Windows Analysis Report
Fac_F00717187991.pdf

Overview

General Information

Sample name:	Fac_F00717187991.pdf
Analysis ID:	1528653
MD5:	d73cc679616decb1c94f690d68abc7de
SHA1:	ad41f6f90bca7f2354f9da5c2f866972acaff21c
SHA256:	d1258a3a442848c6879f232022ef45baae8ee762865d6af00109d6bef12fc99c
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.47.168.24:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49743
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49743
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49743
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49743
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49743
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49743
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49743
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49743
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49743
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49743
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.47.168.24:443

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.47.168.24 23.47.168.24

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443

Source: classification engine

Classification label: clean2.winPDF@14/29@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6300

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-08 01-40-51-039.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Fac_F00717187991.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1680,i,14465121669262946373,16136710372373622939,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1680,i,14465121669262946373,16136710372373622939,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.47.168.24	unknown	United States		16625	AKAMAI-ASUS	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.210.172	true
x1.i.lencr.org	unknown	unknown

ID:	1528653
Product:	CloudBasic
Start time:	07:39:55
Start date:	08.10.2024
Sample:	Fac_F00717187991.pdf
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	d73cc679616decb1c94f690d68abc7de
SHA1:	ad41f6f90bca7f2354f9da5c2f866972acaff21c
SHA256:	d1258a3a442848c6879f232022ef45baae8ee762865d6af00109d6bef12fc99c

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	0727034F010AC7F100FC0918CA993AD2	4D2053930E04443A07773A8201406689FB712394	29615743537266746599DC64F8F2AD7EAA044F61ACB3EED32E2E21EDC67735A4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	0727034F010AC7F100FC0918CA993AD2	4D2053930E04443A07773A8201406689FB712394	29615743537266746599DC64F8F2AD7EAA044F61ACB3EED32E2E21EDC67735A4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	DE9A6E3E59949BD73D1D1C69B41A24A6	D2A8480420C7C1887FB57A776D8264CEECCABB01	246FC5796CDFAD396B7642E8502A0351478D364BAC3CE972BA318474257114DD
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	DE9A6E3E59949BD73D1D1C69B41A24A6	D2A8480420C7C1887FB57A776D8264CEECCABB01	246FC5796CDFAD396B7642E8502A0351478D364BAC3CE972BA318474257114DD
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4b7490e6-b65a-4c89-b169-695cc523283d.tmp	JSON data	924CC7B579CC9B974427813902D49B85	422CEF5282C3E3B9D6936E7215D30BBD254628FB	7ED55E3EAEFB7A41F666298B95C53A86CC0AFBEF62F7A61660E19D198CD13C9C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	924CC7B579CC9B974427813902D49B85	422CEF5282C3E3B9D6936E7215D30BBD254628FB	7ED55E3EAEFB7A41F666298B95C53A86CC0AFBEF62F7A61660E19D198CD13C9C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	D1049E6AF8DB72E8644E34B644DE955E	4877590D53D9BA2015EE288A263DF822BB2ACB0E	35D2CBCFE1AA21BAA4D59915C9622F4DB85373C642967B28524DDBC0D1B825C4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	21CE082AA595CD03D5D062C853412383	D600A58468EDA654C05DA41695D47BA7EC025751	F00F7560AD4EE80018D671FF6E3AFF375B3490D4325A01BB874FDC19B1083AF9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	21CE082AA595CD03D5D062C853412383	D600A58468EDA654C05DA41695D47BA7EC025751	F00F7560AD4EE80018D671FF6E3AFF375B3490D4325A01BB874FDC19B1083AF9
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	D626978EC00AAE6B454A5AB20C2AB979	B93915762A99598B9B20E517EB28DD8D9608AD4A	D15358B05765FF050A15A0876B53C962E331F3DBFE75547FA5C995EB8AC71D9E
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	84491174894F443A042D6433D006B6C0	9EFCFC39239B85E7DB700A962740B605D4D8E8C2	3017283F8527F046A9784FA57E835620991343A7BCA9FD4E343587E1342A2D82
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	E85FD208CF354F62051B996BA71BC9A7	91678038FCDC0D6A2ABE39BE656D7549A980D946	2CA17F4D05462E2C46292A881150D67F982B862D14B1254D7E2479D1AD7AA22F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	B8E6A419774B82B22CD740A106BC3BDC	ACA3FABD016B350F4C19E1841950D7770F467ABB	57324F7975AB3824614A904C807A654217ECC09893075360BEBB8260748B2194
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6300	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	7C78DCF5B92C071F1E0DD22D2B4FB395	0D08BD77982CCE13CE10454437D2B89CBB8F3D61	77BFEC391C6D8AD2E7479717355490B7E75600FFD4E86B76F640EFA877BC367D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	A3D1E6A986AE230B2DB1F2D9840221C7	7BE5092B22F77DAA20F59BA11B5154F0BE7EEF59	00E97D042B171DB787B477F295562CFCFCA5DBDE36C1A36C69643BE7E0B4284D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	B6944A64DF942EA5EEAE9905F7D02877	E0D5E74454A4860EBBD9485B22AB51257C7971F4	1EB26DFFBE85B135D08075EDD59E1DD49E68923A8B97E20AC67BB370F2E3249C
C:\Users\user\AppData\Local\Temp\MSI1170a.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	2680F0E9282712DE1FE86172F351A061	C749F0F01FC51CF10776342CB44C43B7390A251F	B1EBE9BB3461C1BC45B2C616D4A040151E311E3CFEEB0F5DD95E46AD477E9DBA
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-08 01-40-51-039.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	46BF59B2272F5BADBA5024877A70318A	AD6775A7FE3CB0C7A5393A753568B30DF10F9025	002AC30EA7FF3126D1DB6D5BE44CA3127613A003CCCF698CEFDCAABD9DEA60F8
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	1FBAA1795E5DAC326AC51012696C3145	38B90F1B5197BC9CFFC10D676F76F595C017AE50	ADF5577C353718CB7D46CC2F0C1D365994A663C22A7CE3C2FB108F91F97DB4B9
C:\Users\user\AppData\Local\Temp\acrocef_low\1cf2525e-8c23-4248-b038-1a37687853f5.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\30691f3c-e705-4e37-9b5c-f2e1768b085a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\5272485f-52bc-42a7-a18e-5dddf99e3e59.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 416226	12DDE6151F5E778520B3C8434B61AD0C	2D3EA4300ED7D77866B96F7BE2BD8FA4F03D2081	4EDFCFF1CCA3192ECCBA77FFB1572D1C544566CFC73749F0FAC5DD0BF0C73C76
C:\Users\user\AppData\Local\Temp\acrocef_low\a275b0d1-ddb8-42cd-bcaf-1186727c7690.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685

Windows Analysis Report
Fac_F00717187991.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report Fac_F00717187991.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
Fac_F00717187991.pdf