Windows Analysis Report
Front label Dieline_V1.pdf

Overview

General Information

Sample name:	Front label Dieline_V1.pdf
Analysis ID:	1665800
MD5:	b0775894077f24081aff38b179374cef
SHA1:	cd649a2cda2f3300ec5bc13f9524fe0d4cd9a50b
SHA256:	abcc59bc19bb1bfa96fef9822a9770e945e8800d719765eacedb85a0a808094e
Infos:

Detection

Score:	2
Range:	0 - 100
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.4:49726 -> 23.55.253.31:80

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49726 -> 23.55.253.31:80
Source: global traffic	TCP traffic: 23.55.253.31:80 -> 192.168.2.4:49726
Source: global traffic	TCP traffic: 192.168.2.4:49726 -> 23.55.253.31:80
Source: global traffic	TCP traffic: 192.168.2.4:49726 -> 23.55.253.31:80
Source: global traffic	TCP traffic: 23.55.253.31:80 -> 192.168.2.4:49726
Source: global traffic	TCP traffic: 23.55.253.31:80 -> 192.168.2.4:49726
Source: global traffic	TCP traffic: 23.55.253.31:80 -> 192.168.2.4:49726
Source: global traffic	TCP traffic: 192.168.2.4:49726 -> 23.55.253.31:80
Source: global traffic	TCP traffic: 192.168.2.4:49726 -> 23.55.253.31:80

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.55.253.31 23.55.253.31

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: x1.i.lencr.org

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: Front label Dieline_V1.pdf	String found in binary or memory: http://www.extensis.com/meta/FontSense/
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: clean2.winPDF@15/47@2/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7716

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-04-15 15-13-34-653.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Front label Dieline_V1.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1608 --field-trial-handle=1568,i,14606709187914981620,5360071706544978782,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1608 --field-trial-handle=1568,i,14606709187914981620,5360071706544978782,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Front label Dieline_V1.pdf	Initial sample: PDF keyword /JS count = 0
Source: Front label Dieline_V1.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Front label Dieline_V1.pdf

Initial sample: PDF keyword stream count = 30

Source: Front label Dieline_V1.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.55.253.31	e8652.dscx.akamaiedge.net	United States		20940	AKAMAI-ASN1EU	false

Contacted Domains

Name	IP	Active
e8652.dscx.akamaiedge.net	23.55.253.31	true
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.55.37	true
x1.i.lencr.org	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://x1.i.lencr.org/	false		high

ID:	1665800
Product:	CloudBasic
Start time:	21:12:31
Start date:	15.04.2025
Sample:	Front label Dieline_V1.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	b0775894077f24081aff38b179374cef
SHA1:	cd649a2cda2f3300ec5bc13f9524fe0d4cd9a50b
SHA256:	abcc59bc19bb1bfa96fef9822a9770e945e8800d719765eacedb85a0a808094e
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	994D1F9F75339C70A33D4C03B134DCAE	718E3A897E7F7704527D098152B15167DE91725B	8E3C6D7C5C1761C7F1C3D32E50D243AD8F50D2702F39B87A065621593673879E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	994D1F9F75339C70A33D4C03B134DCAE	718E3A897E7F7704527D098152B15167DE91725B	8E3C6D7C5C1761C7F1C3D32E50D243AD8F50D2702F39B87A065621593673879E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	7CBACDEB31919FD058B02F6101AF34A4	56D8C0383626A0324D59E78A8C5CDD5E85355F8B	008F8CA2CDAC376D54EC2B6A7AC78AE169AEEB138D23984F60DCC171F05710F3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	7CBACDEB31919FD058B02F6101AF34A4	56D8C0383626A0324D59E78A8C5CDD5E85355F8B	008F8CA2CDAC376D54EC2B6A7AC78AE169AEEB138D23984F60DCC171F05710F3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\209ff05e-db7f-4302-a667-afe252d0e6ad.tmp	JSON data	EDBBF9A8B2CD088C4E498633B88D567D	379CC3F90D527179178D5CEA495F2E7624535A98	19686A3BBA153215427E0253FEFF9463B6D4D4D415BC11436EB49CB071AF0790
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	EDBBF9A8B2CD088C4E498633B88D567D	379CC3F90D527179178D5CEA495F2E7624535A98	19686A3BBA153215427E0253FEFF9463B6D4D4D415BC11436EB49CB071AF0790
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	EC10B08FF28CBCB991D5E88B9D5C248D	DF02D5EB9AD0F7C4451F623878FE9E29CB5BA3BC	E95DA5F953362B5D969F446A3A230215CC66453324A5D759C3818539BB7750B9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	834CC7E0A72E2A1C032C63270BF808B8	835043240D1DBC92AA995D1829C0DB6F7F7C92D7	A575F38B6F93FF3700042D2EC45784CCA2DF139BEFDDB5255D7DCBD11180403A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	834CC7E0A72E2A1C032C63270BF808B8	835043240D1DBC92AA995D1829C0DB6F7F7C92D7	A575F38B6F93FF3700042D2EC45784CCA2DF139BEFDDB5255D7DCBD11180403A
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250415191337Z-195.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	3AEFD4FB058451BFD2D2C48D9BC58859	C477B459BAE9302C0C1A949A3976EB04EF766130	DF6C6085DC663B893BE697FAA25D7D492B37FA184AA11C6BC207B5104EF9127E
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	02D39780F4FA7AF1E2C92DB710E54E76	0F7F3D966180DEE00AE2AF56F65126168F0E8826	73E3E08571E125F4F0CF5EDAB04AD50A4DD5446602999C1DB27E5AB8366FF18F
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	FD4E7A83274503D8C85D0013A5E6689B	5DF6C1F4DD0BB03CAFE2EA062705F0775C056C98	6B5CF8F54C00AE2A2E06E48C1508EF259B24A7D25E8AAABF6DCB97EB6A0979D6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 73305 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	83142242E97B8953C386F988AA694E4A	833ED12FC15B356136DCDD27C61A50F59C5C7D50	D72761E1A334A754CE8250E3AF7EA4BF25301040929FD88CF9E50B4A9197D755
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	4D62AC83CD3BB5F3EEB92076804BAE0F	4FBD7F05B03F54DAEB54D863AB523183B3AF06C0	AA4A3C29028733545E2A1E6E534F4EE5ADA96D5F2A794252F6AC7E9666E591C3
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	357E3A81863A5A9722CF41B42203FEAA	6371CA3EFC74FBBEF5CCD037B89036A4B6B489EC	69F1C12BDFABC7688C7B7209191350008BE35F16AD5799CAC89B80F9C78C52AE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7716	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	9CFF5082D9BEC7AF71778D14632FD2B8	D4F0A949320E982EBC6C243B2F6188C0E7B34CEB	E4D8B387A2EBD7442D71B12C6D2F76C17A32E01184F33F65EACCD8FF34E59E92
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	4733B9218D214031A2D6B97541C3A388	DEE10F4C38DBEE0B3DE11FCBE3319F896DB37E98	A0B7E8C2421011F93BA0B81ECBA86FE0DDDE36C4B8D1C64EAFA4FDE9E95AA8F7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	8F016BBCF33A3DF324B6AE705C262AA0	D795AD8731F47029D97D987A1E37318201C0287F	945C65DADEAD970CFD1DACE50FE1456E2CD9FB37E4A0A2870FA59FA106724BD2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	E5DE4BD9A61D6F0B0DB252FC7349DF0E	5A6F00E06D1D1473F148D7928508D3EBA837B057	58FB0E00E5031760EDC356AB436F0C04DE99BDBA3ED7707977E0C8599EB115C8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	1480FACDA44A5FA09A84348363C31EBB	BFEAA0B7C49A6E6F0207ABAE101DFB387A30733D	76FC69F3ABCF0AE9887DE359D7478AFFE9EA97C1423A6700C658036BF8C3F9E7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	C580B847DEF5B0477ABEF1060390E022	0FA92AD09DE7ECB5CFC031B5E25998726FFF93DB	A17FB9014984A73ECAFCC07BE20388B8C05505C606E96BC1AC8E6F1F494E1335
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	F3949FDAC0432DF3551EE2B8F2A6B858	7CF2FA4542500B9CA121E8174E8C1F0A54C3D2E3	CDDD9654B08C0B8E138E1935867D7908B355E5CB37D8EBC457B1DC6050DFD702
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	12A53A7F5282CA9B19D9EBF85F2E5042	8473F0EFD47364920DFF0AE07B5F70E19339D614	CD3E545EB2A3EB0941021494EE42EADF4A6DFAC00B458EA3BC6AE26A8C4DB20F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	8D92585F90FB68EE118D049B4A2A0CF2	453A1971818286FA86E7DF3A5D051622F564935B	17CF209BE76BE1AA9E11F9AC015F6C466FFC51EF849F54260E9A070DA10A1907
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	3C009E00DF5871FFAF3F8928678D1A0C	FE0A5220EAAD3418FF6F4B5A2B07FDE64E83DBB4	D447283C9023349C8990D707F749F2C134385CEBC76ABFA941C68F80BABE857D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	CE1D02164AED96A87EE8E2F2C1809150	233E66681E85385423F3652A8965A97A59531B72	2B8B66367F94CA3A00F9CF902296EAD819DD6A790FA05B268DE6B4B3D15BB216
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	C30651B7CCF08BE11DCD4B59A1A3DAD0	C51317FC4AEC77E82D8D047F27989A11083CB329	CB5D21188F547AC091FC547BBFEFA376FC1270DAC8213D2FC0F301575AE111CA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	41395C30BE49A0FBCA3442D3B7BCDFE2	3251A6E4BFAA0E0EA6BF221BF31D7DFF1C6B09E3	A073C266B480576E20BE71FBEFC12F7F5A23F2DA6419F6C1A8F7F5567FB2E9D7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	A3E59CB3E1CC32897A6A3E0BA933376E	F17D248DE283006251496D408D56DE22E7546320	EB01A14BDEF745D6EE3A6C4DA69E1FCE1AEE05C74955505210F20AA7CE9CCE93
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	50AA9A2B7F9D194AC85A6B0BEAF042BF	6E659BF9F18B3CA83377A9D240488699CF4BAF8D	37F019ADA25A82EC348879618A28EBF13E3798CB04990EE952FEF66F91721657
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	2685CC4024B358D42648E3EEA0C946A7	0E2A5D200C15E662BB7069573218B2163EAA9B92	E26718B2A1A58B66EB357ED36B137567D32011221CA0C706F59D2DCDD95C42F1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	AE4B6C32017C7036E908ED86740781B8	140C5A8FB41F653B1EFF8919C3E7994D40C20ADC	D40020BAA973196E12BDD2209685CD2F03505BF2857735BEFF4A05C960706C7C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	F1A28384F0A4308E5BE0D7590ED5F2FE	45BF4CAA23DA15C8A553A12CFCA9BB59ECCEBA1B	2F84D5BBDAF1917D0B6354A2E928FC3A7D338834AC4F63C44936BD43EEA8CE7A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	46D40EDB158B6E044E2F74D986E14BEE	0A01863E093F35E6A9EA21F3BC77227150C99F5F	B2301CE0B96B5AF8DA892F2CB718FAC6ADFC6172DB3C9E957F5ED26311D8654C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	A30ACE1C1CAFE3659B1F16215304CE49	23146251F8BE8DCA218EFB942C993E20C9581CD8	4B0B5A7575C8BC44DC8E2FE794D821D87ABF9F2FFD4363421E21558B3A589824
C:\Users\user\AppData\Local\Temp\MSIa86df.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	F83C8982D1127BFFFD76E83733D48E32	4A81B25467264EE7ED354FFF63D2F792A6A1612E	C5A6002767F5CF1827F56A1163CB4D06E0CEA13EE5A559AC05515477FB905ED9
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-04-15 15-13-34-653.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	EF1121FBC105D84F27FA185F550964CF	1075ED98028228E047282150422FFED5390A37E5	7D3911F0A78BEBE9BE839A813629DD13371E1FAE228D859F1A96C80EACD789A5
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	0B90A4634FD661E3DA2B246C2522232E	68BEE650B4A4F0E719B6E49AA01A26F5B3657E88	0630F8CAEC6C952733DE334A4898B358326DF32F0939F8D49678A0E4B6CC99E4
C:\Users\user\AppData\Local\Temp\acrocef_low\07d39cbe-a3a4-4e8f-b187-4409a38da1f0.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360	E78E4D1CA18BE28748F65C3A192DAFB2	78AD6025CB470EFB9ECA8FF1ED41F617372D1F9F	F4B25F5C5BE48E151080D9CC24C8A4662CBB591A6B32037DB8D7ADE1828D8849
C:\Users\user\AppData\Local\Temp\acrocef_low\18dd79a8-4260-4ad9-8469-35cde953d5a6.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\40255006-9113-46e2-9167-b00bff394166.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	41034A6B023B6BB9C723DA146E190954	22C95166FF8A1C4D2AAC25B75D804CEBAAA6ACF2	52BB8B0CA62248721986D650004C11ACCB0C988B6FBA645D9B4E3557CA87A15D
C:\Users\user\AppData\Local\Temp\acrocef_low\ec04f157-f499-43e9-bef9-f5e641ac5ed9.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE

Windows Analysis Report
Front label Dieline_V1.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report Front label Dieline_V1.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report
Front label Dieline_V1.pdf