Windows Analysis Report
Fedex Scan Y;29tbWl)zc2;lvb,mlu,Z0B)2c290L)mFl;177-signed.pdf

Overview

General Information

Sample name:	Fedex Scan Y;29tbWl)zc2;lvb,mlu,Z0B)2c290L)mFl;177-signed.pdf
Analysis ID:	1524350
MD5:	61b61a032a0cfb3b4d57ac7103bcb64b
SHA1:	41cd2232903e82417ae320baedb05e2ef1814973
SHA256:	da5cbe2f356e8958900f666fc4dd72eb8a4cc060b8ba196c6e35b8dced3fa449

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

Contains long sleeps (>= 3 min)

PDF has an OpenAction (likely to launch a dropper script)

Stores files to the Windows start menu directory

Classification

Signatures

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 28MB

Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: classification engine

Classification label: clean1.winPDF@49/69@1/120

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2824

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-02 11-44-43-479.log

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Fedex Scan Y;29tbWl)zc2;lvb,mlu,Z0B)2c290L)mFl;177-signed.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2248 --field-trial-handle=1592,i,491027021382810470,18401027826524376712,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2248 --field-trial-handle=1592,i,491027021382810470,18401027826524376712,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.adobe.com/go/reader-upsell-scan?mv=in-product&mv2=reader&invc=floating-toolbar&tl=ScanPDFRdrApp&subtl=ScanPDFRdrApp&modern=true&SCAMode=Rdr&DTProd=Reader&DTServLvl=SignedOut&ttsrccat=RGS0263ENUControl
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2016,i,16908384908861861738,1744630284485348241,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c --type=collab-renderer --proc=3896
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c --type=collab-renderer --proc=4684
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c --type=collab-renderer --proc=5484
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.adobe.com/go/reader-upsell-scan?mv=in-product&mv2=reader&invc=floating-toolbar&tl=ScanPDFRdrApp&subtl=ScanPDFRdrApp&modern=true&SCAMode=Rdr&DTProd=Reader&DTServLvl=SignedOut&ttsrccat=RGS0263ENUControl
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2016,i,16908384908861861738,1744630284485348241,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c --type=collab-renderer --proc=3896
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c --type=collab-renderer --proc=4684
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe" GetChannelUri
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe" GetChannelUri
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c --type=collab-renderer --proc=5484
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: apphelp.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: vccorlib140.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: msvcp140.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: appcontracts.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: wintypes.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: cdprt.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: cdp.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: wldp.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: umpdc.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: propsys.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: dsreg.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: msvcp110_win.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: onecoreuapcommonproxystub.dll

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Source: Fedex Scan Y;29tbWl)zc2;lvb,mlu,Z0B)2c290L)mFl;177-signed.pdf	Initial sample: PDF keyword /JS count = 0
Source: Fedex Scan Y;29tbWl)zc2;lvb,mlu,Z0B)2c290L)mFl;177-signed.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Fedex Scan Y;29tbWl)zc2;lvb,mlu,Z0B)2c290L)mFl;177-signed.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

PDF has an OpenAction (likely to launch a dropper script)

Source: Fedex Scan Y;29tbWl)zc2;lvb,mlu,Z0B)2c290L)mFl;177-signed.pdf

Initial sample: PDF keyword /OpenAction

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Contains long sleeps (>= 3 min)

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Thread delayed: delay time: 86400000
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Thread delayed: delay time: 86400000
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Thread delayed: delay time: 86400000
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Thread delayed: delay time: 86400000

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Thread delayed: delay time: 30000
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Thread delayed: delay time: 86400000
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Thread delayed: delay time: 86400000
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Thread delayed: delay time: 86400000
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Thread delayed: delay time: 86400000

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.200.0.33	unknown	United States	20940	AKAMAI-ASN1EU	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
216.58.212.164	unknown	United States	15169	GOOGLEUS	false
184.28.88.176	unknown	United States	16625	AKAMAI-ASUS	false
173.194.76.84	unknown	United States	15169	GOOGLEUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
2.23.197.184	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
2.19.126.140	unknown	European Union	16625	AKAMAI-ASUS	false
52.5.13.197	unknown	United States	14618	AMAZON-AESUS	false
23.56.162.185	unknown	United States	16625	AKAMAI-ASUS	false
142.250.184.238	unknown	United States	15169	GOOGLEUS	false
142.250.184.227	unknown	United States	15169	GOOGLEUS	false
18.207.85.246	unknown	United States	14618	AMAZON-AESUS	false
2.16.100.168	unknown	European Union	20940	AKAMAI-ASN1EU	false

Private

IP
192.168.2.17

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1524350
Product:	CloudBasic
Start time:	17:43:33
Start date:	02.10.2024
Sample:	Fedex Scan Y;29tbWl)zc2;lvb,mlu,Z0B)2c290L)mFl;177-signed.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	61b61a032a0cfb3b4d57ac7103bcb64b
SHA1:	41cd2232903e82417ae320baedb05e2ef1814973
SHA256:	da5cbe2f356e8958900f666fc4dd72eb8a4cc060b8ba196c6e35b8dced3fa449
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	4E86C78E5401AA9D4F5F1404BE9E65B6	CDA10DAE28C40D4AED7E319067D5D7BAEAEDD866	1D4E8E94D1273E764381E0297E12779297A06EFBC4995C3DD648350E0E3479F4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	B36DE1731C6F364E2BCEA9B699AB4AC7	6CF83F1AEEACB235971C0C59420F2BDD1C631926	9FA2206031437F1160E8D43FC3DC7C06EE4091ECD0B06EBF8D1C4241FB0B18EF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\587bc1f9-5ee3-4271-84cf-92e41d98664b.tmp	JSON data	C45D427B83D825EA9124B9C14096597F	BC9E776B6542D2D4E1034E2C5FDE5D2616AD4133	3C0C7C8BF44360A6C03A76C8DC19A2C3F48EA389CE79601019068ED862B5F967
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	929CC6E99547126B372398AAD499520E	9E80FB95EE9FD70D36091AF14FF89552081504C9	6570DBFDDC047BD44B216BBC3AA00C4EF095D3E3120304F7FD277E8B472B7A43
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF65b77d.TMP (copy)	JSON data	929CC6E99547126B372398AAD499520E	9E80FB95EE9FD70D36091AF14FF89552081504C9	6570DBFDDC047BD44B216BBC3AA00C4EF095D3E3120304F7FD277E8B472B7A43
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a5b3a7b4-f141-4237-bf56-a5dab0e7f292.tmp	JSON data	929CC6E99547126B372398AAD499520E	9E80FB95EE9FD70D36091AF14FF89552081504C9	6570DBFDDC047BD44B216BBC3AA00C4EF095D3E3120304F7FD277E8B472B7A43
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	7FD8F91F88AFB1B8C38CD13519224496	13C6827EE8B834A9D4ACFB662EAD8B0128DA5BFE	31DB40502A566807F61462149FA372E7777A08D62A20B1439423800077DB0309
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	D88D52CE3BD83A559870198C7A4E7492	E4001078D10192BED6F15E3A0F40E721649E5B90	21A79285B3B7863D5D9461E1549B4D0A61F43CE92297ABA630F7CB597060C439
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links	data	2CA18D8392674A893869D1D44678DF8E	90760A4B3ED87707597EB8F56AA2F22B152D6282	519F61F1891B02662B71CB896F4F38699F17C95DF0EA4DF2A797F62B73D53217
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000001.dbtmp	ASCII text	46295CAC801E5D4857D09837238A6394	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log	data	4E5714CABB1AF70C101D65B9A0DE00D4	9D3F38185CE8C1EA257833F26AF235B1FF4E99FB	3FCC20ADB132D7F2D935EC5037C159E426B5B732B56C60F7C22A432B532A6B00
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\CURRENT (copy)	ASCII text	46295CAC801E5D4857D09837238A6394	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG	ASCII text	5102336A6501E28406C5126F8EF1F5A7	CDE67D5A4DF9F2F281DB77194D53B2F2F8014130	307534B80D8346FF1303F5906C363EBCAA01A6B04C077A63A11FD78DB08847C8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log	data	A05963DD9E2C7C3F13C18A9245AD5934	15A87493591860C6C22499DF3A705ACB3CB466BD	F40B7EF0FE0B676871403B8DD21CE42AF8E482DC8B81F09D93CB2C48CCD112B4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG	ASCII text	4EDD21730203035E2FA0883294C5705D	AC1BCDB7DCC155325E30540F4E9D0EDA83C99136	4F93299ACF26799AD172642F27FB4EB8A827BF0ADBDF18D511E8ED17B265609F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\MANIFEST-000001	OpenPGP Secret Key	5AF87DFD673BA2115E2FCF5CFDB727AB	D5B5BBF396DC291274584EF71F444F420B6056F1	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\Eureka\AcroCoreSync\Adobe\CoreSync\EntitySync\80307f885d209ff3421f3adf000d6b1e.db	SQLite 3.x database, last written using SQLite version 3040000, writer version 2, read version 2, file counter 1, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 1	863BB379B267B2404CB64A3BC9B4A650	139EDCE2C64569B81175543D1DE743EF474F4432	F7C1BC02F430EBD015E45159D9FD9E18643C4CDCCBB7E7733A248C8393CAA88C
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\Eureka\AcroCoreSync\Adobe\CoreSync\EntitySync\80307f885d209ff3421f3adf000d6b1e.db-journal	SQLite Rollback Journal	CF6CF19538B0CAFB4DB12436F05FD38C	649F8CD8B72EFC59C55E8675DF0A46E423584E2B	815F5F2C9C88DF67CBEAD0CB1ABB997E59E3C0096272449EADB1C344410445B2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\Eureka\AcroCoreSync\Adobe\CoreSync\EntitySync\80307f885d209ff3421f3adf000d6b1e.db-shm	data	FF52F43B9F66CE04CBA3CE69CFD7F166	131475B853FC4885B5654700D06E58E9BC7AF4E7	8DCF0B418636B3113CB7F009E9E6C5E231516750D8E19CDD7B66A1B2C640BD87
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\Eureka\AcroCoreSync\Adobe\CoreSync\EntitySync\80307f885d209ff3421f3adf000d6b1e.db-wal	SQLite Write-Ahead Log, version 3007000	14D7D2DF204541AFCC79C706840D5B5F	17D273546AF1F3C7F4237629295BFD64FA9EE8CA	B0CC07EE5AADF14CC6AFBF57CAC460F2D5462A734C43C2432F32CBC69C3841CB
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\Eureka\AcroCoreSync\CreativeCloud\CoreSync\EntitySync-2024-10-02.log	ASCII text, with CRLF line terminators	2BE612F2287A4E878A78DA48AC4FF38A	EFDFEEEA8893E2E6290A7FEAC5F55521E2A2A4CB	28BBD3B08FC4C6500EEAB5F561AE0A7192D1A55215D816197461D0C5BFD5D07A
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\RFL\LocalMapping\RFLDB230	SQLite 3.x database, last written using SQLite version 3040000, file counter 1, database pages 8, cookie 0x3, schema 4, UTF-8, version-valid-for 1	F391306DD8BAA3198B26D3C80A906E19	6CD1B24D186F1CC68BF9097177DA5676C4A56422	62604481C477AF3F8813122011B9CEC6DDEE9A3992F3FAFE236E3E92FC62E680
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\RFL\LocalMapping\RFLDB230-journal	SQLite Rollback Journal	B3DDA0442937F86B2399D376D948C37B	0218ABB261F5F3D790222143AD9D6AC9D99AB479	6594E6FB7B232FD713129FC6B4109116B4F2047ED01A8A7EB6B6F1A48FA35E4C
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241002154453Z-427.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	A24CC78FBFC61CBF828A276818D75870	57D36FD183DFAF9E648E75C79780DDCCA0695C0E	96609433E493A48692542CAE356AF1FF782B33FF11CE18BE926DF5933E7700D3
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 13, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 13	406A1F34899287A2C2D086730CF9EFA4	7C7CFE70E8CDFD982A825C3E4A50314EEE61050C	866B205CBD4821CA5BE077896328F0E9E905BC11367986771002E48B79C83EF5
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	65427806F64AB75F38DFAD1DB78FD3C0	91425E27981C61F82D343F4E7C5F903F08BA82BA	8B2EE1BDC679BEFB5C87EE5C7F91DDC986782967D21E373B6BD2D76607F49D11
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer	SQLite 3.x database, last written using SQLite version 3040000, file counter 1, database pages 23, cookie 0x11, schema 4, UTF-8, version-valid-for 1	DCD066A1C8CA38D94ACA4E5DF6CA20BF	0C670E7CB31FE1CFD952082C3629AD8861BFD799	E484D26709945669E18A3D0A7F95E3EA943D4170736EDD8FEDFE3F69A7B8D25E
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer-journal	SQLite Rollback Journal	4A3A5BA44A162E5AEAE74829B31453B3	49C1AA3AFBD0B589C62F3663C26BDFA4511D69FA	72D14B9291550C330BC39B466BEB57D943D7D9366BE85D7F5A064B5F0F72A25E
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	CDF4A18CAE7FA9302955BD6E684EC8AA	91B99FC6EE64DDF1748E5C38A352C3F37B6D718C	0B8F842537D370BF806771D589579D9AED13FFE6910D152759A2132B622511B5
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	987EB07A7408223213C27B14B252D929	0411469A5DCABE0A88FB2DC45B09976D09F224DB	9102B364764B71C0F0B6FC64C86E4CCA7251D3093146F0023B5CF602B1212B5C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2824	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	3AB2595A56535F43694A84FB93A5CC66	B8FB6F13CCB5B1B48109144224A62023C67BA12A	7971330A5C7AB2D0230E6DCDCF5268DB8873F1C00663E86F87E11F60E198A063
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	ED45A0F5DF185CD2FC36EB171C1D7F08	315DB48E1AC056FED34B472CA84D4AB51A867C61	A2AA87EAD31453DD9A8869B0F770CDD5CA0E256BF08ABC8A8DFDB58FDEBC9485
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	764F36A34A94D51620CD310D25DA2895	8C5D05C32D0F43CEBDF3033A69C27C84D3A84530	1E4B881CB453F2DCD84E85A2D06060289CB9269DA0DD190FD68CF2DEE0288F46
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	269CB3127BF8AD5FCD15B9DDA0579C2F	C658E058E8E238E7DE95E02703E4FB422209DFBD	5AC9157EE4772AF22D1C435E5529C069C5EA2F4A2B3A2B17CFE353A8FA6D4A4F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	5CC3F7DC1F83CEBF87205F6D00BDAB75	BAC5BDE732505252A9F3273ADBF98099CA508905	AD076FCA948EE7185D3C6960DA7687DD26D9D85AB83B3BBF6B81D16D7D087786
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	AB88B0D6068FD948DCD88F48657CF4E2	712A9C317E0AE3DCCE01AC6503F2D8F49EFD78CF	C3AF6DF286324BFC163EDB27B166D5123196DCC76BF7AFDC2973CDDB8A80F0EB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	CA414C9905EA8AE07E2F62BB3B072F5E	FE7394CEA005786823638C45FDD93244EC8EF7DB	FBAE642DECE158B539E6D4DF4C167F41DB112E35EB760D2734728333AF92A752
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	38BB1FF1CF01144F42342F10D6146F3A	AAF391D2CA3D7EDE8BB9196CEAF4DC8289B8A066	0C7796E0A30D2A57F41EF5063BACCF0FA2C35F0F7D4A1526F45179E4E1A120CF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	39C611710572F2A1A663DC7B3FFFC372	B47BF502EABF74C1DF67C075FD10D12CA6DCDBEF	465FCE3515A804CFB6FC8F34BAFCDC031AE92427BDD345267ED1D48FEA935A0D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	0275D6DA6C07BAB698D2EBBE046C07C9	F8579ED939D111F3F0EFEBC203D1C5AAC1E3AEC6	E19D3E3EB48F4CFC0636CEAFD98DEBFE0CA0871D18BCFDB103ADB4321D1228CE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	325DE634F41019A2CF5AE0983AE0CDD5	3B3B88D136FC92F52EB1F050237D32FF0EA91357	FC142210F99DD604D91CB4F1FAB937695C1D47B239A351670252459130CC7B67
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	944F4166948D02DCD462D60980195FA3	23960E678BF378CEE3AAE2B80F7D2B5C966CD742	4CF81FD3B1B8D4711DE4856801C02D5F14A38C13D377D2D99D138D45682912A2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	B0AC3940C4C003BE24AD046005745295	8D865F62D5F5FED1344F4B5232FB647A36200858	5A9FC14E6A7E0D918BE83E08E292EA79681CBFA3F2EE75FF940B8F248EC9D4CC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	C2822D02E39ACF652B6E7EF30708F62D	7B4F4DB4AFD034DAB3283BDDF386E2F47E0EBC13	6085CB4D1613A648C8650FBCEA7E0CE754B8AC596344DEC2E23FDDC4EE324740
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	93604683E8910989F9D06FF92197D730	E8E9A62699F7FDE69D306724FCE23C1BE3F470B8	BE6D783EDCEA46D16C2C900A6DBAF04DC2DDFE611679D9DC9BE6BF1DE36FE950
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	CE67CD187915AABB731844B5D3CA7D28	7768EF969055B686508F1D4F7A72DDC6971BE0B1	7F64F61C6EA77DDF5B10AF383323C158FE5EDFB7183F14176ABD09DBE42DCA37
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	BBFFA12A00F1A118CD88E05D718EFED2	78DBC11C3933D92B8E3A4A15A4C3AD9D4B40BA81	2A0DACC6E0251918487A527133EB8E1F95D363D8AC7427F0E509A21DEFF9F34A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 23, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 23	9BA7A8CEBAC50881F9F1566CA95DBA91	EBC3432083086EC05B2BC89A76BF66015AA8E0D1	517A14CA4065057F3D0D227ECDD49D8C2A3F0BA3F7116573CE29CB70C5286E69
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	6B1218FF4C6EEDCB7FCF086E3FE245D4	B59806310B17A5D7504D14A8437801262176077A	1110826F191989BA4B833AB32478DF3B73DF99B549674403BD0369F29C8FC4B7
C:\Users\user\AppData\Local\Temp\MSI518bc.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	6A9FDA47D33828BC3ADE74C2C040ECBD	13DB4EA3454FE83FB5CB0B0F9E839B8A0C738CDE	2CFAAE84812657DC1C13BAE81EC9216428E14BCC828AA179332A16C95D8310C4
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91f6i5kk_159499w_26g.tmp	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)	BA1716D4FB435DA6C47CE77E3667E6A8	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-02 11-44-43-479.log	ASCII text, with very long lines (393)	06DEAEDB81D09FD8FB5FF668D8E09CB2	28A02BCBD5975117B97A08AFB049F2C94F334726	D98DE785425112A2D7A41B16073812FA4FA4955F2D5139AE87C9A5FBC4717D64
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (392), with CRLF line terminators	BAAA097A78B7D695A0CE7DB57324C9C5	8D7323649C8957B506B6B7F61C8E142518F5B121	EC63CDF3A75910E5BDC06328883D3024A8139B9816E82A5AAF6444C4B43F5F57
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	4186E5BC91A80E3E50CCF680F7DC4880	337E960122B88697897EECC714D8D30C2A79B49A	167F2473EC94929FCE286599ECED12046A71A95821B09047781D0ECE54CD1E37
C:\Users\user\AppData\Local\Temp\acrocef_low\3af49705-d360-47d9-b1b1-cb4d82805c98.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 37968	6EBF730982F4EE546227EB59BEF4B58A	7BAC2D7BB2CA2065521FBAB3565BAB088D335CE5	CFFC432047F639682F764D701156F076C40FB8F824207463FE5230196543446B
C:\Users\user\AppData\Local\Temp\acrocef_low\6f039ebf-fc37-4168-aaa2-0544f18c5ad1.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	408F8BA5ED5014C1E10FA19D75C944A6	87595F69D692B4D785AAFAD71394426879C7980F	FFFE47EBC7E157F63F4BE40AC0B2DCD73A5DCDF57B9D03FEA3EB99212A7EC16F
C:\Users\user\AppData\Local\Temp\acrocef_low\994d0624-4358-42f3-996f-09932e3343b4.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\bd4d7559-eecd-4b1e-8ce9-498a0b380d2f.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\bfcd1a22-bd2e-40fd-8dd9-284e9ad60c3d.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837	D2D247B52923558A375F88902D534C0D	EA4CAEA24736763CEC24D676DE98B1372010C2F7	24C3481DC96B4EF9B5A97934BEDF56ABE62BF7A163CFF99370A6B57BDF0B1BA0
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 14:46:09 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	A119CB9E84382B3E396B57D82B6CFE38	A4ECA2F2611963AD573A90C5DE1DCAE0C4A93BD4	B9BD630E22FF621C6E63F298DEEA6AAB9557013B0CECFD3E6ED4E5A28F14023A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 14:46:08 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	5D62DFD3CAB7C6F8216531F24FA61096	39CAE6470C80CB4BEAC5FA619412BCDF3EFDB785	97408EA84296F881A520BF6045262EA02FBC2D4A9B08AF86720A574D0278B77D
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	19149615F836CE80B6DEFF9401315166	8655DBD46193CD0179750F5DD4BD63F7019F0674	9BF092EF95020F82C6264F7147B27F34D10C9632810E460BAF99B3ED5E2BE915
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 14:46:08 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	7991C8719EBE80C867CEA76790B5B0C2	589AAC687EE6CAEE8C92CCB6850C128F5AA7F7DE	33A6BB96175A7439D39A2684F0CF1CEF4A094A9F2C43FD15E2AF99ACE29748D2
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 14:46:08 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	19BFB6E43832A5FCECB7A92C827120A5	C5C2724D879232FAD29F52D8FD354525877044C0	002F7543AB68F90AC509F09AB9E758C56CA1D7271A2E0EE1802B61F4AEBA37A5
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 14:46:08 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	284B3D0141C739B68BC34C06A40BEB4D	3731B9E7E6EA34575FB1F8ED98E6801B772B68FE	59AA8960CCD287B5FA2BC2813D47C1B2F36E7EC1FCB3129926903A1C010D840D

Windows Analysis Report
Fedex Scan Y;29tbWl)zc2;lvb,mlu,Z0B)2c290L)mFl;177-signed.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Windows Analysis Report Fedex Scan Y;29tbWl)zc2;lvb,mlu,Z0B)2c290L)mFl;177-signed.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Windows Analysis Report
Fedex Scan Y;29tbWl)zc2;lvb,mlu,Z0B)2c290L)mFl;177-signed.pdf