Edit tour

Windows Analysis Report
CV 31944.pdf

Overview

General Information

Sample name:	CV 31944.pdf
Analysis ID:	1458482
MD5:	d33aefee20a17090334f5b11d92b4ad7
SHA1:	b8bbdb6a57baa8c6e1fc1e5cdf7580532d0093e1
SHA256:	c4303b728b8bfd336e8a3b52140ac97e0e4644455521d5544e81309e1167d983
Infos:

Detection

Score:	20
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

AI detected suspicious PDF

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 3104 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\CV 31944.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6236 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7284 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1724,i,8716942340994201186,11730400643872671699,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 1004 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://indeed-export-600551.pages.dev/009812389/291e" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1712 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1888,i,12805633937832967243,6919689399299974699,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: Joe Sandbox View	IP Address: 1.1.1.1 1.1.1.1
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.1.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab

Source: classification engine

Classification label: sus20.winPDF@41/49@0/7

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4956

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-06-17 12-12-00-793.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\CV 31944.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1724,i,8716942340994201186,11730400643872671699,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://indeed-export-600551.pages.dev/009812389/291e"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1888,i,12805633937832967243,6919689399299974699,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1724,i,8716942340994201186,11730400643872671699,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1888,i,12805633937832967243,6919689399299974699,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: CV 31944.pdf	Initial sample: PDF keyword /JS count = 0
Source: CV 31944.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: CV 31944.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Persistence and Installation Behavior

AI detected suspicious PDF

Source: PDF shot

LLM: Score: 9 Reasons: The screenshot contains multiple indicators of a potential phishing attempt. Firstly, there are visually prominent links such as 'click to download it manually' and 'https://indeed-export-600551.pages.dev/0009812389/291'. These links could potentially lead to malicious websites. Secondly, the text creates a sense of urgency by suggesting that the user needs to download the document manually if it did not start automatically. This tactic is commonly used in phishing attempts to prompt immediate action. Thirdly, the document impersonates a well-known brand, Indeed, which adds a layer of trust and can mislead users into believing the document is legitimate. Finally, the sense of urgency is directly connected to the prominent links, increasing the likelihood of a user clicking on them without proper scrutiny.

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Name	Malicious	Antivirus Detection	Reputation
https://get.indeedex.workers.dev/009812389/291e	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.185.132	unknown	United States	15169	GOOGLEUS	false
172.67.218.27	unknown	United States	13335	CLOUDFLARENETUS	false
172.66.47.155	unknown	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
35.190.80.1	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1458482
Start date and time:	2024-06-17 18:10:57 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	CV 31944.pdf
Detection:	SUS
Classification:	sus20.winPDF@41/49@0/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.19.126.149, 2.19.126.143, 184.28.88.176, 50.16.47.176, 54.224.241.105, 34.237.241.83, 18.213.11.84, 172.64.41.3, 162.159.61.3, 2.16.100.168, 88.221.110.91, 95.101.54.210, 95.101.54.195, 95.101.148.135, 192.229.221.95, 23.215.55.143, 23.215.55.140, 192.168.2.4, 142.250.185.227, 142.250.185.174, 142.250.110.84, 34.104.35.123, 172.217.18.10, 172.217.16.138, 142.250.186.170, 142.250.185.74, 216.58.206.74, 142.250.186.42, 172.217.23.106, 172.217.16.202, 142.250.181.234, 142.250.184.234, 216.58.212.170, 142.250.186.106, 142.250.184.202, 142.250.185.138, 216.58.212.138, 142.250.74.202, 2.16.164.121, 2.16.164.114, 2.16.164.91, 2.16.164.113, 142.250.185.67, 142.250.186.110, 51.105.71.136
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, slscr.update.microsoft.com, e4578.dscb.akamaiedge.net, clientservices.googleapis.com, a767.dspw65.akamai.net, acroipm2.adobe.com, dns.msftncsi.com, a1952.dscq.akamai.net, clients2.google.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, update.googleapis.com, wu-b-net.trafficmanager.net, apps.identrust.com, optimizationguide-pa.googleapis.com, clients1.google.com, self-events-data.trafficmanager.net, fs.microsoft.com, identrust.edgesuite.net, accounts.google.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, self.events.data.microsoft.com, onedscolprduks00.uksouth.cloudapp.azure.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ssl.adobe.com.edgekey.net, armmf.adobe.com, edgedl.me.gvt1.com, clients.l.google.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: CV 31944.pdf

Simulations

Behavior and APIs

Time	Type	Description
12:12:11	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

LLM Input / Output

Input	Output
URL: PDF Model: gpt-4o	```json { "riskscore": 9, "reasons": "The screenshot contains multiple indicators of a potential phishing attempt. Firstly, there are visually prominent links such as 'click to download it manually' and 'https://indeed-export-600551.pages.dev/0009812389/291'. These links could potentially lead to malicious websites. Secondly, the text creates a sense of urgency by suggesting that the user needs to download the document manually if it did not start automatically. This tactic is commonly used in phishing attempts to prompt immediate action. Thirdly, the document impersonates a well-known brand, Indeed, which adds a layer of trust and can mislead users into believing the document is legitimate. Finally, the sense of urgency is directly connected to the prominent links, increasing the likelihood of a user clicking on them without proper scrutiny." }

Input

Output

URL: PDF Model: gpt-4o

```json
{
  "riskscore": 9,
  "reasons": "The screenshot contains multiple indicators of a potential phishing attempt. Firstly, there are visually prominent links such as 'click to download it manually' and 'https://indeed-export-600551.pages.dev/0009812389/291'. These links could potentially lead to malicious websites. Secondly, the text creates a sense of urgency by suggesting that the user needs to download the document manually if it did not start automatically. This tactic is commonly used in phishing attempts to prompt immediate action. Thirdly, the document impersonates a well-known brand, Indeed, which adds a layer of trust and can mislead users into believing the document is legitimate. Finally, the sense of urgency is directly connected to the prominent links, increasing the likelihood of a user clicking on them without proper scrutiny."
}

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.66.47.155	https://yhz.pages.dev/	Get hash	malicious	HTMLPhisher	Browse
1.1.1.1	PO-230821_pdf.exe	Get hash	malicious	FormBook, NSISDropper	Browse	www.974dp.com/sn26/?kJBLpb8=qaEGeuQorcUQurUZCuE8d9pas+Z0M0brqtX248JBolEfq8j8F1R9i1jKZexhxY54UlRG&ML0tl=NZlpi
	AFfv8HpACF.exe	Get hash	malicious	Unknown	Browse	1.1.1.1/
	INVOICE_90990_PDF.exe	Get hash	malicious	FormBook	Browse	www.quranvisor.com/usvr/?mN9d3vF=HHrW7cA9N4YJlebHFvlsdlDciSnnaQItEG8Ccfxp291VjnjcuwoPACt7EOqEq4SWjIf8&Pjf81=-Zdd-V5hqhM4p2S
	Go.exe	Get hash	malicious	Unknown	Browse	1.1.1.1/
239.255.255.250	https://www.sitesofconscience.org/	Get hash	malicious	Unknown	Browse
	https://drive.google.com/file/d/1JwMEh9AmJIvZiNdqJh4RUnTkYVtbznuJ/view?ts=666b8066	Get hash	malicious	Unknown	Browse
	https://wetransfer2024.sytes.net/deviswetransfer%202/rzlt/log.php	Get hash	malicious	Unknown	Browse
	z1O4t3e2y4L1r3949253740576.html	Get hash	malicious	Unknown	Browse
	http://js.opttracker.online	Get hash	malicious	Unknown	Browse
	PlayVM_Now010-SavariaCOINC.html	Get hash	malicious	Unknown	Browse
	http://js.opttracker.online	Get hash	malicious	Unknown	Browse
	https://marvin-occentus.net/	Get hash	malicious	Unknown	Browse
	https://7zq30rxkp61j.creative-industry-solutions.icu/petition_case_ID/#8062233586	Get hash	malicious	Unknown	Browse
	one.txt	Get hash	malicious	Unknown	Browse
172.67.218.27	https://56b361.mxxauthen.ru/joseph.veiguela@seaboardmarine.com/##victimrealdomain##	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Launcher!.exe	Get hash	malicious	LummaC	Browse	104.21.49.90
	https://www.sitesofconscience.org/	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://drive.google.com/file/d/1JwMEh9AmJIvZiNdqJh4RUnTkYVtbznuJ/view?ts=666b8066	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://wetransfer2024.sytes.net/deviswetransfer%202/rzlt/log.php	Get hash	malicious	Unknown	Browse	104.26.1.90
	z1O4t3e2y4L1r3949253740576.html	Get hash	malicious	Unknown	Browse	104.21.7.194
	PlayVM_Now010-SavariaCOINC.html	Get hash	malicious	Unknown	Browse	188.114.97.3
	https://marvin-occentus.net/	Get hash	malicious	Unknown	Browse	104.22.2.142
	https://7zq30rxkp61j.creative-industry-solutions.icu/petition_case_ID/#8062233586	Get hash	malicious	Unknown	Browse	104.21.38.40
	lista de cotizaciones.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	188.114.96.3
	FedEx_#776282183902.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
CLOUDFLARENETUS	Launcher!.exe	Get hash	malicious	LummaC	Browse	104.21.49.90
	https://www.sitesofconscience.org/	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://drive.google.com/file/d/1JwMEh9AmJIvZiNdqJh4RUnTkYVtbznuJ/view?ts=666b8066	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://wetransfer2024.sytes.net/deviswetransfer%202/rzlt/log.php	Get hash	malicious	Unknown	Browse	104.26.1.90
	z1O4t3e2y4L1r3949253740576.html	Get hash	malicious	Unknown	Browse	104.21.7.194
	PlayVM_Now010-SavariaCOINC.html	Get hash	malicious	Unknown	Browse	188.114.97.3
	https://marvin-occentus.net/	Get hash	malicious	Unknown	Browse	104.22.2.142
	https://7zq30rxkp61j.creative-industry-solutions.icu/petition_case_ID/#8062233586	Get hash	malicious	Unknown	Browse	104.21.38.40
	lista de cotizaciones.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	188.114.96.3
	FedEx_#776282183902.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
CLOUDFLARENETUS	Launcher!.exe	Get hash	malicious	LummaC	Browse	104.21.49.90
	https://www.sitesofconscience.org/	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://drive.google.com/file/d/1JwMEh9AmJIvZiNdqJh4RUnTkYVtbznuJ/view?ts=666b8066	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://wetransfer2024.sytes.net/deviswetransfer%202/rzlt/log.php	Get hash	malicious	Unknown	Browse	104.26.1.90
	z1O4t3e2y4L1r3949253740576.html	Get hash	malicious	Unknown	Browse	104.21.7.194
	PlayVM_Now010-SavariaCOINC.html	Get hash	malicious	Unknown	Browse	188.114.97.3
	https://marvin-occentus.net/	Get hash	malicious	Unknown	Browse	104.22.2.142
	https://7zq30rxkp61j.creative-industry-solutions.icu/petition_case_ID/#8062233586	Get hash	malicious	Unknown	Browse	104.21.38.40
	lista de cotizaciones.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	188.114.96.3
	FedEx_#776282183902.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.229859450647582
Encrypted:	false
SSDEEP:	6:18AH9+q2Pwkn2nKuAl9OmbnIFUt8g8Ad5Zmw+g8AdtVkwOwkn2nKuAl9OmbjLJ:18q4vYfHAahFUt8g82/+g8K5JfHAaSJ
MD5:	D7FD42EDCACF786262D503420850D56F
SHA1:	95583D41BD5B1FC4D6203B02BE2BC31EB297293A
SHA-256:	6F6C16A23DC4D1004D8E94AF709969A09C110F1DEDE908D8E74C1559B3785F3D
SHA-512:	FC1E7319BA4A4FF7628ABEADEB07637C59FF307AC9CD42E5B30D4C29AE8B9642659E9AB9BE1A1671FF8C6250E0C558201438F1A6852C8FC32681A2E81B81F691
Malicious:	false
Reputation:	low
Preview:	2024/06/17-12:12:00.985 728 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/06/17-12:12:00.987 728 Recovering log #3.2024/06/17-12:12:00.987 728 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.229859450647582
Encrypted:	false
SSDEEP:	6:18AH9+q2Pwkn2nKuAl9OmbnIFUt8g8Ad5Zmw+g8AdtVkwOwkn2nKuAl9OmbjLJ:18q4vYfHAahFUt8g82/+g8K5JfHAaSJ
MD5:	D7FD42EDCACF786262D503420850D56F
SHA1:	95583D41BD5B1FC4D6203B02BE2BC31EB297293A
SHA-256:	6F6C16A23DC4D1004D8E94AF709969A09C110F1DEDE908D8E74C1559B3785F3D
SHA-512:	FC1E7319BA4A4FF7628ABEADEB07637C59FF307AC9CD42E5B30D4C29AE8B9642659E9AB9BE1A1671FF8C6250E0C558201438F1A6852C8FC32681A2E81B81F691
Malicious:	false
Reputation:	low
Preview:	2024/06/17-12:12:00.985 728 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/06/17-12:12:00.987 728 Recovering log #3.2024/06/17-12:12:00.987 728 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.145820863575695
Encrypted:	false
SSDEEP:	6:18m/4+q2Pwkn2nKuAl9Ombzo2jMGIFUt8g8mlU9Zmw+g8mlUBVkwOwkn2nKuAl97:184NvYfHAa8uFUt8g8L9/+g8LP5JfHAv
MD5:	83BF6C8234011AA53C61F1264066BEF0
SHA1:	C75BA020242E9033E2F731AF22F0031EE1ACC1E1
SHA-256:	4284E3A87B63CB8CF973FB484C869286A0506EC5C2F2479D1AEBD1D06AB9D23F
SHA-512:	03BE325CCC525EE170FA522C14E603DC3687D40CE2C87FDE633CB8B4F490B7A27319C42B18669D300407DFF017A70B32CB06E5177C29D53B3C86C32DD3DE4B34
Malicious:	false
Reputation:	low
Preview:	2024/06/17-12:12:01.105 1ca8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/06/17-12:12:01.107 1ca8 Recovering log #3.2024/06/17-12:12:01.107 1ca8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.145820863575695
Encrypted:	false
SSDEEP:	6:18m/4+q2Pwkn2nKuAl9Ombzo2jMGIFUt8g8mlU9Zmw+g8mlUBVkwOwkn2nKuAl97:184NvYfHAa8uFUt8g8L9/+g8LP5JfHAv
MD5:	83BF6C8234011AA53C61F1264066BEF0
SHA1:	C75BA020242E9033E2F731AF22F0031EE1ACC1E1
SHA-256:	4284E3A87B63CB8CF973FB484C869286A0506EC5C2F2479D1AEBD1D06AB9D23F
SHA-512:	03BE325CCC525EE170FA522C14E603DC3687D40CE2C87FDE633CB8B4F490B7A27319C42B18669D300407DFF017A70B32CB06E5177C29D53B3C86C32DD3DE4B34
Malicious:	false
Reputation:	low
Preview:	2024/06/17-12:12:01.105 1ca8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/06/17-12:12:01.107 1ca8 Recovering log #3.2024/06/17-12:12:01.107 1ca8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4e21d4ee-bbfd-4ab4-bb04-5149217d8003.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.968646153603545
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjsBdOg2HRcaq3QYiubInP7E4T3y:Y2sRdstdMHo3QYhbG7nby
MD5:	B0468111D5045AA634A25FC5A49280B0
SHA1:	EEE9BA3BB3164FE745884614F389E6807E431D75
SHA-256:	12EB9940499CB240AA9DE641381C71481962FA2638DD8C27EF61A867402C9E2C
SHA-512:	3CE0F045D12E42F9DCBDFCA547BA9FC4B275C65CA6D14C79EC5937736AB77D8CD5893B684A7976E37F09DE998C605E9DEFC178EAADA99DE7EEFCD983CFC6E28D
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13363200727095922","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":222308},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.968646153603545
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjsBdOg2HRcaq3QYiubInP7E4T3y:Y2sRdstdMHo3QYhbG7nby
MD5:	B0468111D5045AA634A25FC5A49280B0
SHA1:	EEE9BA3BB3164FE745884614F389E6807E431D75
SHA-256:	12EB9940499CB240AA9DE641381C71481962FA2638DD8C27EF61A867402C9E2C
SHA-512:	3CE0F045D12E42F9DCBDFCA547BA9FC4B275C65CA6D14C79EC5937736AB77D8CD5893B684A7976E37F09DE998C605E9DEFC178EAADA99DE7EEFCD983CFC6E28D
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13363200727095922","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":222308},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.254952261462308
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7kQT5N9D:etJCV4FiN/jTN/2r8Mta02fEhgO73goj
MD5:	0F36615E42700234894D232F7FFE20C5
SHA1:	44B98AED87FB7FEB85064D433FC9D918193F302A
SHA-256:	7702F7CAECBC03303E6CF21D2299601CE5F7E4E78615F39A6202BA96527795E5
SHA-512:	A4062CD6AC54584075D543D225E2DF1ADD3FCB96C2DA7C582DD34071B5752C2F456670A4C22F7E778252DC6EAC5C545B34E4CDDBDFEC64A3ECD920FF408AEC47
Malicious:	false
Reputation:	low
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.189607800809371
Encrypted:	false
SSDEEP:	6:18mNjN+q2Pwkn2nKuAl9OmbzNMxIFUt8g8mdZmw+g8m9NVkwOwkn2nKuAl9OmbzE:18ojIvYfHAa8jFUt8g8S/+g8I5JfHAab
MD5:	2E9BE9B595DC42A49DAA5BB5AF4A2C33
SHA1:	B188E7D149D37EBB450567EB0FC1438FB95249D6
SHA-256:	D1A1825DFCA3834AB32F3A82D5357E9F60384A95F9F15BC362EBBF9EB691DE00
SHA-512:	B32A4ADE8667B2A76999AE63223787727B3AF94965D61B9D0D99AD4F901BC301C5231E46DED77E101F1E37D78B13497C57564D8DA620B70A48181A3AF041AD6E
Malicious:	false
Reputation:	low
Preview:	2024/06/17-12:12:01.489 1ca8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/06/17-12:12:01.502 1ca8 Recovering log #3.2024/06/17-12:12:01.526 1ca8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.189607800809371
Encrypted:	false
SSDEEP:	6:18mNjN+q2Pwkn2nKuAl9OmbzNMxIFUt8g8mdZmw+g8m9NVkwOwkn2nKuAl9OmbzE:18ojIvYfHAa8jFUt8g8S/+g8I5JfHAab
MD5:	2E9BE9B595DC42A49DAA5BB5AF4A2C33
SHA1:	B188E7D149D37EBB450567EB0FC1438FB95249D6
SHA-256:	D1A1825DFCA3834AB32F3A82D5357E9F60384A95F9F15BC362EBBF9EB691DE00
SHA-512:	B32A4ADE8667B2A76999AE63223787727B3AF94965D61B9D0D99AD4F901BC301C5231E46DED77E101F1E37D78B13497C57564D8DA620B70A48181A3AF041AD6E
Malicious:	false
Reputation:	low
Preview:	2024/06/17-12:12:01.489 1ca8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/06/17-12:12:01.502 1ca8 Recovering log #3.2024/06/17-12:12:01.526 1ca8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444602208369469
Encrypted:	false
SSDEEP:	384:SeUci5tviBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:cks3OazzU89UTTgUL
MD5:	470746254A26BAFD849070F0DF293659
SHA1:	FFC20B4D2CF812BD398722B5E50C64DD96DDEE7F
SHA-256:	62E034448A48EDD9E7866CEB8830E8842B64A3DFD0E217E643350D2844566A0D
SHA-512:	0FBB29747D12D58A65A9CA379E23C5B8033AB3312344A888079E3D05A810366A3D9387926B2F8ABA5C04D01B87274C8C61BCFD1B031B40E6CA761DEF8898469B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2140862576641402
Encrypted:	false
SSDEEP:	48:7MgM7nCmRqvmFTIF3XmHjBoGGR+jMz+Lh5:7OntR79IVXEBodRBkD
MD5:	47E62C83929D74B8622CE239BDE967B2
SHA1:	CCD670B3791E538D53A9E1F1B6BED58DB9BF2CED
SHA-256:	BF98CDF24374DD5B4A192054151D71EB3D89E74EDAB17D761EEC447F18346540
SHA-512:	D075309B3ADD7DFD8D3852A606D1CB747B55B624440E603AF70EDF178544B2B3C6A10C85A95FBC0CB4085F984B96436B5042BB3A06B0A83E8CB0AD43AFD2D908
Malicious:	false
Preview:	.... .c.......t........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	893
Entropy (8bit):	7.366016576663508
Encrypted:	false
SSDEEP:	24:hBntmDvKUQQDvKUr7C5fpqp8gPvXHmXvponXux:3ntmD5QQD5XC5RqHHXmXvp++x
MD5:	D4AE187B4574036C2D76B6DF8A8C1A30
SHA1:	B06F409FA14BAB33CBAF4A37811B8740B624D9E5
SHA-256:	A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
SHA-512:	1F44A360E8BB8ADA22BC5BFE001F1BABB4E72005A46BC2A94C33C4BD149FF256CCE6F35D65CA4F7FC2A5B9E15494155449830D2809C8CF218D0B9196EC646B0C
Malicious:	false
Preview:	0..y...H.........j0..f...1.0....H.........N0..J0..2.......D....'..09...@k0....H........0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30...000930211219Z..210930140115Z0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30.."0....H.............0..........P..W..be......,k0.[...}.@......3vI.?!I..N..>H.e...!.e..2....w..{........s.z..2..~..0....8.y.1.P..e.Qc...a.Ka..Rk...K.(.H......>.... .[.....p....%.tr.{j.4.0...h.{T....Z...=d.....Ap..r.&.8U9C....\@........%.......:..n.>..\..<.i.....)W..=....]......B0@0...U.......0....0...U...........0...U.........{,q...K.u...`...0....H...............,...\...(f7:...?K.... ]..YD.>.>..K.t.....t..~.....K. D....}..j.....N..:.pI...........:^H...X._..Z.....Y..n......f3.Y[...sG.+..7H..VK....r2...D.SrmC.&H.Rg.X..gvqx...V..9$1....Z0G..P.......dc`........}...=2.e..\|.Wv..(9..e...w.j..w.......)...55.1.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1341929632267593
Encrypted:	false
SSDEEP:	6:kKmi9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:2DnLNkPlE99SNxAhUe/3
MD5:	7DD06B9E4CFB870BAD66269BEF81A4B8
SHA1:	FCE4B6200306BB75714D6DBF4172DCF4A3329C85
SHA-256:	CABC1C9F4B14FE83F31D82A8251BE7095CD66634AF64E9E70D29260E4B5D4A46
SHA-512:	160A0020746C9A2E206B33EFFE7F69121A27C4F36FE2D469A0650B16C2A04B274CECB7006637E827EBDA2B470A643C0F3FB045BDE8A69D89E5199739E7535284
Malicious:	false
Preview:	p...... ........Y.......(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.034404395079139
Encrypted:	false
SSDEEP:	3:kkFklUcMfllXlE/E/KRkzllPlzRkwWBARLNDU+ZMlKlBkvclcMlVHblB8V7lnklc:kKIYxliBAIdQZV7I7kc3
MD5:	6A0274FE02C3AD09CFDA97FFF4D6DFE3
SHA1:	39C5513C4CDC9571FC6EF46750C992B781B8D7D7
SHA-256:	DE01D9CEBDC76E87DB0E3F87AEC89D1D29D6DA68E237E189155187D916BDA320
SHA-512:	7D584D9C0CEAEC482D77EBFCA02EF65E2E891B6DB81B691385143AEB32EE0FBDD9C61C55B91F22A5F14138932D491057510A4BAFA62EA7E97B33ACD44F75168F
Malicious:	false
Preview:	p...... ....`.....K.....(....................................................... ........!.M........(...........}...h.t.t.p.:././.a.p.p.s...i.d.e.n.t.r.u.s.t...c.o.m./.r.o.o.t.s./.d.s.t.r.o.o.t.c.a.x.3...p.7.c...".3.7.d.-.6.0.7.9.b.8.c.0.9.2.9.c.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4956

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185099
Entropy (8bit):	5.182478651346149
Encrypted:	false
SSDEEP:	1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
MD5:	94185C5850C26B3C6FC24ABC385CDA58
SHA1:	42F042285037B0C35BC4226D387F88C770AB5CAA
SHA-256:	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
SHA-512:	652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185099
Entropy (8bit):	5.182478651346149
Encrypted:	false
SSDEEP:	1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
MD5:	94185C5850C26B3C6FC24ABC385CDA58
SHA1:	42F042285037B0C35BC4226D387F88C770AB5CAA
SHA-256:	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
SHA-512:	652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.33952852432691
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcaDRhGO9VoZcg1vRcR0YRFsoAvJM3g98kUwPeUkwRe9:YvXKXkZc0vSFGMbLUkee9
MD5:	EE49D102C79B5D09C7D63228B14B15E3
SHA1:	1141CB0B7E6CEB3EB55EB994F962B0915AC69A16
SHA-256:	42A1B5B859408554CC7DD8C12779763E9CE2E1F4608CAC42F1BC3901D40A1527
SHA-512:	B118AA05B8D1795071AA6EC588FEBD9ED0F14C5BCBDAEEB6FE59ACB528A25400BE2116C7399D947B849EDB9BBC78F1B844BDE89523A6965EC6749C0F2913B0F6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"091ffcca-a71b-4cae-9c97-b14565c495fc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1718814052381,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2866880687897835
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcaDRhGO9VoZcg1vRcR0YRFsoAvJfBoTfXpnrPeUkwRe9:YvXKXkZc0vSFGWTfXcUkee9
MD5:	373086E467BD6592BE35AB97040E96FF
SHA1:	DF8D557E5319666776F9C6486A5FC03C96A5F5BC
SHA-256:	B9C2CC71A165A9F9ADCEB2B1EF66E1185C4B832927E8620B3B00A4E4A33E2A94
SHA-512:	01EDF12CD299D3DA995DE526D7776487FF4F910B4458660288F29C35469F5B5B28B89F7CDD3AD64D7158A442D27FC3E139F494FA4591001799C285E9B29D9027
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"091ffcca-a71b-4cae-9c97-b14565c495fc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1718814052381,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2634821258406905
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcaDRhGO9VoZcg1vRcR0YRFsoAvJfBD2G6UpnrPeUkwRe9:YvXKXkZc0vSFGR22cUkee9
MD5:	50E9A1A77E2A4F8387DEE72E8A592D02
SHA1:	928B58E2D1BD343E986E9CAD63798C789FA5444C
SHA-256:	06C8D206D05DAFCEA98B953F2AAB1F72919D4ACD4A4352DFC6C72CD4A499FF7A
SHA-512:	FE99D72773973C1C468B2A0C3E8C6F31AC3B29AB81ED028A8BC16855F77851FB2929D350E8AC176F48EAF0A40C8AC80F7D53D99D1D154584FC525DCCFBE9851E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"091ffcca-a71b-4cae-9c97-b14565c495fc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1718814052381,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.325702719575041
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcaDRhGO9VoZcg1vRcR0YRFsoAvJfPmwrPeUkwRe9:YvXKXkZc0vSFGH56Ukee9
MD5:	72A16C7E5AEB9D2622BE485E4DD6F743
SHA1:	ACF3EF6F0E607028E78FB9DE1D0A293C0AF58930
SHA-256:	37FDBF5E579854AFDEAE237CEEB44DD81A4E05335D696FB99F8744EEEB841BF0
SHA-512:	A52BE2A317A8EB097AC263D8E843D448AB6814857E01F8A80B45A9466B1D679C989DB22BF32A275F9B6D8E035CEBF4F3E217CC4335FA77BDD95F6AB72D1A62B4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"091ffcca-a71b-4cae-9c97-b14565c495fc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1718814052381,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.288773036144777
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcaDRhGO9VoZcg1vRcR0YRFsoAvJfJWCtMdPeUkwRe9:YvXKXkZc0vSFGBS8Ukee9
MD5:	A9C0AAB872177A0F3BAFB62DCF9E1FC1
SHA1:	940D4E377367C3CE3F270491ECFF05AFD39490AD
SHA-256:	2DEFA01AC85293992D4BF1F29428FCB6F4E6AA25C08418ADABB5A7F8EB645FC4
SHA-512:	F27F31AAC42CE3AD10B951FA4A87DFA86DE8FAA67C95D5F369494B174B134DF4E303572736897D0BAB75C159DF73C9CFAD1FD5272AE397578B47FE7E8660BC30
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"091ffcca-a71b-4cae-9c97-b14565c495fc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1718814052381,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.273533102361165
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcaDRhGO9VoZcg1vRcR0YRFsoAvJf8dPeUkwRe9:YvXKXkZc0vSFGU8Ukee9
MD5:	4FCEFFF1E5C2BA91B259857E91280B2D
SHA1:	793A38CA16495169F4835F836F557D1E114FAD08
SHA-256:	17BDC6783DEDCAADFBE53BE44A3DE393580075C1340553838E90567998518512
SHA-512:	4DBABF02C0757A01D73C53FEAC4F4F0708D503D58712195181BC9493524DAC0A0D8282539BCD47609BC1F5421681D914446D925D5EB39C6D1519FC73BD7C7229
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"091ffcca-a71b-4cae-9c97-b14565c495fc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1718814052381,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.278287256957476
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcaDRhGO9VoZcg1vRcR0YRFsoAvJfQ1rPeUkwRe9:YvXKXkZc0vSFGY16Ukee9
MD5:	325AA3276DCC40CF765E8AEA7752D8B3
SHA1:	C2E586AF9FEBE9F6CD4045C421285FBF5BE47B37
SHA-256:	08A0F2F4022DDCB90CDB008F68CA9A5FEEF134F7C7EA2F18BCDE60C146C6A393
SHA-512:	68BF0CF36BFE7BE84D7BAB7F11FB8BE1A312E6422546FF9B2C9BDDFAF3408660B8D0AF08E8782E2389277C955AFFB90C272CF043433E14C62D34E5C2EDCA3B0A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"091ffcca-a71b-4cae-9c97-b14565c495fc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1718814052381,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2867148895370475
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcaDRhGO9VoZcg1vRcR0YRFsoAvJfFldPeUkwRe9:YvXKXkZc0vSFGz8Ukee9
MD5:	3DB2AB89DB509E5CD9FC9D460FB0471E
SHA1:	79EA9A29575A35813ABE6160320EEA4D34624863
SHA-256:	30B0173FCEDA82DE010EE7C071FA1AE2616AD2C52B1368CE84A90BA05AD6B84E
SHA-512:	70F8A1F5C9975D30516A6B246F910E426C3197D83149EB14BD16E3475D33FB0D54A66ED38BF8A3312C83C9A47EE377B1CB7D88982C4FF7BDB41A0F7A2622C2D8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"091ffcca-a71b-4cae-9c97-b14565c495fc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1718814052381,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	5.736442692098397
Encrypted:	false
SSDEEP:	24:Yv6XkzvSxKLgENRcbrZbq00iCCBrwJo++ns8ct4mFJN7r:Yv3axEgigrNt0wSJn+ns8cvFJxr
MD5:	BCDC747C6007D3A46965312200EA9CD1
SHA1:	B939F663E7921494FBB5FE477BE3AF78098799CC
SHA-256:	2D43F7F4FD1C5AD95C111C2CEEB1630D38B047D5DAE6937D260C0024DE8843FE
SHA-512:	B863490B00740039D900DAF7BCE3EABCF43285C146984AC0CA14EDB5BE775FC2B3703B5AF726F33778D5A9C2C74C71D6CD730D2B83125A2B505B6C3AF8069B93
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"091ffcca-a71b-4cae-9c97-b14565c495fc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1718814052381,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"79887_247329ActionBlock_0","campaignId":79887,"containerId":"1","controlGroupId":"","treatmentId":"acc56846-d570-4500-a26e-7f8cf2b4acad","variationId":"247329"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJUcnkgQWNyb2JhdCBQcm8ifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNSIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTMiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIDctZGF5IHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0byBwcmVtaXVtIFBERiBhbmQgZS1zaWduaW5nIHRvb2xzLiIsImJ

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2817297922060895
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcaDRhGO9VoZcg1vRcR0YRFsoAvJfYdPeUkwRe9:YvXKXkZc0vSFGg8Ukee9
MD5:	3F72167E30572BE6CDA973E5E603856B
SHA1:	4AAC5AFDB48727002C0A0F2E98830B0492ACAC68
SHA-256:	E2C25F876F23BDF2AE0ED29EDF707CA106FED9F9A1E283E2D33A6CADE55E0C76
SHA-512:	44EDEDC4D16924ECE2CC39082F5460148745F5936F6696000C3335FE84846ABCD69F1E9BAD331B0D5CFD9793B13707A664A2E2DC231FB19EFD31E2ECA37B11EF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"091ffcca-a71b-4cae-9c97-b14565c495fc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1718814052381,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	5.776565527600933
Encrypted:	false
SSDEEP:	24:Yv6XkzvS8rLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNTr:Yv3a8HgDv3W2aYQfgB5OUupHrQ9FJFr
MD5:	2AF134045EB4D3EA90DD115E477044FE
SHA1:	6B4B9BF7BD9B6F8847C916516BE06CAA2969CD99
SHA-256:	7DCA9334813E3088171B1CE7CDAECC44B8DAF9399B4FAA6084C8960328B406DC
SHA-512:	B2523C6A17B11C849898B0A9058B9DC5BAEDC671121FC06A89F755EAEA14E66540CDDA4BF3F9E31CD97A21FC0B063E50157087017063C9925CA6BE4AA10C5D0C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"091ffcca-a71b-4cae-9c97-b14565c495fc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1718814052381,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2654024583184
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcaDRhGO9VoZcg1vRcR0YRFsoAvJfbPtdPeUkwRe9:YvXKXkZc0vSFGDV8Ukee9
MD5:	DFF724421327288817CB1DD75A5CC656
SHA1:	8BE7C5755B160C40166CB8CD3F209F48D8E72BBB
SHA-256:	942BF4164775E44D9B9185EB1E1352594EF50F9028EB2285A851F52D1EA1340B
SHA-512:	334D29F4545E4306768AD02D2BF155C9C5BF23F0EBE5A8DC17D1F9794FE1844DA951A81EF518CE81659F8EF5E248CAE86B54A82857575722F72ECAC4C22304D0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"091ffcca-a71b-4cae-9c97-b14565c495fc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1718814052381,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.270096889581901
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcaDRhGO9VoZcg1vRcR0YRFsoAvJf21rPeUkwRe9:YvXKXkZc0vSFG+16Ukee9
MD5:	961EF44F897A5D9BAF1C2341D114E359
SHA1:	4DBD718CAF2250FE54DABF4E2940E6DE2DC27B4C
SHA-256:	B1BAD4C05CFFABDFAC288EE474325E5F90CDF986203B388C77DF2CBB55E221D0
SHA-512:	691E9EDA2E3F97E7E33B941B7CA9929F13825AC14B70F580262256854BA053C146E3B34CB92C2932C95F4A1F55513EFAB9B62264FEB5B0C3CA62F9984475E1BD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"091ffcca-a71b-4cae-9c97-b14565c495fc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1718814052381,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.288271102890016
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcaDRhGO9VoZcg1vRcR0YRFsoAvJfbpatdPeUkwRe9:YvXKXkZc0vSFGVat8Ukee9
MD5:	61DB55BF8443B820BB05439BF554A678
SHA1:	70979AE73851B32F379E008521BF8970EEA727E9
SHA-256:	A296A06134EE3BB8B96DB4D4B32AB42F1DE7AFF17C9CA499B7261EFD2F221B6A
SHA-512:	CF46D2C6695942E826513D9BA5AEAD7720BB195E3CC0E383901AF83AC0C18F36D3C43218D34B8A45FA53FC146402C2FCB844A8E5350DF2B49BF1CC4D43236C75
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"091ffcca-a71b-4cae-9c97-b14565c495fc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1718814052381,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.247371429703773
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcaDRhGO9VoZcg1vRcR0YRFsoAvJfshHHrPeUkwRe9:YvXKXkZc0vSFGUUUkee9
MD5:	C713C809EECA9CCF859CC42296D1A949
SHA1:	44464587EF3A898175482E7E21476D3AE0E68493
SHA-256:	672AF2E078E1C246DDFB3073C73BC709ED93BC9A37CC11F5B0D077656682B661
SHA-512:	74016E7C60F37D017ECABA7C62E79C5261961D23989BA84FFD61C097243CACCADD5A31D53612E0C1E45B28D3FEF18ADC8558D5CCFCDAF05E24AEE07600190FEC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"091ffcca-a71b-4cae-9c97-b14565c495fc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1718814052381,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.3624756243790745
Encrypted:	false
SSDEEP:	12:YvXKXkZc0vSFGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWPr:Yv6XkzvSh168CgEXX5kcIfANhKr
MD5:	2C7D53333BA8BE53F9C0B8958007F740
SHA1:	7C6F5AED3E8DDF6E251228D2939FAE6A47C8BBB6
SHA-256:	E705A02F1A679D5D21EEE96521E5340F15148F3CD66070C96AD8B61BEA0CF9E7
SHA-512:	3D21E4C28366980C673692000D92E821A7ADF91AD76ED32A6E12D49E0941AC4DE1C1A7D1174FBA5C4BC39ED4AB7CD1AFE40CB4A57A4A0375E928409FE4EA3F8D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"091ffcca-a71b-4cae-9c97-b14565c495fc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1718814052381,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1718640727410}}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.131668949365832
Encrypted:	false
SSDEEP:	24:YP7lCjhctCVmB82KxuaNGqnaykDEgUz1UKjFj0SSnB3G29P2LS8PZ5lqTb9okuFZ:YpwcwVma2UGqV3JeBWSP2PZrGb9ox
MD5:	898F4BDE8CCDFCC5B69B9607742252AF
SHA1:	73EF74FDB64197E81C81628DEEC3DC974BF0A351
SHA-256:	6BB94CD073BA2E0E75F7E0EE3A02B8FF9C3FB8B8B8EBEF5AEB8299574C0FC6F6
SHA-512:	82876D49923BBF90CB944BE08B2B9C1D4884AEF75834E8F0AFAFD407898EF402109152F42FA85180F1DBBF0BF85113682901C5370985B08CBF8E4CA693126512
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"65af725204e3eaf58bcc41e2394f1384","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1372,"ts":1718640727000},{"id":"Edit_InApp_Aug2020","info":{"dg":"c4f4c76162614ad5dea969662da3b76e","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1718640727000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"29c509ff3962c84d82ec6022574329a1","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1718640727000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"83ec75379db99871c660eb6fe616948a","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1718640727000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"4898ada0d06bbc45996c9ac7a910dc60","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1718640727000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"286a7fb111691fbfa2bd8a99badceab1","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":289,"ts":1718640727000},

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1866023943341772
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUySvR9H9vxFGiDIAEkGVvpY:lNVmswUUUUUUUUy+FGSIt0
MD5:	DF48360C2ED86ACF09392237143F8938
SHA1:	5E629F8BA5C0D22AB0978B84C31B2DE77785A4D6
SHA-256:	D9064C702857F98CC166B9FC2B753B3F8DAFA3CE8D4846BC84FD65D656B70842
SHA-512:	F9F1ED71EAC50E4604DA22E0B0C81C1B9C1F99A37F4F324A559CDCC0AAC99C9507B7D8A0D69F2415DF40C6EF67ABBE657F8CA3E80907FE3309B58A6E15DF9839
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.603369573225578
Encrypted:	false
SSDEEP:	48:7M+KUUUUUUUUUUgvR9H9vxFGiDIAEkGVvSqFl2GL7msu:7GUUUUUUUUUUYFGSItwKVmsu
MD5:	C19AB16EA8DABE9A4569D3E9BFCEC779
SHA1:	51D13DF663D1005116F9CE1DE4B71BE19249C2F3
SHA-256:	72157B136A22DCA7DD8BBA5A0CE4FB02D98B3AF31F7EBAE3D14F4DF461DA030B
SHA-512:	590FEC6080733B3B0727238EFE82664BB2B83B132E35D06830B87FBF8D6F846102018CCA1A0B9C4969A469E053C1320181BA324765BC520FDBD2B114C1CE25AB
Malicious:	false
Preview:	.... .c......bi.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI3b9a9.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.501595078528367
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8dq3Glule:Qw946cPbiOxDlbYnuRKCYGlb
MD5:	60F35B3E37918D6B260829052454E35D
SHA1:	DB766ECFAC0D2AA91A3C3E9DB170DF8B12F066A5
SHA-256:	EDFEA5BBEBB4A6E2091FF611711F2FDF7E84DD3F8E7CBD27EEE2ED3D345D2C44
SHA-512:	09097C203F2FE41F4CF958627ABCFD43D3ECE9C45CEEA3B9E3DA978D2A66BBB8A3B89DEC33C078D4FF357C8F6C90D0E4D377F001A5467CD968A2FBBBF0D2B4FF
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.7./.0.6./.2.0.2.4. . .1.2.:.1.2.:.0.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91k2n36o_15z1ybe_3to.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	127214
Entropy (8bit):	7.992938944970855
Encrypted:	true
SSDEEP:	3072:uswQeDPMQviqN8xfRmKMPcSnWlG1SS7Zqc6DOR44IxtUsi5:uswtPMMrSx+0SWlG1SSO6cYsi
MD5:	997CE5ED3633E8FF84C2F7D1F0E48E53
SHA1:	D22617BDF6D8DCE13E5FCBE9BDD57A812EE1E237
SHA-256:	E06C221FB5B43F5A25220D326EB501573C2E0CC9FBB31007BF79054B6F613907
SHA-512:	CE187CD9CE4CAC28B91CD0B090A70B15E28BC59BE0CC2A1E58F4257ACBAD5C05B40D7E1ECC8F16B626BC51AFE6817E524A4326F09C3FBA85637285EA1F3291D8
Malicious:	false
Preview:	PK........,C.X...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........>.X..lz............message.xml.]Ys..~...r..S.c...-.K....v.Y.KEK...E.H.......Z(...V.N.... ..p.s....(...$...o..=:.D..A.....w.....#....8..4;nGq.<.}?.>.#?.........,.Bq..G..v08....G.=.i.....~..Q.......4.....h...`............Z... ..~(.X.g.>..;8=...7.x.G.....v.{..^.y}s...#u+.. ...s.$.2.._t...Gyuz....x...&gO..8..$.hp#.W.@..V...x.OW.c.........."S.x...>.Y....L..1..I<..vL.{$......#.i...7X\l....S..^..?.)..9tX..V.=.3qL.a...b.Bv.....X\|..O. y.5u.19...d..}{..q.d..p}......)..l..r.fk..<..v..(..o......-.f_....h..e ......Z....K.;Ka..cB<....:..x.(...v{(..!@.Z...Bg.n.<..PD.".+..0.A..5.Y...x....9.]..........d.2.h......<.j........~.+.g...8r.....].lS.9..RX@.;..........9.....8.A.......?tq....&....0..t..]...aW.....<.....Ka.=XO..C........~.F3.+.b..Y.\.,..Cq6.n..8..b`..b..{.8.......2o.S.J3U.bx;S..L..Y..L.v..LU.g....%..0U.....\...P>...Q..e..p0#yKN.H.Br..Nh r..D..?..Vuh..q)o.D.]#h.M.A

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9elaef1_15z1ybf_3to.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	127214
Entropy (8bit):	7.992938944970855
Encrypted:	true
SSDEEP:	3072:uswQeDPMQviqN8xfRmKMPcSnWlG1SS7Zqc6DOR44IxtUsi5:uswtPMMrSx+0SWlG1SSO6cYsi
MD5:	997CE5ED3633E8FF84C2F7D1F0E48E53
SHA1:	D22617BDF6D8DCE13E5FCBE9BDD57A812EE1E237
SHA-256:	E06C221FB5B43F5A25220D326EB501573C2E0CC9FBB31007BF79054B6F613907
SHA-512:	CE187CD9CE4CAC28B91CD0B090A70B15E28BC59BE0CC2A1E58F4257ACBAD5C05B40D7E1ECC8F16B626BC51AFE6817E524A4326F09C3FBA85637285EA1F3291D8
Malicious:	false
Preview:	PK........,C.X...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........>.X..lz............message.xml.]Ys..~...r..S.c...-.K....v.Y.KEK...E.H.......Z(...V.N.... ..p.s....(...$...o..=:.D..A.....w.....#....8..4;nGq.<.}?.>.#?.........,.Bq..G..v08....G.=.i.....~..Q.......4.....h...`............Z... ..~(.X.g.>..;8=...7.x.G.....v.{..^.y}s...#u+.. ...s.$.2.._t...Gyuz....x...&gO..8..$.hp#.W.@..V...x.OW.c.........."S.x...>.Y....L..1..I<..vL.{$......#.i...7X\l....S..^..?.)..9tX..V.=.3qL.a...b.Bv.....X\|..O. y.5u.19...d..}{..q.d..p}......)..l..r.fk..<..v..(..o......-.f_....h..e ......Z....K.;Ka..cB<....:..x.(...v{(..!@.Z...Bg.n.<..PD.".+..0.A..5.Y...x....9.]..........d.2.h......<.j........~.+.g...8r.....].lS.9..RX@.;..........9.....8.A.......?tq....&....0..t..]...aW.....<.....Ka.=XO..C........~.F3.+.b..Y.\.,..Cq6.n..8..b`..b..{.8.......2o.S.J3U.bx;S..L..Y..L.v..LU.g....%..0U.....\...P>...Q..e..p0#yKN.H.Br..Nh r..D..?..Vuh..q)o.D.]#h.M.A

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-06-17 12-12-00-793.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3231927902015395
Encrypted:	false
SSDEEP:	384:n7x6p/sLX0p025sWRbREFXraWlwPMlB/ad8AG6WUmuvVOvboQHVp6F6nmxDqZwQ+:Dsx
MD5:	48848E45190139B4896A86DD66F66355
SHA1:	E95C631BC7EFA940468EF6DE1AF12C7C07B0C003
SHA-256:	E2B8C14CB3ABC3370D31EBA51E27353A477AAB2E5869CD0778AD2CA2AE2143DF
SHA-512:	35C1B69AF310179C196126AE55EEC3B310BAA781662C94F97EB36172AF0C74699CB6B817C0F43B5CB3F19C36F3D5509A79A180EF37DF01709893288DBC25A29C
Malicious:	false
Preview:	SessionID=890867d7-fc11-4523-a908-41f114ed4255.1718640720813 Timestamp=2024-06-17T12:12:00:813-0400 ThreadID=7108 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=890867d7-fc11-4523-a908-41f114ed4255.1718640720813 Timestamp=2024-06-17T12:12:00:816-0400 ThreadID=7108 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=890867d7-fc11-4523-a908-41f114ed4255.1718640720813 Timestamp=2024-06-17T12:12:00:816-0400 ThreadID=7108 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=890867d7-fc11-4523-a908-41f114ed4255.1718640720813 Timestamp=2024-06-17T12:12:00:816-0400 ThreadID=7108 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=890867d7-fc11-4523-a908-41f114ed4255.1718640720813 Timestamp=2024-06-17T12:12:00:816-0400 ThreadID=7108 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.389499296140736
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rX:z
MD5:	6143AA0AB9499F7C256B5D9E559C15E2
SHA1:	A22F809924F810A2C61069A7FC820599158C907E
SHA-256:	4AF96E3F87C15E4AA74C74619B079E9820D87BBB66F8E80E22F6E52A8A6A95B3
SHA-512:	F109769598D8CAF969C4998B8B41032FE8A1E3E3921DA609CC3E1E030373BD0A0A38959B964EFE64D85C664FC73AA2ECE01A32E8423A343A0277526B061AFE8D
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\6365fb54-cb7e-411b-b082-749c983f1f5f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\7532b8ed-a4f5-41b9-8d62-b56c6c8be242.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\97e5fc7d-2aa8-48e3-bed8-e1b0d2eeee90.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7ouWLaGZ7wYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVuWLaGZ7wZGk3mlind9i4ufFXpAXkru
MD5:	13F55292D0735B9ABD4259B225D210FC
SHA1:	810CC5D545BFA11D2825F6E1DFA69176794DA7EC
SHA-256:	8C3FFEA68963D108599E8C5AE20DE6E9C473BF33197A03A9A7DDCD0F25A6C7F6
SHA-512:	4F54EDA9EB61172A5243DAA718CFF42A0BF079CC0FA7BE3553CC8B79772763B49F530DD6B54A9D595C4F46B8416ADF7D5C8DAD58FC43A5C651258E669DC375DA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ff0089c9-3327-4648-9dc8-417066317671.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	85893
Entropy (8bit):	6.4285188239971465
Encrypted:	false
SSDEEP:	1536:Lh3s60i02RwxwFnZNt0zfIagnbSLDII+DY:LVs/i0C4IZN+gbE8pDY
MD5:	B7A9A5A223B9DCE0E7D10E2B32A0BA07
SHA1:	FFB925FA80873CF50D8CB6DA530BA8CD7F0D9922
SHA-256:	4EF52E63D45F5230C47DBD3764AA90768F708B24885579375724473BB3FFB255
SHA-512:	A46488535961F26B7E41E1BA98E2015627917366BE08B172B0A5377E5A4EC1C0BD14F1A4E2473B5831A7538B3554E818FE3349DA42C0F40E03B3474EC77532F4
Malicious:	false
Preview:	0..O.0..Mg...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240403114831Z..240410114831Z0..L.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!......S....fNj'.wy..210602000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.5099882082938105
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRmyOFfBS9i7u8meIHKbw2O9TrU/Y/QmpFlT1xaOu8OAbsHqvNDVk:y2GWnSmyOtci7umNbQ9TrUw/QmxT1xsD
MD5:	152F65AAA856C44E87C8ED561AE43C0F
SHA1:	B6440383DBC4D3446E91CBB58EEB8C8BD6671F50
SHA-256:	48AC59FC9FA38016B6D5A4CB5D89A2C0CABCD8A0404AF29FBE995B4AA647A292
SHA-512:	106287A2EA36511D229E6991638D99B796B24B05D4BC8AE75BE5E9B79EA7A324330A26B3B4028FC4A8523FB82D7E3F9A793AE0E9C1F377939956C5667E44381E
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240401194722Z..240422194722Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H............._..T...?..G).L/..K..5...3.j(..G.D0...>...bH.p.O{..Y....^.]I.G......~r.Ye...Sy.....X...1........8'../...O...P;QO.-O.BUq......1s..(,....v....L.q..H.6j %..R.p..H..).;vt.....6...r]/.....4.%....G....J..3Y.....d....N....tu...q....2.wm..$...d...w...G?..h.?.+E...$d.........80X45[...A.7,.....s`...sS.g.]...].i...y].bu.U.......AP....T.d!...eB.`...u.....Z....&.....*$mY..q7.;.5..s..x.$.._..5.W..F?p@.+Ud-...&'...po$..4R7L.`.g.......J...........h...M(./>)..;.g....B..F.?>...Q{%.i.....!lm\|\|..cxb..

Static File Info

General

File type:	PDF document, version 1.6
Entropy (8bit):	7.991198514859593
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	CV 31944.pdf
File size:	516'659 bytes
MD5:	d33aefee20a17090334f5b11d92b4ad7
SHA1:	b8bbdb6a57baa8c6e1fc1e5cdf7580532d0093e1
SHA256:	c4303b728b8bfd336e8a3b52140ac97e0e4644455521d5544e81309e1167d983
SHA512:	57e84ea21e2f7c020797385231371e8d55ad6d3da7d9f8d26392ec6ac46b3643b5270fe0744374336f67aff965c97789bc05822c5a37e439cde21ef496e95866
SSDEEP:	12288:v6F5MMLdTzZqFDWSfky5Rimig393DrpTHLbWkjFKq2Xs28TI5Q:v6HMoTzZqFDWOfXiW93DFHb5Bmd5Q
TLSH:	2FB4239EE61C1E6A604344B0FA92313E88C6B147EB3D059E35BCA3D653265D335E37B2
File Content Preview:	%PDF-1.6..%......10 0 obj..<</Linearized 1 /L 440444 /H [ 1064 89 ] /O 13 /E 435986 /N 1 /T 440139 >>..endobj.. ..11 0 obj..<</Type /XRef/W[1 4 2]/Ind

File Icon


Icon Hash:	62cc8caeb29e8ae0

Static PDF Info

General
Header:	%PDF-1.6
Total Entropy:	7.991199
Total Bytes:	516659
Stream Entropy:	7.991185
Stream Bytes:	437504
Entropy outside Streams:	7.983643
Bytes outside Streams:	79155
Number of EOF found:	2
Bytes after EOF:

Keywords Statistics

Name	Count
obj	16
endobj	16
stream	13
endstream	13
xref	0
trailer	0
startxref	2
/Page	1
/Encrypt	0
/ObjStm	2
/URI	0
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	1
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Image Streams

ID	DHASH	MD5	Preview
15	803535e5d29cb7a9	0b9dbb6381d947a69565df657cf0100a
20	8000808080800082	48b8f3d4da64ffdc5de6f55ec3812870

Target ID:	0
Start time:	12:11:57
Start date:	17/06/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\CV 31944.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	12:12:00
Start date:	17/06/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	12:12:00
Start date:	17/06/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1724,i,8716942340994201186,11730400643872671699,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	12:13:51
Start date:	17/06/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://indeed-export-600551.pages.dev/009812389/291e"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	12:13:52
Start date:	17/06/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1888,i,12805633937832967243,6919689399299974699,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report CV 31944.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4e21d4ee-bbfd-4ab4-bb04-5149217d8003.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4956

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Windows Analysis Report
CV 31944.pdf