Windows Analysis Report
nference.pdf

Overview

General Information

Sample name:	nference.pdf renamed because original name is a hash value
Original sample name:	9th Annual European Medical Device and Diagnostic Sales Training and Clinical Education Conference.pdf
Analysis ID:	1524028
MD5:	c29f553dab871caf1c324a362b9e9496
SHA1:	50a9a32815e697ee4d5b05b2487ca5b0beff7ec4
SHA256:	5d491cd99ea9efbda91c8f304ae498f7aeef140aef81f7ac77851fc67f64a9d5
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs DNS queries)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr

String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: clean0.winPDF@14/44@3/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3980

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-02 06-21-49-223.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\nference.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1748,i,17802959422580266742,13211954815294876157,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1748,i,17802959422580266742,13211954815294876157,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: nference.pdf	Initial sample: PDF keyword /JS count = 0
Source: nference.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: nference.pdf

Initial sample: PDF keyword /Page count = 19

Source: nference.pdf

Initial sample: PDF keyword stream count = 192

Source: nference.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: nference.pdf

Initial sample: PDF keyword endobj count = 366

Source: nference.pdf

Initial sample: PDF keyword endstream count = 192

Source: nference.pdf

Initial sample: PDF keyword obj count = 366

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: nference.pdf

Binary or memory string: ZW^^~QEMUi

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1524028
Product:	CloudBasic
Start time:	12:20:45
Start date:	02.10.2024
Sample:	nference.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	c29f553dab871caf1c324a362b9e9496
SHA1:	50a9a32815e697ee4d5b05b2487ca5b0beff7ec4
SHA256:	5d491cd99ea9efbda91c8f304ae498f7aeef140aef81f7ac77851fc67f64a9d5
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	4237B2ECF28C68ED9222A706B86FA76B	E11A8A7BE5367836BD4557826323CCF53A168B2F	0F3E3F308CA49F232DDB3E44FB36DB2C0B043DE7E3C11A97889AFD7276EDA69B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	4237B2ECF28C68ED9222A706B86FA76B	E11A8A7BE5367836BD4557826323CCF53A168B2F	0F3E3F308CA49F232DDB3E44FB36DB2C0B043DE7E3C11A97889AFD7276EDA69B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	57E70970C8C55A53FB18A8C2AD082E4F	2AB60BB9E33AD44BFF07CDF827DECBD114DD5501	DE8714BDB520642A0F34F0DBAFE935CC098D8178C93CBB61426710E7870EA60F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	57E70970C8C55A53FB18A8C2AD082E4F	2AB60BB9E33AD44BFF07CDF827DECBD114DD5501	DE8714BDB520642A0F34F0DBAFE935CC098D8178C93CBB61426710E7870EA60F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	28684C3CDEF4EF4BEF2C5B5183CEFBC3	5CCF09F07D16CD1296F8DA19BC25429EC38ACA84	10DCEBAC75A33DAD38FFFBB7376D1A54E3307D127B21EA253269B7AE9502B0FD
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ee492608-dd81-423d-aab2-caf9b4444d8e.tmp	JSON data	28684C3CDEF4EF4BEF2C5B5183CEFBC3	5CCF09F07D16CD1296F8DA19BC25429EC38ACA84	10DCEBAC75A33DAD38FFFBB7376D1A54E3307D127B21EA253269B7AE9502B0FD
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	D0C4D276466E584ECE5D287B2A4247EE	4A67F7614BBE87008B93A7543FEE140F757F54A4	A8A09C05D430B97D93AE5D659243502FD4EE4A35318DC197F652AA8FD00ACD1A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	511E6B09E44891045B83DC7B60B7EE59	AA629774168098D91450D81C5394AD6F1AC5DB7A	3F51EAFC7A34D9F128812706D30D760C29FBA500D3CA12BB116680FB102DCB66
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	511E6B09E44891045B83DC7B60B7EE59	AA629774168098D91450D81C5394AD6F1AC5DB7A	3F51EAFC7A34D9F128812706D30D760C29FBA500D3CA12BB116680FB102DCB66
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241002102151Z-155.bmp	PC bitmap, Windows 3.x format, 164 x -116 x 32, cbSize 76150, bits offset 54	B6650A80E357B9E75665798727AB6157	B7E3AB87F6DB1DA1C68F04A422C4D112FD1429EE	7AC578FF3700A3F92C6E22EE7193330C49AD7E689A162F97558D08A9AB3E6A17
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	B6A6A0BD9F449BE4255F5FC6D06EB946	AED8EC2A2AF7FE424D9C146B1A1535DFEFFD7FE4	5C346A89179B86EE8985622104F92923C6BACCF183A271F051ECCC0A692F1BDC
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	8DE6594BDBC519F0F0BB52B6BA2EFD4F	A914ABD344EB19F89108652F1A4774A25421CD48	58FB2FEFFB0C6973B124F1E6794A4D6228C7CB89A3FE7AFA58483D046ACA6A1F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	8DAD6B01652C1762C5FD9351F9FAF934	B4BB4621DCDD2173641306D7F55F4D96F6B0A60C	2356192211E32F2812D26A31F92F2D73598651C9DB45C9CB47334DBAC160761A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3980	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	576CE44A1F5FA5BCD4FEADE0DADD0257	42D108CF4544C9F56413890CCAF38EABF3280258	F3F16C1D7A952DE603420183A81D394AFF013ED02C3279437D7623C11577F0F5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	1F54B9A87E6700FAECEB78A805DDB4D4	C11477BCB5C4C06F08E45CAB9DFF25764302C0C4	ED0E6F518C58BF80E35B343D330DDF9CD3E5DA741174E1C520ECAE1A82C77BC6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	485DF39FBFE7B92E6FF8DB1AE38BC2CD	BBEB20BC54C818E71B98A0C0DF84A024B67CAAC4	EF47DC950048CBDD1A24BF52A4D957175F0A9C8B06A83611F95B176E1EFA3DEF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	F2C39B9807E73832C2E2571FE8E19A0D	5ECB3F6833008359A41EED9B11831766BC1067C3	175FEE9F86A96BF2DD1E04EDF3899FF9CFBB8AEFA3675495EC2A12A78CF11BFA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	E018BC49A7950D7B51D1A8CF97203968	EF2193920F0B83569BF2BA4DDDA33F19F48AEEAA	566F508B358C1920E06172B299BEC437D802035A5F0704D6FE2F2F6CEBF6E093
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	AB941D1A945592CD00724818A0B41B27	1D38BDD16FBCD1081CC770C874A93B317544D77A	3AB364434AF86329620C67D26D4AF7211BFD080DAFA081DA439700E015DA1704
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	7044D1E8419E375929F032E8042790DE	9461BA3D92007A30CC3914C19665DB1A88405CDE	D4B562B781C52BEF7896C65DE235B830E94EDF518F4D116CB79FC5E544154BD0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	95CEF73789FAEB926F9B7149838525E0	43B64AA7A13D4F2333FDCD1786B9DB37736D7224	359D9C4D77FC57EB92784ADF9CB571A5308666E86D2C68D299ECCEA99B87B4A1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	968967483E3A5016EBFB84ABDF901023	63340D9DCE4714A294F8F372D9ACF7D0EABEC1B0	A3B511E47C6E2B723D1680D30D095668F35CE7EFA41D9A91F6DA9BA4F2BFF68B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	213C3DDA86E07AA8C9F8AF7B31B6CBE8	E8133DF1E75A06798C46A43022D60118D740590F	1D6A9DC1C661EB9C71F50063A5F173B4E8B612D3109949AEDC8B55FA3A73AD12
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	E5EBDB72DCF4AFC4BCADB1EFBD1127CB	47D94575D2400F7497619D9A4D976BD5CFA5FD6E	505619A40CB3DE75BDEEE2D63EA9BB75E5CACE9CE4E72E594019B7D77667C5CC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	4F6ACB32C1AB43EDC69B0F2B803C3DD6	2F80B96384330C256A6FD140EAF7AC6D997B88DA	F41D270E898762DE5E6E8707213AB6FB990D5F586383675B1348393279EA38C2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	5D7ADC3CDBFB9A09164E8A85C1F3EEEB	AF22991DE875BDCAA9594C2E1055419EF1F2493A	33A4BDB82524F89C1F13776162B55656154E45B56B2B2214CD938424B793D5EE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	DA5B6BDC5D6915EB0FDDF3B195B7F29F	766C0E2A0FD31B1748B57E1348256503BEF105F4	81AF9694F4C94AC3FED17293F70F5A62E1846615B71471544F8AC93FEA7B114E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	458F0F4F833A1E8E03078337D98B880F	69D04AF97E6367A7E68E6A97140AF59DEE339BA1	AE11C81D9C92F3C0148C5FC7FB2B0DDF36895B4D3E5101F05F1A0B52AF96DA8F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	96B40DD95BA9C908FE6BA4B82CBDEC59	03F914B7D2C6499DE1322119337BCA096E6DC721	5E053A24380D180210E73D4DBABFA0335D72EEB34FC2DA439D1BEC570DBF3F79
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	D43CD08723A6FF932C25A25327DD3FF8	33B5467B53E6299860BCC0B13738C476BBD5018C	620F25BA0B1A4D7532BC52D486786BF4B32FA40C1972CCB169EBCF9E00348FBB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	5E80C1A6AECAFB514C0282237439D176	9245EA9E1B68E2A6D11768BAE578A9CEE07CA2D8	B646EAEFACF20DD3370E00B1732E5AB0EBFBF5B9EB57C500E2CFFD196622D101
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	2169AF5E21E23CACA8617FE28AC85E3C	2336B37512F6AD1CCDE6DC8A7849A3C19F3D25B5	EA31BA0088E3EC17C5911D640287035FA4CD131A1E50C6B2B2D23F08F5F70B9E
C:\Users\user\AppData\Local\Temp\MSI753d5.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	7478038AB631BD59BD70B5A96F32E86F	C731FBBA98C19A5AF247DC1B23E76D52AF87E9A4	EB7595B069832557C009E0FCE9FAB9F49C03310EDAFA9DE57523CFAF20F73831
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-02 06-21-49-223.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	1603DA1E1958467146595B21C20A00E7	7C158BC78AD7771E6C99C4ABB875520C7F4608CF	01A7B0B424A6A3B78042C61DC6E164CCBB62AC04F399620D90D3C1C1D9B377C0
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	65582042C4EB263F094A881D4095200C	BCB5A35DE3900A49F662606F9BEA2B59480DE3A1	556A7A8DCC966DD0F97B78BC98A4E83EFBD8EC095CED922C6A43383DF76EB229
C:\Users\user\AppData\Local\Temp\acrocef_low\075a9cc8-733c-4c98-9d64-8ece926129c7.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	8B9FA2EC5118087D19CFDB20DA7C4C26	E32D6A1829B18717EF1455B73E88D36E0410EF93	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
C:\Users\user\AppData\Local\Temp\acrocef_low\2f072b9e-3b78-44fa-bfe9-5ceb58b95f90.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\74924284-135f-4138-8875-4a8d79da3f3a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\83631ba5-05ee-4d14-84fb-650475fe11dd.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B

Windows Analysis Report
nference.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report nference.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
nference.pdf