Windows Analysis Report
Scan 7820126fdp.pdf

Overview

General Information

Sample name:	Scan 7820126fdp.pdf
Analysis ID:	1546091
MD5:	78951686980095ae33f017a8d267e7d3
SHA1:	c58431ecf229382880f143208992384065a86532
SHA256:	47930e997509ae9efa420f64d0bf2aee3f1082812e4a82b6f7b697cb3da848c6
Infos:

Detection

Score:	21
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

AI detected landing page (webpage, office document or email)

Potential document exploit detected (performs DNS queries)

Suricata IDS alerts with low severity for network traffic

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Suricata IDS alerts with low severity for network traffic

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.5:49717
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.5:63281
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.5:63275

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: sus21.winPDF@14/46@1/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-31 08-53-49-003.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Scan 7820126fdp.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1636,i,16092604103119092067,6882932566358857649,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1636,i,16092604103119092067,6882932566358857649,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Scan 7820126fdp.pdf	Initial sample: PDF keyword /JS count = 0
Source: Scan 7820126fdp.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A9czvge3_16sk1f9_53k.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A9czvge3_16sk1f9_53k.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: Scan 7820126fdp.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Scan 7820126fdp.pdf

Initial sample: PDF keyword obj count = 58

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: PDF document

LLM: PDF document contains QR code

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.214.172	true
x1.i.lencr.org	unknown	unknown

ID:	1546091
Product:	CloudBasic
Start time:	13:52:54
Start date:	31.10.2024
Sample:	Scan 7820126fdp.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	78951686980095ae33f017a8d267e7d3
SHA1:	c58431ecf229382880f143208992384065a86532
SHA256:	47930e997509ae9efa420f64d0bf2aee3f1082812e4a82b6f7b697cb3da848c6
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	EEBE3B10C007F3D3D578B6033490BAC6	A05306090213812C511586BAC73197670ED4FB1A	ED0DA2D28DCD9BA23465C57E38907868249BDC29D9EBB61FA3D5571CC4D7278C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	EEBE3B10C007F3D3D578B6033490BAC6	A05306090213812C511586BAC73197670ED4FB1A	ED0DA2D28DCD9BA23465C57E38907868249BDC29D9EBB61FA3D5571CC4D7278C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	F6B15C316C7B2B7D99FA34591C472B81	1770109BF7407B412A116B21CCCFDD5D266BECF4	2388FCE3B7F611221214ECE77FB1DC8B0DC5E8A49B8DCBA0FBB444895DA548AD
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	F6B15C316C7B2B7D99FA34591C472B81	1770109BF7407B412A116B21CCCFDD5D266BECF4	2388FCE3B7F611221214ECE77FB1DC8B0DC5E8A49B8DCBA0FBB444895DA548AD
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	B98A324C021CAB3A155C3B2338C700F2	A7BA0C29156C2D205746AC6F6F3F8C3F07A883A6	650B131BC3D7065D3F6FC2C3C8048ED970668C3EB16D608B76D2BECD832CB2E1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\de107480-9020-4091-b653-3c5d47f3aa0e.tmp	JSON data	B98A324C021CAB3A155C3B2338C700F2	A7BA0C29156C2D205746AC6F6F3F8C3F07A883A6	650B131BC3D7065D3F6FC2C3C8048ED970668C3EB16D608B76D2BECD832CB2E1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	1EC4EFED83B9E326375BEDB842357BE0	B58B9120729421CEA7465C5A21356081A4800808	2DCCBEDA359A7631CFAD47A702AD6EBEFD8A117BD278FEC36F7ED53B1C7A66EE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	3E0BC16032815A94DAA9585509532D2B	054EA580B72952C7B205054C76E4B16AFC469BE2	913B5D38DFE45F5BDE898EAD07A920783309915F0756CEB1207A78225844D340
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	3E0BC16032815A94DAA9585509532D2B	054EA580B72952C7B205054C76E4B16AFC469BE2	913B5D38DFE45F5BDE898EAD07A920783309915F0756CEB1207A78225844D340
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241031125350Z-155.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	E3433F85EB3C65AFD6EE833AEDC90548	E0925BA814455D87190CFA68FD8196661653C140	15E86F7BD4FC1892EA1F9DF01E35A68BEFCE65DA305402475BDC8B70CD0DE6AA
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	616655423B5383D4F1057BB0DA724D67	E5A467EFC9B001662989D3D380BB0A08BEB93191	2E3047ECB6FA83BD3F97FBC6D5CB27D8CF3B52D45A56A94615CFF1E6C75E83DB
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	7AF4AAA2F05CB0C820E447D5FF03C0E4	57C3E2624F838E4223382449515596E9419CA924	A5EA109F1B3892A92DA7DDE9143F700E3E82B44B68CB399D0C5FF322A8601F86
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6608	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	87EDBEE38F56C20298F25D5D3D4D1B5C	7F904E9615AC3186A87472EF366DD8202855B0B7	A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	A2DFD8EFBF4408AF47F5D5E25A7D0256	F3CACBF78D9EEA2F2101EB0582B813EB07321927	098A92E78F6784588BE1CF50FC3589F4BC4398FEE7089721874150E74A7612F7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	F23A1636D0F45FE54ED8379C08DF2F5D	AC3AB1FBC6988C068C253825B7D892178BE88702	2FAD2B8C353A483C36A5FDC894A1F788F4EFB81820E77AC458178C1BA15E44DB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	384D3E6CD725C86723A3EE30A1D22328	A6C34EC4DFE9E531454A3F2A15F2FE16C4FF9C9B	282ECF4B7E3AB15BFF5F0096B6C4FD35A87BBEE84638FEE9DD64436931E1130E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	4566CFD8897BE6EE11C34C8326B74BC1	99F32146EA3D7DEED7576015939D6B0115350CD3	D6CEC7B6C711ED98FF099FAA839CE6D392EFE52A2115EBEC8F1D0CE31422CEFE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	32CB43C8AF4F0936254671B5D574286B	C7AE5D5A00D28FC1729EE532A23E11811F5D0AAF	9F5536ECB1A627E15C660247A6CE0A3C4C495AF4C796747E16A07232A083E9AD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	1D854EF50C0A7D1BC907673BC60F1FA5	7100A2B8DDC2F202B8E28A1EA71D8BBF536568F5	85A27A1F490463E57FE18F0291DF0AEA971AE791E9B389FE6066BE12478AF5C1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	6AB6D76401E15049AE70FB6554936825	263AC30C72C6549522D6CEEBC2F6944A5BA4890F	6FC58687133AD8B199F16F12A9C75B5CA9C50C56FAEA3A7BD74166F5D63BD1E0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	5051BFE777E9E155908AAC9D384C136D	269AE2B083BFAF8BB7105CD7BDE81AFBC8B220FF	FFA630A2C98FBD70EEB11F866E3859342AD08AEB917DA318F841C3A91D8512CF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	66D5E64D644B6FADE41520ED2CB3E9B1	1B2E338C53C0464496FFB25DA9F1E1F2A1F253B2	3A9B8DB8D716065042467151B13B923407EEFBAE0C33400CD2B72F6A1928F1F7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	E82FFA34783D7738B27193E54E2ABB8C	795ABEC34F403DC3541B29377FAAEE5DF902B18C	978CD30BB144E3B0F1F5AD303D9FC12B922723F29C54F7BD8C7D7A2B838C6688
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	838435A6CA3C4BAB8ECD764DD11C85CF	ACB9C6CC54BA596E670A6EC1A65F1789FFB37D16	6BB50568DF2344F28F9C92D2749B1823D959521ACA2F5754341A673EA67CF815
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	37FBB95F8FAB8C4AEF41E4B59E87AFD7	DE83C4BC4413504BF35B3F5B1B46AF9681D4BEA8	67751B3B094321055151385577C8062379AC5E4807CA63FC8E90784A5B82A64D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	5D1C0EED1DA5E516455B1BBA8C0AB284	D15AE5CAF0CF1AD77950F3C68077D50741EF1706	1886A3A632D7697C65E34960258A15087B879B75E06014B6AA6614E52D9558AD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	483D1DDEE2A2CAED495EF8A14DED5915	B6EE2613A7D876BAA76E6DBF373B7BE975432EF6	CA89F2FEA06AABE09B3F4AB158617E644008221BDA45F0521604418461F32F21
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	C981B291026FA438FD5B80D8BA2D6332	BC4B716E8F27DD15799FEC284AA97B78AB67E54F	5D2244012D4BF7DF2E1445761E556409AF360106083EB1C266A0B70B3C2A56A6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	44D644424CCD629E7DEC3EB0740F189C	9BE957AA957B742FCB7B40C5B4DDAF0EEAF50680	053D6E0E2858F33F8417F3D6AEE9A8EA8F18436A93F129D010F7883C7E83AD80
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	6CAD5E7A2439B45882AE37EC847D08CC	93EBDBF53C8CB36696D7432D539F2ADF93ABAD67	0722B21F45EA8CBB3EC7F37EC5ABE8B3DABD1B9A9937530A89287A5666A715B6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	51917B3BEF3C32E84DAD224C6926E33B	7C30EEDA75D9937D8F0D5856B3D058EF7B1E5C4F	14AAEFDA094A219D2B07929B1D6416C917D6527C587176486EBE6B8B6111AE10
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	48F88C1406AEA2538761813CE72D9B5B	B0374983FBD01900119EAE61ECCBBD4875771FF4	221FF525A1F0C8CD69F0B6D336A7B8D9E496C6443FDC7F42A775DD5447A82610
C:\Users\user\AppData\Local\Temp\MSIf4673.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	1259C1B9AD42CC91FCC2DDE19DDEB77C	4BA6AC276B01F92F645F587F9E55FD8EFA74F8EF	DF7021FF4A3EDED90C120B73DA33E0071B311914501074DEF294EBEDED8AF1F0
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9czvge3_16sk1f9_53k.tmp	PDF document, version 1.6, 0 pages	AD85908E23F29537A9BC8F514A36EDFE	E74F088E3705383C894CBE615179ACA86727A8CA	0FE0F71E3B0DB656D283B7A1F4A187BED5AED50A5247D6F84D30DDDB4BCC50B6
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-31 08-53-49-003.log	ASCII text, with very long lines (393)	1336667A75083BF81E2632FABAA88B67	46E40800B27D95DAED0DBB830E0D0BA85C031D40	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	81440DBE1F555C142BE0E5A1564CA18E	C7B577AB4496CDA010821C94A4F0D4623EE5D508	7F34024A745C601D7E9351968EE9BCF017A852EB0A7E778A106C804C850A1A72
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	0F4F44D88E86A8A06D364EBB2F2C81D6	102F9ED37EFA0030CA81FE425B2B5238E008776A	31D6DAF9246FC4A2A36AF375EE5610DF33CD946784A75D19CDA9B75244AB63E3
C:\Users\user\AppData\Local\Temp\acrocef_low\0714b3b7-ffb2-42c0-adee-6deeee65bc6c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\3efedc54-a2ff-4c8f-bf92-49f1c5a77dd1.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\3f411863-5091-4b95-9c8b-55a2c02e4453.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	AE1E8A5D3E7B2198980A0CA16DE5F3D3	A1DB2C58AFC81E6A114A8EB47BE0243956F79460	8C2E1B13F6658714D51737D6745FE065B87497923945AB3028706A4171C8328F
C:\Users\user\AppData\Local\Temp\acrocef_low\62ab19fa-64e5-42ed-aaa2-c2c20ef3afeb.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685

Windows Analysis Report
Scan 7820126fdp.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report Scan 7820126fdp.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
Scan 7820126fdp.pdf