Windows Analysis Report
schillings 1001 casey.pdf

Overview

General Information

Sample name:	schillings 1001 casey.pdf
Analysis ID:	1542321
MD5:	024d95668a55d343ce3480eecae71127
SHA1:	939f41b020eaa336b671e3f20aeb4b292b0ca93f
SHA256:	e489e2d06b9397325cbb4e476d89382e7ccbdf88d9dd28ce0a9c13b8581ddbe5
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs DNS queries)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: ReaderMessages.0.dr	String found in binary or memory: https://www.adobe.co

Source: classification engine

Classification label: clean0.winPDF@14/45@2/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6572

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-25 13-37-38-867.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\schillings 1001 casey.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1744,i,14201725614896609430,17820809391108696731,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1744,i,14201725614896609430,17820809391108696731,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: schillings 1001 casey.pdf	Initial sample: PDF keyword /JS count = 0
Source: schillings 1001 casey.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: schillings 1001 casey.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.210.172	true
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.18	true
x1.i.lencr.org	unknown	unknown

ID:	1542321
Product:	CloudBasic
Start time:	19:36:36
Start date:	25.10.2024
Sample:	schillings 1001 casey.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	024d95668a55d343ce3480eecae71127
SHA1:	939f41b020eaa336b671e3f20aeb4b292b0ca93f
SHA256:	e489e2d06b9397325cbb4e476d89382e7ccbdf88d9dd28ce0a9c13b8581ddbe5
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	65C944CE2706A169B085AF37C23747E5	B4EFFDB09FBFF6F1278072E2143F4FEFB18C4CF0	06350DDA1E4C5F17065E68D4D3394699D85A579807A0154B9831100AC8D3672C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	65C944CE2706A169B085AF37C23747E5	B4EFFDB09FBFF6F1278072E2143F4FEFB18C4CF0	06350DDA1E4C5F17065E68D4D3394699D85A579807A0154B9831100AC8D3672C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	629CAB7CD3186652515DCD13FBDD7EE3	283A9570E375296267AF7E747BC9DE71806BBAB8	30F5022F22EBE1FC330A64EF535979B97D01B2A62C387C44C7C833AB590545B6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	629CAB7CD3186652515DCD13FBDD7EE3	283A9570E375296267AF7E747BC9DE71806BBAB8	30F5022F22EBE1FC330A64EF535979B97D01B2A62C387C44C7C833AB590545B6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\925f9d79-2fc0-4a8f-a822-06614ce21117.tmp	JSON data	A254A2F0B5C1ADB23C93F2601EA1B97C	EF81EF527F2AE626C6A53C3DE273374BA7905BF3	CCEAA8D8C75974FEA4384038CB51F592B3CD0ACA178B56FCA06B8CAAB1539A33
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	A254A2F0B5C1ADB23C93F2601EA1B97C	EF81EF527F2AE626C6A53C3DE273374BA7905BF3	CCEAA8D8C75974FEA4384038CB51F592B3CD0ACA178B56FCA06B8CAAB1539A33
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	17C445EDA7C6E22F0C7D88D2A93B8BC0	1777B0A1BFF14EF0F750613BA3445EB8E0A0E5FA	AE1C828A16E914BB79CF23CAF08F9B812C5789913C2D127944590031696C6D19
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	2FCFE338295484E86BEBC24D858913E0	5E3690E1519B423C24B0B4369EDD72A4440DFF10	00C2BCA10AC2D083D04C973F091C7745794A7DCE819DE5524330C0A5C479F9FE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	2FCFE338295484E86BEBC24D858913E0	5E3690E1519B423C24B0B4369EDD72A4440DFF10	00C2BCA10AC2D083D04C973F091C7745794A7DCE819DE5524330C0A5C479F9FE
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241025173741Z-174.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	6EB0FE33267A6BFAF773E41707BB0A5D	DB786A5574443820A5177841C4544AE2EEC46F7D	2C6B404147510C4F556AE92F166F0AA4052B4BF4651FF900B52C99233DF761AF
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11	73325E67B07400868D153018D1871522	6451D37E573FAA791A8F8CD5F5E7C63F56F96420	72D2B40A5A58CF6D9BD11119680A4B3E26977046BE2A4AE4B718D5454B8F98D3
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	F916204241BD225DA0C5A0A0D006F1C1	B003DF4D9C48318BCD00CBC993CB398D6C5B52E7	3987644B306A418B6D99DEB6BE23C5513DA588828221409A3156F1A30D4A9C29
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	F0691392B1786A4CFC4291FCE2B212E7	DB4B8560996C401D67BA4301A43DA59E46068D0B	2EEA1E1D894F827E56B19CD714EC275D1B1642D3E8F6D77C00F8745047952CA5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6572	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	AC4D831D284E1A0B031212C23457E437	81956E4DEC35B1BB75D7DE5C9D2CF2B68C1C6416	B91563F11F3D99A8267709DC454B7591DA1E1409742DECBF5DC79F3E2589A469
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	1E8C1CAE88B89030C2BE3748EE69BE88	D46AAA128980D1B0E7BAD484F29522C972EABDC8	373D63E532AA2B6CA69CDE3165DA3331655300658D8CC24F778466BB5F4E07EA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	431B885528A267E648CCD3656159A68E	B97CC738DDF7FF6E14478667B8D0FFDB6B91AEB5	CBC1EB2D888A7B3E62BF1D8582846B3F9017161613AECB3BC930F4D927A0A135
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	174E6F2239DD3753AE01150DB29CF277	88BBC9C04E619FF10491DA10E52118942548600B	03DAB70B10F8B27C71A7CD9EE7F886FC4E9689089251DDB51FAE1698EE92FB3B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	0A0B4425881E183F5E4A85EA496966E6	784DEA3AC13526FA8B503C1B5F06C3EF2D4575AB	D05E08F7463BEC54FE23DDC05722EB1E04634DE5EFB71A9D5B25D1572F43B672
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	F96CB1A7F4B62F8C8478B2D544568985	CC72A7F5FBCA03857105ACC00F96A64500B7B9BF	1C6554B3A647DBC16783152920AD91DCBCB39AECF37B50249FA232A1208A67D3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	7150031E9EF5EDEE5D56BCBFE2B20737	6AC9D00FEFD04A8FFD5C415A6AA0AC4D1F4AA00D	71F0B180CDAB229A1FF74DEA04D3D64408FA1181E5CAE10EE25901ABAC815388
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	69FDBA3ED4FDB8B2241691173EAB3359	ADFA2B59099DF22AB549B9C03B05DDC1561763A5	18A30400DB45E066933074BB849ADCAF38E4E8016D77BB51D8BBF6B81C768C9E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	4FD3863949A3214F82C9ED5CDD1520F7	AD3F59653A2DBC123E20951DA8DF55CD0B433EBE	FEAEFF1918157BFB9295ABC85AEFD6AA42CE51E9F50E75C13C169790C7A72618
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	B4EC5EBD66580B98CC86F22573333C71	168107D344D408B3DEF4CEBC624735EFCCAB1939	7D7143CD546C4D21A395D88A90C96C43E3DB3069FCEF3A11218944EFF51182BD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	9F18ADE8ADDC969A7BF81B174E2FDB7F	6FF46C3DF12E5DEF0BE8EB0411B60E6059176B36	23842F0D7AB03EB4567593DE52B105B553FAF044417CFC5429E3E7B6AC825665
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	31C023649F689D22E3193F15DE64B02C	4FE390A13F3B06EEF48B3E3225F6074687F93DBE	25B5793B7FBB1FE1E4AA08360089DEFFAC7535A17B970B65B28484BBE7F1182A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	5AB5128625B13FE3CBE5D222272DF018	B0622948E4E3B8615734B71F98284DD6A56F715E	EE9D2EF2761608027F906564A01EA73F8F1004566CEF111391C6E8853E2A4D83
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	130698735EB8325EA12E96BBD0AAA738	81293F3713527EBCA81933A04C3AEEEFBFEA1482	FAF2C7D8C08B96BB833DB6BA2117FA5A0B745374EADF910C8900286F84C998A1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	C21DB0E4EF9C0EF106A6B4DC1A8328DE	6426EBD21D6366A7437DEFC1C26AC92DFCF89B35	328E0455DE476E1E947E1B7D582CD8038014FC0F70DB12F6C0EA64AD7F8E3410
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	CDD957019A8A9EEAEB8B0C851E36DAB2	18547053DD226FFDC672C41B6B311496FD87375B	1B620B03F037ABF01083B31BA8CEFC9661593BD68FCC3FA14AE263B53876BAFA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	86946143BD72DB638FC8F483A0E1B6F3	FAE7EAC435E5F8E3B8660D43A882B9A97AD6C8EA	C3A8B8CE1FED4129357D9E126AAD8B460DCEFC78423EBAE06D472173116F44F8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	8D67A1F2641146B76A956EF11D5591D8	6052AD93F249541679F2455C100A06B6D7090E0B	EBB935E54D4ACE3A21D65729147597BF90E8CC7C88874F73665ED10A1268F586
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26	1397055D2FAD2EFB1C55297261C48DAB	FA239160C6E17AA5A83E4BF775EED2428EFD5483	D9AF1185D84C1381B6D3A6559EBDD8FB6CB1BC0058CE05C94F81785BAE027F00
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	4A9A9E69243C8181F40E591FF3E04F2D	EC687D33BA0DB2F3107BA17FB10D37C7793F4F91	81F95EE988F80F3A1CFF0FB5BBC4A833F548DFE70A1BCFA1C6246FCB2B7D87C8
C:\Users\user\AppData\Local\Temp\MSIbab5a.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	65CBDEDF2FCC021A48D14B4E89D6D903	BD9D60716FA871253BC70354182738F902F3A601	E38045744AD83B2DCD14497D55ABE4A84511EF80C40ABEB5D7D77555BD82BC85
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-25 13-37-38-867.log	ASCII text, with very long lines (393)	39628FA3AE1A78F558A4947A4847C830	083A80F18FBEA378E9944FF9B6B74FE68CD56D92	E634D52BBCA86894E6CF9CA673A8FA4035AD705990F27198651E88F969FE73AC
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	0405E03A8D36FEA5E80D8D985E811B49	7DC142181B2CEDE6C1D0F500E0B6EE9DDC0B2DB2	CE69BDD63A00D3A52275AF8A53BFE18FD93F626E4B51671575551B1B1F2DBAEF
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	8841ED318F9A9343533C0BEA3CF79CF9	43C410665F21E7930B9D1240FC199A415E7C09AF	639190B2261B199EC575767F5696F0D23DF6CB329D7282F08E39F3E82B44C474
C:\Users\user\AppData\Local\Temp\acrocef_low\13b63814-bb76-4037-bff6-1f3ace436337.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	CA6B0D9F8DDC295DACE8157B69CA7CF6	6299B4A49AB28786E7BF75E1481D8011E6022AF4	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
C:\Users\user\AppData\Local\Temp\acrocef_low\3822fbfa-6936-4453-964c-cc92be3eca7b.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\4c8161f8-73d1-4c9f-8719-f0d03df2075e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\c6079727-de43-4111-8f6e-43fded50375e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE

Windows Analysis Report
schillings 1001 casey.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report schillings 1001 casey.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
schillings 1001 casey.pdf