Windows Analysis Report
Unilever Rfq letter...pdf

Overview

General Information

Sample name:	Unilever Rfq letter...pdf
Analysis ID:	1544427
MD5:	40aa3755b571d5f21f4e0fc3d474a694
SHA1:	ab6ae191590e046782fc73e70455c10fc532f2d5
SHA256:	14b8c00c07841f9c3d8b019394010d1e92fb353c5b5e29340588b17cf2ab34ba
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs DNS queries)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: clean0.winPDF@14/46@2/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-29 07-09-50-623.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Unilever Rfq letter...pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2068 --field-trial-handle=1716,i,6007794316461202166,2525164083264681267,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2068 --field-trial-handle=1716,i,6007794316461202166,2525164083264681267,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Unilever Rfq letter...pdf	Initial sample: PDF keyword /JS count = 0
Source: Unilever Rfq letter...pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A9enffy3_uz42xw_5hw.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A9enffy3_uz42xw_5hw.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: Unilever Rfq letter...pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Unilever Rfq letter...pdf

Initial sample: PDF keyword obj count = 58

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.214.172	true
x1.i.lencr.org	unknown	unknown

ID:	1544427
Product:	CloudBasic
Start time:	12:08:49
Start date:	29.10.2024
Sample:	Unilever Rfq letter...pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	40aa3755b571d5f21f4e0fc3d474a694
SHA1:	ab6ae191590e046782fc73e70455c10fc532f2d5
SHA256:	14b8c00c07841f9c3d8b019394010d1e92fb353c5b5e29340588b17cf2ab34ba
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	34A9E69307806D64DFE5217E1346A825	EF3B6FBC2A954B94B98948343492469E97E52E50	5741FC338785C02C6FBC947149108B145EF59F77BC9D337F49A05C817C68D7A8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	34A9E69307806D64DFE5217E1346A825	EF3B6FBC2A954B94B98948343492469E97E52E50	5741FC338785C02C6FBC947149108B145EF59F77BC9D337F49A05C817C68D7A8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	C5731D7C331D3E5EE0CB548E6F27D482	034C0679BC3D199613743A981F7C6FBF611D4615	BCC9C9007589F2D7BC6F8803AE42A4808AEAC84A8984B1D72DD0978F1A8B4D9A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	C5731D7C331D3E5EE0CB548E6F27D482	034C0679BC3D199613743A981F7C6FBF611D4615	BCC9C9007589F2D7BC6F8803AE42A4808AEAC84A8984B1D72DD0978F1A8B4D9A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	BE73CEC42E39D4E266B19E32DFC800E0	2DE83259031F806B9C6CFB0542CB0F87986CE080	323F863D6A53D379AD98888BBE79724A5D530173C8B2A0E381CE254EE63AFDE1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\bfb68ca1-fcca-4c15-8374-c6b2d2aedce2.tmp	JSON data	BE73CEC42E39D4E266B19E32DFC800E0	2DE83259031F806B9C6CFB0542CB0F87986CE080	323F863D6A53D379AD98888BBE79724A5D530173C8B2A0E381CE254EE63AFDE1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	16E4F2D4CDB80C6F3268EA257B9F0B63	4FCA4F30BC98D6B90F3B592301B36C4C9A04076F	1BCB9E1A46B6743EE4DB9553F0147443BF043497FBA1FD70014CFBF40F9328D6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	7405E5F318FDB0D002DD487131CCD6E5	E0B38A78382D42F6CD8B76689303D2B41A05CDEC	821B4C732F96859AB4E017A064447263D2065F9D9A2765F303458DE5ED3D3BE1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	7405E5F318FDB0D002DD487131CCD6E5	E0B38A78382D42F6CD8B76689303D2B41A05CDEC	821B4C732F96859AB4E017A064447263D2065F9D9A2765F303458DE5ED3D3BE1
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241029110952Z-162.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	2503E21A6B02AAC145C7BE40BD420E51	C845B3F1C0DD2F1B2072F00E5947A2ADDA05F802	A70690751D2557288D89BA09A6995BC65036D6C9ECD90FFD3C0464070B4FFD01
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	363A6AA229144BAA666874C3AB7FC2AA	0727FB50CC15778E16C9372A3EEFA00BD93BBBFB	AAFB40DEEB31B794B2E4BBED2FA3A8C69A7DEC57BD7A87FCC5ADEEA3EB4FF8F1
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	FE201ECBBB4CBCE99FEA0265176A922C	9526F51C8F6E183D1B936287A00B2B80C486281E	37A36AC754559B9329282C26607DA569B845B43451DE44D2CA0E4FCC75A1B92A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7124	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	5BF45A82151497842DE63E40A6D6F183	1DED28DFF375CDB4BCED2B7FB3C9253D9ECBFCFB	6B580676D6288ACCB21CF6ABB5E570B2EFA73F38C4DC2398564B53B4F3DCAADA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	D480FC94D4CC237783EDA75CBABD4FEE	800E2BA7F0A6E8620093D558D3FAA2E78FBD90C7	1B0E271892D6E0B3CE015D77ADC96108DA57CD62AF3210055D8143635418ACEA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	4C054B0F8918F5187063C24521195A2B	698BC7DDD6C6649FF301EE11A6E69EC6EFB3FBD0	E848E8B46B37B1DD246E9759EF9CA896B8D84C81B4E5919CC6AD47E497027A01
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	45776467E0FC932803E9855F41EC8852	D61096D66C1E303B80C108BD34FAE7420855BD26	F65EA412D1D921651767839F9D8F9CE4C877A27F71C8707C6720EC5396E7D40C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	87AE9F4125C97566F40C9444F9B7793F	BC903EAD13C1EFCE69926D6F69D94DB48346D723	3C8D6E67191C0ED5AE9541456360310A368ABBD42C11383C8E9CD2AAE41F0A3F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	DC4E08AAC976A96C1DEB77E2733A73BA	BB9D1CC24A4570D16C69CA556465D5F6FF80AEFF	2A7EA8C6065284409726029BE5E01390617FFDCDFEB6638DA075D562D51CF263
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	1F02879504A10D59BA8E1E47466A8C92	83B6369BA4CB646325D6259E705ACE6A30DB369B	94A2913A616331A1E0F85AAEDCC67BFF3BDB2DCBA519EDA242380E4F3EE12AC5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	A010143810D70E11B05B95DBAF378C00	78D3AD8B223374B10B3C1B1FD4DBBDE0D691B6CA	80B2AA90C4F490AD05543F0975FFF4BA90C19E853021427AB3E2739F8D5ED71C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	0395A285E1FFC5D593DF4E43C9304A67	058DC71C7EB41A5094BF57BFD57B735666650B99	C3943D62E3CC59E2E5B3C969EEA9047D738537E8FF46FE5E3BA5FBD796D20345
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	45F8CA3F0795152AD251DEE1553EAAE3	A75F65A5B161E5C666F737F05E88CE7EF7E399EE	33E25A4875C5C41E30FF2020DBAC8BBCF92F4270D34F65F24CCE5F0AF79C276C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	DEB3B097C00FCDD14456CAC2D92E1FF5	E23A93EA229359B3BBD05BD5B9A9E3E3BB06405F	E4D567B91A20767ABF6E910F46D96730D4F113C525AC7D0064733BF62BC6DEFB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	CCA262D25FF627C1C5BE456773AB9D3B	F4C9428E82E16F55623AB2436571315D0A026A20	A102A3E19B584A5909CA8BC1A34472AAB7100D620AA55A9797D0B0687B48008A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	2BF6CA2A7AF8578FCDE836B982F7A530	BDC4343F40EF64C7A51596B2384371C452802F9E	6D6D853146C4DB7307CD5F311FBD3F6220F8DB6A91C01783C6EB4ED53FDCA6C6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	2D700942F5CE43E5D20EFA6AF2BDC30B	B90D705A789AC694E157FEE0AA850D394FF8E9D3	DD9192050FBABA15BBB21CCC1B5E5794E1890B01AE493EF0C35AA4281598A71D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	B1AB5C616AD744943E063C41A4CECA4E	E52662AB72A12BF35C54A337303E13AA98B6B64F	04FB8C6F249A6BB233E2FE4D79C23FA674581609B0E86333895A1455F66467FC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	5C96C602FEA604BFC485D7D1D19DB8C1	76813F9D51A35211D5AD11FEDF26025336B16DC2	13B6806639535D00589D9F357AA3ACED7FAB210BB7299036753038A930B13569
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	8EF68F394E87B3EBFA6CD158DF74CB7A	F0556CFA169E8A01A7574890D8B21877A883E1EF	B91C68A17D56B45379BB0E84141A883AE5053F90F1F087FCDA997C8CC61F7774
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	DD150AB66DD524FA42FFCB674821761B	A7279B675874C5F4920682E738C14CE8645F2051	7048BCE79EBA27724C01151032E3289ADD255158C8996BCEDBBFCCED7579BD62
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	B58C39D9A8351C69E0E8073074DB9605	16AC5121FBE857D6DA35F7D80CE5DB51133472E8	4BC3CDFD49E0A5C7E465A37160C25B40E359E7B1CE515DD0B0D1391AB4954CE6
C:\Users\user\AppData\Local\Temp\MSIe253d.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	EEC5473B75F5F7D775D1C030CB001B54	8CFE8654008C4CFC13359775DA1F5BE35F2E853C	8E2584D3868AD696491FD4D4C5007883625BF903382E825744D35DEE876F320E
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9enffy3_uz42xw_5hw.tmp	PDF document, version 1.6, 0 pages	64BF18F86C9E807FE913F7B2F70257E4	A3B1EB2F9D6C6DA9446B9EC3A100BC8E6B51A982	311CB1BD2CD34EFF97DDB6EE00846F289FEF15A2043556D29E6EC965807512C1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9hedhbv_uz42xp_5hw.tmp	data	9788A640297A2003C6945CDCDB52DE04	4A87B3FD8113D9751B8740ADACBFAFD1BEFCF308	0DFC18E66F5D03C73CB191CEF14DDE0335928C164E298C41C2900AED5EF3AA49
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-29 07-09-50-623.log	ASCII text, with very long lines (393)	1336667A75083BF81E2632FABAA88B67	46E40800B27D95DAED0DBB830E0D0BA85C031D40	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	8C32CC8BAB31167211EF26A77E802D76	9B8E2D5E40450A2758CC713019BFD0239EFF7213	F438EED1CF0FEAD7721DEFC64E9B3C28AE37F77A35508E2AF1A3E8672AC0977E
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	3FF5F74A2AB5AE86B86DAD14992D58ED	42F3F045C085E213384F2714EA434DA708A544AC	88AC653AE7D6C598344B4B6A383A2613ABF393C07CEBD849D21B6C91E17CF411
C:\Users\user\AppData\Local\Temp\acrocef_low\1eb11d57-9661-4246-a0a8-b61ad236dc25.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\59c1b7a8-72e4-42f1-af0a-fe22792ea8c4.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\cf6b250b-6279-4942-b966-86cd8566a15e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\feff3388-1d51-4fff-883f-d5727768f4da.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	62F2E9F22B4021BA764763F066157442	0BBCDDCCA2B7342980503F1522E9249B077DED4C	747B773557070E01063EDCDF20C3DA8DD01599EF5EE5E5320BA7328DFDB2E721

Windows Analysis Report
Unilever Rfq letter...pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report Unilever Rfq letter...pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
Unilever Rfq letter...pdf