Windows Analysis Report
1741A0218-101424-Travelers-10142024.pdf

Overview

General Information

Sample name:	1741A0218-101424-Travelers-10142024.pdf
Analysis ID:	1541278
MD5:	27cd98ccdd6d510d09efda0b46944253
SHA1:	b40fc2ed52c4240e10ba98c9363106d7844b9bb2
SHA256:	a61832c8e180ad5beef062065840b0991af8eca459723831272eba65315f1a7b
Infos:

Detection

Score:	20
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

AI detected landing page (webpage, office document or email)

Potential document exploit detected (performs DNS queries)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: sus20.winPDF@14/47@1/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6580

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-24 10-48-06-926.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\1741A0218-101424-Travelers-10142024.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2176 --field-trial-handle=1740,i,14463368390117274462,13698455103500201006,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2176 --field-trial-handle=1740,i,14463368390117274462,13698455103500201006,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 1741A0218-101424-Travelers-10142024.pdf	Initial sample: PDF keyword /JS count = 0
Source: 1741A0218-101424-Travelers-10142024.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: 1741A0218-101424-Travelers-10142024.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: PDF document

LLM: PDF document contains QR code

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1541278
Product:	CloudBasic
Start time:	16:47:07
Start date:	24.10.2024
Sample:	1741A0218-101424-Travelers-10142024.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	27cd98ccdd6d510d09efda0b46944253
SHA1:	b40fc2ed52c4240e10ba98c9363106d7844b9bb2
SHA256:	a61832c8e180ad5beef062065840b0991af8eca459723831272eba65315f1a7b
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	568EDA75C119CD6F9559474958E1C9C4	A9CA9452D66668EE714C5AFFF7D3EED58929F58D	C3A4FBB50C8B8E495C19A4173FE077C6A3F4CFD5B6A734AEF2C9D623535EE833
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	568EDA75C119CD6F9559474958E1C9C4	A9CA9452D66668EE714C5AFFF7D3EED58929F58D	C3A4FBB50C8B8E495C19A4173FE077C6A3F4CFD5B6A734AEF2C9D623535EE833
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	F351D37DAD4DC1D934D41CF9BA05BA36	342C1DE39006930A90478D6D70A3B5E2BE15FD0A	00BD413507038D3AAC687A6D9E79110F46DD5CF5202964C64E1EC2F118A28D94
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	F351D37DAD4DC1D934D41CF9BA05BA36	342C1DE39006930A90478D6D70A3B5E2BE15FD0A	00BD413507038D3AAC687A6D9E79110F46DD5CF5202964C64E1EC2F118A28D94
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	4E9F37F7E0EFC556D9348BC0710A3F5D	BBF1F812C8550ADB33D3E6C1D038C1613C808AE7	7B4B108DBABA60256A25E5B1CE0EA0887541432B15C72B7609620E8F05AA40EF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b3672a8e-00f0-499b-b1c3-4ad577217a0f.tmp	JSON data	4E9F37F7E0EFC556D9348BC0710A3F5D	BBF1F812C8550ADB33D3E6C1D038C1613C808AE7	7B4B108DBABA60256A25E5B1CE0EA0887541432B15C72B7609620E8F05AA40EF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	51555FFF0142E3B1E202FC4FDCFDC3B2	3BB5D12C9DA558E590F22C2B0C47A063867860CB	0C32BE10791F6BF8178D6E61D6C3F58B9CABBE1D1989CA48355A716EF56ECD1D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	CA1A20E7644E0085B186F4A5763CA533	92F8FD5648B2B6733089406FF0E79C40F44812EB	450B82AF2C29C05BD3EAA7D70DA4C95647827C72CF220498720609B3ABA7B403
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	CA1A20E7644E0085B186F4A5763CA533	92F8FD5648B2B6733089406FF0E79C40F44812EB	450B82AF2C29C05BD3EAA7D70DA4C95647827C72CF220498720609B3ABA7B403
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241024144808Z-158.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	8B80716633B88A28960038591E181E6B	A82DBB2AA944F98DFC71512C14E8EE8B5074A310	F45C7C133AFBC549C2A7B540C125A06C6BAF6076A63FE59B8133DE39DBFA6993
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	BB77FB76F2B66469759C7CFB03E18670	53FAA229025EE72FAD59CDE48BB423EBFCF81CBD	B00BE0D2375A0693B5575042653B200146C89D404001F41960B805DCAE2E12A7
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	2716EF721DA9C47379D24AB89CA46352	985C77CF95D64066E048CCEB1FF5F2FE46B755E0	2317ADD73B1F266856D18CBCA64927DFAB54E2D7E12123694618674189BEBCA6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	90814EE22DADF4D21752A97A7059DB4D	BA0A27073EC91D7E137063115BC3853BCD1739E2	1EF5F99DD29237625854EA1BB75DC7F8E138626D982B335F63FC81E871188F6B
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	6DFE4FEA06D70EE2BFA8F90D0660A1EC	6F93DCB238AB83AC76FCB614A3D966A6F27B1D67	710F43079E4200A7D5EC531FDF999AC7C5AEF2007F5804DAEF621EA495B81755
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6580	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	D252132AA457BC635FFA9254392CA5F5	F263C4554AF1FCC7BF74EE05727172CA6FB3D042	4F65B761D88005F56F68A037AF931EBEE83477A42E051C73FCE9C11059B7CC6E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	5BA84BF9E52E17159D402008D685D035	78C266D83C91B436609625AEBA6C0F97D42690CA	55FF0238EC106A9CE791BE5E13F3CDE6B94F43AD5DC18DCE3FAD4879B91FEE97
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	865B2AF236C862D71C9F85C40B488B0A	778B261238C82F294790BF82D9151D0AABADBE44	8457AFDB869374C410F0B9F849B566FE3B6DDC5A32E68AA3B3CC9FF5FB7CA579
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	FA7858952B7839A47EDF47F5CCD3496B	29C760A285E90BC785B2A3EDC1907FCE8265B97E	196E18E917F4F82E7A67C16E51273798FE0659D3BDF50AE0F047F7548A6D6875
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	9926545A705364A67A6E6B50984D4F88	5615F5875EB455C56830A5BD0FF80922A708DAED	9202426C254B8989C8A80B90102D718B0D0054CF864FC6386B88A38DC56E3C98
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	C480B70183A8C5F6168B708B7A17F7AF	D61C9FB720303B5A72565F63E870FB6BF3E05891	66A8F411C08F736FA07B15530D9B34DF12260F82EA77BC6FFA462FC0F1F9E7BF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	4507F18B7148F64B22394710AA14BD78	91F1CEC89F27576245BC55008E1CFB6A0F512873	6F48F6FF3AE5A65705F555E9B793C7CF39E19ADC1D41A5570E0C275FC26B5413
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	0FD05A173BACF865D88A5BC00AC1635C	E5CA9886072B93B2A11102EF7A91F792A6FD2A27	247FFA462690B03A2F1903CDA1DACE5B3F9C8BC3AFF13DCC65C25F631177C3A4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	6CF4EEE4C0F0592766BB04D745F1DB5B	FB81E2F503EF088FFC7F687D8A2FF1FFE074F3F0	0707ECFFF1296FBD5B1596430B36D51A22946E77BF1BFE34D9A99C8AFA139065
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	2A2FB3AF4620466CCDAD038AFFBE448A	BB0C1369FC9D1992CD6B5FD33454531711539C34	2D5B287FA19E6787C87B4FCDAD141692D3AC616350A146E6FDDEE0B191FB06E7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	9C8893160B93C5BCD12EF26E3B84C7D0	46F538122EE4C8C1013EF24D026B8C77AB33CEAF	EA8062FDBA3424160E8DFC639480AF1FD1B55DA3B583BD687AC0DE42525CC569
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	22B832BBA3E831973CEE9047250D388F	F7E582AE9A6E6EF3568E91C59054BC37E8FC3B82	4FEA237DBDEB34F157836702E11C78F537ED21ABE72B5DEBB7B0F3B01F403572
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	62F861CF0107445305F23DD7B72747A3	4B86A0D5EF9CB993C15A39EBE38062A8D9616642	3311D71ABE915D1EB32E59F3CDBD6532C11BDD9BEA0DE25B5A0A42F597DFC698
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	4CA481E19D4D9E806597A204710E9E10	9533AEB572251A3A4C59F088C1A7090BA9287E98	AD938FDBD91B6CED9A5E392A48FEED7E84F97D33EBE2BB54018D4C1A9F1F3312
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	A0AA5FF344EFCD20BEC3C715DC00AC7F	695A8A1E249ACE8F50FF4D38D2D9744CE87D1EA4	2D5737D13E1BE7D508142467EFC4E7356A29AB96ACF5D850EB59D5411153F283
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	A25DAF869D67153132B56F4374B0CFA1	9443EA6610FA9F487591496461DD7927CF3337E8	5322C8866E378D72EEF0B4E0BA7C1FAC66353153F0AF4FF7B903C7E69EF586EB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	DA90F06A14F05A071284A676418CF1DC	D8DBF87BA2E863366FD28038C2CE312494B4FBB0	43D0395B21D2DCAE3B4A24957239D3310470A787DF98012D6C379D018F831E83
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	A642F319C72D14E3247AB336754FFDD7	61137CCB190589E645856358F6364D9F6072B6F5	F80097BB20B072402F5A0C2E10C92B6935AEA70A6BDBB71AB60C34A69EFF5E30
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	318BD938DEF38C800CBD49E57182906A	FF17AC26B2230BF8BD069D3BF6BDDAB45D85EA28	8848D085D39270F9455F30B6CED4DC70227E8F5843F8794E7FC9E3F529E980A4
C:\Users\user\AppData\Local\Temp\MSI28e49.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	240AB822DB5C0739204976A3D3D17F1D	1EEF09220CF09510FCB8C50D3A050CEA2FDB9CCF	5FB75A05F95048CA05AF66775302E24755074D19BA77DD25EF90862B537A41FE
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-24 10-48-06-926.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	9D01C32ADC292B69C2692DA4A51FA0BF	CC85368A548666E65EE7757C1132B76E6F14C96F	171AFED03EE5A492AB797AD072A1F4D958BCADE662EB8787CDAE136005C09745
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	7112E6A5C3E57920C031BD936825046E	444625EB9F22D858190DA3D9075D968008E3BBFD	1862871C59A5BCED35E054CC9D4E7C642CD435B4A9AA9409AD91D15B7E2DE03C
C:\Users\user\AppData\Local\Temp\acrocef_low\3e19c9ac-95e5-4a95-a1d9-4ef392508585.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\3ecf6e96-473a-4049-ba00-f77d7ea07909.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\681881ce-4ac2-4217-9341-78dd3b3d12de.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	AE1E8A5D3E7B2198980A0CA16DE5F3D3	A1DB2C58AFC81E6A114A8EB47BE0243956F79460	8C2E1B13F6658714D51737D6745FE065B87497923945AB3028706A4171C8328F
C:\Users\user\AppData\Local\Temp\acrocef_low\746f7c76-c356-4997-98ad-088c2a0bf7b3.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685

Windows Analysis Report
1741A0218-101424-Travelers-10142024.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report 1741A0218-101424-Travelers-10142024.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
1741A0218-101424-Travelers-10142024.pdf