Windows Analysis Report
http://s3.eu-central-1.amazonaws.com/fiae/Beispiele/ProjektdokumentationFachinformatikerAnwendungsentwicklung2021AndreasKretschmann.pdf

Overview

General Information

Sample URL:	http://s3.eu-central-1.amazonaws.com/fiae/Beispiele/ProjektdokumentationFachinformatikerAnwendungsentwicklung2021AndreasKretschmann.pdf
Analysis ID:	764046
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Drops files with a non-matching file extension (content does not match file extension)

Classification

Signatures

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: unknown

DNS traffic detected: queries for: accounts.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-104.0.5112.81Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /fiae/Beispiele/ProjektdokumentationFachinformatikerAnwendungsentwicklung2021AndreasKretschmann.pdf HTTP/1.1Host: s3.eu-central-1.amazonaws.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-GB,en-US;q=0.9,en;q=0.8

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\Local\Temp\acrord32_sbx\A9R1psdso_vbye37_5bs.tmp

Jump to behavior

Source: classification engine

Classification label: clean0.win@35/49@7/7

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1964 --field-trial-handle=1640,i,10835741753073723708,5021152820849143339,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "http://s3.eu-central-1.amazonaws.com/fiae/Beispiele/ProjektdokumentationFachinformatikerAnwendungsentwicklung2021AndreasKretschmann.pdf
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Downloads\ProjektdokumentationFachinformatikerAnwendungsentwicklung2021AndreasKretschmann.pdf
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1964 --field-trial-handle=1640,i,10835741753073723708,5021152820849143339,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Downloads\ProjektdokumentationFachinformatikerAnwendungsentwicklung2021AndreasKretschmann.pdf	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "http://s3.eu-central-1.amazonaws.com/fiae/Beispiele/ProjektdokumentationFachinformatikerAnwendungsentwicklung2021AndreasKretschmann.pdf	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\21f6f8e2-c457-4f9e-b65e-185755c07296.tmp

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

File opened: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\crash_reporter.cfg

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\ProjektdokumentationFachinformatikerAnwendungsentwicklung2021AndreasKretschmann.pdf.crdownload

Jump to dropped file

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.184.45	accounts.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.219.169.25	s3.eu-central-1.amazonaws.com	United States	16509	AMAZON-02US	false
142.250.184.100	www.google.com	United States	15169	GOOGLEUS	false
142.250.180.174	clients.l.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.1
127.0.0.1

Contacted Domains

Name	IP	Active
accounts.google.com	142.250.184.45	true
www.google.com	142.250.184.100	true
clients.l.google.com	142.250.180.174	true
s3.eu-central-1.amazonaws.com	52.219.169.25	true
clients2.google.com	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false	high
http://s3.eu-central-1.amazonaws.com/fiae/Beispiele/ProjektdokumentationFachinformatikerAnwendungsentwicklung2021AndreasKretschmann.pdf	false	high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false	high

ID:	764046
Product:	CloudBasic
Start time:	11:05:17
Start date:	09.12.2022
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0	data	7B33641428209CB54DADE8D39DB1C4D6	DFD364777B12414F0267166CA0897A35405306B7	64AE46B32F8F6F9AEE36EF690DD055583751CBEDC75629A41CF92A9F289F316E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0	data	40877B6EC74554300E3AFB7561CDA0CE	FFE13518AC922D9DB65135404ACEB7C32F6B5B97	DDE0372114C839E2A9A37D4D5A890A8353CDF8F01714121F5638C0D5ED88DBA1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0	data	8255BBB451E7033328B07B213709BB9D	9267C32061294F6DD2AD4F9ABF7E0D89D24715CB	4A046C8C3E82EB56E2C2389DFC0E9AC84BE84448FA56F1180DF95884F3BDE3FD
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0ace9ee3d914a5c0_0	data	D164A6468C653DF61E59626C6C989468	00F553DD1CED3757C20A863F79FD061D77DCAB9B	3A603743CE211987034A5DE5C8E45591B3C4B92762832423446BCE1F431DCA32
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0	data	550EBAEB14A3DF7F5A6B93EFB1ADE2AB	2EF0BEC0103460AB2C00ED1078B0B54AE66DE3F2	BE83104A07B6363EF12A09BA5E3ED01841A301661403A6D88E4104A56F417A99
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0	data	C420E984F024EA6D8F5336907B7387A5	0748CC7275C36013B009A3992CC8060C3422B0BC	FA6B5CC226E672B3297575BE7D28C247CB354D45DE33820DD94A57CE3D1E058F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0	data	2355A8FED952988427757A85438A6F50	21CE838BE16EA1B2468D0745A286183542F2B578	27DD563C51A1E887601FEF4C54B5731F352D394028E96CAA4410C77B28CFD336
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0	data	0CD0D5CB4C80C453C78EE314B73AC68C	D4D30A4351EB9E39C3C324CB5FB9C58AAFA4E327	9D9CD1C04E4158D438A0B557EFB7B2C9D19853FF3D101DC6F3F8B86A17E9E61A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\3a4ae3940784292a_0	data	5A625C9159C101DFF930CB88EB12BC53	E19BA2E1F6A7375EC043B23F07A83F5C920C5F78	3F691A4D5BB059EFAD764680FFD553C631B75D88716535E08FFE2C1309642EFC
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0	data	55DF571219E2D0E5653640E45F5DDAC9	358424BC1AF6CFE8BE1D86BFFEEEDCE1B80ED686	723F03AD36A379BE381DFB34AECE4834A48595255265916AFF65E1397CA40EAA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0	data	7F0896654F5A43CFA082D5A29CCA86B2	FC31232FC5507F3CAB4ED2E97A3900FBBDC17350	0C6C026B556E61C06F6F8AE456470961B8B4B0A42D466D7F9DF953AB5445823F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0	data	7A60A11927CD794649DEBEDAFFD7D810	F6CB5C64F2424394D710548F5797A5C0B0703035	D5F42A67B6D52A6E5EB5CA231A0B71C1ADACE09E3F846A41893EEFEE0D2D2337
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0	data	ED5737971DE752A85A72296AB9E0E252	F4DC4BA4EAA8CA324BBCF69F0C04AC036EA3CDD7	384188AFBCA32A91B4592617A2D8CD0C4234FC42BF040DB98AB96AADC978056D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0	data	4E51A17C9A96A729C965CD8534122D12	6E1AEC08D1282CA35450DDE7C4D81B591DFB9030	44CFD507B9B3A8174AE6C738051690BE5B88947F85E242E0052CFC50B9805491
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0	data	56551CE445FF5A447B395F674857ADD4	02B9B77D3AC049A7C6B765424AEEDDDA361717F1	DF4D6DC0732C33D5715D16C7C83D0D9D205738B19EEA8022283166A9FDF90E11
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0	data	147D3EFA9E84499E47CC1282801D3432	F7C7F3E77F2C65D7E8D8B4D530D4831429DF9D23	F99773D2A68FFA5A2ED2C6741CA7438011AFC66BD7E1E04F65411056F9BAAA9F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0	data	1F1375A26AEC9F46651F8417F11CDBF4	84FB8C569C5212477B68A680230183AC1EE237FA	D3F7B69DAD8483880DD59112965C98D96BFA8053F0A0A63878742203F9C123BD
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0	data	97205B581DA9AFC48422F738EE56AF6A	53B05EEEB385F15B37C1377DB3AE38268503C7D4	A72E2DCE1D1BE4146D61DF7ED296F027D0ABBF7F59F31067B403AC5294CC41AB
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0	data	41CE1B8098D13509912653989F6E2E46	0A4A0B7A77CF70A80721AC6A70780E824E24202A	52A28674A857D298105BC5FD9C7B4AA1638603138B1147A79C4DF3A3B4C44A8C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0	data	6D346E08B4C3FD2B89B5C6EA0075904E	51FF099D2F66673BEB989C126EEB9D3989D05BF2	E0D1074FE7C7614AF81B192D2E4ECC17EAE576074D356917A13F6EBDACCE3551
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0	data	5D32A41FD042B70F1F6F17F1DDE791D4	C0E063DA99D6AABC0D9EA9A1B7ADBCC6A7FFDE03	D07E47012D8EB31E36FC7315E3165E1E3F142773DB5BE6A3C3866040E1F5E74B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0	data	9007F7391338D223F8C0E36820FCF866	B26BB5FDE1714E6522D201DC4A72557F1195BD9F	C138F9E221E3AEE34ED0D26975CE6EAA9986071DE8770C0B1E56FA097DAD7F04
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0	data	EF9A5AD0642198D1DF3823AA400025DD	5D403C489BB0E046A9B8EACA33ED5F36B3027B76	345D1647A865F7E347C3902B8202CE5158B4BB23886E578206DAD9153946ACD1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0	data	D33DAD7F5E9AF26FEAB7F74939DC1EBB	887172144240129D77F72540AE998A3C4DD58DFC	647F35DD78A3576E24F149CCDB3B3B140F8864112988B20AE83657CEFA1D3AAD
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0	data	43B4656847AB33EFB2B6F7DA7CA6C584	F49150A5EBE51CD7EE39108D4B0CF1F9997F1084	E7F261B11CF0C75DE4BAAB30059AD2F42FD8494BCC40C8F09BCB0D66348AAFA4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\b6d5deb4812ac6e9_0	data	5684CBB8B32B68F2AF78AEC80F83FDCB	A113A8C9A41C0A599A408E257CE6FB5949AB3F0E	8B84892C09CD2394616775E6D86816BCCAE4477492F1333873E5538D7EBA2E2A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0	data	53E8FA75DE20A3B2288FC6A1CE4590B1	78091A9A880B80962D063B32BC71C0819EEDB0C5	0E4574253E15A3E011A75F61A9F9DB7E0755DC8DBA038C1D3B707F95BA128AA2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bf0ac66ae1eb4a7f_0	data	7BEA3D576F8A406BF7ACA36B73B69C10	F621D9BBEB77E5FAD35DA8B1FBDE1BDD730C1E5C	0A98B7C369EE164A49AB7A0B7F40A80F2BA459FA78EC91C22776813B700B508E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\cf3e34002cde7e9c_0	data	4E7E302DB1B9D1BD237B6B21B609863E	A6AFC1C91502D4A2D396AAA312D0AE198781F8EC	9203565F9A241EC321C7E3D7B7681AD01BAA68D1176C95AF63C94D1F2D363D12
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d449e58cb15daaf1_0	data	D2C9F80E599BCF883E40D2B3C31CEDB1	B37D6F04F135E0CB9AAC76BC68BE9D9079AB6B7A	8CFEC4BBC37FA8A8E81992AE40C18D60A7A0BC30BA8022900AE7D65401338FD5
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d88192ac53852604_0	data	A51F73BB8940A6A48821A8F79A00FE8C	42FA17E248417B82239277CA1D6E7F1B05D21114	8FCF1DDDAECDF9A1E4B51238EB389123603A660BA5BD4D44461AE46E731CE87D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\de789e80edd740d6_0	data	57DD5B475B48CCCFC671EF82014575F9	E60B4DDE0E45AF17C80C68BA9FBC666087666DF3	521730962D09200B3F0B3C39754BDE5375643D9E275BECF8CF38756240D70794
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f0cf6dfa8a1afa3d_0	data	D259E423E4565354E66AA774817E7625	81390D60DF628244273DCA8F5CCE3CD03C9EBA19	C52D05D9CEE8D141BBA56BFCF400991EF280E35894BB9FDF429CF25BFDE9A525
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f4a0d4ca2f3b95da_0	data	136DF171825EF84D65C56F034D5FCF10	907054E06A2C558B94C5C99634581943870EEA0C	49F8D3C7B1E741A86E763DA12332F54D9D3EE3FF6F9E40FC4707792132E8F2E8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f941376b2efdd6e6_0	data	8D272A2858A1DCAADFF36F5CA2BA2DE3	7E81488EB139935E7754E807FC4BF546AE5D9DBF	02883A5DCB22FA8FFFAB3FDCFAADC9F4A7F4AB2E847C70274273DDB7A562211F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f971b7eda7fa05c3_0	data	421B4ECD282BCC3CCFF39E6F8C1DC312	71EEE857088BF43D128DAF8B88CCAC98001B6EA3	A51CE2A3A35ABB0AD6F3661AEFFC58CD21EC5D87BE294C3734B2C96AA75E0666
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fd17b2d8331c91e8_0	data	BA5F127416023168C9EC78D17C71567F	6A4D54A98B8D82A848BEB3F525A64B1A4B248E68	8A754FDB18D6C1AD448C21D8B1614890E9CE9C0A885C567E6445A414898B0F9D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fdd733564de6fbcb_0	data	DF1199385F5A0A26CC5383BA28D37F72	EBD7AAA4439F05F5148C17A4BC73806367656AB3	8E5279F463A9DD9393CA2FB488886A6C4CC88727C35387F8F65246A96B08C49E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\febb41df4ea2b63a_0	data	815ADC8D3C1B3398FC7EAAF610A2E4CC	DDA80C503D19631F97E3A2B72C7B25609712B411	8C70F768C711E541B77FDBFC8A4E0970FDEA27CF491B526959C74F7EBD28D48D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\temp-index	data	0C90E3457F036639BB7630631DAC1B58	F1F114BC382E113238C106AA8B54FBAB43F27F52	F97B94665B768B5DAC7AF0BCB623719D5689554DDBA83C5DE4A2B14C24FC3C7E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index (copy)	data	0C90E3457F036639BB7630631DAC1B58	F1F114BC382E113238C106AA8B54FBAB43F27F52	F97B94665B768B5DAC7AF0BCB623719D5689554DDBA83C5DE4A2B14C24FC3C7E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index~RF5769ce.TMP (copy)	data	0C90E3457F036639BB7630631DAC1B58	F1F114BC382E113238C106AA8B54FBAB43F27F52	F97B94665B768B5DAC7AF0BCB623719D5689554DDBA83C5DE4A2B14C24FC3C7E
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-221209100633Z-391.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	42AC886F3F697B74D8A53773FF9E6243	EA28ACBDE2BA9171A485E79E60B2675217640215	D3BD1B835AE1D23CEAD6256ED8D08831595DBB84AEE5E2C749443F0F6B56E133
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3024000, file counter 16, database pages 15, cookie 0x5, schema 4, UTF-8, version-valid-for 16	73F55AD5081EC44C0FA2722EDB6C2F5A	C514FECE88C9C7DC4F06189F9169AAA029EC898E	93326556D1B9F0BFA386614CED82C8B4CCAEA6E8224281B8686237F4BCAA9777
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	09D865EB6DE36EA4944FEE68C127C4DA	3D954B7F09A2D67CDC1C9AA20658ED4E2FA75393	2AA453C6D1D99C333EDCE7B6056CE0C26176AB19D23ECA484B25A7942D9BC4B8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache.bin	data	BFC1D46DC3AB8D7B3BFE4B4F708DA23C	19B2B7B1270D3BF7CAAA624249F87D383B023FA8	16CAEC3AD77EAA056FF54AD407CF49EAA1E8FE25C918ECEC46A2CD08F37F355A
C:\Users\user\Downloads\21f6f8e2-c457-4f9e-b65e-185755c07296.tmp	PDF document, version 1.7, 35 pages	DDC105DFB8D596DC678D15703388BA79	83E1F0A7508D9258E8ECA65CF5CD6C8AAEFF494A	BB83417447802FFF62121971017F348B190E60E19337F23D1029DA2C80632C7B
C:\Users\user\Downloads\ProjektdokumentationFachinformatikerAnwendungsentwicklung2021AndreasKretschmann.pdf (copy)	PDF document, version 1.7, 35 pages	D7B65868F43D1D3D867B0223C4D60ECB	371137A2E55B48ECB6C5F076C392854E592A528B	FC0D0652E22AFEC12B7F73638036B1A22909BA0114BDBC5F78980180A2358899
C:\Users\user\Downloads\ProjektdokumentationFachinformatikerAnwendungsentwicklung2021AndreasKretschmann.pdf.crdownload	PDF document, version 1.7, 35 pages	D7B65868F43D1D3D867B0223C4D60ECB	371137A2E55B48ECB6C5F076C392854E592A528B	FC0D0652E22AFEC12B7F73638036B1A22909BA0114BDBC5F78980180A2358899

Windows Analysis Report
http://s3.eu-central-1.amazonaws.com/fiae/Beispiele/ProjektdokumentationFachinformatikerAnwendungsentwicklung2021AndreasKretschmann.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report http://s3.eu-central-1.amazonaws.com/fiae/Beispiele/ProjektdokumentationFachinformatikerAnwendungsentwicklung2021AndreasKretschmann.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
http://s3.eu-central-1.amazonaws.com/fiae/Beispiele/ProjektdokumentationFachinformatikerAnwendungsentwicklung2021AndreasKretschmann.pdf