Windows Analysis Report
American-Equity 2025 Handbookupdate.pdf

Overview

General Information

Sample name:	American-Equity 2025 Handbookupdate.pdf
Analysis ID:	1665811
MD5:	77c8a45bd2d81ed537b10544650b80de
SHA1:	79e8059eec24e15e750262c129892b9f70743ffe
SHA256:	6e7efa3c669f8677131370157cee200b9a4bb9cf8e091d3693795f9da0736c1f
Infos:

Detection

Score:	2
Range:	0 - 100
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.6:49691 -> 23.55.253.31:80

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.6:49691 -> 23.55.253.31:80
Source: global traffic	TCP traffic: 23.55.253.31:80 -> 192.168.2.6:49691
Source: global traffic	TCP traffic: 192.168.2.6:49691 -> 23.55.253.31:80
Source: global traffic	TCP traffic: 192.168.2.6:49691 -> 23.55.253.31:80
Source: global traffic	TCP traffic: 23.55.253.31:80 -> 192.168.2.6:49691
Source: global traffic	TCP traffic: 23.55.253.31:80 -> 192.168.2.6:49691
Source: global traffic	TCP traffic: 23.55.253.31:80 -> 192.168.2.6:49691
Source: global traffic	TCP traffic: 192.168.2.6:49691 -> 23.55.253.31:80
Source: global traffic	TCP traffic: 192.168.2.6:49691 -> 23.55.253.31:80

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.55.253.31 23.55.253.31

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: x1.i.lencr.org

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.5.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.5.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: clean2.winPDF@15/48@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-04-15 15-26-49-883.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\American-Equity 2025 Handbookupdate.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1608 --field-trial-handle=1588,i,1752010807920482252,9347575554402704444,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1608 --field-trial-handle=1588,i,1752010807920482252,9347575554402704444,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: American-Equity 2025 Handbookupdate.pdf	Initial sample: PDF keyword /JS count = 0
Source: American-Equity 2025 Handbookupdate.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A91f0qipr_1g8tozq_2v8.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A91f0qipr_1g8tozq_2v8.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: American-Equity 2025 Handbookupdate.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: American-Equity 2025 Handbookupdate.pdf

Initial sample: PDF keyword obj count = 176

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.55.253.31	e8652.dscx.akamaiedge.net	United States		20940	AKAMAI-ASN1EU	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.214.172	true
e8652.dscx.akamaiedge.net	23.55.253.31	true
x1.i.lencr.org	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://x1.i.lencr.org/	false		high

ID:	1665811
Product:	CloudBasic
Start time:	21:25:47
Start date:	15.04.2025
Sample:	American-Equity 2025 Handbookupdate.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	77c8a45bd2d81ed537b10544650b80de
SHA1:	79e8059eec24e15e750262c129892b9f70743ffe
SHA256:	6e7efa3c669f8677131370157cee200b9a4bb9cf8e091d3693795f9da0736c1f
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	286A38A83DDBC924BAC2D48A96F69DCA	3E854D818216DC25DC3316C89E0A5C221975AECA	9CB8D6A02D0DA529050F1CF2F99544640F372B7AEB0F361306E083C26F7098FB
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	286A38A83DDBC924BAC2D48A96F69DCA	3E854D818216DC25DC3316C89E0A5C221975AECA	9CB8D6A02D0DA529050F1CF2F99544640F372B7AEB0F361306E083C26F7098FB
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	132F575D4800A1452C438F9FDBFB60D0	96624A4023B587AB2A8A40BC3BA068BCBE003AEF	4767C40679D1F61A4F66455B32EEDD202A08042764BC7786C915B4341139D84C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	132F575D4800A1452C438F9FDBFB60D0	96624A4023B587AB2A8A40BC3BA068BCBE003AEF	4767C40679D1F61A4F66455B32EEDD202A08042764BC7786C915B4341139D84C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\35a5fc1f-d47e-4903-b5dc-a5477be84e4f.tmp	JSON data	33D5A043F5B0687BC2DDA62B391A08D9	08C66F8D0EEEA27D106340688334D2ED7E41456A	5EF38589EAC7EE609EAB565A6CBED9B8459CCBA5918C51898B41B7FAF6D09EB4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	33D5A043F5B0687BC2DDA62B391A08D9	08C66F8D0EEEA27D106340688334D2ED7E41456A	5EF38589EAC7EE609EAB565A6CBED9B8459CCBA5918C51898B41B7FAF6D09EB4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	23ADB60E17DED3AF0F0885F55976860D	388A0DC83D294F38D1D3FCD622BB260F3B411CBC	AE082235DE5E3001E507FEDE6A632DE38410DA071D231CE6CFD2BC0255BFBED1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	83CF7AFD4DC16B532B14B0086EC80A8A	EF1E023A744C98BC8EB8F01D8CE65CDEB28C901F	850AAACD6830EF3AD88F22D51F4ECB180FBC6F7EBE2ED5765AC1C84169E6FC9A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	83CF7AFD4DC16B532B14B0086EC80A8A	EF1E023A744C98BC8EB8F01D8CE65CDEB28C901F	850AAACD6830EF3AD88F22D51F4ECB180FBC6F7EBE2ED5765AC1C84169E6FC9A
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250415192651Z-173.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	55C0D4C5C815F3D3FE0903DF5FA20358	8D70885DBE8AD293135250F3E237D37664295ABF	FC5183AF520428CFAC39C049CEA3F48CCB429A593CB4495609EDB8B8A51D469F
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11	A4AEBF306F7D429BA3E7EE098E9B1808	78D2860BEF490845E88FB088488C7960B027B476	880ABD2CAE30401A6D22B1CEBF4E2862F7BAB3204B1F03F89368D04BCCF90D3B
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	0F21EC0DEEFB27480F8444E4D2DE26D2	51706C4CF1D1ED6906FA3702780B6B147CAA8118	74919E33249A77C33465958C2F5D47F16AA3828B9C77579410A4C3E402FA7B01
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 73305 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	83142242E97B8953C386F988AA694E4A	833ED12FC15B356136DCDD27C61A50F59C5C7D50	D72761E1A334A754CE8250E3AF7EA4BF25301040929FD88CF9E50B4A9197D755
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	BF2BC9C6A896B2EDCC8E86FC27759F38	1527B43857DCDDF1D0806FFF5D5A306DCA40D3BB	F162E57B1FA2CEA3F5F454F296AA9CE8FE6E09A87EB0FAE3005F2C264AEE2A0F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	41B0644ED15B3EF8FED242E33B84BCCE	F1AE81393B23686EB55019B5FA86DDD0CF5B87A2	0141CE903A33A1A084C5B485701B9BAC1B96BC7E79C36CD9E22A49713ACDBFFB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3716	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	265E3E1166312A864FB63291EA661C6A	80DFF3187FF929596EB22E1DB9021BAD6F97178C	C13E08B1887A4E44DC39609D7234E8D732A6BC11313B55D6F4ECFB060CD87728
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	E29B7CD869FC48AB61DC89289013A729	58187F7F3C1A604684018013529E5879E63B73E4	6F3B75BD549670C4A2C9F5D1ED53F8AA62E120B8DB587EDF614C090E53F63F40
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	6A2B413FCD63F45E8CD66208340C9F66	E8BA0C0145D7AF8360CA1DD24BBF12859CCADADA	1FD0381A62A003707B26D8C5436422D57D4DEEEB52149B123EA73C293F2C5306
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	8BFB356158DA017320458FB6A79B6A5B	5CEED93D127A5A89EC28D4340C8F31CC96174569	78B8BCE8EFB8828234EFCB74A8524DB7942BA4C036030A333CEB9E722DD1CB95
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	C6A0C145494A457DB83B79C6A01019C9	B9C3CEC33F6E76E8AF382F56840A55EFFCE1E752	683817D8C2E1073EA6B1E4D83E6C98873C623B8E5A65C8D30B95752A0489AD46
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	9E3447258D9078788B69EDB55BD75A89	5A9597AE70C48E22A3D7BA53FBE397EAC3FF23F8	2D8E7A895397EA2103D940582FE08D547A45A70380132F3DC94F29ABB698A372
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	D183D137F27B5BAC9FCF9FFE8E589C61	DEB5118907C0B304584AC304DB9364A123A07FE0	20D09C366FAC89581AB6372500B0704D482EE9A5075269EA6B9D52278DA2A452
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	9E5336829B51EBBE8880B49C5E63EB40	17F187C1AF6B22CB36FC63453524616985233B90	EF0BD0BEB837074D64691163404785A2EA5020FF73F792E027939A1160EB3491
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	0C1181FEAEFEEBDCF6805C2484FD9AE9	898E20C2CB16CE3692E98230DD99065B772DDB02	541F53A642F3266539FBC45B6997373256B42C10613AD4950B90DB9F30831B42
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	21ECCBCCB9EB12C5865CAF6F6BA17D05	844EA7BCDF24FD17BE69BC04B61EA47A00589E05	95605A34A903DF61517382C047ADE367705983791F13DFB872E7569527FCFAED
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	8DB89161F519CFCF918C1837B87EAD81	0681353D34D87612E6F64CEC3EA5111C2B36FFF4	DA13436BF073F2995FCBA707C0F1F68A6BFECE3CB2F4F3E6C707835517DF610E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	A39959E096213A5CE22BB425D458534E	EFD5B785B608A83C92B1253012E930FB6622FB9D	C682767101749D0B2FA61DA97E07C6E556967B4D788515BB72B863CCE3A55120
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	8E4A799C6900AEF28BA23552A3AFCC1D	6BC75471CA6D9C7FB227A9F86CC3D5A438A5D19B	D37AB7B4004DD97346E94D2E7E7084E98EBC59BBFAC6ECAD89525766EC914963
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	24CA86ADC7A3F49935AB6ADDDE07865F	68E9CAC6A855BAE63DB1DFECAD79F06DB8D7EC28	CD472B7ADFC39922503A5F22C24AF9FE9F0C31C82A5E381BBBC77F1D5A03CD1F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	ECA81796B761F2C6EDB345F61DDBAD25	4E6AC4195E6D6EB0498A67611C853A764EFAF293	13286966D3A551F9D26C242A97B452924F35909E93D0799ADB29D605DD975D96
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	B272F536DC54052157CFDD470E42A3C2	D27B497B37580187194CB1ECA0F6310851A59854	5249541582D3A4E215D7C0A702878C711D1ED203C1CBDDD666FC8BC0260CFF5C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	94103D72D03398F5686172D9BE51D3FF	2E9CBB361213357EE95A3B61EFFFF126F3FC0386	3ED517D05FDBDB30B376BEDFC4804CC8A549D5E053B0D707BE607E3DF3B04626
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	3365E30BD05CC2CB73B6DA3AA6C7C9EB	2D7478269C94F979CCAB02AF0CEFBFA19A20ED54	63E67C5D81F3847CFC07EE4E0DBACA074EDCAE49F53A802DDE359842C03E94AE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24	237A2ED69FFCF3E498A5E94A0829AFF1	002AAB8FFA93A0812EC818C450DDB35F48572F49	0C86C3F8FABADA89D8CB94EF41A1F766BB4FD54F64ECC93179428B67C2ED90D6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	74C31C887CFD817A29E4AE3F7D256D63	48626CFCC59DEF9657F1E8842784EB051039478F	B02D171AFEA92F3F72FC9482243532BD640CC498799156D0D9B10CCD7493DA68
C:\Users\user\AppData\Local\Temp\MSId698e.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	913A079212910C631B787B96387BB519	A497729A164B9544E3191389B14F4E90FA39FDB8	6AE51B2046C18B950D07C93198BFAB320DC51F32342C35195035447315FC1D68
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91f0qipr_1g8tozq_2v8.tmp	PDF document, version 1.6, 0 pages	309CCDABE30649DF9D33AFB9CF722897	71AFA190198C9F0490F1909B4AB237E0AE296F3C	E35F1E5E6603053697265BF3A92F96B0A02A8B6D02E4A424267FDD0773944B62
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-04-15 15-26-49-883.log	ASCII text, with very long lines (393)	128A51060103D95314048C2F32A15C66	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	245997FEB5694334D16BB60E515F948A	445CA7D0E7E649A75D44506E20F31978CB31322E	722A341ECF05B41B4A9ABC64612E655891D02E21AC1D8D3082048EBB1F09AAA2
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	A7D9103C1D5156AD1D3DDD226D10327A	AD7865ED85F70C899F88B87C9C0F5A66F9F101A3	36CED5EC050C1AAE8A85BDFE703B99A4D5908A15A166D0B921F08876C025EB4A
C:\Users\user\AppData\Local\Temp\acrocef_low\444a34e8-f3f9-4646-8bf2-fb76927861eb.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\63a7abf1-67d9-4f39-bc42-52e8b8f7f52e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360	5B97D1E5AC0AACF309B684B011BDCCD6	F3853B1822E143022463AF1369244DC20ED4F959	C507A47EDBFEC4064962822516D24C81B8ED82B610183360D2E11C03323E3C84
C:\Users\user\AppData\Local\Temp\acrocef_low\9b7a16d9-86bd-4409-ba7d-628ff12948fb.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\dbfc4b67-d289-408a-9256-00b03268f9e0.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	7867DAFF192926A49EB7516D226D452F	BD0B185B12DB865CEA23060A9789C6B2D814B62E	C7586BA81615BBAA63DA0D81CE18C0D087D1237500C99C35239A4D3CAEED2934

Windows Analysis Report
American-Equity 2025 Handbookupdate.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report American-Equity 2025 Handbookupdate.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report
American-Equity 2025 Handbookupdate.pdf