Windows Analysis Report
Muffenrohr Tiefbauh., Zahl.-Erinnerung KD2016680.PDF

Overview

General Information

Sample name:	Muffenrohr Tiefbauh., Zahl.-Erinnerung KD2016680.PDF
Analysis ID:	1532976
MD5:	94fed46fd43f848e39f51962eb66f36a
SHA1:	cd9668e67db6a84583694cc33bfedab32b535f24
SHA256:	e4eb20c6e661409e26e2f51a0f82777b771191229e51e283cc4a462fff34268d
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.77.220.172:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 104.77.220.172:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 104.77.220.172:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 104.77.220.172:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 104.77.220.172:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 104.77.220.172:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 104.77.220.172:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 104.77.220.172:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 104.77.220.172:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 104.77.220.172:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 104.77.220.172:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.77.220.172:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.77.220.172:443

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 104.77.220.172 104.77.220.172

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443

Source: classification engine

Classification label: clean2.winPDF@14/31@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3368

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-14 02-52-33-964.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Muffenrohr Tiefbauh., Zahl.-Erinnerung KD2016680.PDF"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1640,i,9707924894947965681,5943374216949905986,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1640,i,9707924894947965681,5943374216949905986,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Muffenrohr Tiefbauh., Zahl.-Erinnerung KD2016680.PDF	Initial sample: PDF keyword /JS count = 0
Source: Muffenrohr Tiefbauh., Zahl.-Erinnerung KD2016680.PDF	Initial sample: PDF keyword /JavaScript count = 0

Source: Muffenrohr Tiefbauh., Zahl.-Erinnerung KD2016680.PDF

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.77.220.172	unknown	United States		16625	AKAMAI-ASUS	false

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1532976
Product:	CloudBasic
Start time:	08:51:33
Start date:	14.10.2024
Sample:	Muffenrohr Tiefbauh., Zahl.-Erinnerung KD2016680.PDF
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	94fed46fd43f848e39f51962eb66f36a
SHA1:	cd9668e67db6a84583694cc33bfedab32b535f24
SHA256:	e4eb20c6e661409e26e2f51a0f82777b771191229e51e283cc4a462fff34268d
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	A7A02CC9CBE80926350500BCE28B5E93	421A97207414AF4628D4A67A20A117397CDE4EBE	A4C2D95B70DA29ADBFAFF6C5775A03A35A93575CCE08B1F5C7A151E5AA414953
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	A7A02CC9CBE80926350500BCE28B5E93	421A97207414AF4628D4A67A20A117397CDE4EBE	A4C2D95B70DA29ADBFAFF6C5775A03A35A93575CCE08B1F5C7A151E5AA414953
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	B699D63306110A6574F897D0069E07E4	C69C634F4953EBF88B992588FB11C8F3B8C5463F	28E760E5F9237EE775BABCCF32562FB8948F3A5480D544404302269AF2902DB6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	B699D63306110A6574F897D0069E07E4	C69C634F4953EBF88B992588FB11C8F3B8C5463F	28E760E5F9237EE775BABCCF32562FB8948F3A5480D544404302269AF2902DB6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5d0bfcf0-e98c-422a-a70e-151bf0d353c8.tmp	JSON data	1F5096F101C8662E87E0457E6B65C1AC	3F6B0A654C067AEEB4A24D5E4198322FBBA2C082	16ACA6143A2B43CF7EED76EA292DF4F02061150B0F2A74BAB967C5A9B4977D17
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	1F5096F101C8662E87E0457E6B65C1AC	3F6B0A654C067AEEB4A24D5E4198322FBBA2C082	16ACA6143A2B43CF7EED76EA292DF4F02061150B0F2A74BAB967C5A9B4977D17
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	FCEC14B275A65A2A8DB94F77E84FFD44	A054A56FC9EC430BD4437C287F86D5E642F4A75F	95A0C9ED4942B83C08942F2AB9C0A87F1712BD9B5387C682545BC714F1BAD32C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	583A91130FDA0DC99AF4D2ECA829BE6C	85BE13264721C7A57F4A6E9DCC2019A53161B054	96EE5FC02BCC4CEF04757F11E7E3BB7E979108AF45F933D8657496079F1B62C7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	583A91130FDA0DC99AF4D2ECA829BE6C	85BE13264721C7A57F4A6E9DCC2019A53161B054	96EE5FC02BCC4CEF04757F11E7E3BB7E979108AF45F933D8657496079F1B62C7
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241014065236Z-160.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	46F3784BA9C276586BD4195D79DDC161	463C5D6A3C9C5C04262259D4C0AFA17B46627964	8A50A4D0E7ADBB81F6F43DD1BE8538F4C32A399FA9B4E7E2739D0E519D8E079A
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	AFB393010F2B70B68A4DC4959B9C88DA	AB5B6E91AA575582367C4DC59A93C9B64D4A220C	AF20F15FCEC3E14CEB69A7A8CDE25BF1166EDDEC03328B4249742773F9C3E920
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	7DC78BBF022C522F238F7894D38A2918	F48AF3E8A3A98F07E10CC80D4D00C668EB6F559C	CCFDD6E7E911B967378B5083FAF781B44D4E661319AA8BA7319FB1DC92815835
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	30CA5E60DBAE5F6F9C2F5586CFC5F5F7	935E0136D745B734AFD58151B01EDE770D5DF157	F7D9D4ACD7A09BB2304ADE2724A3ECA07293F8EEBD56D696C4B83A3DA2BB0A0B
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	A955FE65E52681BFF61C4CD1D1BB688C	E76F9022DFDA01A47DCFA7FD24C1E6851C239517	E90157EB9F1B1A4A7B5265553AF1AF8892B20C1B6FCEE812FA6567C6B3337447
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3368	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	C5747BA5E7269965659DC98A7C2CE9E2	E61BB863CCA9DF0FF40F22D561055C9FC70C2DE9	CE311B0D077000F1E9010EDF8A76599BC32F7DBA03C6F70DAB1CAC84F73629E1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	372338DD79A1C8623FE13BAB1F4BFA56	120A0FC05D53C4F351C193A39480EFD99202C0DB	847B8D5C02EAC146D1008F7E41C34AA069C4DF45B71AB9D551C2BCBE75730B7D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	1A2B94D26E1B85F179A9819E25F288E7	819CD354612E1203333B0A88568D201A28C3C90C	86252EED4EC1A60F1401E64635BC0E4C2565F5509E41D74879AC1E6CF566125C
C:\Users\user\AppData\Local\Temp\MSIe8753.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	BE2BE852FF09E2F44B643D3888B4B290	9AF11BEC9456348B362E689CF8EF7D982EFC59ED	DCAC8FC028AFBEC036117163F5F0296B23CF9345238EDAF943A24B1ABA3A660B
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-14 02-52-33-964.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	F905DF2E338C053F08900CC73F255F13	607CCE17B0ABF08AEC7C08195B8D8ADA20F0E296	2154BC15A022FCFE5EFFE63B0691623E05C71201624592E2497242281E43D173
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	332EE1676369718505D2DF1404B00C49	0F9D185FC44AE4857463D2171907DE9DF4C8595A	F45F0D9DE41CF7FCC8E257155BD60E31C7CC2970B3E928F9EE2723814BD1216F
C:\Users\user\AppData\Local\Temp\acrocef_low\2db72695-2550-4c0d-a6af-f94abb92620d.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\48fa63ed-0ef2-404b-afbb-781fea50a557.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\5ad36a7a-69d8-4a4a-8dbf-d597b9015f74.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\5fc6f6b8-03ad-46f3-96dc-40fe460d9427.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE

Windows Analysis Report
Muffenrohr Tiefbauh., Zahl.-Erinnerung KD2016680.PDF

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report Muffenrohr Tiefbauh., Zahl.-Erinnerung KD2016680.PDF

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
Muffenrohr Tiefbauh., Zahl.-Erinnerung KD2016680.PDF