Windows Analysis Report
DUEQ_RECElPT_SSSL8CLGKPWSR.pdf

Overview

General Information

Sample name:	DUEQ_RECElPT_SSSL8CLGKPWSR.pdf
Analysis ID:	1455409
MD5:	7826209d8f9f6ce7bf8508deedcaab6f
SHA1:	443871f3c14ed1431d64416c22264f465632b5fe
SHA256:	81859b4c5b52cb9fef38e3e35bc27bf411227c4e0d2aee7127cfd959d4d9417b
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

No high impact signatures.

Classification

Signatures

There are no high impact signatures.

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.1.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab

Source: classification engine

Classification label: clean0.winPDF@14/47@0/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-06-11 13-56-12-476.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\DUEQ_RECElPT_SSSL8CLGKPWSR.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1668,i,3490079776710011617,2781617310672127113,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1668,i,3490079776710011617,2781617310672127113,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: DUEQ_RECElPT_SSSL8CLGKPWSR.pdf	Initial sample: PDF keyword /JS count = 0
Source: DUEQ_RECElPT_SSSL8CLGKPWSR.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: DUEQ_RECElPT_SSSL8CLGKPWSR.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.210.172	true

ID:	1455409
Product:	CloudBasic
Start time:	19:55:20
Start date:	11.06.2024
Sample:	DUEQ_RECElPT_SSSL8CLGKPWSR.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	7826209d8f9f6ce7bf8508deedcaab6f
SHA1:	443871f3c14ed1431d64416c22264f465632b5fe
SHA256:	81859b4c5b52cb9fef38e3e35bc27bf411227c4e0d2aee7127cfd959d4d9417b
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	7E2A5A6383F87CB429930BDE04FD1A63	54FEBB26C357F1735151D1BCC9C5C96A914091A3	1D2D8D50D0F581BBD5BF47163323AF69050CA23AE18307FFD5672C0E9DF9A478
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	7E2A5A6383F87CB429930BDE04FD1A63	54FEBB26C357F1735151D1BCC9C5C96A914091A3	1D2D8D50D0F581BBD5BF47163323AF69050CA23AE18307FFD5672C0E9DF9A478
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	23D64E69259849B4F227023B93024E24	3A36BE664004698D0CC05B8C39039E4C0E857748	F57EAA4C6BF82B3E153F71C031A484BF44FB2C3B1CEC5591C256E1274FE38418
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	23D64E69259849B4F227023B93024E24	3A36BE664004698D0CC05B8C39039E4C0E857748	F57EAA4C6BF82B3E153F71C031A484BF44FB2C3B1CEC5591C256E1274FE38418
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	49C4790C7983DFE3B1D1F8402CFE7B7F	88A99F160711AF90B40A381524C78739078C4F52	319838BD4112A8E0D150B2964D4E76C55F6A95354BC3751572063E1885666CC8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c62f1be0-7dac-441b-90ac-f8259d45b215.tmp	JSON data	49C4790C7983DFE3B1D1F8402CFE7B7F	88A99F160711AF90B40A381524C78739078C4F52	319838BD4112A8E0D150B2964D4E76C55F6A95354BC3751572063E1885666CC8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	82F485761F027C734283463630762F01	1C1F2D2359BD65A71C58CB6222F2991C9B36E0EE	E505144D0C513BB8072481017BCAF7F2C924C711F3C2815C7D841BD1CDE05CC4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	AC51E4CDE92930E10B36EAB8DFD80843	D83F872A49EE88DA38FFC44F1FDBEE0B63CAF238	C3A3483A4D137C722CCE9BA251AAF2CEF45F7B76C1E60F897AB009C2F5397043
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	AC51E4CDE92930E10B36EAB8DFD80843	D83F872A49EE88DA38FFC44F1FDBEE0B63CAF238	C3A3483A4D137C722CCE9BA251AAF2CEF45F7B76C1E60F897AB009C2F5397043
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240611175614Z-155.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	4E2BE52D87D04B09C55DB93EFAD2BBF0	3218DA945F93165EF9E404E09429FD89541B7F4B	7C9100AA736AF4ABBE7EA63C9A0DDC1950D367A70FB1D13C8DB601842590B282
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	D1DF63887220831D2364BAC337222035	4E64488998F08A919E449689578472F9E952B6C2	2B15E940BEE7D198FA5CB34895DC0BAE13D92F50D7D0DBF6F8AE63023F28AE68
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	A66C8DCBABF02E6F5301CA534BB401A1	354EFA761990856DFF26341A32279563AAFD4659	7D37584A4119CC9D0A0DC6A72C6C2F2BD6F9ED4AFAAF068E8F69491F75CF5E16
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	D4AE187B4574036C2D76B6DF8A8C1A30	B06F409FA14BAB33CBAF4A37811B8740B624D9E5	A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	F179DE673B9955DE95C215F437A6C530	D992BD4A6ECE0AB340A9881F695DC26EB64D92DF	FE9DA56F90690274CC59540A5712EC5BDAB07259628F11F486226BB48D671976
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	5166E06E4D9C89208BE1284A5EFA3840	A1E5280091745DB4F0CDA26CBF51D05C1471686D	C4332469C98160E436BA2EE3A49277BA0B984C6EF0D9B491A3980D75F519B7F3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6320	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	1134684C3794588547C8BC4750915DD6	C5F88389FB266A70E70E8D2F56BD7997EFB66202	245D7C9DAB0B5C20FF418AF1F546DD4F6F248932B6A222511E714CBD1A581302
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	5443F54C526FD956574BCCC53026FA72	2321BD8E872DA56107E8611079B1DEAD746DD42A	2EB04913EADF3FB19A6B474F8843FC328F4D640FDBF675DE35228AC95125C0A2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	096E0CE9400B47433EEF02666A7FD6F0	25EDB044004416BA3568BFC0D921B318B8A9AD55	B8B7B38C593660A0B5EDAC356EBA85912F8306373340C07D06885BF445395E30
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	61225E38DF0496A2CF33A2C7F03C7E0E	2B6388993F24362C32A7B27B2687ADD9E22E54C4	821985FD456CC96A6058AC91DB8F92B42470E2A832758EEBAFF3B1D235CA65EC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	AB213409AF39C06B517E321CE5265571	C3A032B122355A34AF37BF5BBC6D0AB27A29A773	63E983B88FA184A3219ADAAAA952B42400F94EEB43D739D17B020C35B1E53E6C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	45F19AA9A25554A3AAEA6FED8CADDE87	5329B187859F57F171DB1E176F781C11856ABCF5	F4F9FBFEE77CC4365508F8DF9295B75E6D968436C8FE6C01EEF28E1A3AB8FB85
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	B305019C4E2FD5B2120FBC6126E12F7E	C23A73F30E8B181AC8CBD82B6052FE8997713DF9	750F6E9EB5F043CB04969C62A400CA132AFD998E60473DC74F1371FF2AE9AE13
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	AF326A59BC279CE6B1D107A2A2E2CA65	872FEF9691FDD66B60B39853CF3B5F185AD7FA49	601C6BF730335AB768C079FCAB27F16D3CAF993C41747AAF87BE495B483EAE8E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	38BA6955A28FAE4C36468F1DD746171C	BDB9BD3605CEEC037648785A89E21F0FF38B80CD	387666D332E398154706A2E43711D55B701D9A9525500C97CA0A73D35B9670D6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	3A476558D0E53A5F83017267109B0E09	644749BE8C483C83A888D56E02E8D5774EED7C26	D1F46BF22289BB3064074B75B4E3852B9FE5713363D9D6168D9C94E365CE50BD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	AA5B29D035B7041318CFDE3676E375DC	F6DC34F9A8E5B8613081DCD4DC508717406E2835	15E86CB1C108CB81FF85417978CCB3BD3A2F507C10C0160AC2AB1E74DC918B7A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	E97DF79820558BA731A728BF3E24456D	40DB4C2C38E34917443B9DF89B99DE0A60734705	BAFF24B5BAD497773E26B82905344491FD952CDD5FBAE417B2C8BEA8F1AE0CDA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	3D25969D4CF3C6DE0880BF54D3AC5569	308836394305DD769E97820B464C029DD7009BDA	6552487BF316D8A2AEFF985A36ADC6255FFE760B0FFCC562CDC7E49E2C35D6D3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	E6D1FE584B602ED6A77F2F24C079443A	FE6321C041BEB827702D7B48ED4BDB3CA1AC1728	DA142825AE2ED14F3602FE3F6EF6EEB63AD377960A973F7B58E1F490A23F4042
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	66178F9B840DEFE5CC12D29496514CC0	01300970A273F2117870810C5C7D6F4EF7EBBBCB	AA70442B993E9492DECDB7B3C031A632F3FE67EEFDD43ED7B039430B3D42797D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	918641B24E5A6C664C65FC7D2BB6D2E2	0E376E45C9676305CA3E59E10505B48197B20602	E684CC41F48CF0C5009CE4E4A3856768F03F14F107C3E8B8498E0A15C31CCD3D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	4CF0B70DA075D9F7C9C184BED1112ADD	826769B5A5E0F4CA939031CD8AD86E99AFF2F243	52DA3593A6833C7B7B6DF65606EC8DE529A91186D43BE1EEFCE9A9A11BBFFC25
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	2A9A1A553C127AF7079A9F0319A0A6C6	A1BD33F706F86CFA3E4EE0364E09FEB0AF65D5C4	9EF0D401DBB1CB2ACB0D8F0F567502C83C69E4E90E55A7B22939A4FBA5697602
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	98BC84D171FB21C5272356756DA1706D	EC836B95057F524D83F0C5DA0CBD39C21A06A869	BA97834378728414085D9C745117F1B5C99DFED76BA260F7AF7FF6E4D35A51BC
C:\Users\user\AppData\Local\Temp\MSI4d6bd.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	C2A7BAD2F1A03DAD3E61BDF27F4FEEA2	3D5432058EABDC99F54A9336DB5F0161AF8E8159	F788958576AB3A41145B3FC4DE74C2B33BDDE2D209EEFD3025008C5DF3D77530
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-06-11 13-56-12-476.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	101D2011AACD7830B701DC79E1EB3BB4	2889E984824FDA9333C70A044FBD277BBEE63BCD	2525F28112AD5CCFAE22E414A4817951203F8BE5DEC3C14B700F9A98A6C8ABED
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	03FE32F8574D51C1EBDA19E71A32FBF2	A88FAB00DD9E01C79BC312E5F7C2449DBC90E6FB	8C97064C51F7E9F1B00C4BDC8BBB3862346C02085B51EBB40D2C99E0552A58BA
C:\Users\user\AppData\Local\Temp\acrocef_low\383bcad6-afd3-4f0e-b6e2-9e21a96899c8.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	CA6B0D9F8DDC295DACE8157B69CA7CF6	6299B4A49AB28786E7BF75E1481D8011E6022AF4	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
C:\Users\user\AppData\Local\Temp\acrocef_low\4b7f38c7-a755-4375-94f1-c9ca2b714806.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\50228a4c-f955-437e-a03e-ebf96db5b8f0.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\65860300-4165-43ee-9236-cfb39615d93f.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE

Windows Analysis Report
DUEQ_RECElPT_SSSL8CLGKPWSR.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report DUEQ_RECElPT_SSSL8CLGKPWSR.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
DUEQ_RECElPT_SSSL8CLGKPWSR.pdf