Windows Analysis Report
AE08476Q0222832AEDXB.pdf

Overview

General Information

Sample name:	AE08476Q0222832AEDXB.pdf
Analysis ID:	1541999
MD5:	c576ff4f8796a88cce41337e1e927287
SHA1:	6cf592e186ad07b646866daec6dc82f429260802
SHA256:	4b927a41d9e17746aedc4cbf0cb045595d5d4bc22111a1f779e6d023ee364d90
Infos:

Detection

Score:	20
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

AI detected landing page (webpage, office document or email)

Potential document exploit detected (performs DNS queries)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr

String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: sus20.winPDF@14/43@2/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-25 06-26-38-418.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\AE08476Q0222832AEDXB.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1692,i,16501027314633309046,16174421510889995249,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1692,i,16501027314633309046,16174421510889995249,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: AE08476Q0222832AEDXB.pdf	Initial sample: PDF keyword /JS count = 0
Source: AE08476Q0222832AEDXB.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: AE08476Q0222832AEDXB.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: PDF document	LLM: Page contains button: 'VIEW SHARED FILE' Source: 'PDF document'
Source: PDF document	LLM: PDF document contains prominent button: 'view shared file'

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1541999
Product:	CloudBasic
Start time:	12:25:37
Start date:	25.10.2024
Sample:	AE08476Q0222832AEDXB.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	c576ff4f8796a88cce41337e1e927287
SHA1:	6cf592e186ad07b646866daec6dc82f429260802
SHA256:	4b927a41d9e17746aedc4cbf0cb045595d5d4bc22111a1f779e6d023ee364d90
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	30F43D36E18308DB0358C5D75D417EFF	BFCEEB4A1F60AD4662AF021C17522D53E9737BBE	162B500F2B687880EC304D3FA4F9476E98CEC354DA3241D363879FD812B6C951
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	30F43D36E18308DB0358C5D75D417EFF	BFCEEB4A1F60AD4662AF021C17522D53E9737BBE	162B500F2B687880EC304D3FA4F9476E98CEC354DA3241D363879FD812B6C951
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	04914B7365186137765905641D678D1D	D57370B55CDD8706AEFFAE484FEF59C0A8DEADC7	3F0FB20A7DA38E82F78B48C7FFAFFAF072681702007FE700A2FB2F6CEBACCDD8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	04914B7365186137765905641D678D1D	D57370B55CDD8706AEFFAE484FEF59C0A8DEADC7	3F0FB20A7DA38E82F78B48C7FFAFFAF072681702007FE700A2FB2F6CEBACCDD8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	E25AA2EDFE4332490FEAE5CB08117542	E56B28F9D1C20BA911F5C754D97CC97DE121E9CD	CD306A8C758F80123B2C70E0FCC4F0A17F862E91CA0281AF91BEF7E3EA099933
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a4378186-323b-4f92-bb1d-1538386d9160.tmp	JSON data	E25AA2EDFE4332490FEAE5CB08117542	E56B28F9D1C20BA911F5C754D97CC97DE121E9CD	CD306A8C758F80123B2C70E0FCC4F0A17F862E91CA0281AF91BEF7E3EA099933
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	2D4534AD738C77B37E5E43CFDF3DF592	8646ABC6D2662F389D2B04A17E2D0CF984D8A646	CC5ADFE0C44948703BC98EBDC6B5D5208B1FD318E86FEDA931F1B243605A0459
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	41F7C429BE3189C54B713E0CC8DD4DE4	032194D3647D1E5B3434104DB7484361E79A37CA	8009182DE986A03578484919C58A5A36B51F7C2D453DC11BC0129A95E3641146
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	41F7C429BE3189C54B713E0CC8DD4DE4	032194D3647D1E5B3434104DB7484361E79A37CA	8009182DE986A03578484919C58A5A36B51F7C2D453DC11BC0129A95E3641146
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241025102640Z-171.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	19C681DCB319BF1E2EC73078F41B682F	897BF2741773E1ADB443CD9A2110581A282BD5A8	BD6B9CA3588D0FA2C1F815D20708E16D41AF643AD2BACE511EE9F7B73EE3B42C
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	3164DB472E47ED3BF5578CC1DB51269D	AE32F1485BBCE3C2D388037A5138431D01D21E3F	875E5A557B11CD122AC5E833F800C28715A2F9BB1E66C101CB7D07FE5E7211E3
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	70BEC5625407E65A766DCAED06B97D7D	4F417E13CCD7B8C2D76B3C1FD8D3DF3580EEC4E6	ECB03DC71AFE83B09ECE6334CD37B3A4937C58A793004B679E9F324F2CAD7E4C
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	5E2CEE73691089676D9D2054EF76E97F	3A7A16A9A19DC9592C8A11C89EE0CEC4CA861C2D	AE615FB8D6227DA9A2787F78F5D79A0ED8044C4B4E6A9940C96EBB4BFC85959E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	25BBE0C1F78131EAD32520F19A7B9952	2CECFDBFF8AAF205F214B9E4388227872E7AC249	BED5E54B28D8F98887A9DF4E1944E942340D0C1E961D3F674991A2329709CB7B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	DCA3E003E0E814A1FAEE9A80CB3CD0B8	362DBE2ADB17461D5F4266712C8EE9FC189600C2	B24A14AB02530E82FF8FF2EF18F657EACF4FA212CAFDE819A446A64B23AAF975
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	9E0EE35E6C9A407716BB4BD140E1CE12	57CA3F0183FACF02FAA8A821AD03ED7C9D80BE74	AD09FA8CBC44749E179FD541EE50A98011071ADBD3958E725FA0E1C6E5CF2D91
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	5945AA5FC74531CD63A7CF59347C0F41	A23F2EDB1FA8DB697AB4AA1E9C62303AC5544F12	247A0C9E9DB70C9EEFD262DEB54D70329CA401290CD6FAA74CBBAF831C951724
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	E34D60B1EC945440B9B0B6EEE8C78B46	1BB984B717DF2D7C2A3F51AAF612E68C0F7AAE32	FB98FCD53F8EA4AB9E57486F758E71E627665D2A38A20E10A022906397798F1B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	B25AC74A67547014613DDF1EF3648AB6	E4732AA6E10B5A565FA0971AD959973F9ED212BB	63645519D46875D29337B69CF6429AEBFC3B889B967AAAB286B8EE9E3911F379
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	F3FE72DAD627EF598D31C06B0CAE24EC	96168BF773F2D65F03CB1D5206F906FC68DA51B2	0AAD767B0E2DA344EC6458D22650FA80503BC34E237FCDC6DF8AD386A9C659FD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	B1FAF3C89BD3D5C5B8280CB5007918A4	858F3963FB3D5ED7F206E0DA0AB8F2018255B6A6	0550D448C8BEBC094774EA25E21833EE0F49210DFBCAE9BD61DFC83D19020F53
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	6CD38A5D2F63FC8617F580E1AD35321B	52C036CC005E05BF18A733D36F494FEBB3C242D9	1679B20510FE5FEDB59BDA259DECD0E6E7BCBA0B2DD98C4DD13626D00E471EA1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	1F40601E0F8077B5B8920EF842899521	8A4F368B5256298B52FEB89B266F83949D73D826	DBC9728103804072878795C319413DA2D68BCFC7D6497580FFC201D780CB2EEF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	B68FC5F0FCC709D78EE3BC18EE2E8839	33CD555095B263ECD712BB570A6FBA47D073FE6D	993CCE03BA5E0DC65093A30D8C6FC7A4E155ED07EDE4C29985D253144B885F5D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	66A4C5FF6D2D577378BFD2E5E58AE744	CC6DEBE952C535B929EB9991A51F3A468BE37591	3785CB8082C03F863AC2333C1B9DEBD91825A905F120C7B2B1A580311E35B4D8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	10B3D632A57F1874F3B1A498429A28D6	30BF2A29872DCC1A3546F8B9F4E2B8F7C8D4005B	3724CACAAD6096BE71E67391E77C3F38687906A13BC005489BC916A80E526EC9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	6053850BC64508C033E94AB40F28FC11	E4E32DA0AB5065AB135CD94DF795617FCF73DB6F	615F6677956ABF3363C07B96E5413BCEACFF717219F650CD6473D1DF5D9D4DAD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	0C26CA143981181A8022F438229F0364	9CB3FAC4BB072DBA52F6682F7E2CE477153084D7	2F812D5CEA324170BF010044A8B75A030F4C1B25FA1CF3795645FF757B0E37FC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	C72866020D2704D2D644454D1B16CEAE	92B8F73374467364F3AE816078C1ED4386B1C816	54BD10CBEC14EC90AE9CA640DC3E7C596AE849913002EDB31CA3954468DABDE4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	D1DBA3D1316DB8A7B2CED9EC32FCDDE2	C98FCB3608254134A753A5E6A022C755DE89F5B8	979A937C18F8A899BF8D21A15A5DE89E5B5FD0C5B6B00EBBFA9948FC4DFF03C4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	AE7334644E3135837E4F7EDFBCB0B249	D37E04F8EE54AA8B98A3962EEF697378F2C74764	3FF74D5611BBFCD281BB53A142B61EEA80913132139ADB2D7D1B15CD8C0E1C1C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	652349A6361FA7871FAC7BE0DE763776	8786C4C8EC23A246CC9DE47DA9B5B7B39669B47A	82A29B26D6D446C2141A94FC564E5CE22ACBD8F315EF881E86BA7F5AB904FE3D
C:\Users\user\AppData\Local\Temp\MSId6374.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	3E93FF841752B9EC93B98FA7B15CA411	6036DE52635104C42E37FFA93977E0A01A8C3CA1	267B90281ED3E15EF8EEA27F76F87C1CC5F5619BC3DFFC660D3F3CFF49B7C017
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-25 06-26-38-418.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	573F5FC6A8B8ABE7618E763101BEE3EB	D29BD000697C0E51E0D79F805A82B1A245AFE1BD	2D67B083BFCFE5803E89B8890E0E5B9C82FCB1A13F316B93E57580DE495E7FF3
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	17792DA46F56C2824FD2B2FC0B11E466	6004815A7DCB5E3957BAD62D8D0F662E3489CF07	520296E0B569B95C8BD2AD66EBD37677FCC7BA7DAB1539C23FE617847400FB02
C:\Users\user\AppData\Local\Temp\acrocef_low\2f9916f0-c282-45ba-a6e3-f3a8fa968e15.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\51d48a58-ed63-414d-a965-c7848034e795.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	E787F9888A1628BE8234F19E8EE26D68	44D5180C06ADBBDAADDBCE350CE4DEC997CD83E5	3A09F3799148DA49F039A35AEDD22F368FB35B8D6022C4691C10606F704DAF80
C:\Users\user\AppData\Local\Temp\acrocef_low\906623ce-6e83-474a-8aa7-dee816bd6ac6.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	8B9FA2EC5118087D19CFDB20DA7C4C26	E32D6A1829B18717EF1455B73E88D36E0410EF93	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
C:\Users\user\AppData\Local\Temp\acrocef_low\aa8da7da-0e8e-46cc-bcf9-4e6bf3cd36a1.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B

Windows Analysis Report
AE08476Q0222832AEDXB.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report AE08476Q0222832AEDXB.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
AE08476Q0222832AEDXB.pdf