Windows Analysis Report
joao.jose.fonseca@cgd.pt .pdf

Overview

General Information

Sample name:	joao.jose.fonseca@cgd.pt .pdf
Analysis ID:	1544364
MD5:	4cbefad8b132c8db189dbf857ac5298d
SHA1:	6aeb30d1e57e6eba7d059b1806f96a0403902a9a
SHA256:	ea6e8fc39aa5a5ca48802a06ce26cc41fedd60f10586df320623ee2d1467d0eb
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

PDF is encrypted

Potential document exploit detected (performs DNS queries)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: clean1.winPDF@14/43@1/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5896

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-29 05-27-33-198.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\joao.jose.fonseca@cgd.pt .pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1732,i,15995668999182124379,13045628946271694102,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1732,i,15995668999182124379,13045628946271694102,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: joao.jose.fonseca@cgd.pt .pdf	Initial sample: PDF keyword /JS count = 0
Source: joao.jose.fonseca@cgd.pt .pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: joao.jose.fonseca@cgd.pt .pdf

Initial sample: PDF keyword /Encrypt count = 1

Source: joao.jose.fonseca@cgd.pt .pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

PDF is encrypted

Source: joao.jose.fonseca@cgd.pt .pdf

Initial sample: PDF keyword /Encrypt

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1544364
Product:	CloudBasic
Start time:	10:26:37
Start date:	29.10.2024
Sample:	joao.jose.fonseca@cgd.pt .pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	4cbefad8b132c8db189dbf857ac5298d
SHA1:	6aeb30d1e57e6eba7d059b1806f96a0403902a9a
SHA256:	ea6e8fc39aa5a5ca48802a06ce26cc41fedd60f10586df320623ee2d1467d0eb
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	4BF054DF698D05C2BFB90C3FADE7698D	581EE3FD14E7821D269C1C3811257747612332E4	4CC2A1D9D736F8CC762096766F97330C923BCF8BB68C8F8616C4E5A2648E2EEB
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	4BF054DF698D05C2BFB90C3FADE7698D	581EE3FD14E7821D269C1C3811257747612332E4	4CC2A1D9D736F8CC762096766F97330C923BCF8BB68C8F8616C4E5A2648E2EEB
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	FF4414E84D09334EAA25E030D29FAD64	AFED9D98AB23B51A98907721154576160DD1A648	9800625670C285401E5401B1A47FF8D243F29276BD39D139A98E9171EF9EF22F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	FF4414E84D09334EAA25E030D29FAD64	AFED9D98AB23B51A98907721154576160DD1A648	9800625670C285401E5401B1A47FF8D243F29276BD39D139A98E9171EF9EF22F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8339271c-0c05-4ed0-aba3-72bd00598307.tmp	JSON data	27939DF088C2B09F11ECB27368D7B61B	6916AA14230B37C25B01E7BB4EE51E2BC4FB07CD	31CBF5B37DD3A6F54046D4B8FEF1D0FA4F7AD77DB79A3026AA137FCE4571841D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	27939DF088C2B09F11ECB27368D7B61B	6916AA14230B37C25B01E7BB4EE51E2BC4FB07CD	31CBF5B37DD3A6F54046D4B8FEF1D0FA4F7AD77DB79A3026AA137FCE4571841D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	92DEA744E04BD19FCFBAE9613BCAA8A8	0BCABC28E786CAC2520FCB0936FDC13578A362D6	17049811D5F95D79EDF63ED0BD13CBD9E749BDF8E7E4405D841875874795CD07
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	09CD06DBAEF1EBD584EDD559BE87F69C	241D199190780B64E564688866A83DA9297C1C73	F0715E995DA252CFBA69126CA124DF7C5762F2BA883FFA53B9A0D6E53DC2E5DA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	09CD06DBAEF1EBD584EDD559BE87F69C	241D199190780B64E564688866A83DA9297C1C73	F0715E995DA252CFBA69126CA124DF7C5762F2BA883FFA53B9A0D6E53DC2E5DA
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	63AFEAF222944F7AB0289D9192629917	8F6C6E84218340069005B08B07A474AE2DD1C81F	E33FEB44BE09925E1B523F1257938E913ECF0ABB103757F54BF40577208367BA
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	92C1E67A21104C6A909849646952F0F2	F9A23FB1205B68375075343A9866969F95B170C6	913AA6169EF6476CC75C65E5C962E960C106A9FFF52DD1A45A96B0B5A8C2CB6A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5896	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	2C17E7B4FB18307282C90CCFE678E430	0ABA7AAD61B9EAA662542C67D658943B0B8D3DAE	99B019D3ADE1A730E5FBCDB0CDAEE5A88FA22FAA6751B990887E3D802897DFA1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	6BF13B343B221CB7F9B50E88D24F160F	8619123B5EE5DB85588637108041255A58340046	EB1853AA31BB0D6FE5DCCF9A12DBC87D09E9016E043A2888A4CCF0512217F1A2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	25CA19137877B26CE00F25C9598F6D07	48B52070786B2E27C75B1FB910D5A9D5F506B1B0	0D053F05A1EC42B90E8FEAC77F210B1EF2B84D924D1B08560672D4DD87E459D5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	C0456D5B04BFD1FFFA9C7021EFC1C940	8722DA355F6C7EA9D4A1C1B6A8178DF8A5C851E5	B8388F291350BC955DCCEB12BB9041F3B82788960228F07D727FF336D38B5A3F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	940E9B1248E6932964188FAD5D5F2111	1658AE4B3445F7161493E8E4EE9445D077D2D66F	7BC8AFA79A4C3E9BB3FB547B986EB518F236685C3736A6E19EBB033B2CCE035B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	8938EE1628445EE7FBAF5F6250897193	D56AC82F167B81339388C89CB540480A8BEA8776	1B884BDBA470D097C451CDFB58E41B3B69147D4BAD113C356B5D7AA2F365EAE2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	A88B9DB494A38E04F8669C44E438A74E	096696394CDE610584A52163D336E3CDC24B001D	B2C9561DD970C7707C40723141E0DA254A05D442C2A76763CD88F24584E539EE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	CEE59C38ACBA1BC5D21E574D1296CFA1	4C5107093E51AED0634A797673F08A02B7637E1A	84E736D2F884AADBE5A76904E5533669C77B563B9BD2F32635C879B0D2877B93
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	A6BD20E6CDEFA30444CEC848BA8616BF	5D02405993A6222B0E2F4459FD61DB4BEE9B1A34	FA7E2462E6607C1267DFEBB3BC12915FA383E752F2333975E259BF9B3CA6E000
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	162319A7B9652B883E2B4FF0C0345D9E	9CA8453841AFA179DDD49F8130CCF16E3BEBBFC2	E76F1242E97BD9AA173ECE4A0557D454E496A31626A5BF70011E22538D05E9DD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	8909F68DBFC9B4D934A174A8254CBBCC	678246352FDD27CFC3F05B96475549659FED2705	B005A9FCBCA86AD6F2A7FCB0C9081A24FE3974C5B8FF5C2B370D7C35DF309050
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	87CB75C8103840ED3896A686559CDC56	60EC8E7715CA4130A0F48D62AF94FDEC4FEF13CB	11E3E0181A9920C1894F4300F83AC6818EED0FC1F3BD808F98E3656A74FD91C7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	E033A0988911B8551217EA6EC2F3FBFB	DD556E71EA824778979EAC696F1F43256D0B2240	B7B0D48F1A0677CFEB7E8BD5692065DF139CD8EFA23A6F75469C1D9CCB6CF0BF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	7C4EA0668F1C2A80FB3BCE676227093E	0B3955EB77C66969984C8ABC8EECA0F09DD2781D	BDAD9863383F2506B64DF84F8811454A967B455172974CD6347D54DE76963840
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	780A52B871B3A8C4267DCBB3AED3C2C2	9FC58490F9ABE9BFDD2FCA38C64BED58589559B6	75714175230D6AE451E2C083113F3649377EAFE38EFE382657CC06D2B105EB66
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	5567C03CF0A9EF9AF5A43DE02E55D469	1F66242D8A27C644CBDFDF49B9D1CF3E71D4401F	883D80326F7B1EB0F2D988FD969FEC1ED314519F472ACF34B329CCE63F75B99C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	29B1448EAB63116303084DA51F14528B	866CD995586E634DF9448D71FAE2F41FA8797870	C2F1842C148C14D7349B76CB97B98D6BCF51ECE8A9958D74CDE66CB02DE74E0B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	500E70FC8DC62AEF8601CFDFA441228F	A2CE7B9FE1F031DA2D2CD657D499399E60C41FF0	AA286F7FB579FF591F490A00075D41D3FADFB0766D084A9502A6A6E981F2A7CE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	DA06A5CAD1F4D3E27653572557A78E32	ED735DA6ED2FBB2B42EB22105CEE62183586C7B0	545DAE8616CE3C47A50EDD80AD32F47313D4EC3BEAFC86F594DB6DF1608CD992
C:\Users\user\AppData\Local\Temp\MSI99be.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	1B4FAF5DC093F18A24805DF043D5DC35	064FC8FAC5D2D19A9B6C207BB2916BA6FCA4C751	10FE594AA871B4D491747DE002B9FA6593FE69B88C6DC39FB7A61A9E7EE4E4A9
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-29 05-27-33-198.log	ASCII text, with very long lines (393)	1336667A75083BF81E2632FABAA88B67	46E40800B27D95DAED0DBB830E0D0BA85C031D40	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	E058838CF6E39719AB0509A5A5A2E36C	B1F9B30B93DE8A00BA5BEC072C604C8FABC3220B	9DA58FF973CD8A05043B2C06D5A0127D626513750182A538A1F35061C09DB360
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	01DAA8F305EC18FEA3D609B336834167	F24834FB37CC35673FFD4AE2B0EEA32F4D799433	8D52B15FDB9E65D5EC57324A0D69757142F2EAA34EA0967EE4A897511AF37013
C:\Users\user\AppData\Local\Temp\acrocef_low\1fa2e5f0-ec9d-480a-9200-9675f548939c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\3524daeb-4608-4743-b9b2-182c7d2fb867.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\a6ff3aaf-03b9-419c-98d8-b5c65335a388.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\d3b86d03-d063-4a03-a43d-455289c3d309.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685

Windows Analysis Report
joao.jose.fonseca@cgd.pt .pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report joao.jose.fonseca@cgd.pt .pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
joao.jose.fonseca@cgd.pt .pdf