Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Bestaetigungsanfrage.pdf

Overview

General Information

Sample name:Bestaetigungsanfrage.pdf
Analysis ID:1432063
MD5:eefd99f1a07e5fc5de1df35d1443916b
SHA1:6851a5630d062b243ff87a3cb056a5b6d7607042
SHA256:eec6d591b1bb4f40410e1fab78d03e609578add871aaf3beabbef19ff8fee3e5
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 2232 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Bestaetigungsanfrage.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 7260 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 7488 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1724,i,6587751018619387655,4361184060487084135,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficTCP traffic: 192.168.2.8:49715 -> 23.196.176.131:443
Source: global trafficTCP traffic: 192.168.2.8:49715 -> 23.196.176.131:443
Source: global trafficTCP traffic: 192.168.2.8:49715 -> 23.196.176.131:443
Source: global trafficTCP traffic: 192.168.2.8:49715 -> 23.196.176.131:443
Source: global trafficTCP traffic: 192.168.2.8:49715 -> 23.196.176.131:443
Source: global trafficTCP traffic: 192.168.2.8:49715 -> 23.196.176.131:443
Source: global trafficTCP traffic: 192.168.2.8:49715 -> 23.196.176.131:443
Source: global trafficTCP traffic: 192.168.2.8:49715 -> 23.196.176.131:443
Source: global trafficTCP traffic: 192.168.2.8:49715 -> 23.196.176.131:443
Source: global trafficTCP traffic: 192.168.2.8:49715 -> 23.196.176.131:443
Source: global trafficTCP traffic: 192.168.2.8:49715 -> 23.196.176.131:443
Source: global trafficTCP traffic: 192.168.2.8:49715 -> 23.196.176.131:443
Source: global trafficTCP traffic: 192.168.2.8:49715 -> 23.196.176.131:443
Source: global trafficTCP traffic: 192.168.2.8:49715 -> 23.196.176.131:443
Source: global trafficTCP traffic: 23.196.176.131:443 -> 192.168.2.8:49715
Source: global trafficTCP traffic: 192.168.2.8:49715 -> 23.196.176.131:443
Source: global trafficTCP traffic: 192.168.2.8:49715 -> 23.196.176.131:443
Source: global trafficTCP traffic: 23.196.176.131:443 -> 192.168.2.8:49715
Source: global trafficTCP traffic: 23.196.176.131:443 -> 192.168.2.8:49715
Source: global trafficTCP traffic: 192.168.2.8:49715 -> 23.196.176.131:443
Source: global trafficTCP traffic: 23.196.176.131:443 -> 192.168.2.8:49715
Source: global trafficTCP traffic: 23.196.176.131:443 -> 192.168.2.8:49715
Source: global trafficTCP traffic: 192.168.2.8:49715 -> 23.196.176.131:443
Source: global trafficTCP traffic: 192.168.2.8:49715 -> 23.196.176.131:443
Source: global trafficTCP traffic: 23.196.176.131:443 -> 192.168.2.8:49715
Source: global trafficTCP traffic: 192.168.2.8:49715 -> 23.196.176.131:443
Source: global trafficTCP traffic: 23.196.176.131:443 -> 192.168.2.8:49715
Source: global trafficTCP traffic: 192.168.2.8:49715 -> 23.196.176.131:443
Source: global trafficTCP traffic: 23.196.176.131:443 -> 192.168.2.8:49715
Source: global trafficTCP traffic: 192.168.2.8:49715 -> 23.196.176.131:443
Source: global trafficTCP traffic: 23.196.176.131:443 -> 192.168.2.8:49715
Source: global trafficTCP traffic: 23.196.176.131:443 -> 192.168.2.8:49715
Source: global trafficTCP traffic: 192.168.2.8:49715 -> 23.196.176.131:443
Source: global trafficTCP traffic: 192.168.2.8:49715 -> 23.196.176.131:443
Source: global trafficTCP traffic: 23.196.176.131:443 -> 192.168.2.8:49715
Source: global trafficTCP traffic: 192.168.2.8:49715 -> 23.196.176.131:443
Source: global trafficTCP traffic: 192.168.2.8:49715 -> 23.196.176.131:443
Source: Joe Sandbox ViewIP Address: 23.196.176.131 23.196.176.131
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 23.196.176.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.196.176.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.196.176.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.196.176.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.196.176.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.196.176.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.196.176.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.196.176.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.196.176.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.196.176.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.196.176.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.196.176.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.196.176.131
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: classification engineClassification label: clean2.winPDF@14/41@0/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journalJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-26 11-17-52-338.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Bestaetigungsanfrage.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1724,i,6587751018619387655,4361184060487084135,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1724,i,6587751018619387655,4361184060487084135,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: Bestaetigungsanfrage.pdfInitial sample: PDF keyword /JS count = 0
Source: Bestaetigungsanfrage.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: Bestaetigungsanfrage.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive12
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1432063 Sample: Bestaetigungsanfrage.pdf Startdate: 26/04/2024 Architecture: WINDOWS Score: 2 6 Acrobat.exe 20 62 2->6         started        process3 8 AcroCEF.exe 107 6->8         started        process4 10 AcroCEF.exe 4 8->10         started        dnsIp5 13 23.196.176.131, 443, 49715 AKAMAI-ASUS United States 10->13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
23.196.176.131
unknownUnited States
16625AKAMAI-ASUSfalse

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1432063
Start date and time:2024-04-26 11:16:56 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 10s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultwindowspdfcookbook.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:13
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:Bestaetigungsanfrage.pdf
Detection:CLEAN
Classification:clean2.winPDF@14/41@0/1
EGA Information:Failed
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 0
  • Number of non-executed functions: 0
Cookbook Comments:
  • Found application associated with file extension: .pdf
  • Found PDF document
  • Close Viewer

Warnings

  • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 23.193.120.142, 107.22.247.231, 54.144.73.197, 18.207.85.246, 34.193.227.236, 162.159.61.3, 172.64.41.3, 23.219.155.148, 23.219.155.165
  • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ssl-delivery.adobe.com.edgekey.net, acroipm2.adobe.com.edgesuite.net, a122.dscd.akamai.net, p13n.adobe.io, geo2.adobe.com, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com
  • Not all processes where analyzed, report is missing behavior information
  • VT rate limit hit for: Bestaetigungsanfrage.pdf

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
23.196.176.131SecuriteInfo.com.W32.PossibleThreat.18276.7286.exeGet hashmaliciousUnknownBrowse
    ljsQG2l81U.lnkGet hashmaliciousROKRATBrowse
      DEC-2023-12(20)-REXFPDF.urlGet hashmaliciousUnknownBrowse
        SimpleROOSg.exeGet hashmaliciousUnknownBrowse
          ge3W2hLPfF.exeGet hashmaliciousHavocBrowse
            Annual_Workers' Compensation Insurance Coverage, Wage Adjustment, For mmerryman _Fri Dec,2023.emlGet hashmaliciousUnknownBrowse

              Domains

              ⊘No context

              ASNs

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              AKAMAI-ASUSfile.exeGet hashmaliciousVidarBrowse
              • 23.194.234.100
              RemotePCHost.exeGet hashmaliciousUnknownBrowse
              • 184.31.62.93
              https://autode.sk/4bb5BeVGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
              • 23.214.187.157
              aios3.exeGet hashmaliciousUnknownBrowse
              • 184.31.60.185
              http://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3DGet hashmaliciousHTMLPhisherBrowse
              • 23.59.235.214
              dwn1cGHIbV.elfGet hashmaliciousMiraiBrowse
              • 104.73.199.214
              https://bushelman-my.sharepoint.com/:b:/p/lance/ESXtc6Laa05KpaC4W3rpMEMBfLSUU1GZhgfhBL8opRqFHg?e=Wrw3leGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
              • 23.223.31.42
              [EXTERNAL] New file received.emlGet hashmaliciousHTMLPhisherBrowse
              • 23.47.176.131
              https://www.bing.com/////////////////////ck/a?!&&p=0533e94aab0b2a6eJmltdHM9MTcxMzQ4NDgwMCZpZ3VpZD0xNDE4NDZmNi1iZWY1LTY4NjUtMjQ0YS01MjkwYmYwZTY5ODQmaW5zaWQ9NTIyMA&ptn=3&ver=2&hsh=3&fclid=141846f6-bef5-6865-244a-5290bf0e6984&u=a1aHR0cHM6Ly9reDRrc3IuYXJ0aWNsZXdyaXRpbmdnZW5lcmF0b3IueHl6Lw#vds2aa29aYmRldmluc0B3ZS13b3JsZHdpZGUuY29tGet hashmaliciousHTMLPhisherBrowse
              • 23.209.84.186
              lzShU2RYJa.exeGet hashmaliciousBabuk, Clipboard Hijacker, Djvu, VidarBrowse
              • 96.17.209.196

              JA3 Fingerprints

              ⊘No context

              Dropped Files

              ⊘No context

              Created / dropped Files

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):294
              Entropy (8bit):5.24578951170464
              Encrypted:false
              SSDEEP:6:6p+q2PCHhJ2nKuAl9OmbnIFUt81+Zmw+16VkwOCHhJ2nKuAl9OmbjLJ:NvBHAahFUt8c/+c56HAaSJ
              MD5:23FBDAE0E04A7E2BA9269DA4C9DD2BC5
              SHA1:B753AC8DBBE8DEDB972735A69C04FA389149C51A
              SHA-256:1A6D196B00CC2BEB952C977E591D517971FD7641E59C4CFF2B88E3A0B25290B6
              SHA-512:DEDEAC5463EDC5CD0C31DD4A71332442664D5827A36A584C701377A2808F772F7989C9EFAE04123BB0EA57D1823E41E038316DB674F05433F943E70FDB94082E
              Malicious:false
              Reputation:low
              Preview:2024/04/26-11:17:50.239 1c78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/26-11:17:50.241 1c78 Recovering log #3.2024/04/26-11:17:50.241 1c78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):294
              Entropy (8bit):5.24578951170464
              Encrypted:false
              SSDEEP:6:6p+q2PCHhJ2nKuAl9OmbnIFUt81+Zmw+16VkwOCHhJ2nKuAl9OmbjLJ:NvBHAahFUt8c/+c56HAaSJ
              MD5:23FBDAE0E04A7E2BA9269DA4C9DD2BC5
              SHA1:B753AC8DBBE8DEDB972735A69C04FA389149C51A
              SHA-256:1A6D196B00CC2BEB952C977E591D517971FD7641E59C4CFF2B88E3A0B25290B6
              SHA-512:DEDEAC5463EDC5CD0C31DD4A71332442664D5827A36A584C701377A2808F772F7989C9EFAE04123BB0EA57D1823E41E038316DB674F05433F943E70FDB94082E
              Malicious:false
              Reputation:low
              Preview:2024/04/26-11:17:50.239 1c78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/26-11:17:50.241 1c78 Recovering log #3.2024/04/26-11:17:50.241 1c78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):338
              Entropy (8bit):5.215744969535507
              Encrypted:false
              SSDEEP:6:yReq2PCHhJ2nKuAl9Ombzo2jMGIFUt8vbZmw+vCFkwOCHhJ2nKuAl9Ombzo2jMmd:3vBHAa8uFUt8D/+W56HAa8RJ
              MD5:0F6CDE2D7135C67E9C615860CE37BD82
              SHA1:539C572CF3972BA65F047E8DB09CF68B2EE3BE3E
              SHA-256:A60E02A3E53847F772D33F4C060FF076B72A88347C361FA87547841DAF43AABE
              SHA-512:D5B33A56905A4BE53DAC204AFEE85CF587D72E3247AE2740B8A0FF829EED2D444430C85D7614E5B2C97F9AF8C685D5EFEBD447C8DE896C241FC9571597AD4B9A
              Malicious:false
              Reputation:low
              Preview:2024/04/26-11:17:50.381 1d80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/26-11:17:50.383 1d80 Recovering log #3.2024/04/26-11:17:50.384 1d80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):338
              Entropy (8bit):5.215744969535507
              Encrypted:false
              SSDEEP:6:yReq2PCHhJ2nKuAl9Ombzo2jMGIFUt8vbZmw+vCFkwOCHhJ2nKuAl9Ombzo2jMmd:3vBHAa8uFUt8D/+W56HAa8RJ
              MD5:0F6CDE2D7135C67E9C615860CE37BD82
              SHA1:539C572CF3972BA65F047E8DB09CF68B2EE3BE3E
              SHA-256:A60E02A3E53847F772D33F4C060FF076B72A88347C361FA87547841DAF43AABE
              SHA-512:D5B33A56905A4BE53DAC204AFEE85CF587D72E3247AE2740B8A0FF829EED2D444430C85D7614E5B2C97F9AF8C685D5EFEBD447C8DE896C241FC9571597AD4B9A
              Malicious:false
              Reputation:low
              Preview:2024/04/26-11:17:50.381 1d80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/26-11:17:50.383 1d80 Recovering log #3.2024/04/26-11:17:50.384 1d80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):475
              Entropy (8bit):4.968905002143363
              Encrypted:false
              SSDEEP:12:YH/um3RA8sqZ0ZsBdOg2H2caq3QYiub6P7E4T3y:Y2sRdsnKdMHJ3QYhbS7nby
              MD5:99C20B5298B6370EA93FE5EE53CD1702
              SHA1:988B9E59F33E41B75A82895A13F44A77DA418BE5
              SHA-256:D6C8F778778690D308593DCB758A55CCA8FF120E13B62B639CDDEDC9BF938EEF
              SHA-512:6D8FDA5E176CC10C9BB2E88641DD1B7481AA100D76872E39CD490E43CAA5E00278334C3060309B1A008A990AB3F5DA7CB00E3F44C39BEBFE9B01F67DD1E7940C
              Malicious:false
              Reputation:low
              Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13358683082037911","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126553},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c82d34e2-7a62-4a9f-8e9b-80d40cc40d85.tmp

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:JSON data
              Category:modified
              Size (bytes):475
              Entropy (8bit):4.968905002143363
              Encrypted:false
              SSDEEP:12:YH/um3RA8sqZ0ZsBdOg2H2caq3QYiub6P7E4T3y:Y2sRdsnKdMHJ3QYhbS7nby
              MD5:99C20B5298B6370EA93FE5EE53CD1702
              SHA1:988B9E59F33E41B75A82895A13F44A77DA418BE5
              SHA-256:D6C8F778778690D308593DCB758A55CCA8FF120E13B62B639CDDEDC9BF938EEF
              SHA-512:6D8FDA5E176CC10C9BB2E88641DD1B7481AA100D76872E39CD490E43CAA5E00278334C3060309B1A008A990AB3F5DA7CB00E3F44C39BEBFE9B01F67DD1E7940C
              Malicious:false
              Reputation:low
              Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13358683082037911","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126553},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:data
              Category:dropped
              Size (bytes):4288
              Entropy (8bit):5.226985774917357
              Encrypted:false
              SSDEEP:96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+b/zqI0ZFbhcIsDZZ:S43C4mS7fFi0KFYDjr3LWO3V3aw+b/zf
              MD5:F69BF2563F495CF1538D0B792244FDCD
              SHA1:37B24597CBE472C68570D03CFFA4EAA46974A474
              SHA-256:EC9B177E423FD4C635C80D14F782E6E3FFEF23D15CF6FBE4160487EF1DBF8262
              SHA-512:70DB1D9C9CCF058BBE948CFC0AB383E1355E7EB9822C450445061544379EBEF055DCE2781FDD84006106A5B1BF5BAF2D4A76E95CC095281900C7FE71895D48A0
              Malicious:false
              Reputation:low
              Preview:*...#................version.1..namespace-8..|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):326
              Entropy (8bit):5.218137797648236
              Encrypted:false
              SSDEEP:6:01cq2PCHhJ2nKuAl9OmbzNMxIFUt8pHFUNZmw+pB1kwOCHhJ2nKuAl9OmbzNMFLJ:01cvBHAa8jFUt8pHm/+p/56HAa84J
              MD5:DA512ECD6A3AE1DD87F599A3A1ECD067
              SHA1:C7C49C026D8AA4DF357470B238299FDF93B6F866
              SHA-256:C160A44BA41AB5780C7ABCC6A69FBDBD20BA847FE5D602C419BE43FAF8495C06
              SHA-512:C7EB97974381C33F173EAB934FD220E37DEBADFFDC2F84C47B7BCDB70EAC7F89D7EDCC332045746DB2C2BAC228BFD7712206AB8642AE516567E79E9CA4BFCD98
              Malicious:false
              Reputation:low
              Preview:2024/04/26-11:17:50.521 1d80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/26-11:17:50.522 1d80 Recovering log #3.2024/04/26-11:17:50.523 1d80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):326
              Entropy (8bit):5.218137797648236
              Encrypted:false
              SSDEEP:6:01cq2PCHhJ2nKuAl9OmbzNMxIFUt8pHFUNZmw+pB1kwOCHhJ2nKuAl9OmbzNMFLJ:01cvBHAa8jFUt8pHm/+p/56HAa84J
              MD5:DA512ECD6A3AE1DD87F599A3A1ECD067
              SHA1:C7C49C026D8AA4DF357470B238299FDF93B6F866
              SHA-256:C160A44BA41AB5780C7ABCC6A69FBDBD20BA847FE5D602C419BE43FAF8495C06
              SHA-512:C7EB97974381C33F173EAB934FD220E37DEBADFFDC2F84C47B7BCDB70EAC7F89D7EDCC332045746DB2C2BAC228BFD7712206AB8642AE516567E79E9CA4BFCD98
              Malicious:false
              Reputation:low
              Preview:2024/04/26-11:17:50.521 1d80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/26-11:17:50.522 1d80 Recovering log #3.2024/04/26-11:17:50.523 1d80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

              C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240426091754Z-161.bmp

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
              Category:dropped
              Size (bytes):65110
              Entropy (8bit):1.2192615175664085
              Encrypted:false
              SSDEEP:96:K3sHMMMhSLbL8MzMMdMQMMEMZn4tMEMbW06wGTmiM6JHijJ/8WMYMAMM3MvMyj0J:dbV33XcKcElF7l
              MD5:0FF6A972577BA275B396B8F20097A2A7
              SHA1:A943AA577735C261D8972F2A61E9833BAE2B429E
              SHA-256:74DB72718FBFF484342A31D9FC7F776E0B3EEAC0A184140E41AD21D00259EE6A
              SHA-512:839D8EDFA19AA67256C44AB302CDC837E526A90D2A10EA1D04206D9CCD95F4EF9055074DB0DC91E91BB8B60D0A5F7F41628A7E6581EEBCEB2FC9750C9F568206
              Malicious:false
              Reputation:low
              Preview:BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6984

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:PostScript document text
              Category:dropped
              Size (bytes):185099
              Entropy (8bit):5.182478651346149
              Encrypted:false
              SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
              MD5:94185C5850C26B3C6FC24ABC385CDA58
              SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
              SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
              SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
              Malicious:false
              Reputation:moderate, very likely benign file
              Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:PostScript document text
              Category:dropped
              Size (bytes):185099
              Entropy (8bit):5.182478651346149
              Encrypted:false
              SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
              MD5:94185C5850C26B3C6FC24ABC385CDA58
              SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
              SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
              SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
              Malicious:false
              Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:data
              Category:dropped
              Size (bytes):227002
              Entropy (8bit):3.392780893644728
              Encrypted:false
              SSDEEP:1536:qKPC4iyzDtrh1cK3XEiv07VK/3AYvYwgF/rRoL+sn:XPCaL/3AYvYwglFoL+sn
              MD5:27094DF6D14B4D6728D59FFC4E31294B
              SHA1:CC768A8693F9C122496C2BE949E13F0C36AE7888
              SHA-256:B26846BECCDB3792F05A996D2863C7A1D286BD9F997DBC2112604EBDD206FEAC
              SHA-512:681F8D3F21AF1B1898F6572DB44AE92CF2AF56B3E8C9421C679DF0962A6CABE44753A5327368DAB97BC9AF997EFD86B803847285BB64F427196C65C8B0348BE8
              Malicious:false
              Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):295
              Entropy (8bit):5.352003303872756
              Encrypted:false
              SSDEEP:6:YEQXJ2HX44E52WO2vB3/dVlPIHAR0Y/8goAvJM3g98kUwPeUkwRe9:YvXKX43U2vR/ZwHAorGMbLUkee9
              MD5:D64F1D9EFDA28956A476FD7D88B92FFF
              SHA1:A439AE72186ECE90BD92040CA22F59454CD68B7D
              SHA-256:9FF0B45A2203B63528F7FF5B0E547A23EC1FF01E7F90147547892F8A63647A38
              SHA-512:42745CDF04A9E609B5D6B554CA6329BD839E1A24158F463F2EF8A4C8B5A957E114607035E6B33D918376B02AC3A9FE7FE0247CF1CE0B0CB8F65E4370D52D1AC7
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"d29a4319-4947-4c90-879c-4a6b87685744","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1714296551353,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):294
              Entropy (8bit):5.291648106497895
              Encrypted:false
              SSDEEP:6:YEQXJ2HX44E52WO2vB3/dVlPIHAR0Y/8goAvJfBoTfXpnrPeUkwRe9:YvXKX43U2vR/ZwHAorGWTfXcUkee9
              MD5:0012AFDA8D3EFCB2B5358CB54B77520C
              SHA1:4761DCAE773524F1D433EA4C4F473F51F59C5638
              SHA-256:7B2A2A5208644BAFAD3B1E1D3CBD9EF2DD725449230B6759BA798A0CF6FD11DE
              SHA-512:CC696AD9A6DCACECEF07429A83CFBEC7E6563A693676816BAFA623F8016963758C79DCD1617DEFD865A1F8C9FED660AB7D117778D90850B2D7A1A425152D4477
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"d29a4319-4947-4c90-879c-4a6b87685744","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1714296551353,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):294
              Entropy (8bit):5.269600706497255
              Encrypted:false
              SSDEEP:6:YEQXJ2HX44E52WO2vB3/dVlPIHAR0Y/8goAvJfBD2G6UpnrPeUkwRe9:YvXKX43U2vR/ZwHAorGR22cUkee9
              MD5:DF24D92DD3E6E976DD24B09F5EC0AE86
              SHA1:DEEE81617A6F0ECDBCC6E15296B35A6D5DD63D8D
              SHA-256:7B7AC1ADFF7E4360B30DDF021093FD26302A31F2994526F1656BF5FBE19E5ABF
              SHA-512:529A2F1374B3CFE1B1906C0127A50BE8BB410FF5BACB15A02715D1C48B7856D4AD04B64E8375CAFBC1E777BB4D71DFB53E42CA422AE4CCBD18723C1ED0853E63
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"d29a4319-4947-4c90-879c-4a6b87685744","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1714296551353,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):285
              Entropy (8bit):5.3285532510340365
              Encrypted:false
              SSDEEP:6:YEQXJ2HX44E52WO2vB3/dVlPIHAR0Y/8goAvJfPmwrPeUkwRe9:YvXKX43U2vR/ZwHAorGH56Ukee9
              MD5:79FF3D51997F6E119A9F257512C1AB25
              SHA1:5DE5DC5DFB2CD95FFE5CECCB5072AF4E15EAE513
              SHA-256:2C91A94E7A24603C11F07B03971B14BD36CD5AEBB042DAF77CE0A2665F713146
              SHA-512:B8EFF0F44590EE604FA15735461F273AADB7321B6462332B2E4F8C9FDFA173ADBF47DC66CB32443B139846FA9803DA05BC3022544DDC83BB176AE64CC56BFFB2
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"d29a4319-4947-4c90-879c-4a6b87685744","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1714296551353,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):292
              Entropy (8bit):5.294815684479312
              Encrypted:false
              SSDEEP:6:YEQXJ2HX44E52WO2vB3/dVlPIHAR0Y/8goAvJfJWCtMdPeUkwRe9:YvXKX43U2vR/ZwHAorGBS8Ukee9
              MD5:DB13470460E8A63779FA5C7E2EDD6D2C
              SHA1:7B55D600EEA781653737E1F838694B72DD6261B6
              SHA-256:E8A8E54DAB77D12EBAF0905935A52DF3B1AA964B2DFE8A7581E6E4EB4AC60337
              SHA-512:EBC6E879912A00405E22831D9A0317B954D88F2F5869045D01E5B8EF7F044EABAB7F4DBDFA74A5742A38596A647953415AF4E7A310C8057A381555967491A2E8
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"d29a4319-4947-4c90-879c-4a6b87685744","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1714296551353,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):289
              Entropy (8bit):5.279391207971392
              Encrypted:false
              SSDEEP:6:YEQXJ2HX44E52WO2vB3/dVlPIHAR0Y/8goAvJf8dPeUkwRe9:YvXKX43U2vR/ZwHAorGU8Ukee9
              MD5:9C4B026908A8B9077BCBB3328AFC086E
              SHA1:5CC5CC015A26420A6D51FAAE6F886DAFD93F49E4
              SHA-256:42069FAADF2755F1518AEE9494FAF29B29193DD9540B6A95D954FD9BA6023A1A
              SHA-512:3684111057C2F8E1DCD5CC1A6B42775096850DEA6DD57AF0E229F90F58307414BE5CCEF7B4552F269FDAD849BA6CF8202BBCF4AE91B904D9021DC170FE8A99D8
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"d29a4319-4947-4c90-879c-4a6b87685744","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1714296551353,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):292
              Entropy (8bit):5.278590907159025
              Encrypted:false
              SSDEEP:6:YEQXJ2HX44E52WO2vB3/dVlPIHAR0Y/8goAvJfQ1rPeUkwRe9:YvXKX43U2vR/ZwHAorGY16Ukee9
              MD5:84D52A734862F0E95068F83439D93617
              SHA1:5952B597D3E4EE9CB5F04FE2CEA5D87562187CEA
              SHA-256:72689B878DF4DDE9021D2613B92CB994CEEB633646D84C1D2F46617379221DC1
              SHA-512:A5184282DB4D0A17FE36187C17E24BFE28951D0358AC93240051DF3E50A35D93A7ACB82BB0F20B1755F11DBBA53615DF63BA8C49119C6A67FD8FE84398EC994F
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"d29a4319-4947-4c90-879c-4a6b87685744","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1714296551353,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):289
              Entropy (8bit):5.29486395410216
              Encrypted:false
              SSDEEP:6:YEQXJ2HX44E52WO2vB3/dVlPIHAR0Y/8goAvJfFldPeUkwRe9:YvXKX43U2vR/ZwHAorGz8Ukee9
              MD5:7E15A17223248909E4C8420E169870FA
              SHA1:869DA3313FA48B0AFCD4D839314EBAD27FEC6740
              SHA-256:6ABA7094414119D5CC2298A259FACD60957D4F6724C10D7288D53FD9B7263174
              SHA-512:733C64D4BA48E339983603C115290FA8AF0E78483CF3339A4C94BC77547CC903A745A22C25EDBB7E69731657512A7D4F95B80E197DA48BEAF8C93A8BCD645BB5
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"d29a4319-4947-4c90-879c-4a6b87685744","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1714296551353,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):1372
              Entropy (8bit):5.744269280993622
              Encrypted:false
              SSDEEP:24:Yv6X4LJhkzKLgENRcbrZbq00iCCBrwJo++ns8ct4mFJNU:YvFJhcEgigrNt0wSJn+ns8cvFJ6
              MD5:C6B4FFED9CD45AF8B43912864C7D4484
              SHA1:30A38C2BE646FAFCD61E746A1A1BBFAB2C4A4546
              SHA-256:4A9D0B600B011E268C7FA28BF189B82BBEE8E726A4E7A6CE8CB529C6B4F20B05
              SHA-512:B33AFE69D18B4564BB674BC547765968313CC287B72E1F3A951879CB9FFD31C93A9BA8923329658ED67757A80DD655EF8D950C7219A10E568DA59E522A3C477B
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"d29a4319-4947-4c90-879c-4a6b87685744","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1714296551353,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"79887_247329ActionBlock_0","campaignId":79887,"containerId":"1","controlGroupId":"","treatmentId":"acc56846-d570-4500-a26e-7f8cf2b4acad","variationId":"247329"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJUcnkgQWNyb2JhdCBQcm8ifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNSIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTMiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIDctZGF5IHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0byBwcmVtaXVtIFBERiBhbmQgZS1zaWduaW5nIHRvb2xzLiIsImJ

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):289
              Entropy (8bit):5.288840336735978
              Encrypted:false
              SSDEEP:6:YEQXJ2HX44E52WO2vB3/dVlPIHAR0Y/8goAvJfYdPeUkwRe9:YvXKX43U2vR/ZwHAorGg8Ukee9
              MD5:BD32C4AA3628DEE5C323EF2D76432903
              SHA1:E4CB41D823913C25DC48A6FD75DA8B0BB70D3CCA
              SHA-256:20AA67F45649397E37AA6025ED39F8E9C567B7983A501B5D8C0F0F2498CB8CC5
              SHA-512:BD7715FB22E1A9C3EAEF0C82B774AC226FD25703F7997C3C353434798522BC2DBB46AEF6596644F69B7060E9C685BE7A94B879E8573BF24BDD39EBD49DB9B2CD
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"d29a4319-4947-4c90-879c-4a6b87685744","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1714296551353,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):1395
              Entropy (8bit):5.779513963854262
              Encrypted:false
              SSDEEP:24:Yv6X4LJhkOrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNs:YvFJhTHgDv3W2aYQfgB5OUupHrQ9FJm
              MD5:6246F30F685AFC30DC58B3F4EA60B6AD
              SHA1:6A0F42DDC4BBDB3DA620A64A5C2DFF8DCED50FC5
              SHA-256:7B5A46349F130F922F808D3F3955ABBFFC5DA962D9CE7941AF88C0B3F812F7DF
              SHA-512:1ED715126D4A8353CEF6F0D2EE8EA37833485F64FE6E9D29FE1EA75D0EC074AA4273969B903B7ED2F10DB48CF7E7D3B2AB4FFDE2EAB8F9770956FA18D28B88BE
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"d29a4319-4947-4c90-879c-4a6b87685744","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1714296551353,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):291
              Entropy (8bit):5.272464133126433
              Encrypted:false
              SSDEEP:6:YEQXJ2HX44E52WO2vB3/dVlPIHAR0Y/8goAvJfbPtdPeUkwRe9:YvXKX43U2vR/ZwHAorGDV8Ukee9
              MD5:DAC063F105DB3FBB60092D171DEC7E94
              SHA1:7420AD817980C176B20CF5ACF3C11DB07C8364D8
              SHA-256:6EF05F5D75D34CA01754647CDE999DE40801BE29170BB31E321817C29C12C870
              SHA-512:A3B7EB66EE68BEFDC936CB24DC3C25A55EB81D3078681D72FB1BD4F3E3CB299A180BB7138EC56EB6DF71EDAB782D8ABA83AD971C254549FD3CD7424A909D791D
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"d29a4319-4947-4c90-879c-4a6b87685744","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1714296551353,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):287
              Entropy (8bit):5.271352615962566
              Encrypted:false
              SSDEEP:6:YEQXJ2HX44E52WO2vB3/dVlPIHAR0Y/8goAvJf21rPeUkwRe9:YvXKX43U2vR/ZwHAorG+16Ukee9
              MD5:AC6CFE92FDCA5F96AABB9366461EEE4E
              SHA1:27F0A01D603938F6CAA3B73DFA094A3559393812
              SHA-256:0DDAFA209B349CEA68FA598128A38A3E5ACCB7DE873723E8850205B02D4F2C0B
              SHA-512:82F28F15151A02D43F77AA7FE5D61852CAB962218FFF5D41EC1B82B2D9043E589A8949A534840E0A211CEE1E4FFF866DB4FB9420133F4DE279CED99DB415AD56
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"d29a4319-4947-4c90-879c-4a6b87685744","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1714296551353,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):289
              Entropy (8bit):5.295069442453179
              Encrypted:false
              SSDEEP:6:YEQXJ2HX44E52WO2vB3/dVlPIHAR0Y/8goAvJfbpatdPeUkwRe9:YvXKX43U2vR/ZwHAorGVat8Ukee9
              MD5:CD0E1DB4A14E55DA9E0C6AF20D3F550E
              SHA1:2BB54C520B247A0943832842C0A9B4FF7863C44F
              SHA-256:E095BF7B15EFB2A0387BFF08F79DEF53FF14275965CA7DE6D1ABCF68BA27744A
              SHA-512:28FCED590F3F6C2F2875A0C0DA275EF66D9829155EB5DCAC687261CA245C506E6E6256764851EB0CEEC6A1FF3FBF102DAE7D2FDDD859A718E7276BF0FEA484CA
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"d29a4319-4947-4c90-879c-4a6b87685744","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1714296551353,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):286
              Entropy (8bit):5.24632268014875
              Encrypted:false
              SSDEEP:6:YEQXJ2HX44E52WO2vB3/dVlPIHAR0Y/8goAvJfshHHrPeUkwRe9:YvXKX43U2vR/ZwHAorGUUUkee9
              MD5:60F239995AD0F2E7C0252627FAA084BF
              SHA1:6ADD8EB7D0D57605F081F6DBD84723F0D911853F
              SHA-256:D7B533AEC2F131946E3F2DD2986EDF624CCA911E9276C3C94591E0E0F654109D
              SHA-512:A1B382B97FCA201341A8D47FC0C1BFB712B29DCE88F8DE015EEDD9FEAFCE6C5BD7E2B49070B899EE918AA145BAF8558A7455B149DE53102DB009C694720A862E
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"d29a4319-4947-4c90-879c-4a6b87685744","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1714296551353,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):782
              Entropy (8bit):5.3720457522028955
              Encrypted:false
              SSDEEP:12:YvXKX43U2vR/ZwHAorGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWy1:Yv6X4LJhkL168CgEXX5kcIfANhR
              MD5:6C3AD3176493A05934470947B931908B
              SHA1:B9CD62986F3D27AF56E5FC924084C87F25451C87
              SHA-256:E0C9062A73A03553DCAA47D5C7754E4B3DBB27667C94C69A6A12DF7022BD1C9C
              SHA-512:1CAFA38F62ECEC6A531B4A5BE86EADE039C86760B8FE756B8AF99A52ABE8978052BB6084EB7F687AA288D64195D522C91A751570464A15D7D55CDC807ABA3F67
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"d29a4319-4947-4c90-879c-4a6b87685744","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1714296551353,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1714123076386}}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:data
              Category:dropped
              Size (bytes):4
              Entropy (8bit):0.8112781244591328
              Encrypted:false
              SSDEEP:3:e:e
              MD5:DC84B0D741E5BEAE8070013ADDCC8C28
              SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
              SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
              SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
              Malicious:false
              Preview:....

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):2814
              Entropy (8bit):5.131394607842184
              Encrypted:false
              SSDEEP:24:YvJJzQxC9XaX/VEzaaaMVUEayOudGZu5muzujmO7j0SaEuC2f2LSEUWesMB5ohnA:YQSqeD5405REdXNSSIBeR9UV
              MD5:D7C4F5CEAEE364D55DB3AA13A27542CB
              SHA1:848EFA6925AE1972F5D1C788720ABB59D0C915F4
              SHA-256:CBEDD4DBED3FD74C82917863B0EE321EF52CBBB61A5B65E6A06C93B149F21CCD
              SHA-512:FC0184345139D23E51405E5A0624C469765B740E2E665D2D09CCAEC82BEE9826CAA8B5792DBD292F3FD499B1AE5C0787ABBDA75B259D998CEA4481A0E82F8FA8
              Malicious:false
              Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"7c9448d22c8b651abb718b0fef4fc25a","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1714123075000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"079ec4510bf6491b558bce0d5d0f4ced","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1372,"ts":1714123075000},{"id":"Edit_InApp_Aug2020","info":{"dg":"bd9bb4b85e48d8a3d8d163c5bfb09776","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1714123075000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"356437f96b981f7939aa1d4d1abdcfb6","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1714123075000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"e9f3e4eb4247ab0a2ae4f0c824ed1803","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1714123075000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"6a0030195a7cf456e8811aca0d22f601","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1714123075000},

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
              Category:dropped
              Size (bytes):12288
              Entropy (8bit):1.3184293147949788
              Encrypted:false
              SSDEEP:24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMe5ntqVph:TGufl2GL7ms9WR1CPmPbPah5typilIfF
              MD5:CA4A1F4B76E6C2135EFAE03CCC237E6B
              SHA1:9FD019F980E155965D651865D4BDFC37D642C23C
              SHA-256:952F5A3558DD4BF99C18B6D99A8F42BD967B8838AAFDAB671F9F794096CD9E48
              SHA-512:1A684A6AA3B221C2E320D7C7B1BF679A1B0ECF71A48D6B31EA684ED83A927545414BF876343FED38829C7128B3FE5F7D4F561E921F7F3D20C0F151A5B75B5830
              Malicious:false
              Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:SQLite Rollback Journal
              Category:dropped
              Size (bytes):8720
              Entropy (8bit):1.78074836919879
              Encrypted:false
              SSDEEP:24:7+tmlhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMe5n4qVpaVrScVr0InIqLhx/o:7MNWR1CPmPbPah54ypilI9qFl2GL7msm
              MD5:A9304C9D97AC5B36D3890D265614B16D
              SHA1:601288ACA14557B2524788A4A7B255B44E377F65
              SHA-256:CA136C95364D8F43F8DC45AADECC2F2A9265056C189D36479FB29C8559BABEF1
              SHA-512:369BF902DA98210C56E52A1884AB01262D6B149BB69723E0E56B759B3DC12852970E9E9DA6A767BC9DEB1AE1D0C2050D61933C20C0117B9A658CDD450D5DB721
              Malicious:false
              Preview:.... .c.....u.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\Temp\MSI6a7a7.LOG

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
              Category:dropped
              Size (bytes):246
              Entropy (8bit):3.5162684137903053
              Encrypted:false
              SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8mdWag:Qw946cPbiOxDlbYnuRKvS
              MD5:E881554E528BAA75B271C92B3E23E2E1
              SHA1:FF085F040BB1E617752C51D03A0C0A736077E2BF
              SHA-256:110750951D72C560BE40F220C9A9E2D7495AAB87E27441AEE79A95E7FCB4E10F
              SHA-512:E06CCD07CF19157171BBE11E519B4232B72F663A72B1D5062450F537CE4938B326D52720A27A8D8E1A6BA6B5FCB9C1159B95D1BC360FBE3FE5A4D7E0FF844975
              Malicious:false
              Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.6./.0.4./.2.0.2.4. . .1.1.:.1.7.:.5.7. .=.=.=.....

              C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-26 11-17-52-338.log

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:ASCII text, with very long lines (393)
              Category:dropped
              Size (bytes):16525
              Entropy (8bit):5.33860678500249
              Encrypted:false
              SSDEEP:384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
              MD5:C3FEDB046D1699616E22C50131AAF109
              SHA1:C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
              SHA-256:EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
              SHA-512:845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
              Malicious:false
              Preview:SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

              C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:ASCII text, with very long lines (393), with CRLF line terminators
              Category:dropped
              Size (bytes):16603
              Entropy (8bit):5.331751213559485
              Encrypted:false
              SSDEEP:384:HdhYpNps1Gmx6EX93ZeM7h0kU3+Py1yly3y2y9yfypyjyLyJyaybXPYmg6CY1Iig:FMd
              MD5:29D38D30E272241D6961D02E4C095A90
              SHA1:E95DB59DD54AA0B09C9CD901E086F2AB6FCF107B
              SHA-256:D866BE7995E7ABC09FBED18ED766A8B556B3238AE2003AF339AF8CED53CFD5F6
              SHA-512:A19627E927A4032AA371403E8DDDC8195D7A34E961E192C709964D507E7F0E0041D5F3D049500901FDCA7D949233A268FE06CB972D0A4C33AF393E0C74BF6A24
              Malicious:false
              Preview:SessionID=13b9223c-6f91-4de3-b092-a303099a6247.1714123072349 Timestamp=2024-04-26T11:17:52:349+0200 ThreadID=8012 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=13b9223c-6f91-4de3-b092-a303099a6247.1714123072349 Timestamp=2024-04-26T11:17:52:350+0200 ThreadID=8012 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=13b9223c-6f91-4de3-b092-a303099a6247.1714123072349 Timestamp=2024-04-26T11:17:52:350+0200 ThreadID=8012 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=13b9223c-6f91-4de3-b092-a303099a6247.1714123072349 Timestamp=2024-04-26T11:17:52:350+0200 ThreadID=8012 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=13b9223c-6f91-4de3-b092-a303099a6247.1714123072349 Timestamp=2024-04-26T11:17:52:350+0200 ThreadID=8012 Component=ngl-lib_NglAppLib Description="SetConf

              C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):29845
              Entropy (8bit):5.413306838979887
              Encrypted:false
              SSDEEP:192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbycbYI39cbb:ceo4+rsC732
              MD5:A231ADA6081ECC65FD1CA4A19232DF91
              SHA1:14EC23457BBFF5376F6FA8B7614F1EEFC8BE43C7
              SHA-256:B158A61FB242205A31E69F5C0083E2FBCF50D06C1FB6A10B7965380ABBAEDD81
              SHA-512:6B861DBAE20125F6901BFA4F4015763506E034CCC57CD9034EAFE1AF676B5446B54E07E35D634492F5012A1DA7749E11A9343C3A99BE829E633C0199A59CEDB5
              Malicious:false
              Preview:05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

              C:\Users\user\AppData\Local\Temp\acrocef_low\2d4de221-e3b4-4ac0-953c-26aa100cd83f.tmp

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
              Category:dropped
              Size (bytes):386528
              Entropy (8bit):7.9736851559892425
              Encrypted:false
              SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
              MD5:5C48B0AD2FEF800949466AE872E1F1E2
              SHA1:337D617AE142815EDDACB48484628C1F16692A2F
              SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
              SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
              Malicious:false
              Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

              C:\Users\user\AppData\Local\Temp\acrocef_low\467d3c70-7b56-4e65-b3d3-ba188d855078.tmp

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
              Category:dropped
              Size (bytes):1407294
              Entropy (8bit):7.97605879016224
              Encrypted:false
              SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
              MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
              SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
              SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
              SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
              Malicious:false
              Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

              C:\Users\user\AppData\Local\Temp\acrocef_low\78948e64-17f8-4fb8-90c6-32f395314076.tmp

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
              Category:dropped
              Size (bytes):758601
              Entropy (8bit):7.98639316555857
              Encrypted:false
              SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
              MD5:3A49135134665364308390AC398006F1
              SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
              SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
              SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
              Malicious:false
              Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

              C:\Users\user\AppData\Local\Temp\acrocef_low\9afadbb1-5364-437e-8d08-c852d840db9f.tmp

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
              Category:dropped
              Size (bytes):1419751
              Entropy (8bit):7.976496077007677
              Encrypted:false
              SSDEEP:24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
              MD5:18E3D04537AF72FDBEB3760B2D10C80E
              SHA1:B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
              SHA-256:BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
              SHA-512:2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
              Malicious:false
              Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

              Static File Info

              General

              File type:PDF document, version 1.5, 3 pages
              Entropy (8bit):6.154655157755229
              TrID:
              • Adobe Portable Document Format (5005/1) 100.00%
              File name:Bestaetigungsanfrage.pdf
              File size:234'873 bytes
              MD5:eefd99f1a07e5fc5de1df35d1443916b
              SHA1:6851a5630d062b243ff87a3cb056a5b6d7607042
              SHA256:eec6d591b1bb4f40410e1fab78d03e609578add871aaf3beabbef19ff8fee3e5
              SHA512:0b55214e420362372aa8cc32d443749a3675523de2566af3ff3ece4669a67695f6314626e8cf0982edfdd0ff62ecf7a83a2779e264a4520af693d81f662bbbbc
              SSDEEP:3072:rA2CI1AmUAZKf6+clVv2zaBbbX16n8s07rhqw:rAZ2ewX3lVe+5jwn8sS0w
              TLSH:D534AD17DC584AC7942D93FCBE025EFC2E0C6B5DE9956FEB44364F827A602279C0B05A
              File Content Preview:%PDF-1.5.%......1 0 obj.<</Type /Catalog./Pages 2 0 R./Outlines 6 0 R>>.endobj..7 0 obj.<</Length 17 0 R./Filter /FlateDecode./Type /ObjStm./N 10./First 69>>.stream.x..UKk.0...W.19..e..a....BiBZ......a..^m.....Q.t...z...F....9.Vp.uS..kS4..(.....+.L.Z.....

              File Icon

              Icon Hash:62cc8caeb29e8ae0

              Static PDF Info

              General

              Header:%PDF-1.5
              Total Entropy:6.154655
              Total Bytes:234873
              Stream Entropy:6.096651
              Stream Bytes:229998
              Entropy outside Streams:4.810015
              Bytes outside Streams:4875
              Number of EOF found:2
              Bytes after EOF:

              Keywords Statistics

              NameCount
              obj26
              endobj26
              stream9
              endstream9
              xref2
              trailer2
              startxref2
              /Page3
              /Encrypt0
              /ObjStm1
              /URI0
              /JS0
              /JavaScript0
              /AA0
              /OpenAction0
              /AcroForm0
              /JBIG2Decode0
              /RichMedia0
              /Launch0
              /EmbeddedFile0

              Image Streams

              IDDHASHMD5Preview
              220100000000000838b8901ae41fbf4780038b53a71c9410a5

              Network Behavior

              Network Port Distribution

              TCP Packets

              TimestampSource PortDest PortSource IPDest IP
              Apr 26, 2024 11:18:02.904334068 CEST49715443192.168.2.823.196.176.131
              Apr 26, 2024 11:18:02.904366970 CEST4434971523.196.176.131192.168.2.8
              Apr 26, 2024 11:18:02.904459953 CEST49715443192.168.2.823.196.176.131
              Apr 26, 2024 11:18:02.904656887 CEST49715443192.168.2.823.196.176.131
              Apr 26, 2024 11:18:02.904669046 CEST4434971523.196.176.131192.168.2.8
              Apr 26, 2024 11:18:03.284708023 CEST4434971523.196.176.131192.168.2.8
              Apr 26, 2024 11:18:03.285270929 CEST49715443192.168.2.823.196.176.131
              Apr 26, 2024 11:18:03.285296917 CEST4434971523.196.176.131192.168.2.8
              Apr 26, 2024 11:18:03.286336899 CEST4434971523.196.176.131192.168.2.8
              Apr 26, 2024 11:18:03.286417961 CEST49715443192.168.2.823.196.176.131
              Apr 26, 2024 11:18:03.289220095 CEST49715443192.168.2.823.196.176.131
              Apr 26, 2024 11:18:03.289295912 CEST4434971523.196.176.131192.168.2.8
              Apr 26, 2024 11:18:03.289433956 CEST49715443192.168.2.823.196.176.131
              Apr 26, 2024 11:18:03.332124949 CEST4434971523.196.176.131192.168.2.8
              Apr 26, 2024 11:18:03.335297108 CEST49715443192.168.2.823.196.176.131
              Apr 26, 2024 11:18:03.335310936 CEST4434971523.196.176.131192.168.2.8
              Apr 26, 2024 11:18:03.381083012 CEST49715443192.168.2.823.196.176.131
              Apr 26, 2024 11:18:03.416750908 CEST4434971523.196.176.131192.168.2.8
              Apr 26, 2024 11:18:03.416837931 CEST4434971523.196.176.131192.168.2.8
              Apr 26, 2024 11:18:03.417452097 CEST49715443192.168.2.823.196.176.131
              Apr 26, 2024 11:18:03.417608976 CEST49715443192.168.2.823.196.176.131
              Apr 26, 2024 11:18:03.417624950 CEST4434971523.196.176.131192.168.2.8
              Apr 26, 2024 11:18:03.417635918 CEST49715443192.168.2.823.196.176.131
              Apr 26, 2024 11:18:03.417766094 CEST49715443192.168.2.823.196.176.131

              HTTP Request Dependency Graph

              • armmf.adobe.com

              HTTPS Proxied Packets

              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              0192.168.2.84971523.196.176.1314437488C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              TimestampBytes transferredDirectionData
              2024-04-26 09:18:03 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
              Host: armmf.adobe.com
              Connection: keep-alive
              Accept-Language: en-US,en;q=0.9
              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
              Sec-Fetch-Site: same-origin
              Sec-Fetch-Mode: no-cors
              Sec-Fetch-Dest: empty
              Accept-Encoding: gzip, deflate, br
              If-None-Match: "78-5faa31cce96da"
              If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
              2024-04-26 09:18:03 UTC198INHTTP/1.1 304 Not Modified
              Content-Type: text/plain; charset=UTF-8
              Last-Modified: Mon, 01 May 2023 15:02:33 GMT
              ETag: "78-5faa31cce96da"
              Date: Fri, 26 Apr 2024 09:18:03 GMT
              Connection: close


              Statistics

              CPU Usage

              Click to jump to process

              Memory Usage

              Click to jump to process

              High Level Behavior Distribution

              Click to dive into process behavior distribution

              Behavior

              Click to jump to process

              System Behavior

              General

              Target ID:0
              Start time:11:17:49
              Start date:26/04/2024
              Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              Wow64 process (32bit):false
              Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Bestaetigungsanfrage.pdf"
              Imagebase:0x7ff6e8200000
              File size:5'641'176 bytes
              MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:moderate
              Has exited:true

              General

              Target ID:2
              Start time:11:17:49
              Start date:26/04/2024
              Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              Wow64 process (32bit):false
              Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
              Imagebase:0x7ff79c940000
              File size:3'581'912 bytes
              MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:moderate
              Has exited:true

              General

              Target ID:4
              Start time:11:17:50
              Start date:26/04/2024
              Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              Wow64 process (32bit):false
              Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1724,i,6587751018619387655,4361184060487084135,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
              Imagebase:0x7ff79c940000
              File size:3'581'912 bytes
              MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:moderate
              Has exited:true

              Disassembly

              ⊘No disassembly