Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Fd-Employee-Handbook(1).pdf

Overview

General Information

Sample name:Fd-Employee-Handbook(1).pdf
Analysis ID:1634301
MD5:1297eaca03362fe0679dcb9c4515077e
SHA1:c31d9d7691c598bb2cbcdf63f5a2b2db7db3f3b4
SHA256:6c4b6fd9d0ba5b9d500ea60b846ba7373ddf31b09e0069eb370bb8fc90619276
Infos:

Detection

Score:56
Range:0 - 100
Confidence:100%

Signatures

Antivirus detection for URL or domain
AI detected landing page (webpage, office document or email)
Detected use of open redirect vulnerability
Creates files inside the system directory
Deletes files inside the Windows folder
Detected non-DNS traffic on DNS port
Detected suspicious crossdomain redirect
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

  • System is w10x64_ra
  • Acrobat.exe (PID: 1288 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Fd-Employee-Handbook(1).pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 5096 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 5968 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1716 --field-trial-handle=1556,i,13476320988362733107,2831788834614443356,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • chrome.exe (PID: 6744 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://api.mixpanel.com/track?data=eyJldmVudCI6ICIkY2FtcGFpZ25fbGlua19jbGljayIsICJwcm9wZXJ0aWVzIjogeyJjYW1wYWlnbl9pZCI6IDYwMjY4NDUsICJkaXN0aW5jdF9pZCI6ICJhODQ1NDM1MC04NzAxLTExZWEtYWFkYy0wMjliOTBmMzVhNGUiLCAibWVzc2FnZV9pZCI6IDEzNTU1MjEsICJ0b2tlbiI6ICIxNjcxYjA2MTMwYTdiYzRjNDZkNzM1MGQzYjY1N2JkMiIsICJ0eXBlIjogImVtYWlsIiwgInVybCI6ICJodHRwczovLzE4YmlyZGllcy5vbmVsaW5rLm1lL0lka1IvMWNkOWUyZTUifX0=&redirect=https://gJ.SkyFuxsion.ru/Q3ju3v4jfQ-cUo/$laura_shaneyfelt@fd.org MD5: E81F54E6C1129887AEA47E7D092680BF)
    • chrome.exe (PID: 7124 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2028,i,13936953738696386956,13290440136038811889,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus detection for URL or domain
Source: https://gj.skyfuxsion.ru/favicon.icoAvira URL Cloud: Label: phishing

Phishing

barindex
AI detected landing page (webpage, office document or email)
Source: PDF documentJoe Sandbox AI: PDF document contains QR code
Detected use of open redirect vulnerability
Source: C:\Program Files\Google\Chrome\Application\chrome.exeHTTP traffic: Proxy from: api.mixpanel.com/track?data=eyjldmvudci6iciky2ftcgfpz25fbglua19jbgljayisicjwcm9wzxj0awvzijogeyjjyw1wywlnbl9pzci6idywmjy4ndusicjkaxn0aw5jdf9pzci6icjhodq1ndm1mc04nzaxltexzwetywfkyy0wmjliotbmmzvhnguilcaibwvzc2fnzv9pzci6idezntu1mjesicj0b2tlbii6icixnjcxyja2mtmwytdiyzrjndzknzm1mgqzyjy1n2jkmiisicj0exblijogimvtywlsiiwginvybci6icjodhrwczovlze4ymlyzgllcy5vbmvsaw5rlm1ll0lka1ivmwnkowuyztuifx0=&redirect=https://gj.skyfuxsion.ru/q3ju3v4jfq-cuo/$laura_shaneyfelt@fd.org to https://gj.skyfuxsion.ru/q3ju3v4jfq-cuo/$laura_shaneyfelt@fd.org
Source: https://gj.skyfuxsion.ru/Q3ju3v4jfQ-cUo/$laura_shaneyfelt@fd.orgHTTP Parser: No favicon
Source: unknownHTTPS traffic detected: 2.23.227.208:443 -> 192.168.2.16:49728 version: TLS 1.0
Source: unknownHTTPS traffic detected: 2.23.227.208:443 -> 192.168.2.16:49697 version: TLS 1.2
Source: chrome.exeMemory has grown: Private usage: 0MB later: 39MB
Source: global trafficTCP traffic: 192.168.2.16:51022 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.16:51022 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.16:51022 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.16:51022 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.16:51022 -> 1.1.1.1:53
Source: C:\Program Files\Google\Chrome\Application\chrome.exeHTTP traffic: Redirect from: api.mixpanel.com to https://gj.skyfuxsion.ru/q3ju3v4jfq-cuo/$laura_shaneyfelt@fd.org
Source: unknownHTTPS traffic detected: 2.23.227.208:443 -> 192.168.2.16:49728 version: TLS 1.0
Source: unknownTCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknownTCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknownTCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknownTCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknownTCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknownTCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknownTCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 217.20.57.20
Source: unknownTCP traffic detected without corresponding DNS query: 217.20.57.20
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.181.227
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.181.227
Source: unknownTCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknownTCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknownTCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknownTCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknownTCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknownTCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.0
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.0
Source: unknownTCP traffic detected without corresponding DNS query: 2.23.77.188
Source: global trafficHTTP traffic detected: GET /track?data=eyJldmVudCI6ICIkY2FtcGFpZ25fbGlua19jbGljayIsICJwcm9wZXJ0aWVzIjogeyJjYW1wYWlnbl9pZCI6IDYwMjY4NDUsICJkaXN0aW5jdF9pZCI6ICJhODQ1NDM1MC04NzAxLTExZWEtYWFkYy0wMjliOTBmMzVhNGUiLCAibWVzc2FnZV9pZCI6IDEzNTU1MjEsICJ0b2tlbiI6ICIxNjcxYjA2MTMwYTdiYzRjNDZkNzM1MGQzYjY1N2JkMiIsICJ0eXBlIjogImVtYWlsIiwgInVybCI6ICJodHRwczovLzE4YmlyZGllcy5vbmVsaW5rLm1lL0lka1IvMWNkOWUyZTUifX0=&redirect=https://gJ.SkyFuxsion.ru/Q3ju3v4jfQ-cUo/$laura_shaneyfelt@fd.org HTTP/1.1Host: api.mixpanel.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /Q3ju3v4jfQ-cUo/$laura_shaneyfelt@fd.org HTTP/1.1Host: gj.skyfuxsion.ruConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: gj.skyfuxsion.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://gj.skyfuxsion.ru/Q3ju3v4jfQ-cUo/$laura_shaneyfelt@fd.orgAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: x1.i.lencr.org
Source: global trafficDNS traffic detected: DNS query: api.mixpanel.com
Source: global trafficDNS traffic detected: DNS query: gj.skyfuxsion.ru
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: x1.i.lencr.org
Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenServer: cloudflareDate: Mon, 10 Mar 2025 19:58:34 GMTContent-Type: text/htmlContent-Length: 553Connection: closeCF-RAY: 91e563375fcd9cf8-MIA
Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenServer: cloudflareDate: Mon, 10 Mar 2025 19:58:37 GMTContent-Type: text/htmlContent-Length: 553Connection: closeCF-RAY: 91e56349cd7096ee-MIA
Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49697
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49673
Source: unknownNetwork traffic detected: HTTP traffic on port 49694 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49694
Source: unknownNetwork traffic detected: HTTP traffic on port 49697 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49701 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49701
Source: unknownHTTPS traffic detected: 2.23.227.208:443 -> 192.168.2.16:49697 version: TLS 1.2
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\scoped_dir6744_1589459369
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6744_1974418386
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6744_1974418386\Google.Widevine.CDM.dll
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6744_1974418386\manifest.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6744_1974418386\_metadata\
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6744_1974418386\_metadata\verified_contents.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6744_1974418386\manifest.fingerprint
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile deleted: C:\Windows\SystemTemp\scoped_dir6744_1589459369
Source: classification engineClassification label: mal56.phis.winPDF@41/45@7/151
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-03-10 15-58-21-335.log
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Fd-Employee-Handbook(1).pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1716 --field-trial-handle=1556,i,13476320988362733107,2831788834614443356,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://api.mixpanel.com/track?data=eyJldmVudCI6ICIkY2FtcGFpZ25fbGlua19jbGljayIsICJwcm9wZXJ0aWVzIjogeyJjYW1wYWlnbl9pZCI6IDYwMjY4NDUsICJkaXN0aW5jdF9pZCI6ICJhODQ1NDM1MC04NzAxLTExZWEtYWFkYy0wMjliOTBmMzVhNGUiLCAibWVzc2FnZV9pZCI6IDEzNTU1MjEsICJ0b2tlbiI6ICIxNjcxYjA2MTMwYTdiYzRjNDZkNzM1MGQzYjY1N2JkMiIsICJ0eXBlIjogImVtYWlsIiwgInVybCI6ICJodHRwczovLzE4YmlyZGllcy5vbmVsaW5rLm1lL0lka1IvMWNkOWUyZTUifX0=&redirect=https://gJ.SkyFuxsion.ru/Q3ju3v4jfQ-cUo/$laura_shaneyfelt@fd.org
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2028,i,13936953738696386956,13290440136038811889,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding F7055AB25AEA92003FB664AA376B3967
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1716 --field-trial-handle=1556,i,13476320988362733107,2831788834614443356,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2028,i,13936953738696386956,13290440136038811889,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: Fd-Employee-Handbook(1).pdfInitial sample: PDF keyword /JS count = 0
Source: Fd-Employee-Handbook(1).pdfInitial sample: PDF keyword /JavaScript count = 0
Source: Fd-Employee-Handbook(1).pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: Fd-Employee-Handbook(1).pdfInitial sample: PDF keyword obj count = 60
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6744_1974418386\Google.Widevine.CDM.dllJump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6744_1974418386\Google.Widevine.CDM.dllJump to dropped file
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information queried: ProcessInformation

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
Browser Extensions		1
Process Injection		21
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
Extra Window Memory Injection		1
Process Injection		LSASS Memory1
System Information Discovery		Remote Desktop ProtocolData from Removable Media3
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
File Deletion		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
Web Protocols		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
Extra Window Memory Injection		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture4
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA SecretsInternet Connection DiscoverySSHKeylogging3
Ingress Tool Transfer		Scheduled TransferData Encrypted for Impact

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

SourceDetectionScannerLabelLink
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6744_1974418386\Google.Widevine.CDM.dll0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://gj.skyfuxsion.ru/favicon.ico100%Avira URL Cloudphishing

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
gj.skyfuxsion.ru
188.114.97.3
truetrue
    		unknown
    bg.microsoft.map.fastly.net
    		199.232.214.172
    		truefalse
      		high
      e8652.dscx.akamaiedge.net
      		2.19.105.127
      		truefalse
        		high
        www.google.com
        		172.217.23.100
        		truefalse
          		high
          api.mixpanel.com
          		35.190.25.25
          		truefalse
            		high
            x1.i.lencr.org
            		unknown
            		unknownfalse
              		high

              Contacted URLs

              NameMaliciousAntivirus DetectionReputation
              https://gj.skyfuxsion.ru/Q3ju3v4jfQ-cUo/$laura_shaneyfelt@fd.orgfalse
                		unknown
                https://gj.skyfuxsion.ru/favicon.icotrue
                • Avira URL Cloud: phishing
                		unknown

                World Map of Contacted IPs

                • No. of IPs < 25%
                • 25% < No. of IPs < 50%
                • 50% < No. of IPs < 75%
                • 75% < No. of IPs

                Public IPs

                IPDomainCountryFlagASNASN NameMalicious
                142.250.185.67
                		unknownUnited States
                		15169GOOGLEUSfalse
                1.1.1.1
                		unknownAustralia
                		13335CLOUDFLARENETUSfalse
                108.177.15.84
                		unknownUnited States
                		15169GOOGLEUSfalse
                172.217.16.206
                		unknownUnited States
                		15169GOOGLEUSfalse
                216.58.206.67
                		unknownUnited States
                		15169GOOGLEUSfalse
                2.19.104.203
                		unknownEuropean Union
                		16625AKAMAI-ASUSfalse
                142.250.185.110
                		unknownUnited States
                		15169GOOGLEUSfalse
                35.190.25.25
                		api.mixpanel.comUnited States
                		15169GOOGLEUSfalse
                2.19.105.127
                		e8652.dscx.akamaiedge.netEuropean Union
                		16625AKAMAI-ASUSfalse
                188.114.97.3
                		gj.skyfuxsion.ruEuropean Union
                		13335CLOUDFLARENETUStrue
                142.250.185.142
                		unknownUnited States
                		15169GOOGLEUSfalse
                172.217.23.100
                		www.google.comUnited States
                		15169GOOGLEUSfalse
                199.232.214.172
                		bg.microsoft.map.fastly.netUnited States
                		54113FASTLYUSfalse
                52.6.155.20
                		unknownUnited States
                		14618AMAZON-AESUSfalse
                23.197.208.205
                		unknownUnited States
                		16625AKAMAI-ASUSfalse
                172.64.41.3
                		unknownUnited States
                		13335CLOUDFLARENETUSfalse
                172.217.16.131
                		unknownUnited States
                		15169GOOGLEUSfalse

                Private

                IP
                192.168.2.16

                General Information

                Joe Sandbox version:42.0.0 Malachite
                Analysis ID:1634301
                Start date and time:2025-03-10 20:56:42 +01:00
                Joe Sandbox product:CloudBasic
                Overall analysis duration:
                Hypervisor based Inspection enabled:false
                Report type:full
                Cookbook file name:defaultwindowsinteractivecookbook.jbs
                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                Number of analysed new started processes analysed:15
                Number of new started drivers analysed:0
                Number of existing processes analysed:0
                Number of existing drivers analysed:0
                Number of injected processes analysed:0
                Technologies:
                • EGA enabled
                Analysis Mode:stream
                Analysis stop reason:Timeout
                Sample name:Fd-Employee-Handbook(1).pdf
                Detection:MAL
                Classification:mal56.phis.winPDF@41/45@7/151
                Cookbook Comments:
                • Found application associated with file extension: .pdf

                Warnings

                • Exclude process from analysis (whitelisted): SIHClient.exe
                • Excluded IPs from analysis (whitelisted): 172.64.41.3, 162.159.61.3, 172.217.16.131, 142.250.185.142, 172.217.16.206, 108.177.15.84, 2.19.104.203, 172.202.163.200
                • Excluded domains from analysis (whitelisted): chrome.cloudflare-dns.com, e4578.dscg.akamaiedge.net, clients2.google.com, accounts.google.com, slscr.update.microsoft.com, ssl-delivery.adobe.com.edgekey.net, clientservices.googleapis.com, clients.l.google.com, geo2.adobe.com, fe3cr.delivery.mp.microsoft.com
                • Not all processes where analyzed, report is missing behavior information
                • Report size getting too big, too many NtOpenFile calls found.
                • VT rate limit hit for: gj.skyfuxsion.ru

                Created / dropped Files

                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:ASCII text
                Category:dropped
                Size (bytes):287
                Entropy (8bit):5.239713931601167
                Encrypted:false
                SSDEEP:
                MD5:209616FB93AC2557086A67CDDAD71295
                SHA1:B28A9F5BED48980AFBBB4D03ACC2228DD9D4C2E1
                SHA-256:EE4A6DE97C882F1B340204F0F57F29D7CE487C9D79B06789636DEEC002FD45B7
                SHA-512:FFF093F9CAA8F6F0255487F2435681FBF63D3E93DF0468C296056DE8F9416D234791FA136263A2E55DD8D7A81C4D4F09F65A3EF5CF05702CC5663D6FE390B375
                Malicious:false
                Reputation:unknown
                Preview:2025/03/10-15:58:20.977 b48 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/03/10-15:58:20.979 b48 Recovering log #3.2025/03/10-15:58:20.979 b48 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:ASCII text
                Category:dropped
                Size (bytes):331
                Entropy (8bit):5.143807348819302
                Encrypted:false
                SSDEEP:
                MD5:96C2C7D0EF1A31D85FECD6311D40F9E3
                SHA1:99926C2C32851C7BCBF580D98DE48CA858CE4262
                SHA-256:23A2997F7A80A281F6AAEC4B822666C5822A6D71857FB0FE4496AE4866A78C2A
                SHA-512:EF1D83E8EB7CC918E20DBDF26DFD56F60477A8467965A7AF5A9D2029DF227BCFFD220D771D776733F1E7C837C959FFB4457A768264FC0C134B8A49973565A4B7
                Malicious:false
                Reputation:unknown
                Preview:2025/03/10-15:58:20.880 fdc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/03/10-15:58:20.884 fdc Recovering log #3.2025/03/10-15:58:20.884 fdc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1d822c81-b960-4f4d-b473-6265b7fd0ce8.tmp

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):403
                Entropy (8bit):4.977928818923746
                Encrypted:false
                SSDEEP:
                MD5:90EE46FF4A0AF4AF3CA2D6264A871DAA
                SHA1:48DCFF91B9A703F020A51EEF6A8E5FFBDB296C71
                SHA-256:54D9981722FB3AED575E48D0421C5E79B26C183DE559AE6C202A50CCCDA0D592
                SHA-512:EA4A8DC1DCD183C68C2BAF3DE9A584B64FAD0D9CF1F8157874E9D66122DA5643404C1398A8F674FDD938F82247DFB8BAA87425CC57BAF0EB373111D94E7E24C4
                Malicious:false
                Reputation:unknown
                Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13386196712771157","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":127701},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):0
                Entropy (8bit):0.0
                Encrypted:false
                SSDEEP:
                MD5:90EE46FF4A0AF4AF3CA2D6264A871DAA
                SHA1:48DCFF91B9A703F020A51EEF6A8E5FFBDB296C71
                SHA-256:54D9981722FB3AED575E48D0421C5E79B26C183DE559AE6C202A50CCCDA0D592
                SHA-512:EA4A8DC1DCD183C68C2BAF3DE9A584B64FAD0D9CF1F8157874E9D66122DA5643404C1398A8F674FDD938F82247DFB8BAA87425CC57BAF0EB373111D94E7E24C4
                Malicious:false
                Reputation:unknown
                Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13386196712771157","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":127701},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:data
                Category:dropped
                Size (bytes):4591
                Entropy (8bit):5.236429842329388
                Encrypted:false
                SSDEEP:
                MD5:1C95927CDC9F6CDC0C613B9C9C034C41
                SHA1:885D8CAA330CC135FC5B4F19E93519049A67E2CB
                SHA-256:A0FB98E51CCC23E8FF75E22C084C9EE1EE60A49644FE78B32B5A8BCF36CACD5C
                SHA-512:789CD98CBC5691B3DDD5573838713527DA603AFFF60BC1E583A0728BE38551E4FA68F84DECECC05F8C675E2F27752D0F90D46501E9B2E2A13943B53E41BD3F13
                Malicious:false
                Reputation:unknown
                Preview:*...#................version.1..namespace-e...o................next-map-id.1.Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/.0y.S_r................next-map-id.2.Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/.16.X:r................next-map-id.3.Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/.2.P.@o................next-map-id.4.Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/.346.+^...............Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/....^...............Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/..?&a...............Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/_...a...............Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/...o................next-map-id.5.Pnamespace-07af9ee9_2076_4f12_94b5_

                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:ASCII text
                Category:dropped
                Size (bytes):319
                Entropy (8bit):5.155317763223023
                Encrypted:false
                SSDEEP:
                MD5:78A894D3D06BA84E6B7715894EA71541
                SHA1:C8C781696B6CE431621D9A7B2605C7A5C3EF3DD4
                SHA-256:D7656F0B380E1C6D132926A41A2F003ED796C962C80758AE71B0367358C35A98
                SHA-512:CB5DD8DA17345186980705CB09C75EB3DF4740050F292D76DF3348313754619089CA9FF3F2E3635E6E92B026C3EA917086E3877C2AE2C6D00413FB33211B7941
                Malicious:false
                Reputation:unknown
                Preview:2025/03/10-15:58:21.032 fdc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/03/10-15:58:21.034 fdc Recovering log #3.2025/03/10-15:58:21.038 fdc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250310195823Z-200.bmp

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
                Category:dropped
                Size (bytes):71190
                Entropy (8bit):1.9830339797477645
                Encrypted:false
                SSDEEP:
                MD5:0FAB97DFFD4C89E94BE363DA1668BBEB
                SHA1:302ED58AB2A8AA8990F5B7786D32B27D955EA06A
                SHA-256:479318312B620872FA3793261ABA208508C3914C051938DA316BB12FA3D874F5
                SHA-512:449854C734F0DE1CFA9B98D352FC75A26892BFEF8390D043100E38560620F7CAA133BC7468123048AA4F41E50D28530B0D75BC2C9041F8F9BC0B9C8A89EB6C6F
                Malicious:false
                Reputation:unknown
                Preview:BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2
                Category:dropped
                Size (bytes):57344
                Entropy (8bit):3.291927920232006
                Encrypted:false
                SSDEEP:
                MD5:A4D5FECEFE05F21D6F81ACF4D9A788CF
                SHA1:1A9AC236C80F2A2809F7DE374072E2FCCA5A775C
                SHA-256:83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
                SHA-512:FF106C6B9E1EA4B1F3E3AB01FAEA21BA24A885E63DDF0C36EB0A8C3C89A9430FE676039C076C50D7C46DC4E809F6A7E35A4BFED64D9033FEBD6121AC547AA5E9
                Malicious:false
                Reputation:unknown
                Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:SQLite Rollback Journal
                Category:dropped
                Size (bytes):16928
                Entropy (8bit):1.2147740995941023
                Encrypted:false
                SSDEEP:
                MD5:2FAC594EB86A46D9E09919BF19F72EF2
                SHA1:8AD6A2EA58CCF89DA57D6C206E0EEF49CE62858E
                SHA-256:5EF0F56A86C58B0F7F7AABFBE19A60129B2445938E30BDB22E6079EB7DDAEB5D
                SHA-512:38C8A0C33839558CEE966F33ECD1F7F577A169D4BBC384398B24A6D073F204E2AFCE0293839297D0753BDADC283304E54DEC78B10351B775E47699B19380F21B
                Malicious:false
                Reputation:unknown
                Preview:.... .c.....3..;........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 73305 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                Category:dropped
                Size (bytes):73305
                Entropy (8bit):7.996028107841645
                Encrypted:true
                SSDEEP:
                MD5:83142242E97B8953C386F988AA694E4A
                SHA1:833ED12FC15B356136DCDD27C61A50F59C5C7D50
                SHA-256:D72761E1A334A754CE8250E3AF7EA4BF25301040929FD88CF9E50B4A9197D755
                SHA-512:BB6DA177BD16D163F377D9B4C63F6D535804137887684C113CC2F643CEAB4F34338C06B5A29213C23D375E95D22EF417EAC928822DFB3688CE9E2DE9D5242D10
                Malicious:false
                Reputation:unknown
                Preview:MSCF....Y.......,...................I.................;Za. .authroot.stl.98.?.6..CK..<Tk......4..c... .Ec...U.d.d.E&I.DH*..M.KB."..rK.RQ*..}f..f...}..1....9...........$.8q..fa...7.o.1.0...bfsM4.........u..l..0..4.a.t....0.....6#....n. :... ....%.,CQ5uU..(.3.<7#.0..JN.$...=j|w..*.#.oU..Eq[..P..^..~.V...;..m...I|...l..@-W..=.QQ.._./.M.nZ..(.........`.$Z.9wW:W.]..8*E.......I.D{..n...K:.m..^.(.S.......c..s.y..<...2.%o.o.....H.B.R.....11.|!.(...........h.SZ........<...^....Z>.Pp?... .pT@p.#.&..........#VEV=.....p........y..."T=l.n..egf.w..X.Y..-G...........KQ.]...pM..[m..-6.wd:........T...:.P5Zs....c.oT`..F1#......EuD.......7....V ..-....!.N..%S...k...S. ...@.J..../..b!B.(=\../.l......`.\...q9..>4!b..8EH.....zdy.....#...X>%0w...i.,>c.z.g"p.S..2W.+mMs.....5Def.....#._D.4....>}...i...\.&`D.......z;..ZY.3.+t.`....z_.q'w.z.)..j3.+.co.s..:.........qK...{...E....uPO...#vs.XxH.B!..(t. 8k+.....G\..?..GF8....'..w.>.ms..\ve.nFN..W)....xi..u..5.f.l....

                C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:data
                Category:dropped
                Size (bytes):330
                Entropy (8bit):3.287136292755414
                Encrypted:false
                SSDEEP:
                MD5:30BC4466091A2945A1B0CE77EDBD28F3
                SHA1:18668BEBAB187B6FBFE136A3FAF569A74D3086FA
                SHA-256:C4B387D61030F29BE74B12939438C22FD1A92977E71EF91474EA832E6D8049F2
                SHA-512:547FB0F046756ECDAACE261144D64EDC438652EACE597A570A56A8709D32608C47DBC06FCC21E83BC9D44D5B4EC65BA0BFCA5C5FC17A8EFD60622AB6758A173F
                Malicious:false
                Reputation:unknown
                Preview:p...... ................(....................................................... ..................(....c*.....Y...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".6.4.2.7.f.6.c.2.b.7.8.7.d.b.1.:.0."...

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):295
                Entropy (8bit):5.375842753343148
                Encrypted:false
                SSDEEP:
                MD5:1AE8553547A1F3F12F12DB7EAA995238
                SHA1:95619348ADE8AF3A0F1CDE78EC7E6D7D77958491
                SHA-256:E1B30D5BAF1587115D91D8EC3FCBBCA2A6B5FAE7F374DD29150D93C398308DD0
                SHA-512:3482BD2393E6F3CA39904CACE71DCD9F5D4E3A2292C8438A0985BC4A2E6F86549E23B024BB06E1A10DCE3761D4EDD936E67E3A1C933385363B0A0F78BD1A9443
                Malicious:false
                Reputation:unknown
                Preview:{"analyticsData":{"responseGUID":"359decf4-ecbd-4f83-bbde-f61e381d12e7","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1741809969594,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):294
                Entropy (8bit):5.319793724806727
                Encrypted:false
                SSDEEP:
                MD5:AAC737982BC5D6EC0830DDE3E79FCFED
                SHA1:CF168A72BF9F9CBBDA21EB0F51EAFC48B5ACEAA8
                SHA-256:B65101169812D841CE2F26458A4AEFF8B2A21E7D70AD7D8DBD5EDF17CF7D758D
                SHA-512:9EE60CD6B9CD47A07B2C92DDEC13A95D230CE5E96B35FCCCBF56E4B1A4E444667D0776E6F9FD78000A44C25BB037608CC9A9A7568A7051AE130152D864E86D33
                Malicious:false
                Reputation:unknown
                Preview:{"analyticsData":{"responseGUID":"359decf4-ecbd-4f83-bbde-f61e381d12e7","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1741809969594,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):294
                Entropy (8bit):5.2991186476453205
                Encrypted:false
                SSDEEP:
                MD5:D8E7BA7C474CB993C9B287C94CDB81D0
                SHA1:B2BDD6EC995A3FF3C8FE65E17C69933ED29BD7E8
                SHA-256:5643D85E92635D7C7EAED3B3BB58C8748227F2BA4FC47C54B8EB05481FA2A476
                SHA-512:BA2D6CA6F1A0121C283EDC48BF29B4FCEC662AD86BDAE47701E208C84AD1AEE91F932FE113FB76E2C88CE0FD0709CAAC2837C25FCAE70BCABE4BD5F131DA6A95
                Malicious:false
                Reputation:unknown
                Preview:{"analyticsData":{"responseGUID":"359decf4-ecbd-4f83-bbde-f61e381d12e7","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1741809969594,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):285
                Entropy (8bit):5.364660814611369
                Encrypted:false
                SSDEEP:
                MD5:BDA2CC32A384E644A0BA9DC9D103D682
                SHA1:D05A1CA8611F3D56E187391BD7D3A4C60FD12D7B
                SHA-256:03AB31ABAEB85A3E20FDAB5E79BC8480B4A191989E22AA70DDCA63297DA71A2C
                SHA-512:5CA00762C8AB5B84C0F02FEDC336CE560D43B48233CC267CB408526FB0FCDF0B8F6E3E80717A1CA116C3FF63692247D4643B7A60FEDB0ACCA11B6E1F5DCB8E66
                Malicious:false
                Reputation:unknown
                Preview:{"analyticsData":{"responseGUID":"359decf4-ecbd-4f83-bbde-f61e381d12e7","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1741809969594,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):2135
                Entropy (8bit):5.841183069254282
                Encrypted:false
                SSDEEP:
                MD5:B58D8EE745F00A50BB804C154FD235FD
                SHA1:3B6AB17D46AF4FC0A0E266A9B20A65A0E6811E5E
                SHA-256:3AB6D151BD50F99FD60D80D07F5135B5771335E7B63DD1FDF48DC0B1D827E769
                SHA-512:1473FAA4D70F977D26155D2ADCE68263F1806967FB33D7D7BFBCDCB8DFC3298DB8E634612B740302AC4980AB18534DC6C512ED5EF614CACF8E98A42FE7AFF678
                Malicious:false
                Reputation:unknown
                Preview:{"analyticsData":{"responseGUID":"359decf4-ecbd-4f83-bbde-f61e381d12e7","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1741809969594,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"98856_305507ActionBlock_1","campaignId":98856,"containerId":"1","controlGroupId":"","treatmentId":"c5f7d329-61e3-4065-87ed-fed4efd54ddb","variationId":"305507"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJkYXRhIjp7ImxocFYyQnlQYXRoIjp7Iml0ZW0iOnsiX3BhdGgiOiIvY29udGVudC9kYW0vYWNyb2JhdGRlc2t0b3AvZ3Jvd3RoL3JlYWRlci9lbi11cy9saHAtYmFubmVyL3YyL2NvbnZlcnQiLCJfdmFyaWF0aW9uIjoicmdzMDM2MS0wIiwidGl0bGUiOm51bGwsImRlc2NyaXB0aW9uIjoiRXhwb3J0IFBERnMgdG8gTWljcm9zb2Z0IFdvcmQgYW5kIEV4Y2VsLiIsImN0YUxhYmVsIjpudWxsLCJjdGFCZWhhdmlvciI6bnVsbCwiY3RhVXJsIjpudWxsLCJjdGFVcmxUeXBlIjpudWxsLCJ0

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):289
                Entropy (8bit):5.308309170799119
                Encrypted:false
                SSDEEP:
                MD5:112B01F32D254788F07556670ECC6574
                SHA1:D1E7166E89B0DF6A104FB411870CB4FA27C11327
                SHA-256:2AD7844ABBB27DED0BC21A6435F7D1950A40131CE3E4877BF1DF69AE94094488
                SHA-512:C5B52211F81C6E5D608F98939A7E13F56DBE7C76990C287DB322F723A97CC0E6158557EC10ED8EA8FA8E4B0274186D4EF343380FE1DAA3485187655ECE871363
                Malicious:false
                Reputation:unknown
                Preview:{"analyticsData":{"responseGUID":"359decf4-ecbd-4f83-bbde-f61e381d12e7","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1741809969594,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):292
                Entropy (8bit):5.309455504982244
                Encrypted:false
                SSDEEP:
                MD5:52506ABD59616418D5DFC18E7C047486
                SHA1:780866DFEAC3BB4E14D349079261A00BEEB39A76
                SHA-256:44BC94FC7621BD3CC89E6F9EC50149214A0DCB6ECB174122A977CE547D6FBF96
                SHA-512:8A84F0AA265DAD9D41DBF57ACFB1D67AF821894CCFC4EEFF6E12DAD1078657DDF1F33853493A66A9956B20A19581D36B6950E29FD653E0A37B9FA441281089BF
                Malicious:false
                Reputation:unknown
                Preview:{"analyticsData":{"responseGUID":"359decf4-ecbd-4f83-bbde-f61e381d12e7","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1741809969594,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):2082
                Entropy (8bit):5.835144724768211
                Encrypted:false
                SSDEEP:
                MD5:9B828B1CC55E6A3D5F579DBEC4FCA8F4
                SHA1:AB7D289449AA3C18346CB19E218514051DC95811
                SHA-256:4911D3BAC7F8DC815F924B4992D51C98B85ABBEC6A708BBD81E487D5C022F885
                SHA-512:70BAA881D469070F5A2A31533E92417C6F0A3CF55B9C4ECC1855D38C715A3EF6D5686FEFEB4D99ED05A35547E34C17FF999A0910A0C987AEF24EDEB7D101F8B4
                Malicious:false
                Reputation:unknown
                Preview:{"analyticsData":{"responseGUID":"359decf4-ecbd-4f83-bbde-f61e381d12e7","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1741809969594,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"98856_305507ActionBlock_2","campaignId":98856,"containerId":"1","controlGroupId":"","treatmentId":"14c0f2e3-1443-4ebd-acdc-c9f63dcb7699","variationId":"305507"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJkYXRhIjp7ImxocFYyQnlQYXRoIjp7Iml0ZW0iOnsiX3BhdGgiOiIvY29udGVudC9kYW0vYWNyb2JhdGRlc2t0b3AvZ3Jvd3RoL3JlYWRlci9lbi11cy9saHAtYmFubmVyL3YyL2VkaXQiLCJfdmFyaWF0aW9uIjoicmdzMDM2MS0wIiwidGl0bGUiOm51bGwsImRlc2NyaXB0aW9uIjpudWxsLCJjdGFMYWJlbCI6bnVsbCwiY3RhQmVoYXZpb3IiOm51bGwsImN0YVVybCI6bnVsbCwiY3RhVXJsVHlwZSI6bnVsbCwidHJhY2tpbmdJZCI6IlJHUzAzNjEtRU5VLUNvbnRyb2wiLCJfbWV0YWRhdGEiOnsic

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):295
                Entropy (8bit):5.3334790359333635
                Encrypted:false
                SSDEEP:
                MD5:CEB99DA9DA369A2F78D76D194D6B0093
                SHA1:2AAF1C9E48F2F67391136211FFCCAFBB84939F5A
                SHA-256:ED7A1B54BDD051AE887622369F062C04FB6D3719CD517464A27C67E1FAF1D12D
                SHA-512:F540078D2DA2F986901B1D6FEDE38ACE47D5D2FE6AB7F43E1B56C818EBCB7B9D8A89E501E05FE50503429696C23C1632C21914341C7B257E327DC91C1A9B1E5B
                Malicious:false
                Reputation:unknown
                Preview:{"analyticsData":{"responseGUID":"359decf4-ecbd-4f83-bbde-f61e381d12e7","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1741809969594,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):289
                Entropy (8bit):5.3138098092650266
                Encrypted:false
                SSDEEP:
                MD5:D7E21281F05157A455CEC39AFECF232A
                SHA1:D8A28FA282033E7127D46E127089A1E200C2D9C0
                SHA-256:3DBFD9829BA34FCC9AE40E2E629C9A710DEF2D15A839BFFBB528D2DC8D24C814
                SHA-512:6F18E8FD62D0476C2343D3AF15DE2B3C355D9DB7E1D94E52271F963113053FDE1A7C9D3A8DEAF4CBE8046E2AA4CF19815CDAED964459A264A1E359DB2C1E83DC
                Malicious:false
                Reputation:unknown
                Preview:{"analyticsData":{"responseGUID":"359decf4-ecbd-4f83-bbde-f61e381d12e7","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1741809969594,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):284
                Entropy (8bit):5.301206255065631
                Encrypted:false
                SSDEEP:
                MD5:F21AD7B03371821F5E3640BFDC6F234D
                SHA1:39CAAD63C279020E338AC3206DB9A2034231ED76
                SHA-256:8FA803AA0312521EE21331037B81F62E4A8A18DC48F99D50A1041CA2E29D2FCB
                SHA-512:42AF37E066355FAA85B9195033089CFF66A7413291C1196CE51F31629740EB9FBB5DD3042CF77B50B135894FEE28D4AF465ACB9D3B9154BB95E8AAE7E9FABCA2
                Malicious:false
                Reputation:unknown
                Preview:{"analyticsData":{"responseGUID":"359decf4-ecbd-4f83-bbde-f61e381d12e7","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1741809969594,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):291
                Entropy (8bit):5.2972619941604355
                Encrypted:false
                SSDEEP:
                MD5:EBCABDD10E1DA48E433AA8EB360F4A50
                SHA1:53DBC9420509A50A1F19A577C1F1A3038E2E5AB6
                SHA-256:6CBBB7BFD3180E1ACAAB9663796AC4FAF592D0A3863451C9B66DC9C6BBB5C56F
                SHA-512:E545EFEB0CFEDC4D32EE1D72D59972725970999401D52E4B537C31195583C06E923781FD0F143C90660CE1F21CED7458D7CDC53B8C0C71666E5744C3E8EAE936
                Malicious:false
                Reputation:unknown
                Preview:{"analyticsData":{"responseGUID":"359decf4-ecbd-4f83-bbde-f61e381d12e7","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1741809969594,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):287
                Entropy (8bit):5.300184712766735
                Encrypted:false
                SSDEEP:
                MD5:29361839441A0F0C9A09115C34701676
                SHA1:3DF1D61373E9F0D9B4210586AB042B4D5D80CD9D
                SHA-256:7AEB9658088AC4DF070203B9BE7F5D660C30B8CD23D947DC6E707CBE6BD84479
                SHA-512:E42D953AAFA4AF361D26DA564CCE3FEDB76E302964BC0E4C4BB21341F8E292327072EA9453EA33E24A8B21A3CC4962C6A513B30DCA2F2E60C239553BCE47D351
                Malicious:false
                Reputation:unknown
                Preview:{"analyticsData":{"responseGUID":"359decf4-ecbd-4f83-bbde-f61e381d12e7","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1741809969594,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):2034
                Entropy (8bit):5.839753481311793
                Encrypted:false
                SSDEEP:
                MD5:040C941A1FA7A00303F80E215BE74932
                SHA1:52FA73F82C16A644518C986049B1CF03FF062601
                SHA-256:0730160450CFC39AF6872803EA90FA0E0491F5E58CE01C4D3F73EAA3B84548E8
                SHA-512:DF13CFEF0FDF793B00F0C1D13EE6451AAAC984E66B51611EB36661DA8D0DA7DB1300120C62AC5DFEBE0ADB7667540CFFA6205CB5A2BC9C4805641F5AD76952DB
                Malicious:false
                Reputation:unknown
                Preview:{"analyticsData":{"responseGUID":"359decf4-ecbd-4f83-bbde-f61e381d12e7","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1741809969594,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"98856_305507ActionBlock_0","campaignId":98856,"containerId":"1","controlGroupId":"","treatmentId":"e62f3b57-7a94-481f-9907-c3665f96acef","variationId":"305507"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJkYXRhIjp7ImxocFYyQnlQYXRoIjp7Iml0ZW0iOnsiX3BhdGgiOiIvY29udGVudC9kYW0vYWNyb2JhdGRlc2t0b3AvZ3Jvd3RoL3JlYWRlci9lbi11cy9saHAtYmFubmVyL3YyL3NpZ24iLCJfdmFyaWF0aW9uIjoicmdzMDM2MS0wIiwidGl0bGUiOm51bGwsImRlc2NyaXB0aW9uIjoiRWFzaWx5IGZpbGwgYW5kIHNpZ24gUERGcy4iLCJjdGFMYWJlbCI6bnVsbCwiY3RhQmVoYXZpb3IiOm51bGwsImN0YVVybCI6bnVsbCwiY3RhVXJsVHlwZSI6bnVsbCwidHJhY2tpbmdJZCI6IlJHUzAzNjEtRU5VL

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):286
                Entropy (8bit):5.27575055412693
                Encrypted:false
                SSDEEP:
                MD5:AD1FD5E624E99EE0B1E1D1F7F1239D1D
                SHA1:F718FAA650AB5F4102BF0A73AC42EBFF729B1701
                SHA-256:FFB74A28AC25042A5A5B7F6B64646C1BE981B1DD4183E369F4B15C4BA88EC158
                SHA-512:41FB2234195663915152FAE27A20F2F069798CD66F1EFEB818D72EFAC79C02A605F3FD80753F41200A6025FC73F5D829ED19794E9C12FCCF94FB1E50DCD37737
                Malicious:false
                Reputation:unknown
                Preview:{"analyticsData":{"responseGUID":"359decf4-ecbd-4f83-bbde-f61e381d12e7","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1741809969594,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):282
                Entropy (8bit):5.2948195122418324
                Encrypted:false
                SSDEEP:
                MD5:10A19457C031CFDE2C699098B6636925
                SHA1:4930F7584B43266534E145CA751FC7FB1CA918A3
                SHA-256:98F7F6E57D346575D1E174291297D020BE4B4D79D502D9536DB186AC81FF8756
                SHA-512:279A46FE87BA4B9C2F45B3F5D8E3D9F63D8E19D051CE172462122399F367D59EBA83575A0B09771D9EA836B28B75439910E138F2982A6343FAF1A2712F70CCF5
                Malicious:false
                Reputation:unknown
                Preview:{"analyticsData":{"responseGUID":"359decf4-ecbd-4f83-bbde-f61e381d12e7","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1741809969594,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:data
                Category:dropped
                Size (bytes):4
                Entropy (8bit):0.8112781244591328
                Encrypted:false
                SSDEEP:
                MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                Malicious:false
                Reputation:unknown
                Preview:....

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):2815
                Entropy (8bit):5.140730429927037
                Encrypted:false
                SSDEEP:
                MD5:6126C6FBEF03703A8F02B13787A1734C
                SHA1:F7FF40DAF9A2ACCDE5563EFCA106C3EB1A22EFB9
                SHA-256:F76A1B607F0A68A19BB24005E8F68C11CFFD7C10CD6594A4E3A6CDD33D63F67B
                SHA-512:A0DA9357400CCBA12D128AB9DECC322F65EE5F303A880EABB67D6C7003B252953499B6B36F8FDA67035B536D25BDFA149885FF19BC1E39BE4626D336FB1E7567
                Malicious:false
                Reputation:unknown
                Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"edb0fe74cd90d2eae6967d8eb612ffc4","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1741636718000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"089a3285fcf760e6b4cef4413ba0fc3b","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":2034,"ts":1741636718000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"56a72edfcf1c47dc120ba92889b7c7f8","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":2135,"ts":1741636718000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"0fcbab177da75b179c4ae5968a1f5e23","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":2082,"ts":1741636718000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"4bbf598cbb4cbe95a5470003bc0774ad","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1741636718000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"747dc42d1d8bbb53d619d03938ec2c84","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file",

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
                Category:dropped
                Size (bytes):12288
                Entropy (8bit):0.9885431171373678
                Encrypted:false
                SSDEEP:
                MD5:1E6713EFE12E8FFE480CCCC87C218403
                SHA1:490145FDD3519293A7FD3F29AE4A80E8BFB7ABDB
                SHA-256:5266D8D11871BEDAF28861B7ABD71699AC8A659BD9299669A6716A0F816DD81A
                SHA-512:3B8D80DDD7BE0891F73D093418C1B8BFCCFF70D1659DBA34D3AE35EB63A731C5701739AD81721B690E71D2FE92B2A3CF54AB71DEA3E5C4FB9B6D21D1DD84ECE6
                Malicious:false
                Reputation:unknown
                Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:SQLite Rollback Journal
                Category:dropped
                Size (bytes):8720
                Entropy (8bit):1.3418082192018939
                Encrypted:false
                SSDEEP:
                MD5:CF6D83BB57A7E06E1A8BBC8B91EB81EE
                SHA1:81262C314D682A6CF98539AE7B21E3BB50D4A623
                SHA-256:183583E25C4C1F964BB28060C97C97918398770F958A76D8778927D74BE0CC01
                SHA-512:3BD933465892412C10AE4AB518B0E38ADEF6241C3F9FD5057A2D6906D11254470BD86498A53BCD4C8AC9858CE4B5E3F9EEC87E8DDF748DF0761065B1A9F98B29
                Malicious:false
                Reputation:unknown
                Preview:.... .c......tO}......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\MSIe2c27.LOG

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                Category:dropped
                Size (bytes):246
                Entropy (8bit):3.5278731006694652
                Encrypted:false
                SSDEEP:
                MD5:6B5676B121C193A5805C49E666B40899
                SHA1:E4C00B5968EC3450843F534873930DE29A3D60C4
                SHA-256:7B2401A6A972A0719A081877C5EBF1FFF037CE81D4AB3F68D42617CB72DB220B
                SHA-512:E9F78A0081F833169D0187B5D9F17F8C187EB37C5BA8ABEC8FDF8DFC813425110B577D36F981FA5F8C87BAA5081DB799FA1EAF0AC3C3B1387FB3424E069BA20A
                Malicious:false
                Reputation:unknown
                Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.3./.2.0.2.5. . .1.5.:.5.8.:.2.9. .=.=.=.....

                C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-03-10 15-58-21-335.log

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:ASCII text, with very long lines (393)
                Category:dropped
                Size (bytes):16525
                Entropy (8bit):5.353642815103214
                Encrypted:false
                SSDEEP:
                MD5:91F06491552FC977E9E8AF47786EE7C1
                SHA1:8FEB27904897FFCC2BE1A985D479D7F75F11CEFC
                SHA-256:06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
                SHA-512:A63E6E0D25B88EBB6602885AB8E91167D37267B24516A11F7492F48876D3DDCAE44FFC386E146F3CF6EB4FA6AF251602143F254687B17FCFE6F00783095C5082
                Malicious:false
                Reputation:unknown
                Preview:SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig:

                C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):29752
                Entropy (8bit):5.418273921153782
                Encrypted:false
                SSDEEP:
                MD5:63E10D9F532B96AB5CE9F342C5E0B651
                SHA1:5430122B2B64D7F998701165D4B7F0CD5521C85F
                SHA-256:C29FF0E8C6986C3D859C4CABD06D99045FA1EFC9521BA98C6A818F3D93E5A666
                SHA-512:9663C0004B9C8109A7FD74E1323B34A5AECA1AD25806D7E972F0F325E4A51D2B3C1BCBA22A46A8BE7DA7F07A7DCBE04F59D8596A4543729065A60EAFE8063E71
                Malicious:false
                Reputation:unknown
                Preview:06-10-2023 10:08:42:.---2---..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 10:08:42:.Closing File..06-10-

                C:\Users\user\AppData\Local\Temp\acrocef_low\01ca2ec7-7946-4813-a410-4cc3df4d930f.tmp

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                Category:dropped
                Size (bytes):758601
                Entropy (8bit):7.98639316555857
                Encrypted:false
                SSDEEP:
                MD5:0FD93E20C1612CF7CCA0771CD40D762F
                SHA1:696E5156CF167B4CF06FF0D5DF3B5D46FABDBD77
                SHA-256:9CA209D9F3FEF3163FA292A2523DFFB0CE40E2E1067F4E4502A3B9DC8263B56A
                SHA-512:4CD9E26DE55F15209FD93F553965596986144C4B9A5301FFA8A067492DDB2E19DB2CE1B35F33BED0883705972151F058E6AAD5A143AD1BC0735D94B056BA6B58
                Malicious:false
                Reputation:unknown
                Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                C:\Users\user\AppData\Local\Temp\acrocef_low\1395c067-70f0-4c8d-8cec-df93879afc3c.tmp

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                Category:dropped
                Size (bytes):1407294
                Entropy (8bit):7.97605879016224
                Encrypted:false
                SSDEEP:
                MD5:B72DC97965B108EF06BA9CD87F57DB6E
                SHA1:8956170E7DA82E1F859B4D40F2D3828D55A15AEC
                SHA-256:91284717DA9FFA3114F98846F5D9504A54196172E05D45AD2298019BAB2B2C37
                SHA-512:23A9DF0A499786FE91495AE39C74D9F4D878B52F643571EB36F986B2A91F00B9AEF720F7A4AE056864BF87ABB5B250B960E355041E884FA6D23C1C8EA9A88B7E
                Malicious:false
                Reputation:unknown
                Preview:...........]..8.}. .)."{g.-.}plw.A........,..Y.tI.g.....)Q.H..'p#p`.U.S.H.)....e....a.><..w.....Dw..9.0Y~.......1.._......j.....Oh.q.\,....tn.....w..i.f..?A../.h.D..........n^......M..w......C....!..4.........w4q..F.1I.!A....(.........TN..'8...Q.........^...za..0Hm/.....{.....\....' ..1..0.qzD........'Y...... .m..8Bh... ...4...z..}.9..Lqp..M \Xe......Q..0..+C.B.4Ijm...o..co..q.d.~.8...\/.4.]....8...1.].D....K.|...hp\..... .ch.....\.g..Qpf.{N....n<......'.....KS(.k..$Q.R...6..'.....7.!....{.....b....C.v~...x...FO^..O.d.>'>...........&.. ..WR...6...^.D..A...d1|..F.g..g;.\...m..V..0..le.......4J..p.(..l'.....n_........n.0..P...Y.KJ.S.B.><.\C.}..~....,..k..V....XI#w..B..Q.B...t..\.lB;&!.n.(._=..>...+..a.......N.X{.{..ly.$V......@..E.....R.j.x[..V.....Ij.....mQ....-D....U1..J...F+.%...6.g.T.....X....(...w...8a..\1..^z.6...@R....l.i.A..,.......o..~^bM.E..qW^?.......!..)u.(&*.v....."c.H..Pp..uy...DP8.m3.:T..U=............0-~.B..w...D..'

                C:\Users\user\AppData\Local\Temp\acrocef_low\57681956-d350-4aad-92e8-00c42e9ad267.tmp

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 921996
                Category:dropped
                Size (bytes):386528
                Entropy (8bit):7.9736851559892425
                Encrypted:false
                SSDEEP:
                MD5:C14EBC9A03804BAB863F67F539F142C6
                SHA1:FD44F63771819778149B24DD4B073940F5D95BFA
                SHA-256:A495629FA5E71EE50BB96F9C4CAEAC46E8B44BFC3F910A073348258F63DFAFCE
                SHA-512:8ED832A54A3925914E3BCFC96A3ABFF63A511ADAC79A869AD1569BB175CC1AF84E6C2BD20FA2187A5C3B733625EDE5D95C2172B24ED2F252835689F6D4A0F5A2
                Malicious:false
                Reputation:unknown
                Preview:...........[l\[.......p.a$..$.K...&%J.J...Wuo..dI.vk4.E..P.u..(.....1.I....A...............0.....$ctg.H.'....@.Zk...~.s.A]M.A..:g?.^{...cjL...X..#.Q{......z...m...K.U]-..^V.........@..P...U.R..z.......?......]nG..O{..n........y...v7...~C#..O.z...:...H&..6M;........c..#.y4u.~6.?...V?.%?SW.....K...[..`N.i.1..:..@?i.Q..O...`.....m.!y.{...?=.. .....Zk......%.6......o<.....yA}......no......u,.....U...a.......[S.n..`.....:...1......X..u.u...`..B=.&M.y..s.....}.i..l.'u]. ...6.s`....zdN.F.>;.d%D..}3..b..~..k.......,hl.j..._...F..p.z..o...C..,.Ss.u.Xd..a.Y.{.p...?.k..t,&..'...........^.f.hg....y..Y...i..m....<..^......yK.......;.5...E...K..Q.;k..|;..B.{m..eS..>b..>...6...wmC.i.....wv..k..{..X...RB.P..?w......1l.H..{{.`g.P.8.Z..v_.G.....f.%+z.....p.P..u}.T.....~r]..W7..._..c.k.....@....y.K...uOSj........^....B..]..~{..;...c....r.J.m.S.}.....k....u*^...5./...{......3.I.p.t...V..........W-..|.K.N.....n.........Bl...#)..;..4.x.....'....A....x..

                C:\Users\user\AppData\Local\Temp\acrocef_low\65726aa9-0a1b-4f66-a89d-e0a3a4a4a8ec.tmp

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                Category:dropped
                Size (bytes):758601
                Entropy (8bit):7.98639316555857
                Encrypted:false
                SSDEEP:
                MD5:3A49135134665364308390AC398006F1
                SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                Malicious:false
                Reputation:unknown
                Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                C:\Users\user\AppData\Local\Temp\acrocef_low\e2c78abc-fcf4-4b89-b8e7-e965e9e3649c.tmp

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                Category:dropped
                Size (bytes):386528
                Entropy (8bit):7.9736851559892425
                Encrypted:false
                SSDEEP:
                MD5:5C48B0AD2FEF800949466AE872E1F1E2
                SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                Malicious:false
                Reputation:unknown
                Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                C:\Users\user\AppData\Local\Temp\acrocef_low\fce35be5-b055-4220-9d3b-bdff26dab27d.tmp

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                Category:dropped
                Size (bytes):1419751
                Entropy (8bit):7.976496077007677
                Encrypted:false
                SSDEEP:
                MD5:FE1669C6A66EA60C977202606F8DA6DB
                SHA1:054250FECC9293AF02C8D8E6910134CD74BC3A23
                SHA-256:B9BFC61A0E9F6D2FBAD4A401CBB676B9A300ECDE2357F73BFB62505216477D54
                SHA-512:50ABA4E1B7ECAA2EA52D0F241E632040DE04D47B1E28F1A6B564D8CDE6DB10A44DBA1D5D50DAB75D418A01C9263D3D5D789B94D1FE84041AFEF1C5A35D521921
                Malicious:false
                Reputation:unknown
                Preview:...........]..8.}. .)."{g.-.}plw.A........,..Y.tI.g.....)Q.H..'p#p`.U.S.H.)....e....a.><..w.....Dw..9.0Y~.......1.._......j.....Oh.q.\,....tn.....w..i.f..?A../.h.D..........n^......M..w......C....!..4.........w4q..F.1I.!A....(.........TN..'8...Q.........^...za..0Hm/.....{.....\....' ..1..0.qzD........'Y...... .m..8Bh... ...4...z..}.9..Lqp..M \Xe......Q..0..+C.B.4Ijm...o..co..q.d.~.8...\/.4.]....8...1.].D....K.|...hp\..... .ch.....\.g..Qpf.{N....n<......'.....KS(.k..$Q.R...6..'.....7.!....{.....b....C.v~...x...FO^..O.d.>'>...........&.. ..WR...6...^.D..A...d1|..F.g..g;.\...m..V..0..le.......4J..p.(..l'.....n_........n.0..P...Y.KJ.S.B.><.\C.}..~....,..k..V....XI#w..B..Q.B...t..\.lB;&!.n.(._=..>...+..a.......N.X{.{..ly.$V......@..E.....R.j.x[..V.....Ij.....mQ....-D....U1..J...F+.%...6.g.T.....X....(...w...8a..\1..^z.6...@R....l.i.A..,.......o..~^bM.E..qW^?.......!..)u.(&*.v....."c.H..Pp..uy...DP8.m3.:T..U=............0-~.B..w...D..'

                C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6744_1974418386\Google.Widevine.CDM.dll

                Download File
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                Category:dropped
                Size (bytes):2877728
                Entropy (8bit):6.868480682648069
                Encrypted:false
                SSDEEP:
                MD5:477C17B6448695110B4D227664AA3C48
                SHA1:949FF1136E0971A0176F6ADEA8ADCC0DD6030F22
                SHA-256:CB190E7D1B002A3050705580DD51EBA895A19EB09620BDD48D63085D5D88031E
                SHA-512:1E267B01A78BE40E7A02612B331B1D9291DA8E4330DEA10BF786ACBC69F25E0BAECE45FB3BAFE1F4389F420EBAA62373E4F035A45E34EADA6F72C7C61D2302ED
                Malicious:false
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Reputation:unknown
                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....fd.........." ......(..........A&.......................................,.......,...`A.........................................V*......V*......`,......`+..p....+. )...p,......D*.8....................C*.(.....(.8...........p\*..............................text.....(.......(................. ..`.rdata..h.....(.......(.............@..@.data....l....*..&....*.............@....pdata...p...`+..r....*.............@..@.00cfg..(.....+......p+.............@..@.gxfg....$....+..&...r+.............@..@.retplnel.... ,.......+..................tls.........0,.......+.............@....voltbl.D....@,.......+................._RDATA.......P,.......+.............@..@.rsrc........`,.......+.............@..@.reloc.......p,.......+.............@..B........................................................................................................................................

                C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6744_1974418386\_metadata\verified_contents.json

                Download File
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):1778
                Entropy (8bit):6.02086725086136
                Encrypted:false
                SSDEEP:
                MD5:3E839BA4DA1FFCE29A543C5756A19BDF
                SHA1:D8D84AC06C3BA27CCEF221C6F188042B741D2B91
                SHA-256:43DAA4139D3ED90F4B4635BD4D32346EB8E8528D0D5332052FCDA8F7860DB729
                SHA-512:19B085A9CFEC4D6F1B87CC6BBEEB6578F9CBA014704D05C9114CFB0A33B2E7729AC67499048CB33823C884517CBBDC24AA0748A9BB65E9C67714E6116365F1AB
                Malicious:false
                Reputation:unknown
                Preview:[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJHb29nbGUuV2lkZXZpbmUuQ0RNLmRsbCIsInJvb3RfaGFzaCI6Im9ZZjVLQ2Z1ai1MYmdLYkQyWFdBS1E5Nkp1bTR1Q2dCZTRVeEpGSExSNWMifSx7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoiYk01YTJOU1d2RkY1LW9Tdml2eFdqdXVwZ05pblVGakdPQXRrLTBJcGpDZyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6Im5laWZhb2luZGdnZmNqaWNmZmtncG1ubHBwZWZmYWJkIiwiaXRlbV92ZXJzaW9uIjoiMS4wLjI3MzguMCIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"KTPeHzS0ybFaz3_br3ASYWHjb6Ctul92067u2JMwtNYYm-4KxLiSkJZNBIzhm6hNSEW2p5kUEvHD0TjhhFGCZnWm9titj2bqJayCOAGxZb5BO74JJCRfy5Kwr1KSS4nvocsZepnHBmCiG2OV3by-Lyf1h1uU3X3bDfD92O0vJzrA8rwL2LrwIk-BolLo5nlM0I_MZwg8DhZ8SFBu9GGRVB2XrailDrv4SgupFE9gqA1HY6kjRjoyoAHbRRxZdBNNt9IKNdxNyaF9NcNRY8dAedNQ9Tw3YNp5jB7R9lcjO4knn58RdH2h_GiJ4l96StcXA4e7cqbJ77P-c

                C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6744_1974418386\manifest.fingerprint

                Download File
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:ASCII text, with no line terminators
                Category:dropped
                Size (bytes):66
                Entropy (8bit):3.974403644129192
                Encrypted:false
                SSDEEP:
                MD5:D30A5BBC00F7334EEDE0795D147B2E80
                SHA1:78F3A6995856854CAD0C524884F74E182F9C3C57
                SHA-256:A08C1BC41DE319392676C7389048D8B1C7424C4B74D2F6466BCF5732B8D86642
                SHA-512:DACF60E959C10A3499D55DC594454858343BF6A309F22D73BDEE86B676D8D0CED10E86AC95ECD78E745E8805237121A25830301680BD12BFC7122A82A885FF4B
                Malicious:false
                Reputation:unknown
                Preview:1.c900ba9a2d8318263fd43782ee6fd5fb50bad78bf0eb2c972b5922c458af45ed

                C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6744_1974418386\manifest.json

                Download File
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):145
                Entropy (8bit):4.595307058143632
                Encrypted:false
                SSDEEP:
                MD5:BBC03E9C7C5944E62EFC9C660B7BD2B6
                SHA1:83F161E3F49B64553709994B048D9F597CDE3DC6
                SHA-256:6CCE5AD8D496BC5179FA84AF8AFC568EEBA980D8A75058C6380B64FB42298C28
                SHA-512:FB80F091468A299B5209ACC30EDAF2001D081C22C3B30AAD422CBE6FEA7E5FE36A67A8E000D5DD03A30C60C30391C85FA31F3931E804C351AB0A71E9A978CC0F
                Malicious:false
                Reputation:unknown
                Preview:{. "manifest_version": 2,. "name": "windows-mf-cdm",. "version": "1.0.2738.0",. "accept_arch": [. "x64",. "x86_64",. "x86_64h". ].}

                Chrome Cache Entry: 157

                Download File
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:HTML document, ASCII text, with CRLF line terminators
                Category:downloaded
                Size (bytes):553
                Entropy (8bit):4.662821081936326
                Encrypted:false
                SSDEEP:
                MD5:0127426BF3BA07FF7211399DDF5186C4
                SHA1:221D89F3261F545AC58848EBA300E0134C76FF9A
                SHA-256:982B986BB578E137F062099427A8CAEC3C501C84A9E4B22369EBD2BADEC42FE7
                SHA-512:6CEA4AB7D43A518A316120BF7AE340583E989A21FC3E142DDD71742D53A7AE6CFA276F232ACD6B6794444B28AA9A666C40171EE44341A7B9A3CA8453B61A371A
                Malicious:false
                Reputation:unknown
                URL:https://gj.skyfuxsion.ru/Q3ju3v4jfQ-cUo/$laura_shaneyfelt@fd.org
                Preview:<html>..<head><title>403 Forbidden</title></head>..<body>..<center><h1>403 Forbidden</h1></center>..<hr><center>cloudflare</center>..</body>..</html>.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->..

                Static File Info

                General

                File type:PDF document, version 1.4, 1 pages
                Entropy (8bit):7.934044149107357
                TrID:
                • Adobe Portable Document Format (5005/1) 100.00%
                File name:Fd-Employee-Handbook(1).pdf
                File size:84'500 bytes
                MD5:1297eaca03362fe0679dcb9c4515077e
                SHA1:c31d9d7691c598bb2cbcdf63f5a2b2db7db3f3b4
                SHA256:6c4b6fd9d0ba5b9d500ea60b846ba7373ddf31b09e0069eb370bb8fc90619276
                SHA512:8445b74966f520e9db3e8aa15942028bb5834339600d47a69c3820279f8e0b0b1bc8a562586e5139efe5611b038a8262a1f1fee54bbfc081da7fe222b25dd48c
                SSDEEP:1536:TZen0+oeiii0tqvWhfRwjZ/ZwJwG6aPzKhFEtvHSiVzKVkJ9/PQ:FGvoeiii0LMKJZPbKhFEBSisVw/PQ
                TLSH:FF83E0A4F10EDC5CFE42C909D93D745D4A8CB67B62CC2C8A00724E62D446AD9BF5A3DB
                File Content Preview:%PDF-1.4.%.....1 0 obj.<</Title (33219bf468ffbf206e9b4c444affe248.html)./Creator (Mozilla/5.0 \(Windows NT 10.0; Win64; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) HeadlessChrome/133.0.0.0 Safari/537.36)./Producer (Skia/PDF m133)./CreationDate (D:20250

                File Icon

                Icon Hash:62cc8caeb29e8ae0

                Static PDF Info

                General

                Header:%PDF-1.4
                Total Entropy:7.934044
                Total Bytes:84500
                Stream Entropy:7.987784
                Stream Bytes:75844
                Entropy outside Streams:5.127198
                Bytes outside Streams:8656
                Number of EOF found:1
                Bytes after EOF:

                Keywords Statistics

                NameCount
                obj60
                endobj60
                stream10
                endstream10
                xref1
                trailer1
                startxref1
                /Page1
                /Encrypt0
                /ObjStm0
                /URI0
                /JS0
                /JavaScript0
                /AA0
                /OpenAction0
                /AcroForm0
                /JBIG2Decode0
                /RichMedia0
                /Launch0
                /EmbeddedFile0

                Image Streams

                IDDHASHMD5Preview
                5000000000000000078b5914842395ff18de1c647b7fb8788
                100000000000000000e35904022a369a928da39f8484561997