Edit tour

Windows Analysis Report
Front label Dieline_V1.pdf

Overview

General Information

Sample name:	Front label Dieline_V1.pdf
Analysis ID:	1665800
MD5:	b0775894077f24081aff38b179374cef
SHA1:	cd649a2cda2f3300ec5bc13f9524fe0d4cd9a50b
SHA256:	abcc59bc19bb1bfa96fef9822a9770e945e8800d719765eacedb85a0a808094e
Infos:

Detection

Score:	2
Range:	0 - 100
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 7636 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Front label Dieline_V1.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7804 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8148 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1608 --field-trial-handle=1568,i,14606709187914981620,5360071706544978782,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Source: global traffic

TCP traffic: 192.168.2.4:49726 -> 23.55.253.31:80

Source: global traffic	TCP traffic: 192.168.2.4:49726 -> 23.55.253.31:80
Source: global traffic	TCP traffic: 23.55.253.31:80 -> 192.168.2.4:49726
Source: global traffic	TCP traffic: 192.168.2.4:49726 -> 23.55.253.31:80
Source: global traffic	TCP traffic: 192.168.2.4:49726 -> 23.55.253.31:80
Source: global traffic	TCP traffic: 23.55.253.31:80 -> 192.168.2.4:49726
Source: global traffic	TCP traffic: 23.55.253.31:80 -> 192.168.2.4:49726
Source: global traffic	TCP traffic: 23.55.253.31:80 -> 192.168.2.4:49726
Source: global traffic	TCP traffic: 192.168.2.4:49726 -> 23.55.253.31:80
Source: global traffic	TCP traffic: 192.168.2.4:49726 -> 23.55.253.31:80

Source: Joe Sandbox View

IP Address: 23.55.253.31 23.55.253.31

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: x1.i.lencr.org

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: Front label Dieline_V1.pdf	String found in binary or memory: http://www.extensis.com/meta/FontSense/
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: clean2.winPDF@15/47@2/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7716

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-04-15 15-13-34-653.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Front label Dieline_V1.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1608 --field-trial-handle=1568,i,14606709187914981620,5360071706544978782,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1608 --field-trial-handle=1568,i,14606709187914981620,5360071706544978782,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Front label Dieline_V1.pdf	Initial sample: PDF keyword /JS count = 0
Source: Front label Dieline_V1.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Front label Dieline_V1.pdf

Initial sample: PDF keyword stream count = 30

Source: Front label Dieline_V1.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Exploitation for Client Execution	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Front label Dieline_V1.pdf	0%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
e8652.dscx.akamaiedge.net	23.55.253.31	true	false	high
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.55.37	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://x1.i.lencr.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.extensis.com/meta/FontSense/	Front label Dieline_V1.pdf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.55.253.31	e8652.dscx.akamaiedge.net	United States		20940	AKAMAI-ASN1EU	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1665800
Start date and time:	2025-04-15 21:12:31 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Front label Dieline_V1.pdf
Detection:	CLEAN
Classification:	clean2.winPDF@15/47@2/1
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, RuntimeBroker.exe, ShellExperienceHost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.31.60.185, 23.209.188.149, 23.209.188.151, 3.233.129.217, 52.22.41.97, 3.219.243.226, 52.6.155.20, 162.159.61.3, 172.64.41.3, 217.20.55.37, 23.48.246.137, 23.48.246.132, 23.76.34.6, 52.149.20.212, 23.41.32.203, 23.47.166.160
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com, c.pki.goog, wu-b-net.trafficmanager.net, storeedgefd.dsx.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
15:13:44	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.55.253.31	Workspace Update.pdf	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	x1.i.lencr.org/
	Fatura.pdf	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	pagamento8449.pdf	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	x1.i.lencr.org/
	ShareFile received.pdf	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	(No subject).eml	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	6LqQVR.pdf	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	66eff1749fcc1c59482cc595_1428835357.pdf	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	67206033746876a86fcf0b0e_61190934873.pdf	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	672327232a2b5a0da729714a_62573688605.pdf	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	original.eml	Get hash	malicious	Gabagool	Browse	217.20.55.34
	003.exe	Get hash	malicious	Unknown	Browse	217.20.55.19
	original.eml	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	217.20.55.34
	pagamento8449.pdf	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	217.20.48.38
	SecuriteInfo.com.Trojan.KillProc2.24407.12035.31681.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	217.20.48.19
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	217.20.48.38
	OneDriveSetup.exe	Get hash	malicious	Unknown	Browse	217.20.48.24
	setup_patched.exe	Get hash	malicious	LummaC Stealer	Browse	217.20.48.37
	yap.bat	Get hash	malicious	Koadic	Browse	217.20.48.22
	Rd_client_w_a_s_d_patched.exe	Get hash	malicious	LummaC Stealer	Browse	217.20.55.20
e8652.dscx.akamaiedge.net	Invitation de proposition - #U00c9b#U00e9nisterie PTM.pdf	Get hash	malicious	HTMLPhisher	Browse	23.55.253.31
	Workspace Update.pdf	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	23.55.253.31
	original.eml	Get hash	malicious	Gabagool	Browse	23.55.253.31
	Fatura.pdf	Get hash	malicious	Unknown	Browse	23.55.253.31
	Scanned Page(s).pdf	Get hash	malicious	Unknown	Browse	23.60.85.50
	NorthcareUpdatedContract.pdf	Get hash	malicious	Unknown	Browse	23.216.73.76
	http://assets.website-files.com/65f03c438efea1c906590ffe/65f2aaccae2d27695a9701de_96175503854.pdf	Get hash	malicious	Unknown	Browse	23.208.129.49
	R93FadYc2e.pdf	Get hash	malicious	Unknown	Browse	23.216.73.76
	original.eml	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	23.207.49.54
	pagamento8449.pdf	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	23.55.253.31

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	https://aicreators2.com/Mountain-West/	Get hash	malicious	HTMLPhisher	Browse	23.55.63.48
	Invitation de proposition - #U00c9b#U00e9nisterie PTM.pdf	Get hash	malicious	HTMLPhisher	Browse	23.55.253.31
	Workspace Update.pdf	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	23.55.253.31
	https://apex.oracle.com/pls/apex/r/capsicure/file-document/file-document	Get hash	malicious	HTMLPhisher	Browse	23.1.33.15
	RESUMO DOS PRODUTOS DS_v2.xlsm	Get hash	malicious	Unknown	Browse	23.0.175.163
	[Certificate_Details]_[Microsoft_sarah]_Tue, 15 Apr 2025 07_31_02 -0700.htm	Get hash	malicious	HTMLPhisher	Browse	96.7.218.74
	random.exe	Get hash	malicious	Credential Flusher	Browse	23.47.204.64
	original.eml	Get hash	malicious	Gabagool	Browse	23.55.253.31
	random.exe	Get hash	malicious	Credential Flusher	Browse	23.47.204.51
	https://compliancetracking.cfainstitute.org/amc-form?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImU5OGFkMTQzLWM0YzEtNDIwYi05OWQ4LTRlODM2ZmFiNjQ4NyIsIm5iZiI6MTc0NDY2NTI5OSwiZXhwIjoxNzQ1MjcwMDk5LCJpYXQiOjE3NDQ2NjUyOTksImlzcyI6Imh0dHBzOi8vc3RhbmRhcmRzY29tcGxpYW5jZXRyYWNraW5nYXBpLmNmYWluc3RpdHV0ZS5vcmcvIn0.l4SBJnn8huVpuJVgzl7oq2riSJ7NbE6i7-Sgdch3E3s	Get hash	malicious	Unknown	Browse	23.0.175.163

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2044925674194
Encrypted:	false
SSDEEP:	6:iORPPUFq2Pwkn2nKuAl9OmbnIFUtDPPUfW9Zmw9PPUfWPkwOwkn2nKuAl9OmbjLJ:7R0FvYfHAahFUtD0fW9/90fWP5JfHAae
MD5:	994D1F9F75339C70A33D4C03B134DCAE
SHA1:	718E3A897E7F7704527D098152B15167DE91725B
SHA-256:	8E3C6D7C5C1761C7F1C3D32E50D243AD8F50D2702F39B87A065621593673879E
SHA-512:	194557F9101E9B4FDC8204BF78677967F87CEC79BF10CC96CD484E29D8ECFA2226DF5997EBF6E17997BCCA1AB7A6DA09FFC6305B25C2B0A619D1EC4640B94427
Malicious:	false
Reputation:	low
Preview:	2025/04/15-15:13:33.206 1f34 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/04/15-15:13:33.208 1f34 Recovering log #3.2025/04/15-15:13:33.208 1f34 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2044925674194
Encrypted:	false
SSDEEP:	6:iORPPUFq2Pwkn2nKuAl9OmbnIFUtDPPUfW9Zmw9PPUfWPkwOwkn2nKuAl9OmbjLJ:7R0FvYfHAahFUtD0fW9/90fWP5JfHAae
MD5:	994D1F9F75339C70A33D4C03B134DCAE
SHA1:	718E3A897E7F7704527D098152B15167DE91725B
SHA-256:	8E3C6D7C5C1761C7F1C3D32E50D243AD8F50D2702F39B87A065621593673879E
SHA-512:	194557F9101E9B4FDC8204BF78677967F87CEC79BF10CC96CD484E29D8ECFA2226DF5997EBF6E17997BCCA1AB7A6DA09FFC6305B25C2B0A619D1EC4640B94427
Malicious:	false
Reputation:	low
Preview:	2025/04/15-15:13:33.206 1f34 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/04/15-15:13:33.208 1f34 Recovering log #3.2025/04/15-15:13:33.208 1f34 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.149278110809002
Encrypted:	false
SSDEEP:	6:iORPPU8MMyq2Pwkn2nKuAl9Ombzo2jMGIFUtDPPUr1Zmw9PPU9RkwOwkn2nKuAlx:7R08MMyvYfHAa8uFUtD0h/909R5JfHAv
MD5:	7CBACDEB31919FD058B02F6101AF34A4
SHA1:	56D8C0383626A0324D59E78A8C5CDD5E85355F8B
SHA-256:	008F8CA2CDAC376D54EC2B6A7AC78AE169AEEB138D23984F60DCC171F05710F3
SHA-512:	38E6F423DAA52D4B9B52F1D9A8960998B51EEBA96BF9A44D24101490BF6978A09F59F0A5FA3901E64C2B553EDA14CF3E47B1B7DD804C1390A4B719F821E54458
Malicious:	false
Reputation:	low
Preview:	2025/04/15-15:13:33.022 1fe0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/04/15-15:13:33.027 1fe0 Recovering log #3.2025/04/15-15:13:33.027 1fe0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.149278110809002
Encrypted:	false
SSDEEP:	6:iORPPU8MMyq2Pwkn2nKuAl9Ombzo2jMGIFUtDPPUr1Zmw9PPU9RkwOwkn2nKuAlx:7R08MMyvYfHAa8uFUtD0h/909R5JfHAv
MD5:	7CBACDEB31919FD058B02F6101AF34A4
SHA1:	56D8C0383626A0324D59E78A8C5CDD5E85355F8B
SHA-256:	008F8CA2CDAC376D54EC2B6A7AC78AE169AEEB138D23984F60DCC171F05710F3
SHA-512:	38E6F423DAA52D4B9B52F1D9A8960998B51EEBA96BF9A44D24101490BF6978A09F59F0A5FA3901E64C2B553EDA14CF3E47B1B7DD804C1390A4B719F821E54458
Malicious:	false
Reputation:	low
Preview:	2025/04/15-15:13:33.022 1fe0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/04/15-15:13:33.027 1fe0 Recovering log #3.2025/04/15-15:13:33.027 1fe0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\209ff05e-db7f-4302-a667-afe252d0e6ad.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.96354027269954
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqYKxsBdOg2H6caq3QYiubInP7E4T3y:Y2sRdsjXdMH13QYhbG7nby
MD5:	EDBBF9A8B2CD088C4E498633B88D567D
SHA1:	379CC3F90D527179178D5CEA495F2E7624535A98
SHA-256:	19686A3BBA153215427E0253FEFF9463B6D4D4D415BC11436EB49CB071AF0790
SHA-512:	FDF5DE1A8353FA74F48DE76F51A39DE06D92B8EF83C7DFD98B7052FF809C9FFE80CE07724BE7A98EA9F59E1B281D9E6691EEEF78A90A17713B75AAA950B70A22
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13389304424431972","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":108629},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96354027269954
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqYKxsBdOg2H6caq3QYiubInP7E4T3y:Y2sRdsjXdMH13QYhbG7nby
MD5:	EDBBF9A8B2CD088C4E498633B88D567D
SHA1:	379CC3F90D527179178D5CEA495F2E7624535A98
SHA-256:	19686A3BBA153215427E0253FEFF9463B6D4D4D415BC11436EB49CB071AF0790
SHA-512:	FDF5DE1A8353FA74F48DE76F51A39DE06D92B8EF83C7DFD98B7052FF809C9FFE80CE07724BE7A98EA9F59E1B281D9E6691EEEF78A90A17713B75AAA950B70A22
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13389304424431972","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":108629},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4730
Entropy (8bit):	5.2527380590743205
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo76gxNEs9sixxZ:etJCV4FiN/jTN/2r8Mta02fEhgO73goh
MD5:	EC10B08FF28CBCB991D5E88B9D5C248D
SHA1:	DF02D5EB9AD0F7C4451F623878FE9E29CB5BA3BC
SHA-256:	E95DA5F953362B5D969F446A3A230215CC66453324A5D759C3818539BB7750B9
SHA-512:	8762F4737DDCD3092A134FF96E960BD97D63338AFFFB3AEC07A1028046FF4F4D2FA7743F455C7A92DD5D6BF3C6A452D7436CED831877A1AA89D7A4E4143820BA
Malicious:	false
Reputation:	low
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.132766501488499
Encrypted:	false
SSDEEP:	6:iORPPUbnyq2Pwkn2nKuAl9OmbzNMxIFUtDPPUbo1Zmw9PPUbJFaMRkwOwkn2nKuP:7R0zyvYfHAa8jFUtD0a/90faMR5JfHAo
MD5:	834CC7E0A72E2A1C032C63270BF808B8
SHA1:	835043240D1DBC92AA995D1829C0DB6F7F7C92D7
SHA-256:	A575F38B6F93FF3700042D2EC45784CCA2DF139BEFDDB5255D7DCBD11180403A
SHA-512:	754FF04144460EEB8CB215096B00851FE889A769AB8B2CBD2C214124E3705B27D13CFED1516B34FFDA3020CFB3BF447548BB36EA95EFCBD07E5B6DA2F97157F0
Malicious:	false
Reputation:	low
Preview:	2025/04/15-15:13:33.300 1fe0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/04/15-15:13:33.307 1fe0 Recovering log #3.2025/04/15-15:13:33.315 1fe0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.132766501488499
Encrypted:	false
SSDEEP:	6:iORPPUbnyq2Pwkn2nKuAl9OmbzNMxIFUtDPPUbo1Zmw9PPUbJFaMRkwOwkn2nKuP:7R0zyvYfHAa8jFUtD0a/90faMR5JfHAo
MD5:	834CC7E0A72E2A1C032C63270BF808B8
SHA1:	835043240D1DBC92AA995D1829C0DB6F7F7C92D7
SHA-256:	A575F38B6F93FF3700042D2EC45784CCA2DF139BEFDDB5255D7DCBD11180403A
SHA-512:	754FF04144460EEB8CB215096B00851FE889A769AB8B2CBD2C214124E3705B27D13CFED1516B34FFDA3020CFB3BF447548BB36EA95EFCBD07E5B6DA2F97157F0
Malicious:	false
Reputation:	low
Preview:	2025/04/15-15:13:33.300 1fe0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/04/15-15:13:33.307 1fe0 Recovering log #3.2025/04/15-15:13:33.315 1fe0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250415191337Z-195.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
Category:	dropped
Size (bytes):	71190
Entropy (8bit):	0.45924797826000174
Encrypted:	false
SSDEEP:	48:aUMthUy+SqQEv7zmoOuz53WYTAZ4rVZn0fGGGx4FzyqOQv0TzJZvW/HpJ2+Ik7:ivNSTzzx1TVnMGGGx4Fzybm57
MD5:	3AEFD4FB058451BFD2D2C48D9BC58859
SHA1:	C477B459BAE9302C0C1A949A3976EB04EF766130
SHA-256:	DF6C6085DC663B893BE697FAA25D7D492B37FA184AA11C6BC207B5104EF9127E
SHA-512:	8490E4A72D9227E54AF97765C48AFA0E68A13FF14EDCF4BA43EB7BFEB784F48D961B3710BD36DDD5ADC4298EED6713AEA68968FB9D34651042C6306ACCAB50A6
Malicious:	false
Reputation:	low
Preview:	BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.445313279480867
Encrypted:	false
SSDEEP:	384:yezci5tIiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rvs3OazzU89UTTgUL
MD5:	02D39780F4FA7AF1E2C92DB710E54E76
SHA1:	0F7F3D966180DEE00AE2AF56F65126168F0E8826
SHA-256:	73E3E08571E125F4F0CF5EDAB04AD50A4DD5446602999C1DB27E5AB8366FF18F
SHA-512:	4A479709A984CC34C85B5563AFD7140B8F2B18BE7F9CC17881641DAFA688A9AD84DEF5886F3B665A5AF91B07A690D270F3DAE92E9E8C2EBD5EB4827EED2DC50A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7740922790199036
Encrypted:	false
SSDEEP:	48:7MIp/E2ioyVwioy9oWoy1Cwoy14KOioy1noy1AYoy1Wioy1hioybioy2oy1noy1h:7jpjuwFnXKQ7Yb9IVXEBodRBkU
MD5:	FD4E7A83274503D8C85D0013A5E6689B
SHA1:	5DF6C1F4DD0BB03CAFE2EA062705F0775C056C98
SHA-256:	6B5CF8F54C00AE2A2E06E48C1508EF259B24A7D25E8AAABF6DCB97EB6A0979D6
SHA-512:	61692B4C099E3FD564C9506C22E99D3DF1C9B7CADC7C6DC06B02C5262D96FE69BEEDD9745B68C6A3DEADB6FFE11157A1A05BA99EDFC0858119F2C10FF1F61597
Malicious:	false
Preview:	.... .c.....Ix.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 73305 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	73305
Entropy (8bit):	7.996028107841645
Encrypted:	true
SSDEEP:	1536:krha8mqJ7v3CeFMz/akys7nSTK7QMuK+C/Oh5:kAOFq+Mba9Ok7C/O/
MD5:	83142242E97B8953C386F988AA694E4A
SHA1:	833ED12FC15B356136DCDD27C61A50F59C5C7D50
SHA-256:	D72761E1A334A754CE8250E3AF7EA4BF25301040929FD88CF9E50B4A9197D755
SHA-512:	BB6DA177BD16D163F377D9B4C63F6D535804137887684C113CC2F643CEAB4F34338C06B5A29213C23D375E95D22EF417EAC928822DFB3688CE9E2DE9D5242D10
Malicious:	false
Preview:	MSCF....Y.......,...................I.................;Za. .authroot.stl.98.?.6..CK..<Tk......4..c... .Ec...U.d.d.E&I.DH..M.KB."..rK.RQ..}f..f...}..1....9...........$.8q..fa...7.o.1.0...bfsM4.........u..l..0..4.a.t....0.....6#....n. :... ....%.,CQ5uU..(.3.<7#.0..JN.$...=j\|w...#.oU..Eq[..P..^..~.V...;..m...I\|...l..@-W..=.QQ.._./.M.nZ..(.........`.$Z.9wW:W.]..8E.......I.D{..n...K:.m..^.(.S.......c..s.y..<...2.%o.o.....H.B.R.....11.\|!.(...........h.SZ........<...^....Z>.Pp?... .pT@p.#.&..........#VEV=.....p........y..."T=l.n..egf.w..X.Y..-G...........KQ.]...pM..[m..-6.wd:........T...:.P5Zs....c.oT`..F1#......EuD.......7....V ..-....!.N..%S...k...S. ...@.J..../..b!B.(=\../.l......`.\...q9..>4!b..8EH.....zdy.....#...X>%0w...i.,>c.z.g"p.S..2W.+mMs.....5Def.....#._D.4....>}...i...\.&`D.......z;..ZY.3.+t.`....z_.q'w.z.)..j3.+.co.s..:.........qK...{...E....uPO...#vs.XxH.B!..(t. 8k+.....G\..?..GF8....'..w.>.ms..\ve.nFN..W)....xi..u..5.f.l....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7464849065063075
Encrypted:	false
SSDEEP:	3:kkFklrDcWLpvfllXlE/HT8kYljNNX8RolJuRdxLlGB9lQRYwpDdt:kKJWL6T89NMa8RdWBwRd
MD5:	4D62AC83CD3BB5F3EEB92076804BAE0F
SHA1:	4FBD7F05B03F54DAEB54D863AB523183B3AF06C0
SHA-256:	AA4A3C29028733545E2A1E6E534F4EE5ADA96D5F2A794252F6AC7E9666E591C3
SHA-512:	6F60B568327E00A3655FBD5061E2AA50915E0ECE2195F2D2E5D9FC5E7E5E43F812D2096B61D22108CC0CDB95DDFB11B3F1D59F24CA07753A2545113DB222AD4E
Malicious:	false
Preview:	p...... .........y.:...(....................................................... ..........W.....l..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	330
Entropy (8bit):	3.1753034170119614
Encrypted:	false
SSDEEP:	6:kKvMgmcvSN+SkQlPlEGYRMY9z+4KlDA3RUeqpGVuys1:XrmCkPlE99SNxAhUeq8S
MD5:	357E3A81863A5A9722CF41B42203FEAA
SHA1:	6371CA3EFC74FBBEF5CCD037B89036A4B6B489EC
SHA-256:	69F1C12BDFABC7688C7B7209191350008BE35F16AD5799CAC89B80F9C78C52AE
SHA-512:	AE3049A42B8B93017EFD937A2D965D6A8C71834803F14A290DA7488D9084132B009283536FA194A246AD9CF19EA4964EF6045F3719224C8640CF328B981A962F
Malicious:	false
Preview:	p...... ...........:...(....................................................... ..................(...........Y...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".6.4.2.7.f.6.c.2.b.7.8.7.d.b.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7716

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185099
Entropy (8bit):	5.182478651346149
Encrypted:	false
SSDEEP:	1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
MD5:	94185C5850C26B3C6FC24ABC385CDA58
SHA1:	42F042285037B0C35BC4226D387F88C770AB5CAA
SHA-256:	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
SHA-512:	652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185099
Entropy (8bit):	5.182478651346149
Encrypted:	false
SSDEEP:	1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
MD5:	94185C5850C26B3C6FC24ABC385CDA58
SHA1:	42F042285037B0C35BC4226D387F88C770AB5CAA
SHA-256:	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
SHA-512:	652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	244539
Entropy (8bit):	3.342177162450572
Encrypted:	false
SSDEEP:	1536:vKPC/iyzDtrh1cK3XEivK7VK/3AYvYwgqErRo+RQn:yPC1J/3AYvYwghFo+RQn
MD5:	9CFF5082D9BEC7AF71778D14632FD2B8
SHA1:	D4F0A949320E982EBC6C243B2F6188C0E7B34CEB
SHA-256:	E4D8B387A2EBD7442D71B12C6D2F76C17A32E01184F33F65EACCD8FF34E59E92
SHA-512:	65A443F65DFFE29D54DE9B4AF6C9E3FB99FA7130FC48069C993A1A4EEEF904B058D24E1F3E6B3FB930AB94EF22B6C7BDF067B59928DB705CEE41EE87466DB25B
Malicious:	false
Preview:	Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.337111427641496
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqztmbIpnVoZcg1vRcR0YQGFKxoAvJM3g98kUwPeUkwRe9:YvXKXqzI/Zc0vBAtGMbLUkee9
MD5:	4733B9218D214031A2D6B97541C3A388
SHA1:	DEE10F4C38DBEE0B3DE11FCBE3319F896DB37E98
SHA-256:	A0B7E8C2421011F93BA0B81ECBA86FE0DDDE36C4B8D1C64EAFA4FDE9E95AA8F7
SHA-512:	800B9CDF5BDED07EBBBDA4E4EB471DE5ABD971226889B1B6699D0A9837182D0D19BFDC5AC879D7DB53F2E0D4F3BD9946033A7A457B9206F024246752C0EB9198
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"be4ea61b-d610-41fb-bb29-720229424082","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1744919199496,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.288055550388368
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqztmbIpnVoZcg1vRcR0YQGFKxoAvJfBoTfXpnrPeUkwRe9:YvXKXqzI/Zc0vBAtGWTfXcUkee9
MD5:	8F016BBCF33A3DF324B6AE705C262AA0
SHA1:	D795AD8731F47029D97D987A1E37318201C0287F
SHA-256:	945C65DADEAD970CFD1DACE50FE1456E2CD9FB37E4A0A2870FA59FA106724BD2
SHA-512:	1A6A622A192A15A74907ECFED8F583E5567BF9C8CAC127393591A50C82E6C9ACD9F338A324903855A0581EE3EC925AAB4E8AF8C384F45CAE1AB66C330FB28F08
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"be4ea61b-d610-41fb-bb29-720229424082","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1744919199496,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2675421195257695
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqztmbIpnVoZcg1vRcR0YQGFKxoAvJfBD2G6UpnrPeUkwRe9:YvXKXqzI/Zc0vBAtGR22cUkee9
MD5:	E5DE4BD9A61D6F0B0DB252FC7349DF0E
SHA1:	5A6F00E06D1D1473F148D7928508D3EBA837B057
SHA-256:	58FB0E00E5031760EDC356AB436F0C04DE99BDBA3ED7707977E0C8599EB115C8
SHA-512:	33307A83542B3782B0498B49DEBE17AD1F97EE1662FB82E73BEABFCDB950F86F008F4E3641995E7B9C8E714ABAC3B702804404789CBA46183250008C47513051
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"be4ea61b-d610-41fb-bb29-720229424082","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1744919199496,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.323200812479613
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqztmbIpnVoZcg1vRcR0YQGFKxoAvJfPmwrPeUkwRe9:YvXKXqzI/Zc0vBAtGH56Ukee9
MD5:	1480FACDA44A5FA09A84348363C31EBB
SHA1:	BFEAA0B7C49A6E6F0207ABAE101DFB387A30733D
SHA-256:	76FC69F3ABCF0AE9887DE359D7478AFFE9EA97C1423A6700C658036BF8C3F9E7
SHA-512:	0529FC83E87EF07E0E883EF23365016A3DC0511BCDA9E849DE7B152AFECFA108816520FC255D220A55C3FF5958C55CDAC2680FCC77724B7DBF5C168EB110A710
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"be4ea61b-d610-41fb-bb29-720229424082","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1744919199496,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2213
Entropy (8bit):	5.845996408331968
Encrypted:	false
SSDEEP:	24:Yv6XqzGzv1pLgEGycjycR84b0nNFmerISIedJGWQxiEDtbpEsrAr3IAHlO25FEEg:YvVz+Nhgly48zFm/TWCt8KOP/nDi/V7
MD5:	C580B847DEF5B0477ABEF1060390E022
SHA1:	0FA92AD09DE7ECB5CFC031B5E25998726FFF93DB
SHA-256:	A17FB9014984A73ECAFCC07BE20388B8C05505C606E96BC1AC8E6F1F494E1335
SHA-512:	51D64CDB6DF3806B3423A282B5FCFB11DDAE0C726EFE4CB6E174F4610EE67960288FB95B0CE101558015E72219FB7525B31095C9115EFFBDC6BD7A2214547523
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"be4ea61b-d610-41fb-bb29-720229424082","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1744919199496,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"102656_316349ActionBlock_1","campaignId":102656,"containerId":"1","controlGroupId":"","treatmentId":"5a9d1955-ab74-4b89-837a-074b702313c0","variationId":"316349"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJkYXRhIjp7ImxocFYyQnlQYXRoIjp7Iml0ZW0iOnsiX3BhdGgiOiIvY29udGVudC9kYW0vYWNyb2JhdGRlc2t0b3AvZ3Jvd3RoL3JlYWRlci9lbi11cy9saHAtYmFubmVyL3YyL2NvbnZlcnQiLCJfaWQiOiJlYjYyOWYwOC00YmZiLTRkYmEtYjQzNC01MzUyZTg1MGU4NWYiLCJfdmFyaWF0aW9uIjoicmdzMDM2MS0wIiwidGl0bGUiOm51bGwsImRlc2NyaXB0aW9uIjoiRXhwb3J0IFBERnMgdG8gTWljcm9zb2Z0IFdvcmQgYW5kIEV4Y2VsLiIsImN0YUxhYmVsIjpudWxsLCJjdGFCZW

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.272286734544401
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqztmbIpnVoZcg1vRcR0YQGFKxoAvJf8dPeUkwRe9:YvXKXqzI/Zc0vBAtGU8Ukee9
MD5:	F3949FDAC0432DF3551EE2B8F2A6B858
SHA1:	7CF2FA4542500B9CA121E8174E8C1F0A54C3D2E3
SHA-256:	CDDD9654B08C0B8E138E1935867D7908B355E5CB37D8EBC457B1DC6050DFD702
SHA-512:	1F2BA1898BED8368679D8133F2B3389D6810559C2F4B62D020B8FBC51CCA090E09E3F411C806D65ADD7D1D080B33CEA845500C127A68B2400009275AE57487D7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"be4ea61b-d610-41fb-bb29-720229424082","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1744919199496,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.276163098117308
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqztmbIpnVoZcg1vRcR0YQGFKxoAvJfQ1rPeUkwRe9:YvXKXqzI/Zc0vBAtGY16Ukee9
MD5:	12A53A7F5282CA9B19D9EBF85F2E5042
SHA1:	8473F0EFD47364920DFF0AE07B5F70E19339D614
SHA-256:	CD3E545EB2A3EB0941021494EE42EADF4A6DFAC00B458EA3BC6AE26A8C4DB20F
SHA-512:	74EC069315A5EE937BC6C96740D7EB553840F5B85C81950975C77F9718C28DD3889D415F323C9882100BF7ADE169D9ABD09EF8E5325378CB072E11F2CD8B1586
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"be4ea61b-d610-41fb-bb29-720229424082","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1744919199496,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2160
Entropy (8bit):	5.831253532627878
Encrypted:	false
SSDEEP:	48:YvVz+AogbN48uOQ/GiyL4TwKOkQJi+ohJ7:GtSg54nf/IQOkQJiFz
MD5:	8D92585F90FB68EE118D049B4A2A0CF2
SHA1:	453A1971818286FA86E7DF3A5D051622F564935B
SHA-256:	17CF209BE76BE1AA9E11F9AC015F6C466FFC51EF849F54260E9A070DA10A1907
SHA-512:	54C744B94CD4F3DC3B34E59B68A069ED107D939379E479D2C1A8DB6560888FB352242FBB56A36C40127FA5FCA54C89E69DAAD3E5F12E40F53664E35D17A511A7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"be4ea61b-d610-41fb-bb29-720229424082","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1744919199496,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"102656_316349ActionBlock_2","campaignId":102656,"containerId":"1","controlGroupId":"","treatmentId":"164bf29d-ee04-491c-adf2-c0bfeedb2d1b","variationId":"316349"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJkYXRhIjp7ImxocFYyQnlQYXRoIjp7Iml0ZW0iOnsiX3BhdGgiOiIvY29udGVudC9kYW0vYWNyb2JhdGRlc2t0b3AvZ3Jvd3RoL3JlYWRlci9lbi11cy9saHAtYmFubmVyL3YyL2VkaXQiLCJfaWQiOiIzNzkzMGExNC1kOGMwLTRlZDYtYjI0Yi0zZGUzY2FlZjZlNjAiLCJfdmFyaWF0aW9uIjoicmdzMDM2MS0wIiwidGl0bGUiOm51bGwsImRlc2NyaXB0aW9uIjpudWxsLCJjdGFMYWJlbCI6bnVsbCwiY3RhQmVoYXZpb3IiOm51bGwsImN0YVVybCI6bnVsbCwiY3RhVXJsVHlwZSI6bnVsbCwidHJ

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.297622998983358
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqztmbIpnVoZcg1vRcR0YQGFKxoAvJfzdPeUkwRe9:YvXKXqzI/Zc0vBAtGb8Ukee9
MD5:	3C009E00DF5871FFAF3F8928678D1A0C
SHA1:	FE0A5220EAAD3418FF6F4B5A2B07FDE64E83DBB4
SHA-256:	D447283C9023349C8990D707F749F2C134385CEBC76ABFA941C68F80BABE857D
SHA-512:	FCEACFD7E99E134213CAF264E18CEEEB6C24C28F62DF77355AA61A98FA589365F5589D3948FB8E4BC428E8B37FED0E3CE8171858E2EA7D19750CF07AD8008106
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"be4ea61b-d610-41fb-bb29-720229424082","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1744919199496,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.277521561289704
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqztmbIpnVoZcg1vRcR0YQGFKxoAvJfYdPeUkwRe9:YvXKXqzI/Zc0vBAtGg8Ukee9
MD5:	CE1D02164AED96A87EE8E2F2C1809150
SHA1:	233E66681E85385423F3652A8965A97A59531B72
SHA-256:	2B8B66367F94CA3A00F9CF902296EAD819DD6A790FA05B268DE6B4B3D15BB216
SHA-512:	2DCFEA9327A659FAEA0A055E792209E1753201A7FD9A2A19B79E9ABC7604F2D6A0F96785EB4EA0C6A3C5C2BA9F90B1DF0D7CE24282B8D6462705AAFD7E1BCC26
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"be4ea61b-d610-41fb-bb29-720229424082","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1744919199496,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.263475177879826
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqztmbIpnVoZcg1vRcR0YQGFKxoAvJf+dPeUkwRe9:YvXKXqzI/Zc0vBAtG28Ukee9
MD5:	C30651B7CCF08BE11DCD4B59A1A3DAD0
SHA1:	C51317FC4AEC77E82D8D047F27989A11083CB329
SHA-256:	CB5D21188F547AC091FC547BBFEFA376FC1270DAC8213D2FC0F301575AE111CA
SHA-512:	D2E421B2A65A275F8BE723C9E578B26D9181687EC9049A663D7148771149CD115BB68FB2F11AB7FBF1EC91A5D6185AD728892CEF715D2A8E57A886E783850D80
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"be4ea61b-d610-41fb-bb29-720229424082","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1744919199496,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.261223149951268
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqztmbIpnVoZcg1vRcR0YQGFKxoAvJfbPtdPeUkwRe9:YvXKXqzI/Zc0vBAtGDV8Ukee9
MD5:	41395C30BE49A0FBCA3442D3B7BCDFE2
SHA1:	3251A6E4BFAA0E0EA6BF221BF31D7DFF1C6B09E3
SHA-256:	A073C266B480576E20BE71FBEFC12F7F5A23F2DA6419F6C1A8F7F5567FB2E9D7
SHA-512:	DDDD333EE9E177771AAFE4FFC19935766BB13D37B4E2D680104C2E51436C13A851782C4028B62990E6DF194EC19B7E37527298C979F264F280928D2DFE9E3CDB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"be4ea61b-d610-41fb-bb29-720229424082","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1744919199496,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.265249086816502
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqztmbIpnVoZcg1vRcR0YQGFKxoAvJf21rPeUkwRe9:YvXKXqzI/Zc0vBAtG+16Ukee9
MD5:	A3E59CB3E1CC32897A6A3E0BA933376E
SHA1:	F17D248DE283006251496D408D56DE22E7546320
SHA-256:	EB01A14BDEF745D6EE3A6C4DA69E1FCE1AEE05C74955505210F20AA7CE9CCE93
SHA-512:	6093090EBA5C0B7BB466F62B1FC34789FB72097F811208C92B818462407336CE3105390BEFFA2D313E9A3F1AEEB75E994F8B5C609B3B321E27E468D5084546C2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"be4ea61b-d610-41fb-bb29-720229424082","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1744919199496,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2112
Entropy (8bit):	5.849203498536394
Encrypted:	false
SSDEEP:	24:Yv6XqzGzvtamXayLgEdycgNaLcR84brvXJkoerISIQ1iyLVFgKy1N8IAHlOBJEE+:YvVz+pBgBG48kJko/SiyL4T0AFDA/V7
MD5:	50AA9A2B7F9D194AC85A6B0BEAF042BF
SHA1:	6E659BF9F18B3CA83377A9D240488699CF4BAF8D
SHA-256:	37F019ADA25A82EC348879618A28EBF13E3798CB04990EE952FEF66F91721657
SHA-512:	4215746ECF741A19CCBAEE84372C6994D97E38806E6580F72C52F4DDDA9B60649291A896D1B599E3DBE92E3A5AC356EE9B235C76E98DB00C05A58A6AD121014B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"be4ea61b-d610-41fb-bb29-720229424082","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1744919199496,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"102656_316349ActionBlock_0","campaignId":102656,"containerId":"1","controlGroupId":"","treatmentId":"339c0ba6-2e61-4622-82f6-f07787d206b8","variationId":"316349"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJkYXRhIjp7ImxocFYyQnlQYXRoIjp7Iml0ZW0iOnsiX3BhdGgiOiIvY29udGVudC9kYW0vYWNyb2JhdGRlc2t0b3AvZ3Jvd3RoL3JlYWRlci9lbi11cy9saHAtYmFubmVyL3YyL3NpZ24iLCJfaWQiOiJkMDQzMmY0Yy1hNTM2LTRlMzktOGNkNS1jYThiYjRhZTY2YzIiLCJfdmFyaWF0aW9uIjoicmdzMDM2MS0wIiwidGl0bGUiOm51bGwsImRlc2NyaXB0aW9uIjoiRWFzaWx5IGZpbGwgYW5kIHNpZ24gUERGcy4iLCJjdGFMYWJlbCI6bnVsbCwiY3RhQmVoYXZpb3IiOm51bGwsImN0YVVybCI6bnV

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.242141383242284
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqztmbIpnVoZcg1vRcR0YQGFKxoAvJfshHHrPeUkwRe9:YvXKXqzI/Zc0vBAtGUUUkee9
MD5:	2685CC4024B358D42648E3EEA0C946A7
SHA1:	0E2A5D200C15E662BB7069573218B2163EAA9B92
SHA-256:	E26718B2A1A58B66EB357ED36B137567D32011221CA0C706F59D2DCDD95C42F1
SHA-512:	20CD3FE20025BF1DC12AF39801CCB5DC050753086CDD49AF3112FFA4E2EA0FF29C30DD738074C77DEC7E9700E0FEEC2069816CB2C6864E4A5112EB7A7F841845
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"be4ea61b-d610-41fb-bb29-720229424082","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1744919199496,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.24468197818444
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqztmbIpnVoZcg1vRcR0YQGFKxoAvJTqgFCrPeUkwRe9:YvXKXqzI/Zc0vBAtGTq16Ukee9
MD5:	AE4B6C32017C7036E908ED86740781B8
SHA1:	140C5A8FB41F653B1EFF8919C3E7994D40C20ADC
SHA-256:	D40020BAA973196E12BDD2209685CD2F03505BF2857735BEFF4A05C960706C7C
SHA-512:	7FEB51A211EDCA1B7CDA8A05CBA9CE67E99023124DED9D6704CA782B7764BEB5A2E4EB9AB3A499FE8F760039131FBEA8EBCF518FA1824F0F3B83AA59F2DF6871
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"be4ea61b-d610-41fb-bb29-720229424082","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1744919199496,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2815
Entropy (8bit):	5.126453751198985
Encrypted:	false
SSDEEP:	24:YkX17GaKayaabEwKWFFggJ8h0mr7Lk8Pj2j0SSfCJXC275Ni/2LSSRCtj5kUKz44:YWIKa5EhrbIv8ii/G6tzY4qA097r
MD5:	F1A28384F0A4308E5BE0D7590ED5F2FE
SHA1:	45BF4CAA23DA15C8A553A12CFCA9BB59ECCEBA1B
SHA-256:	2F84D5BBDAF1917D0B6354A2E928FC3A7D338834AC4F63C44936BD43EEA8CE7A
SHA-512:	7AAA62E43D73D5C4F4978F03F109E6DD82D081689254ABED9C7B82DB4F9C0E17486902D5CF204C8DA1FB278CDC0802589D6DA1938F84D0841F4767005693F314
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"c9996f6d021831ded0fd532e7ac6d49e","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1744744419000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"33ba34b68f655e54bd1bb15e9cf7018a","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":2112,"ts":1744744419000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"861dc0c5efc452d9d3383f70a00b5fcf","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":2213,"ts":1744744419000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"eb348400d653e5fecbc5ec0bdcdbb9d5","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":2160,"ts":1744744419000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"ed14f98cb4cfb267ef986ab82c5e7aa8","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1744744419000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"98c5455b36b313fe677d160823caa9b2","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file",

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.188868462249449
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUzSvR9H9vxFGiDIAEkGVvp3:lNVmswUUUUUUUUz+FGSItr
MD5:	46D40EDB158B6E044E2F74D986E14BEE
SHA1:	0A01863E093F35E6A9EA21F3BC77227150C99F5F
SHA-256:	B2301CE0B96B5AF8DA892F2CB718FAC6ADFC6172DB3C9E957F5ED26311D8654C
SHA-512:	00ACCA262A7A98C43D49CE74744B93FBCCBC7579AF90080ADE9B342396D2AAAD8620F2B6313A77ECC8670902F7D9480D213BF6E5DEEEF7044554F9CEC5833614
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6086096322887788
Encrypted:	false
SSDEEP:	48:7MWKUUUUUUUUUU3vR9H9vxFGiDIAEkGVvyqFl2GL7ms4:7GUUUUUUUUUUPFGSItEKVms4
MD5:	A30ACE1C1CAFE3659B1F16215304CE49
SHA1:	23146251F8BE8DCA218EFB942C993E20C9581CD8
SHA-256:	4B0B5A7575C8BC44DC8E2FE794D821D87ABF9F2FFD4363421E21558B3A589824
SHA-512:	9A7551A597B5A6938ECA57325C7111BD0CDAE84B6C5B7B8D62BB90A3662A3A93DDC684D512716E9838F5F39A1DDF9297F2BACD85D8DF4818AF36E8CB8FCBA9C0
Malicious:	false
Preview:	.... .c......$w.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIa86df.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5136057226030957
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8+kClERMoH:Qw946cPbiOxDlbYnuRK4RMu
MD5:	F83C8982D1127BFFFD76E83733D48E32
SHA1:	4A81B25467264EE7ED354FFF63D2F792A6A1612E
SHA-256:	C5A6002767F5CF1827F56A1163CB4D06E0CEA13EE5A559AC05515477FB905ED9
SHA-512:	F985CF1A4D65BDA44C4AF7BD7CE1655E949B6B1DC5D7D9103BB29EA396C15657D95ED0FB101C3AF5C7D2A578C2394CF8B42751B3DBAD9E5839F391142C04F029
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.5./.0.4./.2.0.2.5. . .1.5.:.1.3.:.4.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-04-15 15-13-34-653.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	16603
Entropy (8bit):	5.32667779847735
Encrypted:	false
SSDEEP:	384:h4+5TpWjJOjWVDqtOJ6ft4X/rUhnKmij2doasYaou4smAfNsPsF+DIDmHIGQ0jbO:8MQv
MD5:	EF1121FBC105D84F27FA185F550964CF
SHA1:	1075ED98028228E047282150422FFED5390A37E5
SHA-256:	7D3911F0A78BEBE9BE839A813629DD13371E1FAE228D859F1A96C80EACD789A5
SHA-512:	D0EB458A8118B8F64954EF241CDFB52D1201158957A825EEB2A28009DA50327B503630B89FA0AD2652E9263CE97B7284D633F5C7DF02455BF8CF89532D1E62D5
Malicious:	false
Preview:	SessionID=24d12718-db2c-4d98-8260-2ae534a6ad16.1744744414672 Timestamp=2025-04-15T15:13:34:672-0400 ThreadID=5348 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=24d12718-db2c-4d98-8260-2ae534a6ad16.1744744414672 Timestamp=2025-04-15T15:13:34:702-0400 ThreadID=5348 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=24d12718-db2c-4d98-8260-2ae534a6ad16.1744744414672 Timestamp=2025-04-15T15:13:34:702-0400 ThreadID=5348 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=24d12718-db2c-4d98-8260-2ae534a6ad16.1744744414672 Timestamp=2025-04-15T15:13:34:702-0400 ThreadID=5348 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=24d12718-db2c-4d98-8260-2ae534a6ad16.1744744414672 Timestamp=2025-04-15T15:13:34:703-0400 ThreadID=5348 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29845
Entropy (8bit):	5.391105217995448
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rY:k
MD5:	0B90A4634FD661E3DA2B246C2522232E
SHA1:	68BEE650B4A4F0E719B6E49AA01A26F5B3657E88
SHA-256:	0630F8CAEC6C952733DE334A4898B358326DF32F0939F8D49678A0E4B6CC99E4
SHA-512:	53DD53C7E9C8B49C723E12D76B3B3C3C20C628BCEC30665B733AD4AF6F7BC7B2CE3AB9EF5C5DBE7866253F00FF8870B573C235BB4FF209056E83D8A437A96127
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\07d39cbe-a3a4-4e8f-b187-4409a38da1f0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/n5ZwYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:xZwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	E78E4D1CA18BE28748F65C3A192DAFB2
SHA1:	78AD6025CB470EFB9ECA8FF1ED41F617372D1F9F
SHA-256:	F4B25F5C5BE48E151080D9CC24C8A4662CBB591A6B32037DB8D7ADE1828D8849
SHA-512:	E170C9BD3B6BB575244FCD380334D763C30352586F60824A67868EAE8E895BE0601D51670FCC304724BDF321CE8EF64881E606C9CF4C18C5817DFB5A679E44D6
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\18dd79a8-4260-4ad9-8469-35cde953d5a6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\40255006-9113-46e2-9167-b00bff394166.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VRaWL07oXGZ4YIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:tRaWLxXGZ4ZGh3mlind9i4ufFXpAXkru
MD5:	41034A6B023B6BB9C723DA146E190954
SHA1:	22C95166FF8A1C4D2AAC25B75D804CEBAAA6ACF2
SHA-256:	52BB8B0CA62248721986D650004C11ACCB0C988B6FBA645D9B4E3557CA87A15D
SHA-512:	6F8CD54BBB750E32FEBD78895F433CCF0C553C56E6B7DDEA03E3EA36ED283084CF6EA6FA8999162999D184B0F04B6E6DAB7F6FC27648EE517F744D7E8DBC8AAD
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ec04f157-f499-43e9-bef9-f5e641ac5ed9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

Static File Info

General

File type:	PDF document, version 1.5 (zip deflate encoded)
Entropy (8bit):	7.498119772147105
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Front label Dieline_V1.pdf
File size:	390'204 bytes
MD5:	b0775894077f24081aff38b179374cef
SHA1:	cd649a2cda2f3300ec5bc13f9524fe0d4cd9a50b
SHA256:	abcc59bc19bb1bfa96fef9822a9770e945e8800d719765eacedb85a0a808094e
SHA512:	c3b06e0aeab05161dc87b6647ee9d2a02e7ad2e1ab7bff18c1263087694ecbf9ba7db8d7d89b2fe1f9916cc440c0c0c05e37286c2d3f3b1e724f6245de32edf5
SSDEEP:	6144:97N7eNAbBQ+FMnm0ka2pX6dcMF2XKqCxqHc3gH7byWJmbh5/c3iIvwZ4zfrBBpBj:LeNGfMnm0ka2x6iMF6K1xq83YbiJc3iy
TLSH:	7D849B676FF91964C21CE29102843C8A7CC7358FD9F42D8BFAEE5E80DF58A5014CB65A
File Content Preview:	%PDF-1.5.%......11 0 obj.<</Linearized 1/L 333021/O 13/E 276573/N 1/T 332713/H [ 495 196]>>.endobj. ..31 0 obj.<</DecodeParms<</Columns 5/Predictor 12>>/Filter/FlateDecode/ID[<A1B05987BEC54B34B01AC26BA893D407><13CE91AD9379C74A90AD7ECE1851A4A

File Icon


Icon Hash:	62cc8caeb29e8ae0

Static PDF Info

General
Header:	%PDF-1.5
Total Entropy:	7.498120
Total Bytes:	390204
Stream Entropy:	7.503512
Stream Bytes:	386121
Entropy outside Streams:	5.319753
Bytes outside Streams:	4083
Number of EOF found:	3
Bytes after EOF:

Keywords Statistics

Name	Count
obj	34
endobj	34
stream	30
endstream	30
xref	0
trailer	0
startxref	3
/Page	2
/Encrypt	0
/ObjStm	5
/URI	0
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 15, 2025 21:13:44.345215082 CEST	49726	80	192.168.2.4	23.55.253.31
Apr 15, 2025 21:13:44.450722933 CEST	80	49726	23.55.253.31	192.168.2.4
Apr 15, 2025 21:13:44.450839043 CEST	49726	80	192.168.2.4	23.55.253.31
Apr 15, 2025 21:13:44.451515913 CEST	49726	80	192.168.2.4	23.55.253.31
Apr 15, 2025 21:13:44.557137012 CEST	80	49726	23.55.253.31	192.168.2.4
Apr 15, 2025 21:13:44.558624983 CEST	80	49726	23.55.253.31	192.168.2.4
Apr 15, 2025 21:13:44.558640957 CEST	80	49726	23.55.253.31	192.168.2.4
Apr 15, 2025 21:13:44.558722973 CEST	49726	80	192.168.2.4	23.55.253.31
Apr 15, 2025 21:13:57.352010012 CEST	49726	80	192.168.2.4	23.55.253.31

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 15, 2025 21:13:44.233406067 CEST	50297	53	192.168.2.4	1.1.1.1
Apr 15, 2025 21:13:44.341640949 CEST	53	50297	1.1.1.1	192.168.2.4
Apr 15, 2025 21:13:56.555615902 CEST	65463	53	192.168.2.4	1.1.1.1
Apr 15, 2025 21:13:56.665246010 CEST	53	65463	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 15, 2025 21:13:44.233406067 CEST	192.168.2.4	1.1.1.1	0x17c6	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Apr 15, 2025 21:13:56.555615902 CEST	192.168.2.4	1.1.1.1	0x1e66	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 15, 2025 21:13:42.288301945 CEST	1.1.1.1	192.168.2.4	0x5415	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.55.37	A (IP address)	IN (0x0001)	false
Apr 15, 2025 21:13:42.288301945 CEST	1.1.1.1	192.168.2.4	0x5415	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.55.19	A (IP address)	IN (0x0001)	false
Apr 15, 2025 21:13:42.288301945 CEST	1.1.1.1	192.168.2.4	0x5415	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.55.22	A (IP address)	IN (0x0001)	false
Apr 15, 2025 21:13:42.288301945 CEST	1.1.1.1	192.168.2.4	0x5415	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.48.20	A (IP address)	IN (0x0001)	false
Apr 15, 2025 21:13:42.288301945 CEST	1.1.1.1	192.168.2.4	0x5415	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.48.34	A (IP address)	IN (0x0001)	false
Apr 15, 2025 21:13:42.288301945 CEST	1.1.1.1	192.168.2.4	0x5415	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.55.34	A (IP address)	IN (0x0001)	false
Apr 15, 2025 21:13:42.288301945 CEST	1.1.1.1	192.168.2.4	0x5415	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.48.19	A (IP address)	IN (0x0001)	false
Apr 15, 2025 21:13:42.288301945 CEST	1.1.1.1	192.168.2.4	0x5415	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.48.24	A (IP address)	IN (0x0001)	false
Apr 15, 2025 21:13:44.341640949 CEST	1.1.1.1	192.168.2.4	0x17c6	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 21:13:44.341640949 CEST	1.1.1.1	192.168.2.4	0x17c6	No error (0)	crl.root-x1.letsencrypt.org.edgekey.net	e8652.dscx.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 21:13:44.341640949 CEST	1.1.1.1	192.168.2.4	0x17c6	No error (0)	e8652.dscx.akamaiedge.net		23.55.253.31	A (IP address)	IN (0x0001)	false
Apr 15, 2025 21:13:56.665246010 CEST	1.1.1.1	192.168.2.4	0x1e66	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 21:13:56.665246010 CEST	1.1.1.1	192.168.2.4	0x1e66	No error (0)	crl.root-x1.letsencrypt.org.edgekey.net	e8652.dscx.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 21:13:56.665246010 CEST	1.1.1.1	192.168.2.4	0x1e66	No error (0)	e8652.dscx.akamaiedge.net		23.55.253.31	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

x1.i.lencr.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49726	23.55.253.31	80	7804	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2025 21:13:44.451515913 CEST	115	OUT	GET / HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/10.0 Host: x1.i.lencr.org
Apr 15, 2025 21:13:44.558624983 CEST	1358	IN	HTTP/1.1 200 OK Server: nginx Content-Type: application/pkix-cert Last-Modified: Fri, 04 Aug 2023 20:57:56 GMT ETag: "64cd6654-56f" Content-Disposition: attachment; filename="ISRG Root X1.der" Cache-Control: max-age=27817 Expires: Wed, 16 Apr 2025 02:57:21 GMT Date: Tue, 15 Apr 2025 19:13:44 GMT Content-Length: 1391 Connection: keep-alive Data Raw: 30 82 05 6b 30 82 03 53 a0 03 02 01 02 02 11 00 82 10 cf b0 d2 40 e3 59 44 63 e0 bb 63 82 8b 00 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 1e 17 0d 31 35 30 36 30 34 31 31 30 34 33 38 5a 17 0d 33 35 30 36 30 34 31 31 30 34 33 38 5a 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 ad e8 24 73 f4 14 37 f3 9b 9e 2b 57 28 1c 87 be dc b7 df 38 90 8c 6e 3c e6 57 a0 78 f7 75 c2 a2 fe f5 6a 6e f6 00 4f 28 db de 68 86 6c 44 93 b6 b1 63 fd 14 12 6b bf 1f d2 ea 31 9b 21 7e d1 33 [TRUNCATED] Data Ascii: 0k0S@YDcc0H0O10UUS1)0'U Internet Security Research Group10UISRG Root X10150604110438Z350604110438Z0O10UUS1)0'U Internet Security Research Group10UISRG Root X10"0H0$s7+W(8n<WxujnO(hlDck1!~3<Hy!KqiJffl~<p)"K~G\|H#S8Oo.IWt/8{p!u0<cOK~w.{JL%p)S$J?aQcq.o[\4ylv;by/&676urIAv5/(ldwnG7Y^hrA)>Y>&$ZL@F:Qn;}rxY>Qx/>{JKsP\|Ctt0[q600\H;}`)A\|;FHvvj=8d+(B"']ypN:'Qnd3COB0@0U0U00UyY{sXn0*HUXPi ')au\ni/VKsY!~Lq`9!VPYYbEf\|o;'}~"+"
Apr 15, 2025 21:13:44.558640957 CEST	387	IN	Data Raw: 0e 8f f2 8a 34 5b 58 d8 fc 01 c9 54 b9 b8 26 cc 8a 88 33 89 4c 2d 84 3c 82 df ee 96 57 05 ba 2c bb f7 c4 b7 c7 4e 3b 82 be 31 c8 22 73 73 92 d1 c2 80 a4 39 39 10 33 23 82 4c 3c 9f 86 b2 55 98 1d be 29 86 8c 22 9b 9e e2 6b 3b 57 3a 82 70 4d dc 09 Data Ascii: 4[XT&3L-<W,N;1"ss993#L<U)"k;W:pMMl]+NEJ&rj,_(.{q{^FS\|7B*HL9GR+3S}MmBo@'5\(3#PylFn~:R-?[$

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Acrobat.exePID: 7636, Parent PID: 3964

General

Target ID:	0
Start time:	15:13:30
Start date:	15/04/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Front label Dieline_V1.pdf"
Imagebase:	0x7ff732040000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: AcroCEF.exePID: 7804, Parent PID: 7636

General

Target ID:	1
Start time:	15:13:31
Start date:	15/04/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff651880000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: AcroCEF.exePID: 8148, Parent PID: 7804

General

Target ID:	3
Start time:	15:13:32
Start date:	15/04/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1608 --field-trial-handle=1568,i,14606709187914981620,5360071706544978782,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff651880000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Front label Dieline_V1.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\209ff05e-db7f-4302-a667-afe252d0e6ad.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250415191337Z-195.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7716

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Windows Analysis Report
Front label Dieline_V1.pdf