Windows Analysis Report
bellpartnersinc.pdf

Overview

General Information

Sample name:	bellpartnersinc.pdf
Analysis ID:	1531114
MD5:	7c469a711023198444209d27913d2e2e
SHA1:	61cba661073f1e43b7a382388c6c53c4930018d0
SHA256:	e0d8d42c76313e9248d7956abce26ff44fec461fe44cb87717c408c35ce2facf
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs DNS queries)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: clean0.winPDF@14/45@1/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-10 15-29-40-183.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\bellpartnersinc.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1636,i,5456880637434493383,11984852861388079225,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1636,i,5456880637434493383,11984852861388079225,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: bellpartnersinc.pdf	Initial sample: PDF keyword /JS count = 0
Source: bellpartnersinc.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: bellpartnersinc.pdf

Initial sample: PDF keyword stream count = 248

Source: bellpartnersinc.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: bellpartnersinc.pdf

Initial sample: PDF keyword endobj count = 567

Source: bellpartnersinc.pdf

Initial sample: PDF keyword endstream count = 248

Source: bellpartnersinc.pdf

Initial sample: PDF keyword obj count = 567

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1531114
Product:	CloudBasic
Start time:	21:28:36
Start date:	10.10.2024
Sample:	bellpartnersinc.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	7c469a711023198444209d27913d2e2e
SHA1:	61cba661073f1e43b7a382388c6c53c4930018d0
SHA256:	e0d8d42c76313e9248d7956abce26ff44fec461fe44cb87717c408c35ce2facf
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	072E842F953F6609BD9ACD76D377C495	698D5D6C06908A79A1F70892846DBE703D65DFE9	BC96B66BE76E93DE0F55405915BCC38D5BEE1CE356480394721B17D0E40895B8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	072E842F953F6609BD9ACD76D377C495	698D5D6C06908A79A1F70892846DBE703D65DFE9	BC96B66BE76E93DE0F55405915BCC38D5BEE1CE356480394721B17D0E40895B8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	C060BE79E3B999583B7262CEA7BAF615	A4F6833D275CF21AF379099FAE3287A108F11334	BF12C691D10BBE16EB871AACC822E7C22B7447B3C9A9AE4CF0D2AE3DF0F22669
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	C060BE79E3B999583B7262CEA7BAF615	A4F6833D275CF21AF379099FAE3287A108F11334	BF12C691D10BBE16EB871AACC822E7C22B7447B3C9A9AE4CF0D2AE3DF0F22669
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\10eb0e63-f504-49da-8550-b65e5c236d83.tmp	JSON data	0525ECF9B10DFB20F32133FC31C40907	76BC5761AA503A7C805598FE68BB607DE81B065D	9CBEC3F286A344E2A6BE56CFB40B37DA3D865FF5D0D9A02EA3F107CCA6584FFD
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	0525ECF9B10DFB20F32133FC31C40907	76BC5761AA503A7C805598FE68BB607DE81B065D	9CBEC3F286A344E2A6BE56CFB40B37DA3D865FF5D0D9A02EA3F107CCA6584FFD
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	9E1B4F686683D40C14E5A025EB135A41	29ABECDE08560A0B2DA5AC8A7E0E6E6016753962	1F6A6660DC9637B27F2728E5DC1C61B83825322AB0D624F7206659A2412EBFB0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	9AFC2DAAC70E1650FF429E081620AA1D	AEB0B813B1B9257615E319D6C63B9693815AEA25	A73B7640D9D3D54E9E8D858398870FA83C1B0C0EF231DC52517707A0166E251E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	9AFC2DAAC70E1650FF429E081620AA1D	AEB0B813B1B9257615E319D6C63B9693815AEA25	A73B7640D9D3D54E9E8D858398870FA83C1B0C0EF231DC52517707A0166E251E
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241010192942Z-161.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	022C9B2F0C2A8B1F6DE3AAB2A487C6F1	98AFCB47BEBB6094696E9B4450ED3EC97F38F5B0	D072109F0980583061C9BD578FC280A0908870CFF6F5EC5B7B1718B4F7003DDF
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	9E11F26D9CECC7EDDCB3231B555CAEAF	48F74D1F7418215FFD0428DE464B0C791C6F989A	5919EFCEACFFE1AEE65D45F2F23F4AD3FFBB11AF6F65685AA02510C63215D0EB
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	A9D97420E1F3BF644FD8B9D104BA2377	630CD2EE6616F634FF400DCD294103B50B1069D6	C2973AAB026CBFFB1D14B75B33D2A0DCFCA5C1940A478A0F4C4181C7380FD16A
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	8617F833C9A85DAED0D87B28B8533093	818BD2F5D8990A5C87F726A5DD21546DCC69BB2B	D8DD0B442690534EEEAEC0044FD32A66F08DF1E1F82B70B58921A64C2046E4E2
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	44ECD778F0C3477E324552B79411E3E3	2C6D0B110A4841C0242EB765B4E6F20D09C62F15	B9AEB75B47795F39DD3F477C071323193B2BCD08842DC2C1596C98B57B963DAB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	463ED1373803D8A7B8BC1FCF3C85DDC8	F90CBFC803CCEB0E61160D6792866A4C1A9A6CDC	4286E2557B85A2EBFF88A773694453873F14E07825A11AAD1DAF390057B30BC5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	7D44D4D8511DB1AE99A9B3A3BE759209	7294C4BB622201687F16DB43427F639E52F4EF37	3E83D6455864BB863786B1431A275D27064B1C9F5D6E51895870FC3504BBBE0B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	64EF0B471DDC41618B41542276BF3F86	3F8C9B8C40B649B5F7F7945CF6552D34666E3F85	84A3DAE93BD79693F557D324E0DF2B983C24708CC3D7C6FF64E5F50C6FE03D24
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	14D218680099B34469421587698F7EBF	DCAECEC4F6F5A9CD1E79BB21178A0E45C23F67CC	B8E4754C3B06D8A421BEF18F869FA6E4F45E85E08DA7C0E0927D93B94307C9F3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	B120AC49801CE454CA7A25E3311C4794	76C4AB2F4EDC57978E080B1BE73D4A0E0ACE48E8	AF2AF18EE964F04F865FE04EFAD9B52EC09861057B3DB5378605AD247012BD0D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	C71C92ECF4FB28732BD930BA2F8A4A56	E0917833307E9729E195C6D418A98BD98C355962	2F4E261ADE628D3801C87EFE9CCAE3040750DCA2F79FBEC2C3F87B4422DA8F99
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	739D962FB76D0AC5C30F129A37765559	D35507845125E012374CA8A90FC21B993AE7378C	CF4F5706AC6559EE5DE2942786EB2C17037DC5A68F5783B201C12FDCBECD46EC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	FC1DE37FE1ACD9C1A051D1438302D888	016F6F916AEDEEB15CF7A5A2E4FEFCD356A68D84	D4E5DBB6CDB90B490176F482260FD902483B49DEF6FFE225C28DAD9711F12F4A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	2AAF4F5B6EB4F8CDE6D48A0F5F639D55	F22BD999AA790FFF386F9346A2F73A00C11C9C32	210B84D0192CC06792E85CEABFC017A3C4C1352F9FFFAA55951DBEA60E0E1259
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	12ABCE7C5C11916E16F6A91D16669965	9FC1E859FFF4140079405587C241EB08C4A8945F	6F51866EFCB1815713CB7F678DC99AF7C7A051CAC4323305A71F0F3A5714A779
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	10240747ADE157C1325927363FA3A481	9060BED0C05BF87B5BFF71957E0B7262BCAD6A6A	19ABFD58D0FF482B3111EA25FC199DA39FC37209CE6C3DA43E943F156D7D12B9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	EF4163BC85DE7806FC47E5F0C7BD880E	C2EC9C325EBE9EFAFBB7E5ED73C6E62A06856910	662BD6C0B1B749EA65AC2D00FF4DB1CFACFBF2A98780FAA733413E1AA87BC748
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	D51A609E254E82491369755E37AC072C	AA71454015DD594885464B4D114DD396D27DB0C0	BF3A2676B97905E7EBAD802370CDA12636AC340A49C421E2281D240A78C443FB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	03C96CC011F541F6EB331D578BE26BEF	B54C03070BA68DC613FB58D9C977CD2036A04F60	9792795F880AEDBC80D7ACF62E7CC5E8D451E73102551E2FB201FACE859D187C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	EC7AD55FF5DAF04E52EE6994F37C0B46	0922364B7F2708FC66861E92678FE79B156D1FAF	F3347123800DB8E8795658489255DB114C6859F2F43F353CCCCD8EFA2EAB7C10
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	DC426680B59ACDD19C912F2F983E5EDE	2FF787D0A849DA42697920624D954E4778835290	76A16F224C5CB6D7ECEE48D237A55511B70F2DD7E21E14D73107BD3507EE4DE1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	713C51230D7BB25DE7342212B5E1FE69	189F96F4474DE605BCC59FBE006412E3678515CD	F01FAEFEA132727F0C001AF49969F5CC17305A33F52F6B57D58C8E5F4A8121E7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	B3058F4CA64E8077A4527960AAE853FF	CBCD44494F44E0DFF998216470547F9A6FC1872A	91E12B36218960F7C66A2E882843F3E5F73EEB972026B6C86C776E5FD42A4265
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	E96C4AA27E57E1DEAE01577E137976DE	E540921E68BF1B5067FCB6B56467A221342814F8	E445519E52CAE407EC469C5245585CE7980AE44EEB08289BC852522C6935EAC0
C:\Users\user\AppData\Local\Temp\MSIaa0ff.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	D930907D4E2EEAE793159EEB63FAEB9A	C95058F77EA4F7C0EF5122432518039A79B32112	26CB8E7EA7432D0FD5942EBDD60F5F81F6F6FF60DEFAD7A8E2635BE91FDCCF43
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-10 15-29-40-183.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	7B6EC8BBFAED8D38BAEED030FAE356A1	9A122B625DEE2A4F6685A1D4E9CB90FA2778CAF5	010E2BB2FA5DA0392FFA71562CC70E1568136CD59F3DA22BF5CF34DB9978E360
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	C172C69A8DEB8AC3D76B145747EEFC33	E434D883C8111B031C0643F3F6F45024679B5829	2B6D759780A12FCD0932FBFEA97DF973591A38FFC82616805868957C79A9CEAB
C:\Users\user\AppData\Local\Temp\acrocef_low\37d6b1dd-c090-4ce6-91a3-e08c758e9d8c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\6171429c-e9e8-47fc-9e39-24f44a60543c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\97c76fc4-13c0-421c-a5f6-1e2222ea40df.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\c4f889dd-e86f-4a43-b04f-41d471fef97b.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE

Windows Analysis Report
bellpartnersinc.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report bellpartnersinc.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
bellpartnersinc.pdf