Windows Analysis Report
Trialog 28.11.pdf

Overview

General Information

Sample name:	Trialog 28.11.pdf
Analysis ID:	1579405
MD5:	6954e94ea779383b5c7a3274d652f5db
SHA1:	8c2be521875d64e64432b3e1b1e51a6057a6fe6c
SHA256:	92083136652655590249c43efa3a84b8378971982353b93ffadde232c73a055b
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs DNS queries)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: clean0.winPDF@14/51@1/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-22 01-20-41-487.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Trialog 28.11.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1664,i,17986111413712263075,3581551862786602674,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1664,i,17986111413712263075,3581551862786602674,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Trialog 28.11.pdf	Initial sample: PDF keyword /JS count = 0
Source: Trialog 28.11.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Trialog 28.11.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Trialog 28.11.pdf

Initial sample: PDF keyword obj count = 148

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.58.101	true
x1.i.lencr.org	unknown	unknown

ID:	1579405
Product:	CloudBasic
Start time:	07:19:39
Start date:	22.12.2024
Sample:	Trialog 28.11.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	6954e94ea779383b5c7a3274d652f5db
SHA1:	8c2be521875d64e64432b3e1b1e51a6057a6fe6c
SHA256:	92083136652655590249c43efa3a84b8378971982353b93ffadde232c73a055b
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	375D6918766FD015A58DD5A0058FF777	361DB8802DCC04AD152A2689DD574AC34F6E04C0	5CF02B7F0EA0C31307655FDF81FFF1493C4A687A5D7851A0FD312C5B43352974
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	375D6918766FD015A58DD5A0058FF777	361DB8802DCC04AD152A2689DD574AC34F6E04C0	5CF02B7F0EA0C31307655FDF81FFF1493C4A687A5D7851A0FD312C5B43352974
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	DC27511183DCEA3C155ECF8E497B3E1E	34A52A3B19BCEEA043E8F202EB049E416B8583E5	DA0A7B9C5FECFD4887BE9C96D19D24E3640FF6919788C864DCE75861D6079458
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	DC27511183DCEA3C155ECF8E497B3E1E	34A52A3B19BCEEA043E8F202EB049E416B8583E5	DA0A7B9C5FECFD4887BE9C96D19D24E3640FF6919788C864DCE75861D6079458
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\723712ed-7dd0-469a-a928-7ccb345c4972.tmp	JSON data	876E29ED1155AD270C65259ECAC84E82	21E5F36F5A8242779AAD826F33CB40D1F9DA832A	F0FAE3D5F96CD6B2D979AC043E6F462A251AC966536776BF200BAC2B97A119D4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7a6c4464-d314-4dd4-a942-eb2f25e3970d.tmp	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6ce1d7.TMP (copy)	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	9D566A59CD3122682B3D235D015628CC	07C2A37EAF3067896321844A6E9FF2621223668F	5CA9F22B626C6745F9C8817BD7FE7C23E957DE6B82F5206365E3D1F08B698509
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	63F932E69D990B0C33A5062102CE1598	55F3BC5BABCB9279491D16AC046E14141986FC34	C55E0FA704B394F46D70F38F815699F2AC7CDD783F18E26A74963052141DBC77
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	63F932E69D990B0C33A5062102CE1598	55F3BC5BABCB9279491D16AC046E14141986FC34	C55E0FA704B394F46D70F38F815699F2AC7CDD783F18E26A74963052141DBC77
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241222062043Z-162.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	9C91C4FC7D08D592856E9ACF81DD3FEB	4DD4EC417521D428657BF6B24BD0447F54C586BC	FA42F3FF3145673BFA1DB4BA9FB2AF0E709F914B76386E07F770FEF3F104D95E
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	C6F15E00910A8D1C97178048ABF12976	D36E73B87728AD278450551E1ACE88F2EEA09558	6DAD9A01E4B3E799939116773241D82C7F7A43DC869F766925CDCDDF2922477D
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	DFA722E0C5BE5F903136B76D38A5DB38	A6C8644F3A628B7315661E64A5C954FF764207AD	0ABA8AA15E4A4A85928B0DF619A70BBA953D79E2368830E48E81AAB048357046
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	7EDF3C10DF8AD61F2EFC1FFFA9B7BEE8	551E916783942C8EA74C2A6704020CD250EF810D	65DC53601C2D9800088A76DECE4006FE459820759F4117A7B0D4E09547F3C60F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	34FDA3F35716296E5B814314F47E3ACA	00866B4E78D50C08EEABE9ACF028EA3D8A69A6FF	496609E160E2B5E98B72AC54B53534882F5A2A682BB266D216B2079FE1302E96
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7600	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7600	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	44442045A7DF5FEE21D93AFD2050E3CF	6C985B345F91C4B69A6A2DB48D5C7D993BACD5D5	EEC26EF4604CF39D98D26DB1C2183B6C6E06558629E33D698DF46157A6E6E56C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	C550573CE1D4261D1CB7B12688CC4993	3397E5C3C74643B7872319FF11B14ED2B65A6B9A	7F02F138049C32D6AD6FB6A282FABA985D557A7A5C24C50C9842EA97F992903F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	6982C1122AB49DDF59541B6B6CA590A7	CAE5A1F1055F45CB84310EEB7376AF2B2ABB8F9B	FFE4F3FBA6AA7094FDAFD063B9D618F988A542A3CF175EC1F98DA4B5EA17C333
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	8A706F2AF1365D329D86B5FE405E7569	2BE75339F292C0B21BBCC42B64B2F879D4EA620B	6F38D6840701DBCAE5061F532358AA711687198A99CA4EC6D98F54E8666D9602
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	ECA0660FC11C58A0916F6CDD6180B9D9	D0971663E7008F1DE4F550DEA0FA889642233B1B	1EF7DD388BBBA2498CED888DD5B846260387AE1E91CEDBCECD028A2A23661379
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	D6ED1DD034AA8E10934E9ED358A9AAC3	F81994AFC024733F850C25133BFDAB74542C3F25	0F1FD89A60238869F0D6066A6FB8187DB2A3606C3C222695A54D6F4C96183621
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	CBFC4F80E97FAB7031A8EF668415102D	E57BE82171C275209C5BBDA3369CF83851633C45	1D90B9159F3DF28099620942651522F675080C8E691C7805E916A67D5BCF19B2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	88525E89F9EAFC657D2A6F74AC9B2CE3	03910928994016C1BD0935E2A7A09999F6576BC1	D56AD3DB3F68F21E62E0DA9D19F25FEBF404E905ADEB4462B3C38151676F4D7A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	1BEDF4CCD75AD4C66EC9420DBE44D76E	E2603812AD011C160422BA9EE90240FDB1438172	8142C0368F0292D7E40997A99F6E9A27C32EA421F4E8CA4192B3AB3147C970DA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	659960CE729884DDBD4BA8AEFBAA8781	82A45DCBFADB8921C505775970312DAEE0B283FF	E209B0AEED0EFF2B331ACA9E3E9762E9423A8762BC266C5E50304EFB3CF56B3A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	8751FD0D095FEA730FCE5007BA2338CE	CE9C3AF4DB11401FB4EE74B83865401AC9267F84	4C52883621600721748966345093F744A3C2AF9A0BDB2F9A9970F2CFBF0CD5FA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	4434C106A7B895DD3B0890215936A013	0684D5D239ED7E32751D9663A16CA77A6F6F5809	E09F7B59D64B6BD2B19A892C5B9CDF76633A691317DCE7855D97ECB3A967D9CD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	B88AA90CC69DD9229FDAC036AF0103D3	70F40C748F34B7110FABEC85AEC82C7B000CEE87	63BB3894963E46840BDF081CA2C685C28BF6E549A237535FBCF2BEC07EA669EC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	9DD3A4006B673B458707F99FA8BC3FAC	3EFAFDA3BF9BEF6CD60CE1AA363C9A8B9717C2F9	27318311525EFA9942B9B376D7A3C8DE75C863428E48904DB0FFFC6841BB1B64
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	C965D7D23AB2FDDEFE52BC65B65DCE30	E1C39DF815D7C8A97F080FF52FBC2FC3C7A806A8	9C44DF67DE26AE3CAB9BF807C8FD7544B00710E5E49D5F12E99FFAB7AB00DEEA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	2326F2E72F602819A345D68159A5FD96	FCE62F16CFC1A842C3CB8A983636CFF66A29FB47	6DCE6D6D6B9D6E594FC125F5EE501C314B413740E0AFCBADB00880431DEE26AD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	AD2DC414F562B31496663BD53BD994C2	5CA65BAF72760C24F0E081E92B1A8E96CF1FD0CD	EF4F5DF6F1C413A0012791482093CD7AD2734F853F815661AC3DDBCE3AB1C771
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	92E9BC855AFB2A65B4DBE6E7826B00BE	B170E46632B3327D248ED3C2C48A6A0208DD895C	A43294C49EAC285076C87D6CC859A1FEDD4E143CE36F47422DB06AF0ECECEFF7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	867B1D7240A3D29F95D18468D69E04FF	EA4CCD7C1E5E35565748EC07283E9C9CC282D269	1414E3DF2102F558C95E4C101AD066A01BFDEFD8CB5F4256A42ED05042693E11
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	82E279182AB27A74ADD1843A96181D6F	FA87BEB97C3427C4AFBF08A3F1359C97AAE4BA45	B3CFE023965014680944C042EF9EB28C8B3092AFD12948B97C3922805E2F86E7
C:\Users\user\AppData\Local\Temp\MSIca50c.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	0466FA92F0769DF5C0C769131777DFED	FBDFE683BB178A4CF6F1C8E9CC5EBFD52A9735FC	CA750B434F5A80C64EB2F3212FEEABE9B92421643FCE3A2ED3104AEAC301DE27
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-22 01-20-41-487.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	B7DE6B36E606FE2A592E49B796B0D74D	A87247CC1C8E516067A8A26533239FAFAD0E95AA	35F77BC9840AC0573727DFC0A17FA1105918B5427A748E3D40C27584A31E9185
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	8CAD41F504FD66BE729238A7CF6F115F	1A3C4EF64B02713321538F75CE2C8AD1F2F34AC0	4EEC97A4483A79BF862BC2A1436B6635B2A2F17980F735636BBF40C9ED9AD627
C:\Users\user\AppData\Local\Temp\acrocef_low\2c3d3169-29ca-4b39-9c51-19d7ce7a4a22.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\39f52eac-5153-4977-84dc-654adb6c388d.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\cf25cb5a-872e-4b99-8194-b168ccbaeed7.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\f6395958-3254-43fc-959a-aee1373e0bc1.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	CDB0A9F62FD4871F0603FBBF1FE6BD06	C972A2B8E6E7CD72A156C1EAB8F5F31E76A7DA24	85BD3F2168D078DFF0ECEB670C3DC651E8797522C6A2921EC478EAD5A09E415F

Windows Analysis Report
Trialog 28.11.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report Trialog 28.11.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
Trialog 28.11.pdf