Windows Analysis Report
report_dc93a548a752332b6bc69b06e70fd90dce376e8d.pdf

Overview

General Information

Sample name:	report_dc93a548a752332b6bc69b06e70fd90dce376e8d.pdf
Analysis ID:	1545889
MD5:	3710a4aa997a4f68dfc1911aad368490
SHA1:	c9edc6dc44ac3682646501803d07adf785bc23b5
SHA256:	53fc9eff2e6b72b3496e74ca38de525e00f7e33290e4ee6857382df7a76abc1e
Infos:

Detection

Score:	20
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

AI detected landing page (webpage, office document or email)

Potential document exploit detected (performs DNS queries)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: time.windows.com
Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D.2.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: ReaderMessages.0.dr	String found in binary or memory: https://www.adobe.co

Source: classification engine

Classification label: sus20.winPDF@14/32@3/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-31 04-19-49-398.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\report_dc93a548a752332b6bc69b06e70fd90dce376e8d.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1724,i,14140567284905888454,1848930123106568438,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1724,i,14140567284905888454,1848930123106568438,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: report_dc93a548a752332b6bc69b06e70fd90dce376e8d.pdf	Initial sample: PDF keyword /JS count = 0
Source: report_dc93a548a752332b6bc69b06e70fd90dce376e8d.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A91muqody_1fk5r07_ek.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A91muqody_1fk5r07_ek.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: report_dc93a548a752332b6bc69b06e70fd90dce376e8d.pdf

Initial sample: PDF keyword stream count = 39

Source: report_dc93a548a752332b6bc69b06e70fd90dce376e8d.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: report_dc93a548a752332b6bc69b06e70fd90dce376e8d.pdf

Initial sample: PDF keyword endobj count = 333

Source: report_dc93a548a752332b6bc69b06e70fd90dce376e8d.pdf

Initial sample: PDF keyword obj count = 333

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: PDF document

LLM: PDF document contains prominent button: 'click here'

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown
time.windows.com	unknown	unknown

ID:	1545889
Product:	CloudBasic
Start time:	09:18:41
Start date:	31.10.2024
Sample:	report_dc93a548a752332b6bc69b06e70fd90dce376e8d.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	3710a4aa997a4f68dfc1911aad368490
SHA1:	c9edc6dc44ac3682646501803d07adf785bc23b5
SHA256:	53fc9eff2e6b72b3496e74ca38de525e00f7e33290e4ee6857382df7a76abc1e
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	8E15B2FE1BC904994C9CB50B2BE15FDF	A630767A47FF36645E18BA0317249884593E1B28	FFFA61F27BD2DE9E1CE5715D7D83E6A852C242B3FE9665B630509737088C0A0C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	8E15B2FE1BC904994C9CB50B2BE15FDF	A630767A47FF36645E18BA0317249884593E1B28	FFFA61F27BD2DE9E1CE5715D7D83E6A852C242B3FE9665B630509737088C0A0C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	35AE2D349B8115C1B2CC2E2AF66E90C3	0B3AD3F63AAEB4B4B52CBF6B28D21B5CAF6ECEA2	20B3EE61DCA1E9E138505D5D4B85CEDCA5077AAF496C137333B351DF092EF156
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	35AE2D349B8115C1B2CC2E2AF66E90C3	0B3AD3F63AAEB4B4B52CBF6B28D21B5CAF6ECEA2	20B3EE61DCA1E9E138505D5D4B85CEDCA5077AAF496C137333B351DF092EF156
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1b9cb12b-4f08-4b5a-9e6e-ec85db2ecdbd.tmp	JSON data	7B1795B125A008E7E59746E4B300A540	8D00F92348E86294AB62DB5AF19928B1097C8EE3	71A4E774A63C5287A06B776FF73E63919DE79431CC89978A5B7FDF4767E3F1FE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6fcc11e2-ad85-4ec9-aa25-48940e18a14c.tmp	JSON data	7BE9C8316EB1B7252CB363207744A145	57861355BE6541501AED40F896891579DCF473BF	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	7BE9C8316EB1B7252CB363207744A145	57861355BE6541501AED40F896891579DCF473BF	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF69e139.TMP (copy)	JSON data	7BE9C8316EB1B7252CB363207744A145	57861355BE6541501AED40F896891579DCF473BF	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	55CF22A2B17446DA07CA09FE2A51CA9F	28CB6563E0FC6C6AB4C2EE9D0F79CE1D230E6F97	E972CAE5E55CFD1EF7EA4700168765F95A92DCD99B947A236DCCCB57DACD318B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	64F9A4AF8A29D4C8E58E36048E38A749	03DAE800135A78E6F9B25738C96ECA0A48C6D256	FCF90B0914B48F34AD6312FF29C808429352D382E45E2F2ABFEDB794CFB66CF3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	64F9A4AF8A29D4C8E58E36048E38A749	03DAE800135A78E6F9B25738C96ECA0A48C6D256	FCF90B0914B48F34AD6312FF29C808429352D382E45E2F2ABFEDB794CFB66CF3
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241031081951Z-172.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	FAF4B85D6C3D8CFE4E8DE953457BD535	40C01D1E4A8B854B0770D64E44C8E621B1FC85B9	73EB51401D566B1B3B61FB137A26D8F40897CB3E0DA3ED5359E7FBEDA960D4E1
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	67296DB4019C6DD784E92CB4D0EA2348	0941BACF1EE66A00CD4207A623BDD4333002E07E	3C1D0DF042663DEB2BB41840330E94EB4680A532CCFE8EEBFD661180537D825D
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	D3BD28462B1B3023D6FDBDFF0F7B36B4	DD6D71E38CD3521B47BDFEF99106CE6A2EB62416	2A46A502508218A13BAA6EDD56677A2DBDB8DBFB4DD1B6EEBE795CB787046763
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	F966FC1530F2D4EED4775DFFDA71449F	66E496C96C997AF75B572407AA56D130A606F727	4437EC9457E0DAB1E09D02B3404D0635B1972DE026C7CA1F38C1A191E7477699
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	46BE7347CB3520DC9F4572ED28EC744D	FD0E2A4073EEA191502F06D1E9961100F4D27458	2D6639A516F494B90CCC42F5B1F37A9354E85A7A9776C2A14D2C2A3E24330A2D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	3E72A2976C3500F5A8A45C175E97EC6E	8A11F3DADE9660EE85249D0359EE0437DF390BC2	4DDAF17A443CE807F14BDA0E41F95ED1C0FBE0C7AF1773FE98C6690C88D1E773
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	472E73F9BAE33D8B350FC89BC7BB8203	F19968A86C3A8C06139D5CC9EC4F72E9293243D0	41576CF75F0FCD03A866092EC806FB347D1D7CFA6945239AAC187FD73F286FDB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	A31BBDEA1CE832F68023E8A03104B868	24A7AD6444113BA88B9A4C94138AF182ABBE730A	8C3B351F1CF51401FC28FC8B04C241B72260F48323153ACE5BCD5CD04EAC26F1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	B5EB5823CD60ECF00F89E7B9100F00B4	BEC8AE7A9FC63B893160B320DAE1CADBF7D14D4D	80C9F7BC6E1FCEEEA6E42CBC3086EFEDEF90C1CFDF52AD1F3C4915DB9116802C
C:\Users\user\AppData\Local\Temp\MSI9a49d.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	69293F46CBB09DAE50E2ACE67965DEB6	8C4F57CB3B433B6ACD6239CC65BD4FF6A88D201A	2A2FAE96FA49F370AD9C0DB324DE5A8190E4B3F108869B1B206FCA268A94FE72
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91muqody_1fk5r07_ek.tmp	PDF document, version 1.6, 0 pages	E133C32ADAB3036C1655D7B185A1CD68	04D9038D4E64E6B884071A396920A3C852AAFA9C	F2C9899BF05EA983CA68F471CF5A4F51F01B426EF8FCDE0874347A4EC8677E4D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-31 04-19-49-398.log	ASCII text, with very long lines (393)	F49CA270724D610D1589E217EA78D6D1	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	ED698AFD52998B897498B4516133C4A6	5B25EF0B4D684B9EDA52D0FFB6893CFC41A026E6	A5A2D335874BAF688A92DA4560A033794CDFEDE19F0AD20A9B32BC5E092262BA
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	5961C445F2453847F09366FFC37BB744	575ABD5E342DB0DA74D92D4F479287D2736D1F9C	0A903A663488C02C54134681D4F576722A1BF917B5A473BEB94384A552903276
C:\Users\user\AppData\Local\Temp\acrocef_low\760da1b3-e74a-4637-bad3-542e9b400a5a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\8a20341b-2fc6-4dc0-ae79-aa21bbfdce2b.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\9606cb15-703e-482e-bbb8-a27b1c306f64.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	0DEB641F638584E0D369B736918ADE0D	F28C3A8DF2F27ED0505D17C146DD4E3B3D02585F	3FCEA64B11AADB53C8AF1073FEBAAEDB9CD9489CF209A4C091F7C16BD62302BE
C:\Users\user\AppData\Local\Temp\acrocef_low\c7c2b035-04dc-4a77-ab36-debdf4594d95.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	FFA982D6F2F9B46A1DECDD28BF3EF0E1	B1D05ED9BD6A80BD0E3377E9F62B47EF83FCC0C8	93D954FA4BBEDCDFBC7BF14FA1BB3986056261F4A5035C3CFF229FF16D12B78B

Windows Analysis Report
report_dc93a548a752332b6bc69b06e70fd90dce376e8d.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report report_dc93a548a752332b6bc69b06e70fd90dce376e8d.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
report_dc93a548a752332b6bc69b06e70fd90dce376e8d.pdf