Windows Analysis Report
Alchemy_Quarterly_Newsletter-April__24.pdf

Overview

General Information

Sample name:	Alchemy_Quarterly_Newsletter-April__24.pdf
Analysis ID:	1431807
MD5:	9f7d4b9dfd805cf2c811535cd750d86c
SHA1:	7c7d74d23e42c47df705c560e232a1201ba276ca
SHA256:	1917bc9d6591663e5eb22710cfe9d97ab9eab4e1c650f401a6e9082c4a248d4e
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185

Source: global traffic

Source: A919h0cks_en93uu_54g.tmp.0.dr	String found in binary or memory: https://www.amfiindia.com/research
Source: A919h0cks_en93uu_54g.tmp.0.dr	String found in binary or memory: https://www.amfiindia.com/research-information/other-data/categorization-of-stocks
Source: Alchemy_Quarterly_Newsletter-April__24.pdf	String found in binary or memory: https://www.amfiindia.com/research-information/other-data/categorization-of-stocks)

Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715

Source: classification engine

Classification label: clean1.winPDF@14/43@0/1

Source: Alchemy_Quarterly_Newsletter-April__24.pdf

Initial sample: https://www.amfiindia.com/research-information/other-data/categorization-of-stocks

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-25 20-05-02-382.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Alchemy_Quarterly_Newsletter-April__24.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1628,i,8684521670987530744,9423196504567068144,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1628,i,8684521670987530744,9423196504567068144,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Alchemy_Quarterly_Newsletter-April__24.pdf	Initial sample: PDF keyword /JS count = 0
Source: Alchemy_Quarterly_Newsletter-April__24.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A9elqs2j_en93v1_54g.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A9elqs2j_en93v1_54g.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: Alchemy_Quarterly_Newsletter-April__24.pdf

Initial sample: PDF keyword /Page count = 11

Source: Alchemy_Quarterly_Newsletter-April__24.pdf

Initial sample: PDF keyword stream count = 40

Source: Alchemy_Quarterly_Newsletter-April__24.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Alchemy_Quarterly_Newsletter-April__24.pdf

Initial sample: PDF keyword /ObjStm count = 17

Source: Alchemy_Quarterly_Newsletter-April__24.pdf

Initial sample: PDF keyword obj count = 99

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
184.31.48.185	unknown	United States		16625	AKAMAI-ASUS	false

ID:	1431807
Product:	CloudBasic
Start time:	20:04:13
Start date:	25.04.2024
Sample:	Alchemy_Quarterly_Newsletter-April__24.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	9f7d4b9dfd805cf2c811535cd750d86c
SHA1:	7c7d74d23e42c47df705c560e232a1201ba276ca
SHA256:	1917bc9d6591663e5eb22710cfe9d97ab9eab4e1c650f401a6e9082c4a248d4e
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	236EA27BA05CEF71A7EACD13D0602CC9	21904F6AB82E91F90636F8A0C0E9776292E99436	473EA076170415348D868B1B996E642B7E1A816F010330A36765A0C96015F12A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	236EA27BA05CEF71A7EACD13D0602CC9	21904F6AB82E91F90636F8A0C0E9776292E99436	473EA076170415348D868B1B996E642B7E1A816F010330A36765A0C96015F12A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	6F18E6FC51CF0BC430A3720B8A7896B7	85CB1CAF43AB95387E49B124AF1D8F669BFD4822	8E5D7100C100CB65B324CEBCF5DE066CA664B94DDEB6594B74316D4A8529C778
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	6F18E6FC51CF0BC430A3720B8A7896B7	85CB1CAF43AB95387E49B124AF1D8F669BFD4822	8E5D7100C100CB65B324CEBCF5DE066CA664B94DDEB6594B74316D4A8529C778
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4e3bbaab-757e-46b1-a686-29321586e52a.tmp	JSON data	849639EDFE372A4A2CD9B65E6A64C778	AD4EF61D6112B9EDCB795CDCEE97EAB1DF8D2AC8	56E4BCA83C797F757A9E0A1B2519773885999E3253CA24EEB1677482A4EE89AE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	849639EDFE372A4A2CD9B65E6A64C778	AD4EF61D6112B9EDCB795CDCEE97EAB1DF8D2AC8	56E4BCA83C797F757A9E0A1B2519773885999E3253CA24EEB1677482A4EE89AE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	7382DCE367E454E74B061E140F2FD87F	DACBAB20928A0BFEC0D442465859F69FE62CFE60	1C8E1A99D047E94D0EC9755DAF40424B712737D3A4A20EF3A64965E012BE3C15
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	D271BF383A0DFDD708E5A25B0EFC83A8	E066AFC47C467CF5E0BDCAE77C758DE2F98B8F07	090EEFA7A53EC738E70D51F87E2B7D2301AB23A92D0B3749374F86C3B8CC688F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	D271BF383A0DFDD708E5A25B0EFC83A8	E066AFC47C467CF5E0BDCAE77C758DE2F98B8F07	090EEFA7A53EC738E70D51F87E2B7D2301AB23A92D0B3749374F86C3B8CC688F
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240425180504Z-174.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	2640B6A863CCAE9FE06CC38D69BF19C8	C4582638E526224DE60C7C99BD383323DDD914F0	173716DA00C14C7EFC9027D8C6F66C0DA24F573A81C0FAF57DBB9D9D03B23447
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6640	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	87EDBEE38F56C20298F25D5D3D4D1B5C	7F904E9615AC3186A87472EF366DD8202855B0B7	A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	C2A7DD9AE35810E728BE6B6BC7FC7A1B	248467CA71ED0B6BB75197BA1E006086BE79DB62	F758C20741544B5BA18A7E15A8963C622D49957795857B133C73CEA9A89D1F33
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	3AF7AB937A1946FE861F59CEF136D18F	88FB628BFFB37D32DB6D30EC54BC33B7124EE871	CE0AB102A3118878843710B32D1C9FAABD4C74E2DD6D1C2A19EEE4354A216E72
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	3A8D06CEB3877327BCD700CA0BD5B96A	3F6235C6C242724A7F7D87E0525ED508E210A902	D57BDD95F9A60FED83CBF1307BE521530662CD507B48A7536FEE855E6F1F9B35
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	7629125BEBFA8FBF03C961B872CD0487	299D68427A92CA86CEB93A600D0FE54C634DE788	DC7A7D757CA49E7275C19E97FEB23354F0CDFB8689EB9351341C6C4862E03111
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	A758A16F73D48E1689C1A1F09ADE0630	B3B4D62B17F4382ECEC0BFF0831B68EBD6AB36CF	9D90BF02CCF92177609A41A306639EF0177AF67FBC985CDA89E78342BF84ED26
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	FC8A14E251DDD97C33B5C256C3904860	ADF4EA44920FFF78EDDC9BE51E39C01E0B1396F1	B0601FB45C921DA896BEAB8F0A72B48549FFC4D7C58B9BB9FEF6441C2949C4D7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	9F7C9F9BD39FE15D7AF79AF499CE7F33	7CD70243660C9F7FA22B9DB5BA66B7D5C8B68851	2693C1FA65EC8D096A3BC7332055BFC8F397C957EAFFC6C3D08A248AB96CAF49
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	5CD79AFBF940C073BAB66F2FA607F50B	6DCDEE3B7E8D381ECB7CB8C65319207F7F657086	C9B25874C4B6C698EBA354CC8AE303B8FAC9FC72461967BA25C152116F496ECB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	CDFF69D65F538C6220E3CB688027B82A	E71F4195343C10944228AF0DB835F499BF088486	48875DAF2EB59FD89548880B7696AF5E858C085377703B2F7021882191B1157F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	8F955EE5B7247004D86F21F116E11720	723A78989BB4B0BA292A9E4210B2AEC0586B24ED	1B0F4305CAC3E9D484ECE13D71986AEB21F9A474571DBB58361A7D9EC6B38D0C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	9804D20D0A867D377244B0FDC35A070E	5C7FBD5C434E1C8CDD38A00B53F12B3021617213	412A24C960645A02830DF092D29764D267D95ED127F8CFEE8EE12ADC36C2B3C2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	20E1CCAD680C9019DFE06345E4FFEF9A	37ED4AA1A6E4975921E14A970041AE3184506E1A	C1DAF5058825D247CB34CAC5E1AF4F8BBD9AE596C7E1BB0E82D1E005D257ADB3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	EEE8CDE3D946709C6AA8DAC9AF55F1D9	0104E07B367E3582DBF92AFD85F7DDAADA6484C7	BC92E52FDACFC94DE928448F28955696486E690CCBFEE621FB8A070560B3A88D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	705623FC0224DF6F46DDC74FF254695B	554936837B3011918352770123099F190BF30DEE	804ABDFF937CE9946C41B9E65F194DB864A04D272E5F5AE62AA59F547662B392
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	79544C42521B6C9F89D86EDFCCA0295E	8C76D005F312D08BCF987557D3EA57C3E7DC0271	504E4FE8CDDB6AA78AFCF5129FDE85C5C7F5564116E5C1C1820CBBB2DCB230F4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	DB19C57D10CF8AE62FCAF0DBA89A360A	3F8E070D2C79B195CC81C8EAEFC77E11146ABCA9	E010ECDFD999F36D377BECF799FE593781FBE4211FF2AD2C221A73B68B303099
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	2CAD0E0D5BA37FD6257B7554D103D2EC	4787E97F6F95FBBD1B213D9F2BF1D049915D13CA	F18C620A71331F627E34BFE8DA49904DA33085BDE6633335590E35EB3BED668C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	B2D4C781F3D4FE6BE1E8F23836035AD3	7A13E08981BCE8E3C2EC294E23BE37920E44A9CF	ACA836959869496E10DF10D407337A7D6124B11892285A2A33B3E22F7A49EA17
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	BAA20ABE8805D49FF1113B62D4155143	7A3BBD59291CA0C6C765164C0BC02E94FAD457B7	F3B079E4364C500CA537A64F506D0F07C92437DDE4CC2315D1330A65D83078AC
C:\Users\user\AppData\Local\Temp\MSIeb975.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	1459D8805F044A3977F2A7E6749FCD20	221A4D64E232932A4FA17D5B9FCA1FD00C969022	2EB4A9B92D8BF44C30B5A785FC6EC86F07BE789DF9BA8B4B51D50A4264DC9112
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A919h0cks_en93uu_54g.tmp	data	9AA606E670AFE0344747962B1181E7B3	07B5B639EFF3FC1ED3ABBFDD41F7542463DC9470	6F4918B2F64CD30E84259BACDC4F90D27F24481B9FF6CEB34745CEA557E53BF4
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9elqs2j_en93v1_54g.tmp	PDF document, version 1.6, 0 pages	121E254F71C38E2071853F6730B07E83	69BFBCD8E5515AE1C5D7E77E1D6036B1E5EF52D5	E5145F8B44D78339C96EB756F92F51D43FEBF7FCBAF3254217AFF9AA9C030AEC
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-25 20-05-02-382.log	ASCII text, with very long lines (393)	1336667A75083BF81E2632FABAA88B67	46E40800B27D95DAED0DBB830E0D0BA85C031D40	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	23B12D34A917AF07F4FFC15480293AE5	AB543291F5B3E7B917D52AEDA66E6C80F1E11AE3	0BFA5CC6842A2E27A76FF5ACC507A48789B0F470DA8BC07DFFDE6EEAD59757DC
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	31934BB00B8AD0023C760B3A30CC867E	D21477775784661905A0919EFFD9366C48CDA742	D58163CA5332FDD31E5CFD26FC7C5F4B2FA15359E4B1797E69E8616AD8F329C7
C:\Users\user\AppData\Local\Temp\acrocef_low\6c9789ee-24d0-4545-8a26-dd1155140891.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\853d4b8e-c721-4de5-a920-1f2100034927.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\aa958ec5-3988-4fa6-8527-d210dab67988.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\ed1599cc-5dd9-4718-b5c6-1639667deda5.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B

Windows Analysis Report
Alchemy_Quarterly_Newsletter-April__24.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report Alchemy_Quarterly_Newsletter-April__24.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
Alchemy_Quarterly_Newsletter-April__24.pdf