Windows Analysis Report
Payment Advice Note from 23.10.2024.PDF

Overview

General Information

Sample name:	Payment Advice Note from 23.10.2024.PDF
Analysis ID:	1541934
MD5:	61d0202fd5308335457f828ba76b14f3
SHA1:	5f2a15165283491019e2d5784d5e9efdcf465b5f
SHA256:	4853a6400ed4b7d916046ab8a33d9c52584cb1bd9e7d9c3e0706577757f9da0d
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs DNS queries)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr

String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: clean0.winPDF@14/45@1/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7628

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-25 04-41-41-656.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Payment Advice Note from 23.10.2024.PDF"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1720,i,15579801058208779322,836281527291943635,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1720,i,15579801058208779322,836281527291943635,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Payment Advice Note from 23.10.2024.PDF	Initial sample: PDF keyword /JS count = 0
Source: Payment Advice Note from 23.10.2024.PDF	Initial sample: PDF keyword /JavaScript count = 0

Source: Payment Advice Note from 23.10.2024.PDF

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1541934
Product:	CloudBasic
Start time:	10:40:37
Start date:	25.10.2024
Sample:	Payment Advice Note from 23.10.2024.PDF
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	61d0202fd5308335457f828ba76b14f3
SHA1:	5f2a15165283491019e2d5784d5e9efdcf465b5f
SHA256:	4853a6400ed4b7d916046ab8a33d9c52584cb1bd9e7d9c3e0706577757f9da0d
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	403E51724ED2ED2ACD0A021F0F977630	07A1E250F1160350CEF1682B2C5E71DBA6AC214A	87C4684AC7ECE6A45D25CE5E349B9040DCBB14C602582B35C440637940D52B5B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	403E51724ED2ED2ACD0A021F0F977630	07A1E250F1160350CEF1682B2C5E71DBA6AC214A	87C4684AC7ECE6A45D25CE5E349B9040DCBB14C602582B35C440637940D52B5B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	62E05FB78F3AE795512A2C84EF52B4E0	D0099570AD72419F401C5E734E1D5AC988D6EA10	4AC92D44544AA497C1A86DC51E901CA4B6E111BE1330F7C8CCB603A986971571
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	62E05FB78F3AE795512A2C84EF52B4E0	D0099570AD72419F401C5E734E1D5AC988D6EA10	4AC92D44544AA497C1A86DC51E901CA4B6E111BE1330F7C8CCB603A986971571
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0a28b6f2-6e31-4db5-8ec9-ddb93d1fec15.tmp	JSON data	4D113042AA5AF9F83C9E014137ADD5FF	640F757571977A59F91FA6435705356A37D3550C	DD1F3B14C8A2D31B6697D734B52942EE411D4F02C50FA8809CC4D44E48A31D94
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	4D113042AA5AF9F83C9E014137ADD5FF	640F757571977A59F91FA6435705356A37D3550C	DD1F3B14C8A2D31B6697D734B52942EE411D4F02C50FA8809CC4D44E48A31D94
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	E499934AF060F15831440B5C08234AB4	F1FF9CB1C40EFAA3DB452BF0F98F2190A38FA06E	DDCB2117D001060F51966CB5937763891D9A23C0C9BFE52828E8E1044B903565
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	3C36D7DE480473B218B9B2C0374E711C	702CFA943F5BCD1861667D252C6B9B6346447E26	4270980E10600951C47AF1CC59F742F066BB85055878AF58DD218C37510ECF13
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	3C36D7DE480473B218B9B2C0374E711C	702CFA943F5BCD1861667D252C6B9B6346447E26	4270980E10600951C47AF1CC59F742F066BB85055878AF58DD218C37510ECF13
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241025084143Z-154.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	C8C324A5A7531A9B55D6954BC4D5F464	CBCADEA32763BCA8A55D300F7D84DB0B7A24CEDB	5335A095A14ABA9F6C61764619C5F2B6726F48454028EE07C943ECC48801BDE0
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	01CCA961C9CD6B420563BE957021B152	AD570586D2010EA6724EE8F57D047E39D7D17999	6E30E88A112BB08162A478FB7BFFAD6697585966457DF275242B9875A02BA87D
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	0019EDA097B9ECB3F053079F623D7290	3BC002AF9EFFD4A9BAFD099CAC67B9EF980F482B	42E6650AC413FAF1A109BF49CB1B36DE17B9CF8BA1A83B61E4102098802748C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	0EB00B722995641F6B04CE4C5F61C822	32EEC64D3616C2B4B788A0BBDF173A5D2963FEAB	A2CFA44F8B6C1255A62FD43AA6AC88289B3F1DF502025B6752565613EF5BC114
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7628	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	20CCCC657334B84B1DA3089A7CFC5F79	089D6F2569B04ACC7A0F27AC00F7AE72F9686E7A	937BA6C1419547DFD74D7E3E85F124FF6046BBD7C05A24DA67CC93A1DD3C807B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	CBCAF2F60ACD2C6B7C4898C53E9E1CB2	96F2A27E4344A09CE954D5D4077DDED227E27FD5	9A61610E711868AC978D14B813CE1E743ED4EE6F3D25499FCB88F4C828213E6B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	24260641AF90F7491790E48F6B327C25	7C81EA6C610D0F1FB183435EBA8374BC3D8EDD61	D3270C8F6C595207D0A332011D109A982C53246249B1F8CCECADF235BFD8C0AA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	276F8E3FFB66F5764554E235947B6E34	E0F164BC63CD65D67A53874C5F768A5C3A714370	E73B33BD1A9FAB7E889445F9174698172D81493858322863306629FA1D6297E5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	9B2FBC48746B3F0D3A3D8236FDBB7947	F1DCF5E36F07DD46860D4B75E2F1D3791AC9B04D	F5A3CB56118AED11A2E6A38637474AD74074606C0043E3F1B8DB9D340F353BA3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	9757DC0DB209DF03F7AA3BDD048E6997	7CB180EA746AA09D2FDAF90FC21A8A46E22852FF	21B9C6CCDE42B2478224F38A4A408F0F914F5074835177DD168F0F6F44365CAB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	263B5B9C4AF677392414799A21CC6DB3	EF49B9ED07E0D6C41425DCAC3A469241BF66A6CF	646FF215992986FC334FE216DD03AB727C8E4A3D0077CD116B8D17AFBEA7F4C5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	A0D7CAD14991D940327BC8BAC1F72C12	8CD07F80CE08A91C9D477353EF953D18C5C150C7	7B622103BF171E3700A10530F61893B44B7133A1CFFB9FDA44642F5B5E6C560A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	28AC21A8CC6A5E46D8111BA24A54CFCB	7684489DDBD38A5AE2DDC970E6D18A8B08CDEB0A	7AAC5C7BDF209B46318C10E2F1610A8533E21C89E1D20CFFC7AB5EBFDC39FB56
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	24A975B6AE5BDB3F705D3301BD5A7F99	4B23DC7D7C84C4DD0EDCEE493EBAFB46C9B3DAF0	5D437016D95A2BC0FF90336DD84427E58C814F19CC4BC8DA3DFC6D09BCBF0E67
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	0474BE7C03F8FB86773E563CA01EAB4E	77175651970CEA8CB9E8CE419A2DDEF6C5AB5C8B	230077BF043B3C4563097D485D93DDA297D781A021DF80BDC53C26BCB6240C27
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	132AD224645BDAD96CDD754D094ECD4E	2DA76D9CCFAA5A709258B50F6E177CA78C173CDC	8D1B204FA2F2B4E24C19B6D0D5136C438BCEE25442D14DE37C4BE10BA224C8B9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	5E84CC23A7F1063483784DB21ED18151	EFCD6592D6073D44E3B18C2659EA46E84A0CF54B	1930E61A6D421494B6FE0A749CD57F7D23EF7357E2B41C9685B5C1C49C4D1021
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	C4D52D8A3289C5412AFF7E9B6DC73D97	926C2B272A0076DC5973B82A84E139EE8B967136	1356FE47632AB9D34C389A4C3EECCD07154077366C3478DAEE6BD1EADDC640C8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	742B0C550B39E77DF3718EB8C201F83A	92E7B7E06C9CEBF6FD03936CDB633B79CB832ABA	FCA52B5F5485608E29803E0BB2CD220AB8F4CB3BAFD67CDECC075FF087440609
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	1E189B026580277AF6174147CA1FDFE1	3AA464CAF0B0699842FBB50A200B18AFFD99A648	04F5A212A731A86BE1D6EF183490FF207357F2E862A79DC453E419604CF3A199
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	FFADF3AEB014FE65F3BD9EDB0327C344	E6F2179B2A72094F03B878A4D75647F4735E5EF9	8E38901AE8E1125A135DF515B23E9C126D44C1D16F01EF2FF02F0EF726C29FCB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	08E95B0CB22685CCB65D4AF5A18C2FE9	CB09E10F90FA499482CF6359BC7918BBBD122D63	A0EE25CFA7D974AB2DF1D7FC4A11CC33D499E9BB1765E9F8D751FAEC69D27361
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	6A629F29E51B60BC94C1D4B9A04BC3AA	B05D281454657D4F7BF938702BC4245ADE66277F	C21E3097D96F55F39E6590CEE068B42F1A41FCD82C52BEABD85ED97CEF849CBC
C:\Users\user\AppData\Local\Temp\MSIe067a.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	B691F16604D3343469A0C4010452CDCA	DA0A5B0585BDFCB16323E9149023D1BACDD6E0C0	12EF49544510E582FA0B82DA9BE8D842EA8E9DF2676FDCC730E48BEA9C591518
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-25 04-41-41-656.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	FB108D2FD97830716362875D11420575	B7DC919907BDE2EA3139E3355981713FA9D5F5E8	177B82821DC64442876BC305A2ADCD2009B70BAFFB7F9F2B31FC9102D6A481D3
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	B24C3FCCBA8F39C1E9B6CCBDDD4A1C67	BFE26E1D411CC635899017E3791DFCDC93DE972D	1DE21D5A162B00FDAAE6197D6D8C47DC42CBD45D47D2A6A8114E441432434791
C:\Users\user\AppData\Local\Temp\acrocef_low\366db157-a353-4cfd-8c9d-42d7618c6f77.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\44ca9251-9e1f-464b-a173-68afeea30368.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\9da875ef-0139-478b-8cac-a4344c9c99d5.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\bf07bb13-2945-459a-8850-cd6474e7c4f9.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685

Windows Analysis Report
Payment Advice Note from 23.10.2024.PDF

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report Payment Advice Note from 23.10.2024.PDF

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
Payment Advice Note from 23.10.2024.PDF