Windows Analysis Report
Rear label Dieline 2_V1.pdf

Overview

General Information

Sample name:	Rear label Dieline 2_V1.pdf
Analysis ID:	1665809
MD5:	8606cfe426a2041891d0164a466d4ad7
SHA1:	4c4eb447163fa4579920e0ca40cc2289b022399c
SHA256:	c20e9c23b81394e33067be0a6c424d7235bd1ee7232292dc2e4b87158b88b4af
Infos:

Detection

Score:	2
Range:	0 - 100
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.4:49720 -> 23.55.253.31:80

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49720 -> 23.55.253.31:80
Source: global traffic	TCP traffic: 23.55.253.31:80 -> 192.168.2.4:49720
Source: global traffic	TCP traffic: 192.168.2.4:49720 -> 23.55.253.31:80
Source: global traffic	TCP traffic: 192.168.2.4:49720 -> 23.55.253.31:80
Source: global traffic	TCP traffic: 23.55.253.31:80 -> 192.168.2.4:49720
Source: global traffic	TCP traffic: 23.55.253.31:80 -> 192.168.2.4:49720
Source: global traffic	TCP traffic: 23.55.253.31:80 -> 192.168.2.4:49720
Source: global traffic	TCP traffic: 192.168.2.4:49720 -> 23.55.253.31:80
Source: global traffic	TCP traffic: 192.168.2.4:49720 -> 23.55.253.31:80

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.55.253.31 23.55.253.31

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: x1.i.lencr.org

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: Rear label Dieline 2_V1.pdf	String found in binary or memory: http://www.extensis.com/meta/FontSense/
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: clean2.winPDF@15/47@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1236

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-04-15 15-24-52-700.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Rear label Dieline 2_V1.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2232 --field-trial-handle=1568,i,6353204785273642511,6675323965327543815,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2232 --field-trial-handle=1568,i,6353204785273642511,6675323965327543815,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Rear label Dieline 2_V1.pdf	Initial sample: PDF keyword /JS count = 0
Source: Rear label Dieline 2_V1.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Rear label Dieline 2_V1.pdf

Initial sample: PDF keyword stream count = 28

Source: Rear label Dieline 2_V1.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.55.253.31	e8652.dscx.akamaiedge.net	United States		20940	AKAMAI-ASN1EU	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.210.172	true
e8652.dscx.akamaiedge.net	23.55.253.31	true
x1.i.lencr.org	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://x1.i.lencr.org/	false		high

ID:	1665809
Product:	CloudBasic
Start time:	21:23:50
Start date:	15.04.2025
Sample:	Rear label Dieline 2_V1.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	8606cfe426a2041891d0164a466d4ad7
SHA1:	4c4eb447163fa4579920e0ca40cc2289b022399c
SHA256:	c20e9c23b81394e33067be0a6c424d7235bd1ee7232292dc2e4b87158b88b4af
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	1DFDCDDF23E491C805FB6BDC5E2E32EC	2D295406E4ABD4E7EEDC1A429C459AE60A59D27B	57CCA20BB7396A543BDEC7B7B47512735A6AC048840A63D21CBBF8E70686280F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	1DFDCDDF23E491C805FB6BDC5E2E32EC	2D295406E4ABD4E7EEDC1A429C459AE60A59D27B	57CCA20BB7396A543BDEC7B7B47512735A6AC048840A63D21CBBF8E70686280F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	FA30DF061EDDC720980CE0DD63EF645E	EC7F091E90BF3E4BC6EE4E260205AF204D6FD5F1	8A2B6F40DD79683092353B935C9E3E81C50742A1B875207314530D338C2487C3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	FA30DF061EDDC720980CE0DD63EF645E	EC7F091E90BF3E4BC6EE4E260205AF204D6FD5F1	8A2B6F40DD79683092353B935C9E3E81C50742A1B875207314530D338C2487C3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	A0C584A2D0382D1D699CAC93EBA9E774	F9D2ECC0F1D41BA4AC124729D979A5E91970C1B9	CD9E4C4A65D94DA1732A7CBB8505A7CE8AB9E686D223A120110A5944533243ED
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d7b0a116-cfbf-4db7-9fc4-2b872e7403c6.tmp	JSON data	A0C584A2D0382D1D699CAC93EBA9E774	F9D2ECC0F1D41BA4AC124729D979A5E91970C1B9	CD9E4C4A65D94DA1732A7CBB8505A7CE8AB9E686D223A120110A5944533243ED
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	56B830961DF7ADFA5E5BB1FFBC441D39	CDDB0ECC8D2FD6C0DFF25119782AE758A7768434	82E30FEEB71C668BC209D720C2F93F60C97046A4E3806964A982F4102118A444
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	A8D9CE024F9EB1C2CC0CE000738DF071	1A5A7C343186444DE8280BB012B958A17C1AD96C	63FEA926BA4B5BFD28795F59E04E655CD7BFA36243DAC49EF25D2A341CA96890
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	A8D9CE024F9EB1C2CC0CE000738DF071	1A5A7C343186444DE8280BB012B958A17C1AD96C	63FEA926BA4B5BFD28795F59E04E655CD7BFA36243DAC49EF25D2A341CA96890
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250415192455Z-201.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	06F30F5F6B2171B75FC1BCBBCE8F2E4C	C57BE821C0CBAC8E1050FF8C4E80BE2007EDFC6B	4BBD8C21227E5EE88CF6694F3B0C906CFC45B9B9A263158B8E5DF78D24C8834A
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	1E880482DD53CA0D0FC5C48D2B5B87AB	E4D36F2ADD93AA9A7E9DE589B2FFA2587204F13E	5461600A44F4D053429CBEF8A1D8055361C0DDE5AC30B1DCC5A23BE6B9C7DC5C
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	0F98336D257FFA5F42B9C455B69F21CD	126E6BC192D06707C2131C3F75340E916155E09A	62C3830289F34FCFAC540F9DB853CD45DFA5214164D5BE9F388A698582FA70DB
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 73305 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	83142242E97B8953C386F988AA694E4A	833ED12FC15B356136DCDD27C61A50F59C5C7D50	D72761E1A334A754CE8250E3AF7EA4BF25301040929FD88CF9E50B4A9197D755
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	20C907CBAC6A71BDF9079C873C4152A8	30855BED2830EEDC387A4EC0A56BF9347113E1E3	F6A5F31DD37F368D3423CAD130FFDE34E7936BB6ABEB7AD97E7F45AFE336369F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	BD89F0826870595700234A27C8F0340E	781232745F7B4422CE63B73A3E3FAA691A112727	48B0E645934B8B017DD2648861BE86B74065A8711ED825F01719FA03400BCD50
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1236	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	9CFF5082D9BEC7AF71778D14632FD2B8	D4F0A949320E982EBC6C243B2F6188C0E7B34CEB	E4D8B387A2EBD7442D71B12C6D2F76C17A32E01184F33F65EACCD8FF34E59E92
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	237D4DC6676A70E9D8F8656E3ACB7C2D	F438FD812B91C07E93B9B46CABBCE729101C60BC	A15AF040100ABF44A0A17F840E9BF0185E40EC10888E1E037108E44AF3CCA205
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	9067646DA53EA175A239CDD5AEC3818C	DFBA414B9D3478CDFA502B934B0B87D5C47F6EE1	3DFFAAE1A0743FDDD4CA9344006D600A57EF267425DCCF0A4110FAC50A8F1F6F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	E09BE5B39638D1E05E91D434A08818DF	F44EC4D712C741BCD6561EDA0F018EF17069E2D1	5D70731067732EB421F6B3342CBD40BF7E0F47656E9BE08A54E78AD9306ECD43
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	4FEF44AB9694D52C863607519BAD178E	49205DD4A6779C9CDB28F9570A8D4179C23B0633	0F7C971CD11BA6D2154D0593250BF280C7684A24C6FB0575D1FEB1EB87B5F1B5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	0536EE2C4E65B372BC7BD22ACB6AB028	D68B09D615EF678E433DBF8E633CE6BB1E036616	8D867A0FEA1921F9A62ECEE6C5A19A2CE18A59E991DD849E117E999260B08E6A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	ECA895F0D1D3CEFF4BD75F1355CF895E	AB033BF97359EBB539CCAF7BEDC0FC05D6197C80	73281E82BA16EC75EED8A6428971BCA6E0340249F5FF4030591224005AD84944
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	DEC9925137827636CAF00C799F84AA85	19F31F198034C3081E6E51FAD4FD75F84634A4C2	7115A79CB3BCC9792AE46F349AB17FFD6549B3DAAB2A77F4C705A3CF9C9B01CA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	A6DBED3CECC28E8842CCEA0109A15EA9	B439101FC02A4BF1E0FECF19285276AC646BCC7F	0488C05963F6B07EF5A6A5741251260D97B2EC2487FA9F2A3BDD0830BC646A49
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	506D8CE3F51EF96A4DD3072E0DB3774A	E3F0FCC0E37B4F89CD99BE15C034EEBB7657185E	9E083A18B506ACC5FC2BA95C761557104FE9B11007C3075B2F77259DF9020C8B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	AA5E65F95B31D7693388F05D90728D14	A3B1C9BA160EB68E276B5B14F5FB10C99C3E16A5	5177CB8E5129A7EF62D513A806303E63C49357D5A5A5C377DBAB267B7A9B74D2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	83E3A363E894DA4EEB56947D3AD90D95	CD6FE41CE2CF8FEDD54AF7448ED40F9018A54D0C	B91E83A3A8CD9BBE9163AF145651F13BDCF7B6809C59FC61E60A88FD0100EC18
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	3486B704F2B382635BDFDA64B38277B2	DE5E025C7BCF5FD09233737F1B39AE52C3890570	2D532AFDA0996C4A43957AD591ADDCC3AD58B03A3D86B3FBC6F0D525A7B21D7D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	9CE78DE2F12A9CE5D1591860D1FCCABD	77108D53A42709D56A5AECDDA2AFBDC2235F4957	B55D30A2935B1628AEFF7DA52F09995E20D3066841C85B487929B3A30D37EDAA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	380873CF644B42AAE7D92A128AF5D695	E30DD4E6A5D2684B4D770C50D7027B59F92259F4	D9142A625D9B9B528FF286684F7A86CF85A2A5FB04BBF43E0D093ACA1D2BC83D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	4EE956B7F4C69A9ECED2BCD28BBC3C0B	0BE4E32ACDA7AB63C5F84BCC5E546B58FC726355	9AC88E4D4D4AAD311AC486740AF51CB4C0FFBD9262ED4D11FD87110395AA1CCF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	917C53ED987DB216CFB27AA7F828A7B1	877453C0D922E4488AD6D4D9B3F54400D63DB9A0	3D7B51B6F3251DBBE950CC75485232AA2E4EFD380AEE357F86B2370BE81426DA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	A6DE2E3A3F6421F34CFBB0E8AC55C919	8C30D36943256CA1EA16CAC736F6F214B8F26CD1	3B64CEEC5311860B326B9B7588988C440E1F3DE8DECE9D66D52C2AD2568F3329
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	B297DC4425F1A3BE5B19B353E39465F9	5351A2473DF77E0EEF1F67855E43BB5A1CA49D9E	951198369C6151CA3D78B1B468F3F8EF9C3CEEAB540489EE6093F3ADA8BF406F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	420142EA1F05198F36F8DEE3DB16088E	EFA839F42E74F10D7FAF61D2D6BDD736658FD25B	BED38C282004361372521FDCADA2EEC00CE3B31B2712A1D4ACB5951FCA8745D4
C:\Users\user\AppData\Local\Temp\MSI92f1f.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	31FE68F97377837D6A900CC7DCD4E3DD	BDE7672FDC61B25AFDE8DB61A360BBAE23726A2A	8B3A3B1533557F1DFEBC184AEA136870A7430810E35B80C0677EB9F2C5FA1D05
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-04-15 15-24-52-700.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (392), with CRLF line terminators	AE6189CA888E9C5E5EE7092F94CB7896	7A69973BF351B1B1209134FB3B3EC8B84909D688	A9EF1EFFBAE510FD735A0E0A5F1A2BAEB9166E7E249FF55DA37D81B3C2DC89D4
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	5B7E271A8219E1FB612AC08473F21791	4D9488EBD036BEB27D92D5E07F6CBD5451FD2EF4	C3550FD85A9FB4B22F37D4753A096F4255627DDE8ACF54361BFED77F690EF6EB
C:\Users\user\AppData\Local\Temp\acrocef_low\05a0568b-6b3d-4949-9848-4ff4d892853d.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	E726B36897E958CA051FEA78BCF29204	1123642FB646996FEB2FD7DDCD8FE4F3C50A5949	CD35E76A516E66EE1994048C33D954CA73B4EC4542D15309F7923193B8ED1C39
C:\Users\user\AppData\Local\Temp\acrocef_low\1a65bf5f-a824-405b-8e08-fce1c5a10179.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\41fe0c5a-398e-4d04-8fbb-ad88abfa25f3.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\5f4fdbbd-d6af-4585-9f53-fa4b376982fa.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1111944	FA6978A9EA472E8ACFF72AFE8CC7CC81	D58155446B67ACF4DA331A977B8EC7BA105C2C4F	3D0DF2B14FC632520705424D2DA394922D3EDD8C977950656B736352CD5A37E2

Windows Analysis Report
Rear label Dieline 2_V1.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report Rear label Dieline 2_V1.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report
Rear label Dieline 2_V1.pdf