Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
PDF.pdf

Overview

General Information

Sample name:PDF.pdf
Analysis ID:1431117
MD5:fd5b2d2f6c3f4b92b25ef110751cb024
SHA1:4bcc58c2e98a760f7d91fd106e0ac962381ad06b
SHA256:93d72a5b9d6b70e8fae6e848af34d9ec659ce811637c4970add600bda8e18f69
Infos:

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 7016 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\PDF.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 7096 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 7204 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1720,i,6517084977861050195,15223958444467974964,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.1.100.158:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.1.100.158:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.1.100.158:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.1.100.158:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.1.100.158:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.1.100.158:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.1.100.158:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.1.100.158:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.1.100.158:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.1.100.158:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.1.100.158:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.1.100.158:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.1.100.158:443
Source: global trafficTCP traffic: 23.1.100.158:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.1.100.158:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.1.100.158:443
Source: global trafficTCP traffic: 23.1.100.158:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 23.1.100.158:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.1.100.158:443
Source: global trafficTCP traffic: 23.1.100.158:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 23.1.100.158:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.1.100.158:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.1.100.158:443
Source: global trafficTCP traffic: 23.1.100.158:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.1.100.158:443
Source: global trafficTCP traffic: 23.1.100.158:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.1.100.158:443
Source: global trafficTCP traffic: 23.1.100.158:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 23.1.100.158:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.1.100.158:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.1.100.158:443
Source: global trafficTCP traffic: 23.1.100.158:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.1.100.158:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.1.100.158:443
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.100.158
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.100.158
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.100.158
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.100.158
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.100.158
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.100.158
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.100.158
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.100.158
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.100.158
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.100.158
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.100.158
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.100.158
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: classification engineClassification label: clean1.winPDF@14/44@0/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journalJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-24 15-54-36-990.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\PDF.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1720,i,6517084977861050195,15223958444467974964,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1720,i,6517084977861050195,15223958444467974964,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: PDF.pdfInitial sample: PDF keyword /JS count = 0
Source: PDF.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: A921765m_1b6sn6m_4uw.tmp.0.drInitial sample: PDF keyword /JS count = 0
Source: A921765m_1b6sn6m_4uw.tmp.0.drInitial sample: PDF keyword /JavaScript count = 0
Source: PDF.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: PDF.pdfInitial sample: PDF keyword obj count = 52
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive12
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1431117 Sample: PDF.pdf Startdate: 24/04/2024 Architecture: WINDOWS Score: 1 6 Acrobat.exe 17 73 2->6         started        process3 8 AcroCEF.exe 104 6->8         started        process4 10 AcroCEF.exe 2 8->10         started        dnsIp5 13 23.1.100.158, 443, 49740 AKAMAI-ASUS United States 10->13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
PDF.pdf0%ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
23.1.100.158
unknownUnited States
16625AKAMAI-ASUSfalse

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1431117
Start date and time:2024-04-24 15:53:47 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 3m 58s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultwindowspdfcookbook.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:10
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:PDF.pdf
Detection:CLEAN
Classification:clean1.winPDF@14/44@0/1
Cookbook Comments:
  • Found application associated with file extension: .pdf
  • Found PDF document
  • Close Viewer

Warnings

  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 23.202.56.131, 52.202.204.11, 23.22.254.206, 54.227.187.23, 52.5.13.197, 23.1.236.16, 23.1.236.34, 162.159.61.3, 172.64.41.3
  • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com
  • Not all processes where analyzed, report is missing behavior information
  • VT rate limit hit for: PDF.pdf

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
AKAMAI-ASUShttps://campaign-statistics.com/link_click/PJygYHTMZ2_OXDfP/30633247af9f78d20f1e067eab9a8276Get hashmaliciousHTMLPhisherBrowse
  • 23.209.84.171
sIQywRNC5M.exeGet hashmaliciousBabuk, Clipboard Hijacker, Djvu, VidarBrowse
  • 184.85.65.125
qJKiVKZdFk.exeGet hashmaliciousClipboard Hijacker, Djvu, VidarBrowse
  • 23.65.44.84
https://i.imgur.com/EoTj4iI.pngGet hashmaliciousUnknownBrowse
  • 184.28.252.71
https://i.imgur.com/VlAllek.pngGet hashmaliciousUnknownBrowse
  • 184.28.252.71
Z4CYGTBlj7.exeGet hashmaliciousBabuk, Clipboard Hijacker, Djvu, VidarBrowse
  • 184.85.65.125
SUwX12D2S6.exeGet hashmaliciousBabuk, Clipboard Hijacker, Djvu, VidarBrowse
  • 23.66.133.162
file.exeGet hashmaliciousPureLog Stealer, VidarBrowse
  • 23.66.133.162
rq0mVjR9ar.exeGet hashmaliciousBabuk, Clipboard Hijacker, Djvu, VidarBrowse
  • 96.17.209.196
8jvTeVxooN.exeGet hashmaliciousBabuk, Djvu, VidarBrowse
  • 184.30.90.143

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:ASCII text
Category:dropped
Size (bytes):292
Entropy (8bit):5.253462049898292
Encrypted:false
SSDEEP:6:D+RL0qq2Pwkn2nKuAl9OmbnIFUt84+RL0jZmw+4+RLSu5kwOwkn2nKuAl9OmbjLJ:D+tvYfHAahFUt84+I/+4+h55JfHAaSJ
MD5:EEC3C6108FB6E7C47EA4AEFF7F2CA8D0
SHA1:B3E119E23149B6B70F2237C972976AD96A60EF85
SHA-256:26734B8D94D76C1B7640778D9807E03CD37AE7D06519E847315D424B369DA530
SHA-512:DE27B02875507ACA472AD26A00DA2B38EDA4A977820DDF3C8F352112369DE9FA5B79B70FA001E7188E1B3E7921DD1370D2F2A8884BB7B6139D0605A9403763D0
Malicious:false
Reputation:low
Preview:2024/04/24-15:54:34.787 1950 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/24-15:54:34.787 1950 Recovering log #3.2024/04/24-15:54:34.788 1950 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:ASCII text
Category:dropped
Size (bytes):292
Entropy (8bit):5.253462049898292
Encrypted:false
SSDEEP:6:D+RL0qq2Pwkn2nKuAl9OmbnIFUt84+RL0jZmw+4+RLSu5kwOwkn2nKuAl9OmbjLJ:D+tvYfHAahFUt84+I/+4+h55JfHAaSJ
MD5:EEC3C6108FB6E7C47EA4AEFF7F2CA8D0
SHA1:B3E119E23149B6B70F2237C972976AD96A60EF85
SHA-256:26734B8D94D76C1B7640778D9807E03CD37AE7D06519E847315D424B369DA530
SHA-512:DE27B02875507ACA472AD26A00DA2B38EDA4A977820DDF3C8F352112369DE9FA5B79B70FA001E7188E1B3E7921DD1370D2F2A8884BB7B6139D0605A9403763D0
Malicious:false
Reputation:low
Preview:2024/04/24-15:54:34.787 1950 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/24-15:54:34.787 1950 Recovering log #3.2024/04/24-15:54:34.788 1950 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:ASCII text
Category:dropped
Size (bytes):336
Entropy (8bit):5.171368206002661
Encrypted:false
SSDEEP:6:D+RLm34q2Pwkn2nKuAl9Ombzo2jMGIFUt84+RLUUS3JZmw+4+RLiUEDkwOwkn2ng:D+EIvYfHAa8uFUt84+KUm/+4+Va5JfHA
MD5:E0970948D0466CD2A51646F54B67C731
SHA1:4CB961AAB7996A3AB6C267EF3F4519623FA426D1
SHA-256:17324E0B8BFA7A43908E23A2B56BCFEF5CC5AD035D069F2C9ECC258622608034
SHA-512:93E4156E858DAE4DAFE37BAED82265505228E2A5AB4A432F23962BDA2F08DE13BC67072838A162A243DD3D1033C75A737C53A9A09AA6B35E85F38013A2C9EAFC
Malicious:false
Reputation:low
Preview:2024/04/24-15:54:34.818 1c44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/24-15:54:34.823 1c44 Recovering log #3.2024/04/24-15:54:34.829 1c44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:ASCII text
Category:dropped
Size (bytes):336
Entropy (8bit):5.171368206002661
Encrypted:false
SSDEEP:6:D+RLm34q2Pwkn2nKuAl9Ombzo2jMGIFUt84+RLUUS3JZmw+4+RLiUEDkwOwkn2ng:D+EIvYfHAa8uFUt84+KUm/+4+Va5JfHA
MD5:E0970948D0466CD2A51646F54B67C731
SHA1:4CB961AAB7996A3AB6C267EF3F4519623FA426D1
SHA-256:17324E0B8BFA7A43908E23A2B56BCFEF5CC5AD035D069F2C9ECC258622608034
SHA-512:93E4156E858DAE4DAFE37BAED82265505228E2A5AB4A432F23962BDA2F08DE13BC67072838A162A243DD3D1033C75A737C53A9A09AA6B35E85F38013A2C9EAFC
Malicious:false
Reputation:low
Preview:2024/04/24-15:54:34.818 1c44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/24-15:54:34.823 1c44 Recovering log #3.2024/04/24-15:54:34.829 1c44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6584ba49-a54d-4b03-a665-23c2e0eca653.tmp

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:JSON data
Category:modified
Size (bytes):475
Entropy (8bit):4.960572042101188
Encrypted:false
SSDEEP:12:YH/um3RA8sqZKksBdOg2HOxcaq3QYiubInP7E4T3y:Y2sRds7dMHN3QYhbG7nby
MD5:82279DB65BB90D5A520DDF2512F5F682
SHA1:1502006AA3568B67D47071DD7F83B9A5B3E71F13
SHA-256:D2B900CA8687D812AF96AE25AFFD592302E5EA7557998768B3E4EA85EF5024AF
SHA-512:DD722592930ECBB38E2FE2C5C8C41E73572B4276D142108FB21049B61B1E36E5D51BE0F89526370DBD70519ACF562017196D018BAA3B853DB8E3CC259803E5EC
Malicious:false
Reputation:low
Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13358526886835037","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":154848},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:JSON data
Category:dropped
Size (bytes):475
Entropy (8bit):4.960572042101188
Encrypted:false
SSDEEP:12:YH/um3RA8sqZKksBdOg2HOxcaq3QYiubInP7E4T3y:Y2sRds7dMHN3QYhbG7nby
MD5:82279DB65BB90D5A520DDF2512F5F682
SHA1:1502006AA3568B67D47071DD7F83B9A5B3E71F13
SHA-256:D2B900CA8687D812AF96AE25AFFD592302E5EA7557998768B3E4EA85EF5024AF
SHA-512:DD722592930ECBB38E2FE2C5C8C41E73572B4276D142108FB21049B61B1E36E5D51BE0F89526370DBD70519ACF562017196D018BAA3B853DB8E3CC259803E5EC
Malicious:false
Reputation:low
Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13358526886835037","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":154848},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:data
Category:dropped
Size (bytes):4730
Entropy (8bit):5.2581678724755605
Encrypted:false
SSDEEP:96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7vfZQ0CZ:etJCV4FiN/jTN/2r8Mta02fEhgO73go2
MD5:E488282A3186920237D5139EE78B384E
SHA1:D7ADBAB2A78F55AA1E11BDF1F428045531AE9280
SHA-256:E48967FFCC002D8F797E40D4455BDD320F3AFA2BC232EEBB15B9C4947261A0D6
SHA-512:9A701E5B10EA8764445A4918536769CDCEBD4CD55AC2D3633D4EB34F19287DF32E23DBF2402E0EAD48DB406922D7F0F455BBADE4DB11862A2FE1635630CD9337
Malicious:false
Reputation:low
Preview:*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:ASCII text
Category:dropped
Size (bytes):324
Entropy (8bit):5.164028325214326
Encrypted:false
SSDEEP:6:D+DV4q2Pwkn2nKuAl9OmbzNMxIFUt84+I5LJZmw+4+uVDkwOwkn2nKuAl9OmbzNq:D+ivYfHAa8jFUt84+IP/+4+O5JfHAa8E
MD5:A92A1424BBC21B92F4890A8516D0A42E
SHA1:A0C595D6AA723AA853C2D33F24381CF556FE03D7
SHA-256:54A72A8F502E21B87F054B1C93C4CAFA38403B210B11CD9F1C1460C1DA0554F2
SHA-512:53FF102291BC9AE3B7A12431ABE2AAFE5B412665F8A8A8E4074B2117106E6026348995138FC98740BF2F78A5E5A086386DB5D4DA5F276A26E4912430CF443859
Malicious:false
Reputation:low
Preview:2024/04/24-15:54:35.339 1c44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/24-15:54:35.345 1c44 Recovering log #3.2024/04/24-15:54:35.347 1c44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:ASCII text
Category:dropped
Size (bytes):324
Entropy (8bit):5.164028325214326
Encrypted:false
SSDEEP:6:D+DV4q2Pwkn2nKuAl9OmbzNMxIFUt84+I5LJZmw+4+uVDkwOwkn2nKuAl9OmbzNq:D+ivYfHAa8jFUt84+IP/+4+O5JfHAa8E
MD5:A92A1424BBC21B92F4890A8516D0A42E
SHA1:A0C595D6AA723AA853C2D33F24381CF556FE03D7
SHA-256:54A72A8F502E21B87F054B1C93C4CAFA38403B210B11CD9F1C1460C1DA0554F2
SHA-512:53FF102291BC9AE3B7A12431ABE2AAFE5B412665F8A8A8E4074B2117106E6026348995138FC98740BF2F78A5E5A086386DB5D4DA5F276A26E4912430CF443859
Malicious:false
Reputation:low
Preview:2024/04/24-15:54:35.339 1c44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/24-15:54:35.345 1c44 Recovering log #3.2024/04/24-15:54:35.347 1c44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240424135439Z-160.bmp

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
Category:dropped
Size (bytes):65110
Entropy (8bit):1.526751136697956
Encrypted:false
SSDEEP:192:VL+yj0occJmrJ5rV/1+2J8dr3hXibaMcII8aSdL:VLxcrQJ7BIF
MD5:B1ED8FD32CE8C877FB50023E7D94D294
SHA1:64A03FDAC615FD33B76AB09D50D2A2F740BEC105
SHA-256:5215733D313078E70B62307D7FAE85F00ADCFE232E3ABD6D6E2420A7A3D1308C
SHA-512:E1FC42FD34B8F034462B86BAB7485FA1C6537244C4B0975BA0F8BDCA45FFE4DFC49349E4CD0AC4DA544CBD981B698B126CC236182E513AA86898B72D75535A38
Malicious:false
Reputation:low
Preview:BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:dropped
Size (bytes):86016
Entropy (8bit):4.445565457369124
Encrypted:false
SSDEEP:384:yezci5t+iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rRs3OazzU89UTTgUL
MD5:2A39CB9389DE17FEF60B5A5E1DD245CF
SHA1:8DCBEBD78F62C355CA8A99E9EA505FE752723BFD
SHA-256:A45B0F1E3351300C2DCC62B8E8E94B5B806BE04EC1A1DD4A8C180DE18F1B8597
SHA-512:156C80967E53DC92054F91587915C280625E06EFEA4455E3638DB585412B436F3AD381C52371F3775CFD41326E1DB2EA82ABEBEFE062EF0C68675ADD94EADA36
Malicious:false
Reputation:low
Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:SQLite Rollback Journal
Category:modified
Size (bytes):8720
Entropy (8bit):3.7758170321719935
Encrypted:false
SSDEEP:48:7Mop/E2ioyVfioy9oWoy1Cwoy1rKOioy1noy1AYoy1Wioy1hioybioyfoy1noy1z:7LpjufFGXKQOib9IVXEBodRBkQ
MD5:025353C937B9CDD69340CB282E65B25C
SHA1:47B64732A9E8E4B3813C8563C3B2B831A2F955CF
SHA-256:E8844EB191181CE047A7DAC32991A5F022022FC2719108175186002F465CF0E6
SHA-512:A169F2928BC700BB339A76D3038EAC8A32758881094F2B0A9DCAC282778AFE042B4D65728B904CBFCD53349899C7793ECDB4115910A2436D11564D461838C412
Malicious:false
Reputation:low
Preview:.... .c.....z..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6296

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:PostScript document text
Category:dropped
Size (bytes):185099
Entropy (8bit):5.182478651346149
Encrypted:false
SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
MD5:94185C5850C26B3C6FC24ABC385CDA58
SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
Malicious:false
Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:PostScript document text
Category:dropped
Size (bytes):185099
Entropy (8bit):5.182478651346149
Encrypted:false
SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
MD5:94185C5850C26B3C6FC24ABC385CDA58
SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
Malicious:false
Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:data
Category:dropped
Size (bytes):243196
Entropy (8bit):3.3450692389394283
Encrypted:false
SSDEEP:1536:vKPCPiyzDtrh1cK3XEivK7VK/3AYvYwgqErRo+RQn:yPClJ/3AYvYwghFo+RQn
MD5:F5567C4FF4AB049B696D3BE0DD72A793
SHA1:EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916
SHA-256:D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
SHA-512:E769735991E5B1331E259608854D00CDA4F3E92285FDC500158CBD09CBCCEAD8A387F78256A43919B13EBE70C995D19242377C315B0CCBBD4F813251608C1D56
Malicious:false
Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):295
Entropy (8bit):5.354218846941187
Encrypted:false
SSDEEP:6:YEQXJ2HXDGwQRTHNHVoZcg1vRcR0YFjqoAvJM3g98kUwPeUkwRe9:YvXKXDukZc0vAZGMbLUkee9
MD5:B00AC12E6C39732D056882A670770538
SHA1:5B8CE6D357E2A13B51A8D5A4DE33E95BE30AEF7D
SHA-256:AFDCB26EE040D060936143145A5EC91D8FAE95F0BA4661C5C193BFE3144364E6
SHA-512:000A867702741FCEC62DDF38ACB2E0D91ECAD70B6842BB4AA4FAE14D20633828D1A3C8433163EEB0EFC6DE8AA4F6372B02B1AEBF7365041952509D5984B7058F
Malicious:false
Preview:{"analyticsData":{"responseGUID":"97f093c6-09d6-49b7-99d0-e5a46af9245a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714139845817,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):294
Entropy (8bit):5.304326348316404
Encrypted:false
SSDEEP:6:YEQXJ2HXDGwQRTHNHVoZcg1vRcR0YFjqoAvJfBoTfXpnrPeUkwRe9:YvXKXDukZc0vAZGWTfXcUkee9
MD5:5546415EBEBEF0482479CEC813C1450C
SHA1:6A1FD0D63453C33DC55986FBF941253C87BB7D4E
SHA-256:13253628AEFE3B6DD43829E3AF10C3F01DD7CE56EAC4F1B17F5CE7E899916C81
SHA-512:A7D239A4B580257CD18A9A153EC0C9CABD20EB8B80B3581FF9B6859B1ADD434B94F4C26236B9695D6602D8B9B00E8536B79788259E4154182D332D6027E9004C
Malicious:false
Preview:{"analyticsData":{"responseGUID":"97f093c6-09d6-49b7-99d0-e5a46af9245a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714139845817,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):294
Entropy (8bit):5.283032562543283
Encrypted:false
SSDEEP:6:YEQXJ2HXDGwQRTHNHVoZcg1vRcR0YFjqoAvJfBD2G6UpnrPeUkwRe9:YvXKXDukZc0vAZGR22cUkee9
MD5:75D6C2CD8270E501351D2D7A3530A6BB
SHA1:F42D1C3640033C643C2B9DFFFFBF8D877005BB52
SHA-256:813733AF5666AB0BAB88968B6E42003E7E2473AA361998F157B796008E9E76C7
SHA-512:DF0429FC4C8DC79046FF26D06806DEF7191A9A4031098F5B16740E9C9FEFCBF353FAB7C6663854AC44810B9914DB25D68457FD29C46BE0777787E52BCC277C9E
Malicious:false
Preview:{"analyticsData":{"responseGUID":"97f093c6-09d6-49b7-99d0-e5a46af9245a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714139845817,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):285
Entropy (8bit):5.340908492105609
Encrypted:false
SSDEEP:6:YEQXJ2HXDGwQRTHNHVoZcg1vRcR0YFjqoAvJfPmwrPeUkwRe9:YvXKXDukZc0vAZGH56Ukee9
MD5:B99BAE5DD8A319D1727FC89C29155DD2
SHA1:1ED8D884A95521B8F9F229F6BD77BC5C9EEC06A0
SHA-256:3E9AE2FC097FB56F26CA26296AD1309D3124DF7B35F42EF903B0904E9479ECBB
SHA-512:23A356FF72255BFB3FB7286A71DC50E0EC7B9202528F449B29A2735877831AD228049F94A2934F8504C44FAC5CD4FCE4F72EA5DB1E1BB01B1F36A09A0C51AE17
Malicious:false
Preview:{"analyticsData":{"responseGUID":"97f093c6-09d6-49b7-99d0-e5a46af9245a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714139845817,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):292
Entropy (8bit):5.300687050524701
Encrypted:false
SSDEEP:6:YEQXJ2HXDGwQRTHNHVoZcg1vRcR0YFjqoAvJfJWCtMdPeUkwRe9:YvXKXDukZc0vAZGBS8Ukee9
MD5:0A496FD71ED079B5B001A818915081CB
SHA1:58D746E7FB8913FC57D325986D543A74F47EF3FA
SHA-256:3BFA9892C6B034E5A9E0E50B87B903E359DF84CB232381027FFA431767FA1DBC
SHA-512:9DA2813B728D61BA8F804A28A33261CACDB9E9066B37D2B341DD7608FAF8432B4F0199E50FBA05C6F44E3334A444C9F38BC90C307B4F658AC59F07ED15D8CA52
Malicious:false
Preview:{"analyticsData":{"responseGUID":"97f093c6-09d6-49b7-99d0-e5a46af9245a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714139845817,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):289
Entropy (8bit):5.2876830203139935
Encrypted:false
SSDEEP:6:YEQXJ2HXDGwQRTHNHVoZcg1vRcR0YFjqoAvJf8dPeUkwRe9:YvXKXDukZc0vAZGU8Ukee9
MD5:75ACAB1FB49ECA3FD8E3A78DC1DED638
SHA1:99A6DDE30F1AA5511CE6C25E772506269D182C66
SHA-256:DF7ABF9F46B9DC2FC829AE9154A1519405F99E1927AC67F8CA2DD07B5C2FD84E
SHA-512:0F0DF76FC05318C1EDD26E717EF16EF6292EB6B728CA5B010B131D655C5B0B7941060DB3411748F1D7E3BE3B1EFAF4A7705D20730C2A41AE664A54BC5F979817
Malicious:false
Preview:{"analyticsData":{"responseGUID":"97f093c6-09d6-49b7-99d0-e5a46af9245a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714139845817,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):292
Entropy (8bit):5.292291799040925
Encrypted:false
SSDEEP:6:YEQXJ2HXDGwQRTHNHVoZcg1vRcR0YFjqoAvJfQ1rPeUkwRe9:YvXKXDukZc0vAZGY16Ukee9
MD5:5282DF50F73846897DCFE94CC2464AC0
SHA1:F48B34737DCAAC7701361430231B480459B53CDB
SHA-256:75A842DAA40691F5009ADF9D62A04102D4DCB371A731F5E8FFF44138E0A7BA50
SHA-512:8F8840D35CA47186DDC8C933B3C3C35484525950A0511F67B44F2572F5F24A77EEDE9DA15A38DB49A73AAC26B75F92E2D332E0844381A290953F9DB487585C9B
Malicious:false
Preview:{"analyticsData":{"responseGUID":"97f093c6-09d6-49b7-99d0-e5a46af9245a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714139845817,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):289
Entropy (8bit):5.296486066585093
Encrypted:false
SSDEEP:6:YEQXJ2HXDGwQRTHNHVoZcg1vRcR0YFjqoAvJfFldPeUkwRe9:YvXKXDukZc0vAZGz8Ukee9
MD5:96546AE68B6DEDB9C75619F8F74BD7B0
SHA1:528EB47A9A5872C9E3DF1F5CF645981E22DBBB54
SHA-256:E8C706CE050E40A07D08A17F39DCEB628BD9FD4292B7E8B654F28B9F4DF1B743
SHA-512:1D34BEAF0C9E9AD692CD651FDB32AD4C34500BC58E4E6B5800E6C6DA50BA1B26402D05D5A4D0F300D604F0BFA1EE1E3EE9F325B3494CDF6656357BACCC04ACE3
Malicious:false
Preview:{"analyticsData":{"responseGUID":"97f093c6-09d6-49b7-99d0-e5a46af9245a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714139845817,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):1372
Entropy (8bit):5.741491306771547
Encrypted:false
SSDEEP:24:Yv6XTzv4KLgENRcbrZbq00iCCBrwJo++ns8ct4mFJNeR1:YvYAEgigrNt0wSJn+ns8cvFJYR1
MD5:0D2CB09BDE26624C0028B9AACF175DF5
SHA1:5D6BEFEAB9847D9D7B723099382CF2E8A3782CD5
SHA-256:C211B972004F304ADDBAB9B16E9872B6F3832BC18C02361939336E08CAFD602C
SHA-512:E31B585B76E613A4600D2768BC35463C8025F6A88FABCAA63E4EA6EFD025A068302F2945233BF01A2974741D60C38EB4E2A882796C1DDE5B5AEB9A0B3979CD2F
Malicious:false
Preview:{"analyticsData":{"responseGUID":"97f093c6-09d6-49b7-99d0-e5a46af9245a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714139845817,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"79887_247329ActionBlock_0","campaignId":79887,"containerId":"1","controlGroupId":"","treatmentId":"acc56846-d570-4500-a26e-7f8cf2b4acad","variationId":"247329"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJUcnkgQWNyb2JhdCBQcm8ifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNSIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTMiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIDctZGF5IHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0byBwcmVtaXVtIFBERiBhbmQgZS1zaWduaW5nIHRvb2xzLiIsImJ

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):289
Entropy (8bit):5.293767481475774
Encrypted:false
SSDEEP:6:YEQXJ2HXDGwQRTHNHVoZcg1vRcR0YFjqoAvJfYdPeUkwRe9:YvXKXDukZc0vAZGg8Ukee9
MD5:6D78616DB499454D24CAAFA0517DF25D
SHA1:4B69C248FA9321B74F4F975197268EE1370AB81A
SHA-256:5C6C25B1848D62604DADFECB3C02D49C9EFE9D615F56B2B1DB302E64F4EAB4DA
SHA-512:EAF5893184D1011ABEDC650E516CCA14C768787D77AA475D19759038CF7D18F79B45C9FDBCFF43F2787DD844A6A1CBD75E4E6B3475309573973DE480DD2EFB6D
Malicious:false
Preview:{"analyticsData":{"responseGUID":"97f093c6-09d6-49b7-99d0-e5a46af9245a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714139845817,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):1395
Entropy (8bit):5.778654565405989
Encrypted:false
SSDEEP:24:Yv6XTzvXrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNGR1:YvYPHgDv3W2aYQfgB5OUupHrQ9FJUR1
MD5:080BA61F6A4ABB2F92B9A1FA2B72606E
SHA1:4D51862D5DD48F13981BBC9DA1E894492E15C363
SHA-256:8598E0061ADE9F6C92813451F2FC5BBC88D5D035F510F6B450E118208BD96B07
SHA-512:5C591000A9A2768143C20B64C7C8F33C92E23D7412E151D41468E3211CC48B48830397DA2EDAD469CF37C10A4A8F552917D506F7557E971ABFFE42DF007DAEB7
Malicious:false
Preview:{"analyticsData":{"responseGUID":"97f093c6-09d6-49b7-99d0-e5a46af9245a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714139845817,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):291
Entropy (8bit):5.277357414328498
Encrypted:false
SSDEEP:6:YEQXJ2HXDGwQRTHNHVoZcg1vRcR0YFjqoAvJfbPtdPeUkwRe9:YvXKXDukZc0vAZGDV8Ukee9
MD5:E90F5EBE6C1E28F04115FA35750D120F
SHA1:04CD06A50F527DA260EC5307DAEEBFD37D16ED10
SHA-256:7B7274C7AD0D5001058BB3CA2DBB9F282843054E9E205F1B9AA8805AC68191C7
SHA-512:BD2D64E0BFC3E7456C3FC08786851F627A701A19FF08F8B444D8A0FF3BAEFCDCA0305C919C88BBC7C3271C026E4ABD8988DCB677FA4D3F3769039C6E86646291
Malicious:false
Preview:{"analyticsData":{"responseGUID":"97f093c6-09d6-49b7-99d0-e5a46af9245a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714139845817,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):287
Entropy (8bit):5.282218465187958
Encrypted:false
SSDEEP:6:YEQXJ2HXDGwQRTHNHVoZcg1vRcR0YFjqoAvJf21rPeUkwRe9:YvXKXDukZc0vAZG+16Ukee9
MD5:456568B205E1137AA3AC081605DEE445
SHA1:CD5F263A4F88659389731EB3A68116129B862A64
SHA-256:3952029AF58ED433CE39C569C2577D3A8450E1C35A57EF6306287A4BB1B01BC8
SHA-512:C2ED5247A4D282DADA35F89D509ADF0AC58D77C21A9EB4191D06222BD713B38AC57EDCAE13DB9DD9E932AFFC058B8A509A32BD40701EEE8EB58B88E8B2579086
Malicious:false
Preview:{"analyticsData":{"responseGUID":"97f093c6-09d6-49b7-99d0-e5a46af9245a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714139845817,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):289
Entropy (8bit):5.3003087921597
Encrypted:false
SSDEEP:6:YEQXJ2HXDGwQRTHNHVoZcg1vRcR0YFjqoAvJfbpatdPeUkwRe9:YvXKXDukZc0vAZGVat8Ukee9
MD5:12466EAE0C82D12C068F5968C1E31B63
SHA1:1E43E819FD5B23BE3D6A31AC8ECE5B2562E9D181
SHA-256:F630CB930A6AB36ED8E543777F17596AEB03222F0C6DD033E947DF82838B93CB
SHA-512:1B23B86F9B3C812EB5088C25A3F1284ED6F37773902B6B8E0C4566AD92955BC1FD12F8EF88C361EF7AE7432D20A26C05ADE385D1D7B066A8F630E9CC5973AD55
Malicious:false
Preview:{"analyticsData":{"responseGUID":"97f093c6-09d6-49b7-99d0-e5a46af9245a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714139845817,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):286
Entropy (8bit):5.2572451016159585
Encrypted:false
SSDEEP:6:YEQXJ2HXDGwQRTHNHVoZcg1vRcR0YFjqoAvJfshHHrPeUkwRe9:YvXKXDukZc0vAZGUUUkee9
MD5:1A1886ED621CDEA0E4ABA9AF422F87ED
SHA1:96CBD2934AFDEE94F80C9E51BDD8149CF9F26679
SHA-256:8A13DEC6133019DD3F86D05808BC7F6B191BBBF376A950FEEF167023F7C29992
SHA-512:12B5FB3B770EA20B389CCEB56AA83032AE3339637DC191B0177993EF2BD7482F528DFBF1B7B7E52614DA72979B09C96A5585164740AD878380E09B4FEC64A1B4
Malicious:false
Preview:{"analyticsData":{"responseGUID":"97f093c6-09d6-49b7-99d0-e5a46af9245a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714139845817,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):782
Entropy (8bit):5.368682683911196
Encrypted:false
SSDEEP:12:YvXKXDukZc0vAZGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWKR1:Yv6XTzv2168CgEXX5kcIfANhBR1
MD5:1338A8E3C8CF0D6E5BFA7E7DE5261A58
SHA1:100DCC495D580C6509F897304FF5A2411CF6F8A1
SHA-256:A5F151B860C6E11C4EFB59D4FF4A604C232C7EEE890CB6C5B45BF0C34CC9F4AD
SHA-512:966B7A15B75274BDF658DB21E2A498F55F1F19ED4BE0AEC818A81959F5B5A195FB502851A4277C401AADB2410276BC9D3103234E986015D961C46F28AC114687
Malicious:false
Preview:{"analyticsData":{"responseGUID":"97f093c6-09d6-49b7-99d0-e5a46af9245a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714139845817,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1713966880848}}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:data
Category:dropped
Size (bytes):4
Entropy (8bit):0.8112781244591328
Encrypted:false
SSDEEP:3:e:e
MD5:DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:false
Preview:....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):2814
Entropy (8bit):5.140235653251507
Encrypted:false
SSDEEP:48:YiFRGRXeyORaRD3gRJeRlsR/aRKRC4Rpm+6RKWFcRoycRv4WRuW9OR6RnBF:RFRGRIRaRD3gR8RaRiRKRNRpm+6R/cRC
MD5:DA48990B92B120D93B3C1517046931C4
SHA1:4DABC763342EC695BA0FB0689DE507989A77981D
SHA-256:1F3429A4AD112438B452B54989F693EFB2FD943512050A22F045B156CA82C47D
SHA-512:A9CBF748E61924986500DE5BEE9C901C6D89F35F984BF74DE9727658C785FE8929D796033EA5C9627760CDEDF46A5BD0678EEE4C84C6191D0DD1CFA1C17D3595
Malicious:false
Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"011a0507be084fb7245a8c7dbd82e98e","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1713966880000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"2f645093ca15ae3a351e47da27dafc3f","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1372,"ts":1713966880000},{"id":"Edit_InApp_Aug2020","info":{"dg":"731ff4d5a5961940cf7a9617580beb24","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1713966880000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"a0342e91b1bc80242e4a4d789d45b7cb","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1713966880000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"3819b26df53a3eeb43d108f719ec91b1","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1713966880000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"44721d374ccdfc548986dbb0e9e2836d","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1713966880000},

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:dropped
Size (bytes):12288
Entropy (8bit):1.1867303410795567
Encrypted:false
SSDEEP:48:TGufl2GL7msEHUUUUUUUUXzSvR9H9vxFGiDIAEkGVvpTr:lNVmswUUUUUUUUj+FGSIt7
MD5:26926CEE7CE303781336BD9B86CFA359
SHA1:2ADB1D856498A4156E339B929651885238AA57CF
SHA-256:4FF22E7B575B635848F041AAF09387BC486A8B5F1F99B5F162B0FF811746E927
SHA-512:D0CBF7C67AC9FE881F8F6C7F4AF2BCECB8A8841FEC263A15EF6BD5C907D8F2A1B5457737EDAA6374E0C072D6C54873CFD862A36C6FF53A4A61F59A02F5D26C4C
Malicious:false
Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:SQLite Rollback Journal
Category:dropped
Size (bytes):8720
Entropy (8bit):1.6068806804027993
Encrypted:false
SSDEEP:48:7M2KUUUUUUUUUUX3vR9H9vxFGiDIAEkGVveqFl2GL7msr:7+UUUUUUUUUU/FGSIt4KVmsr
MD5:1CC27E188ABE437961ED495FAB98754B
SHA1:4BB6C2F4586CDEBE6578674EC478A5F7959B8FAC
SHA-256:11ACFA5488AA53609262CA8453CBD12591237F724565D5D699AA49FA9CC8525E
SHA-512:B0E098BFF5F38D127F275B7E6709D0F2A45306BB4CBA5C192A350A6E2D820923134FB345633EA29D4AB6F0D06F44D84E25DF31A8D3D5CCF79ABBEC16FD6B16BE
Malicious:false
Preview:.... .c.....o.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIc3583.LOG

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:dropped
Size (bytes):246
Entropy (8bit):3.501595078528367
Encrypted:false
SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8c+aV7mCH:Qw946cPbiOxDlbYnuRKH5vH
MD5:45DF00AC2355D1045DD59F038A6DD7F6
SHA1:22DD79681BFDB2CDC6B6C6C7E233B7B721267DB0
SHA-256:92F7EAA39852374DD4147D29588AC0DF11F75EED839B00C14F6E17F6AF70BC4B
SHA-512:DC9BD375E9288A419B21C0462406EBFD240001562C4BAD5207C38FBD59945FDC46203104C826BFE663B28300E8541EC8A28DC994338CB3EE8EDA46249B115E1A
Malicious:false
Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.4./.0.4./.2.0.2.4. . .1.5.:.5.4.:.4.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A921765m_1b6sn6m_4uw.tmp

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:PDF document, version 1.6, 0 pages
Category:dropped
Size (bytes):358
Entropy (8bit):4.99266790937656
Encrypted:false
SSDEEP:6:IngVMrexJzJT0y9VEQIFVmb/eu2g/86S1kxROOVTJuXKCTJuXKnCSyAAO:IngVMre9T0HQIDmy9g06JXTmKCdmKnlX
MD5:1CF3CC2751E7B2403B9BCA9D198E5342
SHA1:1193722198ADEAE89464BD0F09A40C5F99D5AA43
SHA-256:A92A5335F90CE2FDAAD36D5AF8B2FC34D5DD18CE07CAFBB4E65761B276C67E4E
SHA-512:887098C32633A7347F68166D77410B21CB6EE924728F533144AD8825EF6D4F1116A71064CF5974DE5D4058FC1D41C45F48B7BE58FD3ADFCC1CFBF3C7631A7EB8
Malicious:false
Preview:%PDF-1.6.%......1 0 obj.<</Pages 2 0 R/Type/Catalog>>.endobj.2 0 obj.<</Count 0/Kids[]/Type/Pages>>.endobj.3 0 obj.<<>>.endobj.xref..0 4..0000000000 65535 f..0000000016 00000 n..0000000061 00000 n..0000000107 00000 n..trailer..<</Size 4/Root 1 0 R/Info 3 0 R/ID[<4145360AC4D66347A5199153B069019E><4145360AC4D66347A5199153B069019E>]>>..startxref..127..%%EOF..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-24 15-54-36-990.log

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:ASCII text, with very long lines (393)
Category:dropped
Size (bytes):16525
Entropy (8bit):5.345946398610936
Encrypted:false
SSDEEP:384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:false
Preview:SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:ASCII text, with very long lines (393), with CRLF line terminators
Category:dropped
Size (bytes):16603
Entropy (8bit):5.375247552570406
Encrypted:false
SSDEEP:384:RyYACABA6AMAvA8A3AwbAmNyNDN4NfNl60HZHF8v878iJ2JFJUJTe9M909y9+wJ7:gdd
MD5:83BD380D77BACB88AB1C44B8917610F9
SHA1:403D30E2A750E524C7647271D9B955356176A00F
SHA-256:C7BE8D1F5E8EFDA4361CFE4D06CAD3E1CE24AC526083CF71807DF14E982C51D7
SHA-512:8E4709F719C7C30AC9F6054591B015ECBD714CE50DC14E1812162E592CB77B3B75D41725F79E03C70C974B5916366FB183DDA31538B2E1835F9F284E2B505C88
Malicious:false
Preview:SessionID=962d2097-f00b-4548-9c0c-8e0e538b2cf9.1713966877009 Timestamp=2024-04-24T15:54:37:009+0200 ThreadID=3272 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=962d2097-f00b-4548-9c0c-8e0e538b2cf9.1713966877009 Timestamp=2024-04-24T15:54:37:010+0200 ThreadID=3272 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=962d2097-f00b-4548-9c0c-8e0e538b2cf9.1713966877009 Timestamp=2024-04-24T15:54:37:010+0200 ThreadID=3272 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=962d2097-f00b-4548-9c0c-8e0e538b2cf9.1713966877009 Timestamp=2024-04-24T15:54:37:010+0200 ThreadID=3272 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=962d2097-f00b-4548-9c0c-8e0e538b2cf9.1713966877009 Timestamp=2024-04-24T15:54:37:010+0200 ThreadID=3272 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:ASCII text, with CRLF line terminators
Category:dropped
Size (bytes):29845
Entropy (8bit):5.389016266368936
Encrypted:false
SSDEEP:768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rO:K
MD5:ADE65BD4EDBD8F0D140B4115BD73EBAD
SHA1:7973188EB72488104E04B71045B4F235E3C53246
SHA-256:7652954CE241B1A8B98B0E516653E7FC1031DFEB665AA27602B5BFFD05DB5133
SHA-512:71DF61B89C07F2454D7C29617AB3BAB1B46E1BF00B6A90AC1616875F7CBB545FDF46A4573D1B775653F3BEE0BD871873ACA3AF1E33B687512EEBFB71EDA2983D
Malicious:false
Preview:03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\4ed3c469-3983-4ba4-b28b-5414761cc1e4.tmp

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:dropped
Size (bytes):1407294
Entropy (8bit):7.97605879016224
Encrypted:false
SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:false
Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\8dea7bab-3771-4cd3-85df-2394a8bdea26.tmp

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:dropped
Size (bytes):758601
Entropy (8bit):7.98639316555857
Encrypted:false
SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:3A49135134665364308390AC398006F1
SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:false
Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\a7117dc9-c23a-4be9-b155-4bdd85f60115.tmp

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:dropped
Size (bytes):386528
Entropy (8bit):7.9736851559892425
Encrypted:false
SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:5C48B0AD2FEF800949466AE872E1F1E2
SHA1:337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:false
Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\b0736235-78eb-41a1-81cd-940b9fb25bd7.tmp

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:dropped
Size (bytes):1419751
Entropy (8bit):7.976496077007677
Encrypted:false
SSDEEP:24576:/xA7owWLcGZtwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLcGZtwZGk3mlind9i4ufFXpAXkru
MD5:A46246FAEAB95D87F5B4FE236C2B3D3E
SHA1:7F018DB9238A63FEAD8D11A92297E7366058A75A
SHA-256:7E822FECC47177C5A7F4C250E7D53509D104DE68B0D0CE9445877B508400988E
SHA-512:8AAB79958BF39F014FBA7F69287FE0C357746E63FA3482DE3231BDF4A97B964A0815DAF7BFE9751C55BA6BE618E0A964CEB23FC30B4FA9DFEB284F42EBA897BF
Malicious:false
Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

Static File Info

General

File type:PDF document, version 1.5, 2 pages
Entropy (8bit):7.992350840789984
TrID:
  • Adobe Portable Document Format (5005/1) 100.00%
File name:PDF.pdf
File size:363'948 bytes
MD5:fd5b2d2f6c3f4b92b25ef110751cb024
SHA1:4bcc58c2e98a760f7d91fd106e0ac962381ad06b
SHA256:93d72a5b9d6b70e8fae6e848af34d9ec659ce811637c4970add600bda8e18f69
SHA512:8ce4da26654e20ce960d567fc3b06031f2c65298c34c82c8460f47e04b28f4e2d8b0df15162db1dc12c00e40708f4cd62a1c26c8d8c280ce42f9faff3e1db5b3
SSDEEP:6144:x4ppvCQFRsfo5SEgdsxaB+bAVDrvwyXvcZDZ6lUGGUvQQL57e8yf0SZcRczHq8SP:xGXYo5SjsxayGPv1Xvc3+U+QQL54f0CG
TLSH:0F74122BD8955D1DBD038E494E27681143ADF03372C825A51C7E098AA205ED6EFDF3BE
File Content Preview:%PDF-1.5.%.....8 0 obj.<<./Type /FontDescriptor./FontName /Times#20New#20Roman./Flags 32./ItalicAngle 0./Ascent 891./Descent -216./CapHeight 693./AvgWidth 401./MaxWidth 2614./FontWeight 400./XHeight 250./Leading 42./StemV 40./FontBBox [-568 -216 2046 693]

File Icon

Icon Hash:62cc8caeb29e8ae0

Static PDF Info

General

Header:%PDF-1.5
Total Entropy:7.992351
Total Bytes:363948
Stream Entropy:7.994865
Stream Bytes:355196
Entropy outside Streams:5.000754
Bytes outside Streams:8752
Number of EOF found:1
Bytes after EOF:

Keywords Statistics

NameCount
obj52
endobj52
stream7
endstream7
xref1
trailer1
startxref1
/Page2
/Encrypt0
/ObjStm0
/URI0
/JS0
/JavaScript0
/AA0
/OpenAction0
/AcroForm0
/JBIG2Decode0
/RichMedia0
/Launch0
/EmbeddedFile0

Image Streams

IDDHASHMD5Preview
27406667416b6d61484e1bf1960318bb2f370a7df8574c5251

Network Behavior

Network Port Distribution

TCP Packets

TimestampSource PortDest PortSource IPDest IP
Apr 24, 2024 15:54:47.487761021 CEST49740443192.168.2.423.1.100.158
Apr 24, 2024 15:54:47.487797022 CEST4434974023.1.100.158192.168.2.4
Apr 24, 2024 15:54:47.487869024 CEST49740443192.168.2.423.1.100.158
Apr 24, 2024 15:54:47.488068104 CEST49740443192.168.2.423.1.100.158
Apr 24, 2024 15:54:47.488079071 CEST4434974023.1.100.158192.168.2.4
Apr 24, 2024 15:54:48.005764008 CEST4434974023.1.100.158192.168.2.4
Apr 24, 2024 15:54:48.006148100 CEST49740443192.168.2.423.1.100.158
Apr 24, 2024 15:54:48.006175041 CEST4434974023.1.100.158192.168.2.4
Apr 24, 2024 15:54:48.007169008 CEST4434974023.1.100.158192.168.2.4
Apr 24, 2024 15:54:48.007266045 CEST49740443192.168.2.423.1.100.158
Apr 24, 2024 15:54:48.009574890 CEST49740443192.168.2.423.1.100.158
Apr 24, 2024 15:54:48.009639025 CEST4434974023.1.100.158192.168.2.4
Apr 24, 2024 15:54:48.009886980 CEST49740443192.168.2.423.1.100.158
Apr 24, 2024 15:54:48.009892941 CEST4434974023.1.100.158192.168.2.4
Apr 24, 2024 15:54:48.054837942 CEST49740443192.168.2.423.1.100.158
Apr 24, 2024 15:54:48.182060003 CEST4434974023.1.100.158192.168.2.4
Apr 24, 2024 15:54:48.182285070 CEST4434974023.1.100.158192.168.2.4
Apr 24, 2024 15:54:48.182341099 CEST49740443192.168.2.423.1.100.158
Apr 24, 2024 15:54:48.182750940 CEST49740443192.168.2.423.1.100.158
Apr 24, 2024 15:54:48.182769060 CEST4434974023.1.100.158192.168.2.4
Apr 24, 2024 15:54:48.182780981 CEST49740443192.168.2.423.1.100.158
Apr 24, 2024 15:54:48.182818890 CEST49740443192.168.2.423.1.100.158

HTTP Request Dependency Graph

  • armmf.adobe.com

HTTPS Proxied Packets

Session IDSource IPSource PortDestination IPDestination PortPIDProcess
0192.168.2.44974023.1.100.1584437204C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
TimestampBytes transferredDirectionData
2024-04-24 13:54:48 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
Host: armmf.adobe.com
Connection: keep-alive
Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: empty
Accept-Encoding: gzip, deflate, br
If-None-Match: "78-5faa31cce96da"
If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
2024-04-24 13:54:48 UTC198INHTTP/1.1 304 Not Modified
Content-Type: text/plain; charset=UTF-8
Last-Modified: Mon, 01 May 2023 15:02:33 GMT
ETag: "78-5faa31cce96da"
Date: Wed, 24 Apr 2024 13:54:48 GMT
Connection: close


Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

General

Target ID:0
Start time:15:54:33
Start date:24/04/2024
Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):false
Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\PDF.pdf"
Imagebase:0x7ff6bc1b0000
File size:5'641'176 bytes
MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:moderate
Has exited:true

General

Target ID:1
Start time:15:54:34
Start date:24/04/2024
Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):false
Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:0x7ff74bb60000
File size:3'581'912 bytes
MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:moderate
Has exited:true

General

Target ID:3
Start time:15:54:34
Start date:24/04/2024
Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):false
Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1720,i,6517084977861050195,15223958444467974964,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:0x7ff74bb60000
File size:3'581'912 bytes
MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:moderate
Has exited:true

Disassembly

⊘No disassembly