7F535EE	C28A1B6EFDBCF1EAA2EEDE0F306A6F8B5FB28388F6FD02D4B03E3A9D47074925
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	05117CEC9D2ECCE4CB4B7E706AE8EE7C	1B733D58750F61DAE958C2911D44F584E7F535EE	C28A1B6EFDBCF1EAA2EEDE0F306A6F8B5FB28388F6FD02D4B03E3A9D47074925
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\11c001f4-704a-43e0-8db5-47d4c60a20d8.tmp	JSON data	2AFC3ECB86693002AAF9F6949AD626E4	D5490CBA4A64ADFEBB860F75108CAF97E76A4A5E	88A8AEA3B82E8A9583123E48EED25C22A4BECA7F6EA7B3984E8C35C2783C9213
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	2AFC3ECB86693002AAF9F6949AD626E4	D5490CBA4A64ADFEBB860F75108CAF97E76A4A5E	88A8AEA3B82E8A9583123E48EED25C22A4BECA7F6EA7B3984E8C35C2783C9213
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	39A42BD26F43AD5B5A431ADDC7796B7F	A0E875AF092B586272B1EDAE2CA77B1A30F4F57B	641B58F4AAF670D922177311604BF10613516C07B4FC64E2122CA2A94BF6E842
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	8598383EE0437CC7D76003C7226433B9	B22E52538A0C493748A704015D0D5E2A6DAB4D0B	6F8673F34BB74546736110E87E64F389D527DC63E84C1BD1D09DA9833F395B6D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	8598383EE0437CC7D76003C7226433B9	B22E52538A0C493748A704015D0D5E2A6DAB4D0B	6F8673F34BB74546736110E87E64F389D527DC63E84C1BD1D09DA9833F395B6D
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240424123555Z-161.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	E8C8C2D6E45942F07D246B0C81BADACA	D8B5E426AB1F62AE509DF8FF496490B8F0ED1FC4	19FFB0AB7BBB8D49B5D5C71D0DFD3F37E85EF9FF494F799D4DDA30ED50C8A823
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6512	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	27094DF6D14B4D6728D59FFC4E31294B	CC768A8693F9C122496C2BE949E13F0C36AE7888	B26846BECCDB3792F05A996D2863C7A1D286BD9F997DBC2112604EBDD206FEAC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	60A88B2190A028FDFBD1D2D875340248	FE907F6AAE5DAE8AB33B18B5E5CF2CCED008ED18	AC627AFCAEA4CB733FB37BA8C9302D8C8F5680383936540AC0B7FD1B54F3DA2D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	009409CFDB50D5C71290B47BEDC8DEC4	7253C013650F1499530A3C76B260A1B315E08566	EBD1E71EA6EBCDB058224E00768EED92194F937ECBC82CFE21A850AC0866BF00
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	892F8F6BA9B82EE3E07361E1B1DDE9EB	0F1517257F71DE28E4580478CBACAE7EB7D116D7	1C4F90FF7280DC2EA213E69B083750690838D9BAD33E1F479A70589C89402074
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	FD987529A731597322DCFEC85C42CFA6	C325C8EB6BD3A8460D292652C9F4780BAC76509B	A6A497308F86C55D52370C27FA5D694F8FFD4D3155DDB9C88318360F86A4A9A6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	BCF4767A72C0D3E56830CC332208BA22	952F882D59C2251F5E7A56B66DDCD41693364BB9	0B11C14EF63FF7BCA8B079AF6D377D5C6860C65D2DC377E1BEB8CCD0251CE119
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	E934A95A05788008635EB426310FF89D	E11613A3BAB9D8D3176B8235479C32328DB2D07E	156A94D9F7EEDFD5B3F8A33A7035EB0DFCA9C49E7586F03E92797538E0BB4C22
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	451272F683B8FDD056356AA0A9062C68	BDEAA7FAAEB01B24FD2031809E43F8C731D49F18	DD2F07A8A53208D62112A3E5A12FA47F0C319FEA0BD29BA26F672736E52EC55B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	02A3E83A5866ACB0C37534B053E4B75F	4B56C661B0C1EB996197B3F7733A9BF8F38A667E	FF0F9542B18849AF985376A200EF482042EAB55361346B7961C2B3CC0D225716
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	97767069E2D2ACFDC0F713BC478C33F7	5E808AD48C51A3477251B05B5F1620BC3CED59AA	AFD8F8019EF6080C0570ED99E54855431C618E19B907B56BC72632240DC28EA6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	E661A8904FE498C990A615DE93EFA08C	3AA45084B7B03B7931450CD04F6DB0B449F5A9B4	C8B190499782FB48098B0333F22361E3F99F119CED09D132990F7D5D50151C98
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	6EC962D96B3AF3FBA2C906D11F9D1430	12C55682AA34FAFD447DE494E39A121F143918C4	1969442D5A16D35387C15B294335B716AD327286D3DAD5641DCCF47032814857
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	B6D8FE6D1BC31F61AB3A831B97DDCB13	38F121D65AA90B7D1D0E2A86A6EAF5B680E09BA8	1F6C9CE7B8EBB2DE0890D979A4CE93706F5BFDED07439D9AE88204EC3DD06B09
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	7881B653911C18B0E6BB0BA998E82932	F24A974FAA97B87A41DA0D4F27DDE0C6EE706A81	CAE0250DF6F9B5C90FCAD62C6B9F46F5EA8F9C4DB1DCE1E1C127D2986653219D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	07174F85ADC6476E884F2234A2035FE0	B4FC27926332A3F4CAFFC7E6F4EC23EF3C1EC1B9	E23C61A8584E0D78B8171EB1560E4EA731A789D1DB42026C5DD5002842AA81EA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	01954A9F63AF789F22B7B611614CC7C5	BC3371F44F78C3D702CAB118BDFEDFCCF606F600	126DF6567158D936FFC6F551C31CA22CFC71B25E5F72856B06AA8CAC4E283713
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	31057AF10585C6B2D7CE8346564B3FC9	18FFE35D89048BF5FA372B56000E65408567B529	BCD99D87F91E368020FC7B4434DE68A6C2FBB23F248A778A77EEBE41DE2FE591
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	12F8CEF30639BE283CCEA7CA61ECA459	13B1BD73B46A4BFE798F538B88BCB3B18F64288A	D9EFA59479AF66D110995C4DA33CE6403990637C94AC2CDB966AD46DB3E9596A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	6F3164338F1350E19E2ED3CD1BAB2657	AEE6CFDB3CFC6ED42C69D03708A6859B460109B1	3E0012AF7073BD0D4831038F51323C4BE3AE33A4B431125D4845AF5DDBBB1C06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	47964A7A5ADB2B2065F8193DA7A159BF	FEBC4C8F1FA0A1A57D01C34055FD1F6AE838BE24	DE480F5D09FAEB1DE5571B62A380F986F2900C697F594C3050DABC77E81C06B3
C:\Users\user\AppData\Local\Temp\MSIbafbf.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	CE4625199321772547DF94491513E01A	B2CE4D8582E32CF69EBE5DE09F0A094CFB8F1CA9	ADB7AD2844A5C642382384C7CD147FC8C3ABBBC04F8F830E29BDEABF9AF46352
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-24 14-35-53-200.log	ASCII text, with very long lines (393)	C3FEDB046D1699616E22C50131AAF109	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	02C7657FAB3F112D4A6E5414DCC85A45	7A6862D21438748879E438889D194E44EAD3E9FF	F146FE1BDBC1D400BBD7D8B3581C25FFF26B08220EBA48538D9C397286655918
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	30B90559B807BF034539F5522A6C5F35	2EC3DD992B9D4A114153D46CCD5B6688EB22F930	C85C0448FCFC668D7414E65B2923C1CFF5E8B3F1850830D50FC3FA0AC44EFEDC
C:\Users\user\AppData\Local\Temp\acrocef_low\8cc4bb0d-7f56-43b1-92ae-9f33c280e677.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\af70be3b-a814-4dc7-9a28-a1e12e3bf90e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\ea9470f5-351c-4bde-b7ea-b7e3ae732e5e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\fcf01b0f-181c-4905-b937-29a7721a7055.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	59EE5E2FB56A099CAA8EDFD7AF821ED6	F5DC4F876768D57B69EC894ADE0A66E813BFED92	E100AAAA4FB2B3D78E3B6475C3B48BE189C5A39F73CFC2D22423F2CE928D3E75

Windows Analysis Report
0060599005-A05-044-4.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report 0060599005-A05-044-4.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
0060599005-A05-044-4.pdf