Windows Analysis Report
Report_85730cdd-1ba3-4d7c-8ecf-103ec107fc6b.pdf

Overview

General Information

Sample name:	Report_85730cdd-1ba3-4d7c-8ecf-103ec107fc6b.pdf
Analysis ID:	1438419
MD5:	3cefa9f5174baf368a71e17592692f15
SHA1:	c002c219b828aae3ff940d2d1ff774ebbc0c1330
SHA256:	6c004f29e5fb4050a85b141319669b764dd73860fe38e47bf2abf288f1a04b41

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Stores files to the Windows start menu directory

Classification

Signatures

Source: chrome.exe

Memory has grown: Private usage: 23MB later: 31MB

Source: unknown	TCP traffic detected without corresponding DNS query: 23.213.36.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.213.36.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.213.36.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.213.36.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.213.36.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.213.36.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.213.36.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.213.36.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.213.36.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.213.36.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.213.36.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.213.36.145
Source: unknown	TCP traffic detected without corresponding DNS query: 5.230.44.76
Source: unknown	TCP traffic detected without corresponding DNS query: 5.230.44.76
Source: unknown	TCP traffic detected without corresponding DNS query: 5.230.44.76
Source: unknown	TCP traffic detected without corresponding DNS query: 5.230.44.76
Source: unknown	TCP traffic detected without corresponding DNS query: 5.230.44.76
Source: unknown	TCP traffic detected without corresponding DNS query: 5.230.44.76
Source: unknown	TCP traffic detected without corresponding DNS query: 5.230.44.76
Source: unknown	TCP traffic detected without corresponding DNS query: 5.230.44.76
Source: unknown	TCP traffic detected without corresponding DNS query: 5.230.44.76
Source: unknown	TCP traffic detected without corresponding DNS query: 5.230.44.76
Source: unknown	TCP traffic detected without corresponding DNS query: 5.230.44.76
Source: unknown	TCP traffic detected without corresponding DNS query: 5.230.44.76
Source: unknown	TCP traffic detected without corresponding DNS query: 5.230.44.76
Source: unknown	TCP traffic detected without corresponding DNS query: 5.230.44.76
Source: unknown	TCP traffic detected without corresponding DNS query: 5.230.44.76
Source: unknown	TCP traffic detected without corresponding DNS query: 5.230.44.76
Source: unknown	TCP traffic detected without corresponding DNS query: 5.230.44.76
Source: unknown	TCP traffic detected without corresponding DNS query: 5.230.44.76
Source: unknown	TCP traffic detected without corresponding DNS query: 5.230.44.76
Source: unknown	TCP traffic detected without corresponding DNS query: 5.230.44.76
Source: unknown	TCP traffic detected without corresponding DNS query: 5.230.44.76
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: classification engine

Classification label: clean0.winPDF@32/32@2/68

Source: Report_85730cdd-1ba3-4d7c-8ecf-103ec107fc6b.pdf

Initial sample: https://signaturedo1rture.arcencieltour.info/get/9a831435-d8a3-3bce-bc11-4d7f727eb6ee

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4468

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-05-08 17-45-48-442.log

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Report_85730cdd-1ba3-4d7c-8ecf-103ec107fc6b.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1580,i,2690051050023038129,15551241143277578108,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 7FEC8C42FA479053FD4FBC4332D638B5
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1580,i,2690051050023038129,15551241143277578108,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://signaturedo1rture.arcencieltour.info/get/9a831435-d8a3-3bce-bc11-4d7f727eb6ee
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=1832,i,11350477795455199426,8346384971983572533,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://signaturedo1rture.arcencieltour.info/get/9a831435-d8a3-3bce-bc11-4d7f727eb6ee
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=1832,i,11350477795455199426,8346384971983572533,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Report_85730cdd-1ba3-4d7c-8ecf-103ec107fc6b.pdf	Initial sample: PDF keyword /JS count = 0
Source: Report_85730cdd-1ba3-4d7c-8ecf-103ec107fc6b.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Report_85730cdd-1ba3-4d7c-8ecf-103ec107fc6b.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
74.125.135.84	unknown	United States	15169	GOOGLEUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
5.230.44.76	unknown	Germany	12586	ASGHOSTNETDE	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
96.7.156.186	unknown	United States	16625	AKAMAI-ASUS	false
142.251.33.110	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.251.211.228	www.google.com	United States	15169	GOOGLEUS	false
142.251.211.227	unknown	United States	15169	GOOGLEUS	false
18.207.85.246	unknown	United States	14618	AMAZON-AESUS	false
23.213.36.145	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false

Private

IP
192.168.2.17

Contacted Domains

Name	IP	Active
www.google.com	142.251.211.228	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://signaturedo1rture.arcencieltour.info/get/9a831435-d8a3-3bce-bc11-4d7f727eb6ee	false		unknown

ID:	1438419
Product:	CloudBasic
Start time:	17:45:15
Start date:	08.05.2024
Sample:	Report_85730cdd-1ba3-4d7c-8ecf-103ec107fc6b.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	3cefa9f5174baf368a71e17592692f15
SHA1:	c002c219b828aae3ff940d2d1ff774ebbc0c1330
SHA256:	6c004f29e5fb4050a85b141319669b764dd73860fe38e47bf2abf288f1a04b41
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\21c86540-b372-4c00-9c33-dd8ff9286bfa.tmp	JSON data	4641F417ED5B8E3E04E307C009AE8EDB	9AEAF15560CE3E609A7DB1E5C95E5E06E9409EEA	FEB3A99FC25F1A73CA67F8BF6B022742520B8A760E4BC8545B9973F12BA89A73
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	4641F417ED5B8E3E04E307C009AE8EDB	9AEAF15560CE3E609A7DB1E5C95E5E06E9409EEA	FEB3A99FC25F1A73CA67F8BF6B022742520B8A760E4BC8545B9973F12BA89A73
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000001.dbtmp	ASCII text	46295CAC801E5D4857D09837238A6394	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\CURRENT (copy)	ASCII text	46295CAC801E5D4857D09837238A6394	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\MANIFEST-000001	OpenPGP Secret Key	5AF87DFD673BA2115E2FCF5CFDB727AB	D5B5BBF396DC291274584EF71F444F420B6056F1	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240508154550Z-165.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	EB5A7253E5BE20155EEF71EDDA91818E	C05C3BC996839B6A0B871DD07EDDA447799C8D8E	4C16BD7FC5977A2E0126549419DC4E0BADC67E7E381E8623728AF89E9E99D31A
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11	DF21DA742E6ADDD6AD2279AC72A4FF8F	916E7D84BBC2CC0A4D9CC3B1584EFF8162C6F8A2	748350E10E0F24543A704ED48DE7637207B00BAD6D214A41E78C5C180908F80A
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	E1737E6AAC6BFAF7A4F9D6013CFBE855	08684F7D4F02DE8CCEF7CEA439C84524004A7466	2196C1FC68D3598B4CF5970A9155BF42A0501140DA94178AF76BBD438F3032E8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4468	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	9199EC4BEE029504C7CCF4821E125024	2FF216FF3399885FCD213A52CFF8FBEBE198DF2E	1479E57E3AF9AC766178989CA817862345C3BD515B77D8C9DAA9B268F5C31501
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	8249C6B586B31A024013C1B8839217E5	4D9BD1946B42AB03B9C7EC8246969C0D7CC54385	80764B77BE2F71D762F893A51EDE719153F00E7DC8B9AA570869331AEAA0944D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	48A3B52957704665645D7E595178C193	F6A146CB560CC11273EF98AA1CA6819E8598E21D	0A729DC3251C3EEFEA8DDCDA745EA6FA62D7D68388795EAB35B78A37060D2250
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	AA4BDC6EEA1547801805BEF13192929C	0D18931C3F332ABDED8EC5E9528BCF8FCAA1E71D	872FD52351C90F5AFA629E0486CF5B816B6BB5A46731408E772E035BE9C23822
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	895620C983B87521216ACAB8CDAE786E	87A18C29B9B495E654D31898658239F5FA8EE2A6	423E0927EEC625CCE5E3BA8D5BD181D9CB1778C7A24021073773BE69EAA0E63C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	43628D173769AA835E1D5773EB43CA77	085CBD63FD4274A43DCF6EB2B445A4AF4E1A713C	F8F3B8B5A8CF3F2B6D0B72014A8C5313FF8820929C51BDC6421C52A3FBBA2A1F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	5F9B168C184CCDBA363BE572DB5AD53A	78AB4176A33D7571EAA6C3CB24EB33435DE8A7BF	0E841DA4D052E2498AD6EAC424E4FD0D1190DF001AAAFBF2D0E962F8EEDC758F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	FDA1C9AE4A64378DE99F3A0C50E9FF25	427BD0B7F14AF30FB57187A047D228FB604100C7	648F2FD3BB66A41333AA8F08D509CF9DBEACA828183D88A65E5336C1F8F623BB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	0EB1C136AD49418835F29454215190E5	440A42F5AA8ADBF3146352BA1E15DB774B662C14	F066201FC5F4F561964AB6CE9E96EA4839FE328E93B82633DB1971C3EDD0BFD6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	9ECD8843C32784AE68B79D2156C9C3AF	B5BC75163A46FC59319A015E4D7C9A43CE8A5C0D	053BF4363584EA6F08D2FBC679D82E0E35C3D45EF66CA3527C1916774ED032CE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	49AB382B4E303338739F988F19D12D1F	73B6F0992A072F9C6BB39C1D632643B45DCFE36A	C9DD460247A4BF3DF9816C016554978619D6CC13F7C9C192FE2AF2B4EE2B4DFC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	3D02E9BC06B313231F2E06FC553E742C	E2A124C06726BB0AE975B21567C386489F175A19	9BAF72112404715D1E59E4849E73C819E9CA6CA693099FB6EBD5326ABADB817A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	EAE09597C3991E712483C5A6F47B075D	FEE0EA49537B655D61D4F3EDB8DAE599A5AE06D6	69C5C3B3AEBCAD2140C0177EDD6F13CF4250A03F2A371437A98F830DC55EDD5F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	5CA40F345EE0067C0A7E8667144E4719	49126440746D25F800755DB84C29132537C13EBD	A4F33E417C629A046F7B94268F6218D9B4910DE5BB14B3C0AA421C0312C9079B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	9B50D1EF4064DEAA6494AE9091FEA4AF	A5762A203AC081D3B34D28D3387248F7E79F278F	9679C931099E13A5DDE6196D5B21002FD4AA9F929A52EDE4C97B298B9A351D20
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	8877AFB701F0D5F2ECF3C7475F687FBA	4966A0A49114F565ED127F0CB2BE31F675EE55AA	FF2A642A4298E7CC45808717693AD561A370A6ED971ACAB9A0115A1E44510432
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	E156347952C38DA9EA1DC4FF6433AAF8	F5EC21D0804129525A3F97A5250EFB10E39FEBEA	6B643A64F9EC575B8BD428BCD873B1293FEDDADCB373B115AFA0F8F274876DAA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 23, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 23	B6CADF62FB8100F80D0F2F3F7FCB4D22	A8E632A78A1DA0EF8D000A00DD4AE8481121B0DC	7FC5401BFA0A8951E3CF24D1D5F2E0653123C1C3DED843A9CE043B0273C1750B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	5C52673702BDBD7A73B09D64FDD032D5	56BF4C88D99F6B27AAFBC3DC76F3C3A108A5D743	A6630EFF2D7C2D8FD83320AA442E3E45208DA3E9C083E59B9A960088366DECB5
C:\Users\user\AppData\Local\Temp\MSI98fe.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	1524FD56622A7B1E59CD5715B19A8EC3	5165C4E0D48E204AB4989E2C7793EF0E86908090	D0E46ACBDFB6A79D6CB241441212067A16EBE45F192836DB9EE5515345F90F75
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-05-08 17-45-48-442.log	ASCII text, with very long lines (393)	06DEAEDB81D09FD8FB5FF668D8E09CB2	28A02BCBD5975117B97A08AFB049F2C94F334726	D98DE785425112A2D7A41B16073812FA4FA4955F2D5139AE87C9A5FBC4717D64
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	24AD10F00D98C12604AFCC1E95C851C9	3171B32137062DA4DA587A7368E71FEB4C06E046	B9053247FC007716A770F866B467524FF0E4036405B35324203677D3DCE404BF
C:\Users\user\AppData\Local\Temp\acrocef_low\92897961-78b5-4473-9129-1abfe3cdff7a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 160932	5B21A6981E55EF9576D169BBED44BCDB	B3A14100B7E7C2C01D61B010A54937952D111E20	9555E661370D1DC26605DAE88BDBC1ABA68038C769BF6E354A256B1A1C4C110E
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	4C7E4DA6B8077945D04D0D1A36EDBF50	3D20885F776889B046474D46C6183A93440C8DFF	4A28B323C6B968DE6DFD016784B01B4D2411A36BC050CF54FE39257C4B6A0573

Windows Analysis Report
Report_85730cdd-1ba3-4d7c-8ecf-103ec107fc6b.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report Report_85730cdd-1ba3-4d7c-8ecf-103ec107fc6b.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
Report_85730cdd-1ba3-4d7c-8ecf-103ec107fc6b.pdf