Windows Analysis Report
Herinnering (5)_20241017163011148.pdf

Overview

General Information

Sample name:	Herinnering (5)_20241017163011148.pdf
Analysis ID:	1541945
MD5:	b6e2cc2ba1e583099cc943fa5a23216c
SHA1:	72a909151acd4253dce5d818b5829123b4c7e6fe
SHA256:	171137ccd4a23a564074e583bcd77f04cadab38b406f84239c7b3e973a1e6c0e
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs DNS queries)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: 241.42.69.40.in-addr.arpa

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: 241.42.69.40.in-addr.arpa

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: clean0.winPDF@14/45@2/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6380

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-25 04-55-22-456.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Herinnering (5)_20241017163011148.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1732,i,17151241865359330168,7598862305262395057,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1732,i,17151241865359330168,7598862305262395057,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Herinnering (5)_20241017163011148.pdf	Initial sample: PDF keyword /JS count = 0
Source: Herinnering (5)_20241017163011148.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Herinnering (5)_20241017163011148.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.214.172	true
241.42.69.40.in-addr.arpa	unknown	unknown
x1.i.lencr.org	unknown	unknown

ID:	1541945
Product:	CloudBasic
Start time:	10:54:27
Start date:	25.10.2024
Sample:	Herinnering (5)_20241017163011148.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	b6e2cc2ba1e583099cc943fa5a23216c
SHA1:	72a909151acd4253dce5d818b5829123b4c7e6fe
SHA256:	171137ccd4a23a564074e583bcd77f04cadab38b406f84239c7b3e973a1e6c0e
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	F0F86507B88A33023B43D7A2C707A8AF	FB83E6A0DF3C914788E52E21087924F7D46A6146	F579463B8356028889B96E1D7C3BAD9337E09A9A487AD86AA68FD29B3E987A29
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	F0F86507B88A33023B43D7A2C707A8AF	FB83E6A0DF3C914788E52E21087924F7D46A6146	F579463B8356028889B96E1D7C3BAD9337E09A9A487AD86AA68FD29B3E987A29
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	28B5D99261001925741600879F8A6F67	FA4D0B1696DC9DC87A66E0B517CC310445CEDB24	EE607D469BAD4692DD2F1964DB47235B6F7ED8EFF6C6522C7689171395DBD874
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	28B5D99261001925741600879F8A6F67	FA4D0B1696DC9DC87A66E0B517CC310445CEDB24	EE607D469BAD4692DD2F1964DB47235B6F7ED8EFF6C6522C7689171395DBD874
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	1C9C87AA94DDC9A7E2743D7EDB756EFF	293552CC3B3766B8543334ABF21594973AD7CC55	A28B934003B99ABCC797901897A5C79036EF2CD358FBA2EDBF37A12F1E750F3F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fc139e13-c93f-4c76-92f2-d63804454f25.tmp	JSON data	1C9C87AA94DDC9A7E2743D7EDB756EFF	293552CC3B3766B8543334ABF21594973AD7CC55	A28B934003B99ABCC797901897A5C79036EF2CD358FBA2EDBF37A12F1E750F3F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	C6071C136C2810280C73F7FDCD220BF2	CFBD84867A048688ABEF2AFB67E841D554589DA5	A9C595CA9E28C815D3D4CFEDBFAB7F3D12E38371254372ACE05A788BF0111FE5
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	3693FC8E547AF294033B95CBF40441E5	ED6370A53B7E1F1D14CAECDB3377E696211605D2	7B18545D402F46001F74A3782A5A286D93538A61D0A9C99316DA6F2DB02770AF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	3693FC8E547AF294033B95CBF40441E5	ED6370A53B7E1F1D14CAECDB3377E696211605D2	7B18545D402F46001F74A3782A5A286D93538A61D0A9C99316DA6F2DB02770AF
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241025085524Z-152.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	A6B588DE31FD9C2E0F90047A336E9D98	BBF86DA8AEBDE46680E67D114EAFF1E43349AC35	7FFD65F3ECC73D50BFE6061C6FA572D9D90A3B623F9694A46911613A6D3A1943
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	1D574CEB8785422FC32EE5124876E7B8	D289E9927B026DB522C5BEEF953BF0FEA173BBBB	F8923AFD15B935B6131A4CC85E4EB71898340FADF03E3544B345175E36BDE6EA
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	C052CB68D2179B820C68E48B1C731C23	76A1A1ACAB1043F10DC79D2C99DE40EC89E370AE	9C08D7AE4929FDC4F47E20C3000E2B985700538F540A7F2EA34259CFD7368AF9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6380	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	87EDBEE38F56C20298F25D5D3D4D1B5C	7F904E9615AC3186A87472EF366DD8202855B0B7	A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	84F94C64B7C168B40120E48081DF523D	1062B494D6EEFD29E275CF912C9D80CE889EF7B7	BAC1A3677A2F17686D44B54B2E8ABDA484980415F277975EF69270186858FB8D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	3979AED2EB0FF047279948A6704A0CF7	217017806E9BE73623EEF9CF5F0B9BB49D7D5B85	2FFFBB911C3BCE5E64352124E6178D3A9CD072CA3415B038B54BFF847EF4101C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	4652FDF5F9F0E0A2B44D46C8275AE5BD	2EFE50A214AA9AA5C11AA459ECE2251B73654262	7AB5228D51DAE5584AF63F8E8197785479E553049B92D8B3F5F19F17DF386D68
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	0EB4E69573E99E4A0FA3B39673E59362	B16D3B597A720620F8EF913F69FD148AD7F24783	C244A56B0D73BBBE3672EAB164950BD748A10DEB9D2E8A9454BA512A90070F49
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	AD9742C72FC36F37062D217914F43F15	B21A82F02AB30BDDFE68CC754C628CB9F133E8CB	9F1561A1023DC2365257F07600567B9E22FFFBB4077FD841F8BA6182023159CD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	63F49130EBAF5735D6FEA5BA96044E5F	D976CA39240C6BD88A4D873B05C431771BC8854E	504729634018A6DDF1C5B697504EE528DE9272CCF6A810E3B1E23969F523013B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	205C0C99E7E25536A0A4F58D56AE562E	3D8E37047131415A50A95B44AE663E4D20FB2FAA	16EA2955ACB5771EBF705B13D40E7A6A0988606F96B231393957B61555B4911F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	61CCC2AB7BFF00800A486D2F642F05DA	4259B1CA82E6D6B863973BE662F6F8B40341E388	BC74FA9DF543DF502EBED380694343FBB90A42A0001A6EB3454858FAFFF72FFC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	913648F418DD237B000D9A72989CE42A	DEB5B8DCF8A16C53383B23AB3843171F56391478	D9230EF04CB0475F027F5030EDAA7338FBE4337D125755C27C1178A645790CE2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	7C963AD0A128AFD35EEEA2BD241C0020	1A6812077540E2427D7E969FD42111ADBC17E2B1	24E3FC605C09BBD4A314B840C6D08F6D87B6DA4ADDADF06BE42FB3F8E2E23335
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	8FC2F7E7B4987281DE72501F84093F16	66188DEC3C1065CA84F04AF59E946128FF623101	CB91461C08E0CCB8503FB01838B15D128AD7259C65784A516283453B11DF8545
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	2881C8C9EB1DD387F2AE3945F918C3B3	EB2658DFDA2B3644421345286BD98E5AF4FF40AD	291735C11499E18F1E3FFB7BC31898B896A5BEEB622D57201C3C7BCD059596C6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	ED5FC193D35F086E8CFE582A1270A2A8	302CFB2CCC308315AF5EBC96B811F96DAB6961D5	AE12060EDF08DC81773FCC2AFD54DE42137B22576C09245B825960ABE63B0114
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	89D859CFF9F838B43B4E3AEB592B0B46	67DB101C42A8C9AAE054F18C4BE25B8E5B7C0B0D	EF535FEF41D03177F9F6B52B333EAF19096C5DDFCE3C941CFF76E6909D7B087E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	7A05DC00F38A0AF8B2E88AEB5B240B90	333D7601CDEA99EA3DFC9FA27FBD981B73040B29	69470780FDCB7F14D08D62339A9BFB7BD305D379CAF834B104D6A873D320A014
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	0ED7E77A2E879A774AE301CC04AB92B7	D5BBA2F94C1BB69FAB34A12E16D070AFD4B65894	C974ED6B1074C29BBE27909656EA575109F30C94EBEF5ED214BA5BB71DBAA326
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	F7FF8A3B7F5C471B99BBDECC2979B555	846107E631A29430C6E7842E180BBBDCF33D5306	5C7DF553CEE2FF4B86758E04A7CA0D897551AA2E91111A5EF9E3A824816DCA3C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	F2113F5F585A43B697E068C0C877BB2C	0779BF91D27C0AC2F549DD35AB73158013DA68BD	59EA8A4780DF43ED98A064F7005D6C11A5A72D07EBBD520B8372988E1408C50A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	2C28937B9FB2BF93CC661979149FCFB6	DDEB9CC0D7185FD7A3FEF8DE21534162771CF9CF	20DA2013DAA08FB859F43F0EC8FD1256F2564C5E481F7B957A8E0B1078211CAF
C:\Users\user\AppData\Local\Temp\MSI98b93.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	82E17035BBB9B164E99B9E80DA6BD4E8	F93C1CA058840BC138BC3DCDFC12BFD6ABB35244	D19A885C982998B553943C14859D9171124B71D88FD1877CD4934001C1F1BFD1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-25 04-55-22-456.log	ASCII text, with very long lines (393)	1336667A75083BF81E2632FABAA88B67	46E40800B27D95DAED0DBB830E0D0BA85C031D40	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	6903342B67A2ED516F9C2389BB37FF48	2CE261A407DF4B2D9EC705974B148B5FD5D6B4C5	5C6C43859866FC2EE8BC1D346AC5C263EE511C0B6F5E7700D2372ABBBDA92B1F
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	56B800B495D33DF9AAC8594655C154D0	C1BF400393842EC6E9C7BA3DCFE6BA211973E236	B2443C40260EF2F47B7882AB1B6C4C5528F319CF8C99EBC4E64FF04981002A6D
C:\Users\user\AppData\Local\Temp\acrocef_low\2006c744-3882-4549-8bb4-41c0f21ab3ab.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\36f30b3a-e515-4715-87c4-c1ef1db112f0.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\7551ef95-f852-4df3-a64c-141f841856e1.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	716C2C392DCD15C95BBD760EEBABFCD0	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
C:\Users\user\AppData\Local\Temp\acrocef_low\92d963b3-e386-4292-b838-0e3af5acd7ed.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE

Windows Analysis Report
Herinnering (5)_20241017163011148.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report Herinnering (5)_20241017163011148.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
Herinnering (5)_20241017163011148.pdf