Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Toyota Mot_0043394_CC367099.pdf

Overview

General Information

Sample name:Toyota Mot_0043394_CC367099.pdf
Analysis ID:1437715
MD5:4859953a387b32836780fc839fb02e20
SHA1:0147602ab9808dc2bf4a8b5d83aded6714af6145
SHA256:636922d548c79ab03614dab37b7896108b31bfa9a3615be1a841d99d3e089948
Infos:

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 7644 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Toyota Mot_0043394_CC367099.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 7812 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 7996 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1656,i,9355703423911665835,3495983511669041495,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.77.8.172:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.77.8.172:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.77.8.172:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.77.8.172:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.77.8.172:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.77.8.172:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.77.8.172:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.77.8.172:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.77.8.172:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.77.8.172:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.77.8.172:443
Source: global trafficTCP traffic: 104.77.8.172:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.77.8.172:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.77.8.172:443
Source: global trafficTCP traffic: 104.77.8.172:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 104.77.8.172:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.77.8.172:443
Source: global trafficTCP traffic: 104.77.8.172:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 104.77.8.172:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.77.8.172:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.77.8.172:443
Source: global trafficTCP traffic: 104.77.8.172:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.77.8.172:443
Source: global trafficTCP traffic: 104.77.8.172:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.77.8.172:443
Source: global trafficTCP traffic: 104.77.8.172:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 104.77.8.172:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.77.8.172:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.77.8.172:443
Source: global trafficTCP traffic: 104.77.8.172:443 -> 192.168.2.4:49740
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1 Host: armmf.adobe.com Connection: keep-alive Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br If-None-Match: "78-5faa31cce96da" If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 104.77.8.172
Source: unknownTCP traffic detected without corresponding DNS query: 104.77.8.172
Source: unknownTCP traffic detected without corresponding DNS query: 104.77.8.172
Source: unknownTCP traffic detected without corresponding DNS query: 104.77.8.172
Source: unknownTCP traffic detected without corresponding DNS query: 104.77.8.172
Source: unknownTCP traffic detected without corresponding DNS query: 104.77.8.172
Source: unknownTCP traffic detected without corresponding DNS query: 104.77.8.172
Source: unknownTCP traffic detected without corresponding DNS query: 104.77.8.172
Source: unknownTCP traffic detected without corresponding DNS query: 104.77.8.172
Source: unknownTCP traffic detected without corresponding DNS query: 104.77.8.172
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1 Host: armmf.adobe.com Connection: keep-alive Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br If-None-Match: "78-5faa31cce96da" If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: classification engineClassification label: clean1.winPDF@14/44@0/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7736Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-05-07 20-39-16-409.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Toyota Mot_0043394_CC367099.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1656,i,9355703423911665835,3495983511669041495,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1656,i,9355703423911665835,3495983511669041495,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: Toyota Mot_0043394_CC367099.pdfInitial sample: PDF keyword /JS count = 0
Source: Toyota Mot_0043394_CC367099.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: A9cxq7wf_1qgb8ju_5yw.tmp.0.drInitial sample: PDF keyword /JS count = 0
Source: A9cxq7wf_1qgb8ju_5yw.tmp.0.drInitial sample: PDF keyword /JavaScript count = 0
Source: Toyota Mot_0043394_CC367099.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive12
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1437715 Sample: Toyota Mot_0043394_CC367099.pdf Startdate: 07/05/2024 Architecture: WINDOWS Score: 1 6 Acrobat.exe 20 73 2->6         started        process3 8 AcroCEF.exe 104 6->8         started        process4 10 AcroCEF.exe 2 8->10         started        dnsIp5 13 104.77.8.172, 443, 49740 AKAMAI-ASUS United States 10->13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
104.77.8.172
unknownUnited States
16625AKAMAI-ASUSfalse

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1437715
Start date and time:2024-05-07 20:38:28 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 3m 48s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultwindowspdfcookbook.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:10
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:Toyota Mot_0043394_CC367099.pdf
Detection:CLEAN
Classification:clean1.winPDF@14/44@0/1
Cookbook Comments:
  • Found application associated with file extension: .pdf
  • Found PDF document
  • Close Viewer

Warnings

  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 23.196.184.145, 52.202.204.11, 23.22.254.206, 54.227.187.23, 52.5.13.197, 23.223.209.213, 23.223.209.217, 172.64.41.3, 162.159.61.3
  • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com
  • Not all processes where analyzed, report is missing behavior information
  • VT rate limit hit for: Toyota Mot_0043394_CC367099.pdf

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
AKAMAI-ASUSPayment Confirmation#U007e#U007e6985.rtfGet hashmaliciousHTMLPhisherBrowse
  • 23.196.3.178
https://issuu.com/designcontrol/docs/adobeeeee?fr=sZDI1NjczMjA1NzcGet hashmaliciousHTMLPhisherBrowse
  • 23.203.176.161
file.exeGet hashmaliciousVidarBrowse
  • 104.102.129.112
https://esparzalarm.com/closing/HUD/offGet hashmaliciousHTMLPhisherBrowse
  • 23.40.179.187
https://tracksystemsinc-my.sharepoint.com/:b:/p/john_bogaczyk/EdlYE7gx97FJsgXvuX9aWbEBDrtBzsHcx2nPCPEi1RGOsg?e=anCHKXGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
  • 23.200.88.25
https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:92095073-e15a-4dff-8e43-d4abc08308b6Get hashmaliciousHtmlDropper, HTMLPhisherBrowse
  • 23.223.209.69
file.exeGet hashmaliciousVidarBrowse
  • 104.102.129.112
https://cityofvincennes-my.sharepoint.com/:b:/g/personal/bbobe_vincennes_in_gov/Eb--LKxM5a1KgirOUZhQ-NgBZvKQiyKDdHP9nIL9-jsvHg?e=4%3AQvjK6zGet hashmaliciousHTMLPhisherBrowse
  • 23.40.179.168
https://help.nextiva.com/0D5UV00000CENsy?fromEmail=1&s1oid=00D4x0000024KeV&s1nid=0DB8Y0000001q0j&s1uid=005UV000000Gbt2&s1ext=0&emkind=chatterPostNotification&emtm=1715035203355&emvtk=xliOiy4JGvwIBQw.4ViBLNixLC3jvtIl_ydu19EzVXQ%3D&OpenCommentForEdit=1Get hashmaliciousUnknownBrowse
  • 23.46.225.71
FW IMPORTANT DVO 96FEJJ - Distribution_Notice.emlGet hashmaliciousHTMLPhisherBrowse
  • 104.126.112.182

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:ASCII text
Category:dropped
Size (bytes):292
Entropy (8bit):5.189842555987087
Encrypted:false
SSDEEP:6:Dtnq2Pwkn2nKuAl9OmbnIFUt86tKZmw+6t2kwOwkn2nKuAl9OmbjLJ:D5vYfHAahFUt86E/+6k5JfHAaSJ
MD5:3BC8E052D511CE0D856260ADE04AECB7
SHA1:18EC2AEDF656954409A6442DCE406A5DD5B30260
SHA-256:AF5F6A755A2907C3302C0CED31FD48E802393A35E4A153F2ACBBEB954C2FD7A5
SHA-512:B0661E2C0400C161A3058583E63F71B8C1D271D6F4647D14748B8E3E6C437C14DC105A275551F3D1B7FDECB2A9C0F34EAB9A2C9EAF345D659819F3CE66DB5532
Malicious:false
Reputation:low
Preview:2024/05/07-20:39:14.154 1ea4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/05/07-20:39:14.154 1ea4 Recovering log #3.2024/05/07-20:39:14.154 1ea4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:ASCII text
Category:dropped
Size (bytes):292
Entropy (8bit):5.189842555987087
Encrypted:false
SSDEEP:6:Dtnq2Pwkn2nKuAl9OmbnIFUt86tKZmw+6t2kwOwkn2nKuAl9OmbjLJ:D5vYfHAahFUt86E/+6k5JfHAaSJ
MD5:3BC8E052D511CE0D856260ADE04AECB7
SHA1:18EC2AEDF656954409A6442DCE406A5DD5B30260
SHA-256:AF5F6A755A2907C3302C0CED31FD48E802393A35E4A153F2ACBBEB954C2FD7A5
SHA-512:B0661E2C0400C161A3058583E63F71B8C1D271D6F4647D14748B8E3E6C437C14DC105A275551F3D1B7FDECB2A9C0F34EAB9A2C9EAF345D659819F3CE66DB5532
Malicious:false
Reputation:low
Preview:2024/05/07-20:39:14.154 1ea4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/05/07-20:39:14.154 1ea4 Recovering log #3.2024/05/07-20:39:14.154 1ea4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:ASCII text
Category:dropped
Size (bytes):336
Entropy (8bit):5.2049581953301
Encrypted:false
SSDEEP:6:DYxVq2Pwkn2nKuAl9Ombzo2jMGIFUt869gZmw+6pSIkwOwkn2nKuAl9Ombzo2jM4:DYxVvYfHAa8uFUt869g/+68I5JfHAa8z
MD5:43B4FF9B53A754EB3F0FB6A6BD5EE151
SHA1:3F386ADEB10F84A3829D92FD449E6642A37D57BC
SHA-256:88266DFFA33B509EC35C0968B37A1251DB7E9DB9F2256E8E1E9571FB647F4A2C
SHA-512:D4303FBAA9146FF4F64742E5404D7BB10D83B5C839488E5009D19BC03E8DBA8CB21369A01FAFD111FD28747083B285F767048674812E343CF724B46B4214AC8F
Malicious:false
Reputation:low
Preview:2024/05/07-20:39:14.242 1f74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/05/07-20:39:14.252 1f74 Recovering log #3.2024/05/07-20:39:14.253 1f74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:ASCII text
Category:dropped
Size (bytes):336
Entropy (8bit):5.2049581953301
Encrypted:false
SSDEEP:6:DYxVq2Pwkn2nKuAl9Ombzo2jMGIFUt869gZmw+6pSIkwOwkn2nKuAl9Ombzo2jM4:DYxVvYfHAa8uFUt869g/+68I5JfHAa8z
MD5:43B4FF9B53A754EB3F0FB6A6BD5EE151
SHA1:3F386ADEB10F84A3829D92FD449E6642A37D57BC
SHA-256:88266DFFA33B509EC35C0968B37A1251DB7E9DB9F2256E8E1E9571FB647F4A2C
SHA-512:D4303FBAA9146FF4F64742E5404D7BB10D83B5C839488E5009D19BC03E8DBA8CB21369A01FAFD111FD28747083B285F767048674812E343CF724B46B4214AC8F
Malicious:false
Reputation:low
Preview:2024/05/07-20:39:14.242 1f74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/05/07-20:39:14.252 1f74 Recovering log #3.2024/05/07-20:39:14.253 1f74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:JSON data
Category:dropped
Size (bytes):474
Entropy (8bit):4.957078780689853
Encrypted:false
SSDEEP:12:YH/um3RA8sqZcusBdOg2Hscaq3QYiubInP7E4T3y:Y2sRdsNdMHP3QYhbG7nby
MD5:6B666CF9D0DA2CBD3F09D76F7659F529
SHA1:CA58EADB2DC20C7D8B9FFFC50032E060D806C4A4
SHA-256:1410B0187A064AED04FEE8CF9E45653F2058F395BFA5C0A403CBDC6E1868C40A
SHA-512:E4A4AD5AD7544EC59CD77388206141C48CD47ED327A93CA3CB35C719F5615C323C5BD45423222F41D70FB37B9CAE3ACE277722D3E0929811B309DD81DA3FE8EA
Malicious:false
Reputation:low
Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13359667166108443","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":86161},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f02c40ac-e430-496b-9a63-168730030bd2.tmp

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:JSON data
Category:modified
Size (bytes):474
Entropy (8bit):4.957078780689853
Encrypted:false
SSDEEP:12:YH/um3RA8sqZcusBdOg2Hscaq3QYiubInP7E4T3y:Y2sRdsNdMHP3QYhbG7nby
MD5:6B666CF9D0DA2CBD3F09D76F7659F529
SHA1:CA58EADB2DC20C7D8B9FFFC50032E060D806C4A4
SHA-256:1410B0187A064AED04FEE8CF9E45653F2058F395BFA5C0A403CBDC6E1868C40A
SHA-512:E4A4AD5AD7544EC59CD77388206141C48CD47ED327A93CA3CB35C719F5615C323C5BD45423222F41D70FB37B9CAE3ACE277722D3E0929811B309DD81DA3FE8EA
Malicious:false
Reputation:low
Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13359667166108443","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":86161},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:data
Category:dropped
Size (bytes):4730
Entropy (8bit):5.248558321732744
Encrypted:false
SSDEEP:96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7H8tGUTtpOZ:etJCV4FiN/jTN/2r8Mta02fEhgO73goT
MD5:4771446D0C0B0C9CA69CD2C1E88D9B09
SHA1:82854755F85498582CDD92371747A65E627B9488
SHA-256:BE8CF1030BEFF97C8145B196DAA54085AF51593C59678BB79557736FAA1539B2
SHA-512:2BAFA25A62195FE6EA9B431B5F1E911D1B5AEA4A226D45B5509B662604160ACCE84E503292CAD407629D17D2C983E907D11CD49A609E37DCC34ACFF24538AD07
Malicious:false
Reputation:low
Preview:*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:ASCII text
Category:dropped
Size (bytes):324
Entropy (8bit):5.226351596370954
Encrypted:false
SSDEEP:6:DidVq2Pwkn2nKuAl9OmbzNMxIFUt86GgZmw+6qdSIkwOwkn2nKuAl9OmbzNMFLJ:DuVvYfHAa8jFUt86Gg/+6qQI5JfHAa8E
MD5:1D33E87C95D03816BAC7F8D2DCB4CE6D
SHA1:67FB263A7B769779FD34820D7A11F4A915ADA7B6
SHA-256:D130A31DEC984651EE3441D915932B9D0E0A29B96B362280D5B7D543A64BE1BD
SHA-512:FC5B33CEA1196EAF32F7A9A3102EA223780D65D549A818946547F120902B64D97374CA1D5B2F7E8BC677342972327E4F81B65AE39E461A5CE9CF322EEC285FC4
Malicious:false
Reputation:low
Preview:2024/05/07-20:39:14.967 1f74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/05/07-20:39:14.970 1f74 Recovering log #3.2024/05/07-20:39:14.973 1f74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:ASCII text
Category:dropped
Size (bytes):324
Entropy (8bit):5.226351596370954
Encrypted:false
SSDEEP:6:DidVq2Pwkn2nKuAl9OmbzNMxIFUt86GgZmw+6qdSIkwOwkn2nKuAl9OmbzNMFLJ:DuVvYfHAa8jFUt86Gg/+6qQI5JfHAa8E
MD5:1D33E87C95D03816BAC7F8D2DCB4CE6D
SHA1:67FB263A7B769779FD34820D7A11F4A915ADA7B6
SHA-256:D130A31DEC984651EE3441D915932B9D0E0A29B96B362280D5B7D543A64BE1BD
SHA-512:FC5B33CEA1196EAF32F7A9A3102EA223780D65D549A818946547F120902B64D97374CA1D5B2F7E8BC677342972327E4F81B65AE39E461A5CE9CF322EEC285FC4
Malicious:false
Reputation:low
Preview:2024/05/07-20:39:14.967 1f74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/05/07-20:39:14.970 1f74 Recovering log #3.2024/05/07-20:39:14.973 1f74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240507183918Z-156.bmp

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
Category:dropped
Size (bytes):71190
Entropy (8bit):0.5610254057291832
Encrypted:false
SSDEEP:96:xMGMMOpWMM9OMMMrY7MbMMjCHMQ4M/MMMMMZMMNMSEq4MiMlM0Mrio:CYS
MD5:F6DA8214D727BA07427A651182B68F39
SHA1:6DC65AD0D763BE2466945CAD329D1EC16E38338D
SHA-256:C847213F3E15D299628612F2063ED7446BC837BB91361D6B1E515A020CAAB40A
SHA-512:1DAAE41FEE297F728429AB81439CFCC8BB08021BD92A0CCE4095BB34E8A6992F68515223B151CF294FF086CEE66F432B87DA32B5BB56C1B29E6F7B539D996896
Malicious:false
Reputation:low
Preview:BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:dropped
Size (bytes):86016
Entropy (8bit):4.44502111305005
Encrypted:false
SSDEEP:384:yezci5t0iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rjs3OazzU89UTTgUL
MD5:35C71103D3C7955447637D0FE3FD01B8
SHA1:BF8E7E9A99DB06C31B56FAD6471937820453901B
SHA-256:BD13F180201F9038A795DFB067D0AA961B381A82214AB56164EE6B3AAE9CBB69
SHA-512:1DD48DD18A06C164132345B5691BD1DBE1B20B5F5AB841688DF96F5342BB0163F00C527558DED2A5E7B301F0AFD9E62D80CCC357B60FA08F394AE60135E8314E
Malicious:false
Reputation:low
Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:SQLite Rollback Journal
Category:dropped
Size (bytes):8720
Entropy (8bit):3.7758908835833767
Encrypted:false
SSDEEP:48:7MEup/E2ioyVeioy9oWoy1Cwoy1uKOioy1noy1AYoy1Wioy1hioybioygoy1noyX:7SpjueFBXKQ5vb9IVXEBodRBk9
MD5:C042B7A3DE1AD50CC3DA74EF0DD7AEA1
SHA1:45E62202E18C4ECC86F4DBB9D83837BC50555E4B
SHA-256:4759D723A8568C98D1915BA7F78834CB8679363A7A2EFBB8DB87B074167E6A5B
SHA-512:5BD57B789F6B9A40853CEC2B802486E24B696BA7092C8700AF9CBB522FABD4B87FC4C5165D7263589C34DB6F94A02996DA6565AA41E8373545DC0D7FDDF1F230
Malicious:false
Reputation:low
Preview:.... .c......l.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7736

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:PostScript document text
Category:dropped
Size (bytes):185099
Entropy (8bit):5.182478651346149
Encrypted:false
SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
MD5:94185C5850C26B3C6FC24ABC385CDA58
SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
Malicious:false
Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:PostScript document text
Category:dropped
Size (bytes):185099
Entropy (8bit):5.182478651346149
Encrypted:false
SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
MD5:94185C5850C26B3C6FC24ABC385CDA58
SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
Malicious:false
Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:data
Category:dropped
Size (bytes):243196
Entropy (8bit):3.3450692389394283
Encrypted:false
SSDEEP:1536:vKPCPiyzDtrh1cK3XEivK7VK/3AYvYwgqErRo+RQn:yPClJ/3AYvYwghFo+RQn
MD5:F5567C4FF4AB049B696D3BE0DD72A793
SHA1:EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916
SHA-256:D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
SHA-512:E769735991E5B1331E259608854D00CDA4F3E92285FDC500158CBD09CBCCEAD8A387F78256A43919B13EBE70C995D19242377C315B0CCBBD4F813251608C1D56
Malicious:false
Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):295
Entropy (8bit):5.361504142608443
Encrypted:false
SSDEEP:6:YEQXJ2HXPAcif9UaR79VoZcg1vRcR0YRs7oAvJM3g98kUwPeUkwRe9:YvXKXviNR7EZc0vuGMbLUkee9
MD5:EC079353A5B4C3BFF0208CDBC5B52F13
SHA1:D9727CEF91E29DC4DF8319780F41BB9992A8B487
SHA-256:5F14502643AD0DD7D5646BFCCBC2EEF5AA6C3934F3095168A2417AE44876D523
SHA-512:B7E16E99D2B9EC5645175D6E532DE9EDFB724F90392F089293519EF352AC8E737E88CE310DC837869BC14E74626D92B4D7BB60D3631EFE8DFD9B970078DFA808
Malicious:false
Preview:{"analyticsData":{"responseGUID":"8efe02ef-a991-4f66-9c0c-6c1151420dc3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1715281369307,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):294
Entropy (8bit):5.3076315977396105
Encrypted:false
SSDEEP:6:YEQXJ2HXPAcif9UaR79VoZcg1vRcR0YRs7oAvJfBoTfXpnrPeUkwRe9:YvXKXviNR7EZc0vuGWTfXcUkee9
MD5:869D283674A1DE49E203CBAA36F0A613
SHA1:CEEC7DB2F891AE96F9E00FE825EA2B9D5C179D96
SHA-256:612E0B7E5ABE155D852460C16516B17CAF13E8028886FA65D00E70D6EE4F05C6
SHA-512:9D8632F515F686C8385345A1CD5D153B07BB2DD6F883FE1280AC805B8272D5D5500BE3C002C9D2DEEAF66ED0DBD45BEFEAAFBFE4E82531CCC2A0EC3FF0AA7F82
Malicious:false
Preview:{"analyticsData":{"responseGUID":"8efe02ef-a991-4f66-9c0c-6c1151420dc3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1715281369307,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):294
Entropy (8bit):5.28566542663103
Encrypted:false
SSDEEP:6:YEQXJ2HXPAcif9UaR79VoZcg1vRcR0YRs7oAvJfBD2G6UpnrPeUkwRe9:YvXKXviNR7EZc0vuGR22cUkee9
MD5:3CDB8988F72A5D30589C563A1F54941F
SHA1:8F49FD01F842A5DF19E5DD63823EA87CF7B18135
SHA-256:FBF9AA52A3FC677BEEB10E8CE33E8B7F21782115B335F2CA1428588C284932CD
SHA-512:8A1895E45654578E91640092D7F27356D96071A55CD6A87E2BD231DACEF5CC53DAFE591E8A0CF178A91C488CF6748F0819233AD07D3282C00C80734C1B18EE2B
Malicious:false
Preview:{"analyticsData":{"responseGUID":"8efe02ef-a991-4f66-9c0c-6c1151420dc3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1715281369307,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):285
Entropy (8bit):5.3484494121822435
Encrypted:false
SSDEEP:6:YEQXJ2HXPAcif9UaR79VoZcg1vRcR0YRs7oAvJfPmwrPeUkwRe9:YvXKXviNR7EZc0vuGH56Ukee9
MD5:6CD8900EE2CA4CE6A2CF48C6B7802D65
SHA1:5094A514F14B23723EB837DC666811B2971B51AF
SHA-256:898DDF373CD3D78D4F3728C8C49034619BE77F469696141756ECA7886113AA61
SHA-512:A1BCC23400C86670FF6667FBFE1E8332C5DFFF77186BE0A3BEFAA040E6E68DC754EA20B7A2EE8C934AFAE564BE3A9AA2A2182604422D32390EC7A18B4308EFE9
Malicious:false
Preview:{"analyticsData":{"responseGUID":"8efe02ef-a991-4f66-9c0c-6c1151420dc3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1715281369307,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):292
Entropy (8bit):5.308047315173093
Encrypted:false
SSDEEP:6:YEQXJ2HXPAcif9UaR79VoZcg1vRcR0YRs7oAvJfJWCtMdPeUkwRe9:YvXKXviNR7EZc0vuGBS8Ukee9
MD5:8CB19710A28BEAD0D53C1E3AE335DF3F
SHA1:B199EAB9D9DBE2D1879198A4F88537F1C92E39B2
SHA-256:D5826D0B1EB31829AE5910D783F715B996C284963F47A2F53C6FD2B2E7955AE5
SHA-512:C947254D7186F4BFC1701BDA26A443A439A63DCF2BD5FED76D01F7F672133951EAA264D05B8614C6A7D44BD89808830B0164715FA5A83B7767AD3C51D968553F
Malicious:false
Preview:{"analyticsData":{"responseGUID":"8efe02ef-a991-4f66-9c0c-6c1151420dc3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1715281369307,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):289
Entropy (8bit):5.29432001448096
Encrypted:false
SSDEEP:6:YEQXJ2HXPAcif9UaR79VoZcg1vRcR0YRs7oAvJf8dPeUkwRe9:YvXKXviNR7EZc0vuGU8Ukee9
MD5:155FF8EA85CA418259F28C25012F0EB7
SHA1:EDB089E38CB14BFCD3C2DFDB735CAA9EE55C6F79
SHA-256:2206C82B8AF5135BAD13C5084E363F26E5A67B0B172289E2DD56504106AE1D01
SHA-512:7F9666E6DCF8AC12C6498D4EF15B64187FD457E5F004C8AE50BA903BA5E1E3F1D00C9F8F7DAE350F6DD08BB04F046981E4CE7810EFF0524B626D5B14D43E1161
Malicious:false
Preview:{"analyticsData":{"responseGUID":"8efe02ef-a991-4f66-9c0c-6c1151420dc3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1715281369307,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):292
Entropy (8bit):5.297695382010819
Encrypted:false
SSDEEP:6:YEQXJ2HXPAcif9UaR79VoZcg1vRcR0YRs7oAvJfQ1rPeUkwRe9:YvXKXviNR7EZc0vuGY16Ukee9
MD5:39E71EB4D9A5D9CF2DCA6774C2F2AFE2
SHA1:C57FC8803A5491D6EDBBB70D375E22017E3B3F1F
SHA-256:9977D5793CE5BD994E9ECFF6666DB8A7AD56FE91FC15EC1EA90632FECBB7A2F1
SHA-512:A464D41C79DCB69BFDEF04B435937573837484220DC803E57661CFC743D3D9813E21893374BD254A1C2BD4B7AFA4E5E1DD5DA7F647E25ED1A8291BA7648757B2
Malicious:false
Preview:{"analyticsData":{"responseGUID":"8efe02ef-a991-4f66-9c0c-6c1151420dc3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1715281369307,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):289
Entropy (8bit):5.305499200706181
Encrypted:false
SSDEEP:6:YEQXJ2HXPAcif9UaR79VoZcg1vRcR0YRs7oAvJfFldPeUkwRe9:YvXKXviNR7EZc0vuGz8Ukee9
MD5:E299402D3ACDC953BB0116C683DB0802
SHA1:5B562AA63A8B166EA02CB868D0C2B0040BC247F3
SHA-256:7D90E078F35999825E814AE5C96231C1F755133D04E69C7D985714151F5C990C
SHA-512:A0B50C304ADA1079B3070133A47B937A7E962CC1FB7692517F9395753B792243C10C249F314E5BA827F9991AD9924E9669EF1CC331A947A3D750B95288ED461D
Malicious:false
Preview:{"analyticsData":{"responseGUID":"8efe02ef-a991-4f66-9c0c-6c1151420dc3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1715281369307,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):1372
Entropy (8bit):5.738232773650697
Encrypted:false
SSDEEP:24:Yv6XvuR7EzvqKLgENRcbrZbq00iCCBrwJo++ns8ct4mFJNa:YvJBMiEgigrNt0wSJn+ns8cvFJg
MD5:5EF60E13FEB42E3326979BF5A5E3D77A
SHA1:68BC97F4ABB4FED73F6084509976627E6A904BF8
SHA-256:E1DE042294E6D69A42BEC1515CBD2EECBB479A11FAB408019F2766755830E15D
SHA-512:9890BD7771AB21F061E7DCEF694A72328196BAED9C8C09DB4EE081A37C725A4995504A436C8A320ED0CC536C06838F73227D78120DBC10AAB578AB426AE5BE42
Malicious:false
Preview:{"analyticsData":{"responseGUID":"8efe02ef-a991-4f66-9c0c-6c1151420dc3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1715281369307,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"79887_247329ActionBlock_0","campaignId":79887,"containerId":"1","controlGroupId":"","treatmentId":"acc56846-d570-4500-a26e-7f8cf2b4acad","variationId":"247329"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJUcnkgQWNyb2JhdCBQcm8ifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNSIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTMiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIDctZGF5IHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0byBwcmVtaXVtIFBERiBhbmQgZS1zaWduaW5nIHRvb2xzLiIsImJ

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):289
Entropy (8bit):5.3012041502554625
Encrypted:false
SSDEEP:6:YEQXJ2HXPAcif9UaR79VoZcg1vRcR0YRs7oAvJfYdPeUkwRe9:YvXKXviNR7EZc0vuGg8Ukee9
MD5:C693B0046AE7B9DE0804DF7AB68A00E6
SHA1:406F5656B678393C2E7D37E28A5574D41B3B4A97
SHA-256:77C4CD37760A0A16F7A396D3F965778D25C124F1D00634825710187C7C5EA16E
SHA-512:42F7E225B53E45F15564991C59E7673772E841A8C1153EF7237435A8303BEFD71C39710DA8450661964B0515ACA62AD2BA87303372E131BF07A30AF14EE0EEEE
Malicious:false
Preview:{"analyticsData":{"responseGUID":"8efe02ef-a991-4f66-9c0c-6c1151420dc3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1715281369307,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):1395
Entropy (8bit):5.774491794891674
Encrypted:false
SSDEEP:24:Yv6XvuR7EzvZrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNS:YvJBMhHgDv3W2aYQfgB5OUupHrQ9FJ8
MD5:2A1071E03CDBE2F140E21FFB3C636420
SHA1:46E81807A992F0426672D984EC6FC7ED0E26B7D5
SHA-256:9B6E13A97F7C18EBEA35E0BBDE90DE3A864A296270BFC122F9A3FB2C79D46ACB
SHA-512:49D563FEB3BD79AC07C9327B66677108CBB9BA5E079C4621CFE6FE9207A65C8B26FBE9D1D73870BFCF34A53D14DB7335AD2FD4D6009CDE4ABDAA6A8C8A934D5E
Malicious:false
Preview:{"analyticsData":{"responseGUID":"8efe02ef-a991-4f66-9c0c-6c1151420dc3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1715281369307,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):291
Entropy (8bit):5.284742971982554
Encrypted:false
SSDEEP:6:YEQXJ2HXPAcif9UaR79VoZcg1vRcR0YRs7oAvJfbPtdPeUkwRe9:YvXKXviNR7EZc0vuGDV8Ukee9
MD5:D18725676DC2BF9644D52DF5E125E010
SHA1:1531220500CCF80CDE1789F0C8582F3632389BD9
SHA-256:BD3F7B03BDE9B555F2D7A2418B8A36D20B760ADCCE698EAD96E219283E364CEC
SHA-512:FE655A0F51417D236E896BA91463FC4EB265F52CE6487ACCDE371B98B4ED348C910825E35D68A65E260A05E75E0FFE35400BCA4960B0C5C741A8F5D7E4FAED27
Malicious:false
Preview:{"analyticsData":{"responseGUID":"8efe02ef-a991-4f66-9c0c-6c1151420dc3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1715281369307,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):287
Entropy (8bit):5.289096711245437
Encrypted:false
SSDEEP:6:YEQXJ2HXPAcif9UaR79VoZcg1vRcR0YRs7oAvJf21rPeUkwRe9:YvXKXviNR7EZc0vuG+16Ukee9
MD5:17F12001A54CEDBBB2F778BBF7CE2404
SHA1:73322D7893CE027159CBC3A6E196BB6F6A0894EA
SHA-256:265DB85BBAACDB5058D143B207C275C4A89660904E490A78AC3CCC274399A783
SHA-512:38DF3B2D1AA47FC950B9F09BE28E4AA286851D935DE6F0CC8E03F38046425C72F5318294748EFDC84658CB160381664A0276A9E04CED79E415FB6AAA5B0860D9
Malicious:false
Preview:{"analyticsData":{"responseGUID":"8efe02ef-a991-4f66-9c0c-6c1151420dc3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1715281369307,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):289
Entropy (8bit):5.308316756538734
Encrypted:false
SSDEEP:6:YEQXJ2HXPAcif9UaR79VoZcg1vRcR0YRs7oAvJfbpatdPeUkwRe9:YvXKXviNR7EZc0vuGVat8Ukee9
MD5:2B51AB118D80F48367E254D1D3E85E4C
SHA1:93D0651C0DE2AB72966D60F956266B0F2D74CD86
SHA-256:CA1422D732E738FAF9AF9CFA86A3BE7C4AEEE8B4E46CEACB5A386715DAE7F10C
SHA-512:2F4A848F075EA4A1C9E4E30538A8EECB7469BA90BEE4A27F82DA85D5241452676EF324E06DA91A973D5EC1D425480F45A5E391C1C43A3DE1312DDE49AA9DCA68
Malicious:false
Preview:{"analyticsData":{"responseGUID":"8efe02ef-a991-4f66-9c0c-6c1151420dc3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1715281369307,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):286
Entropy (8bit):5.266352779101953
Encrypted:false
SSDEEP:6:YEQXJ2HXPAcif9UaR79VoZcg1vRcR0YRs7oAvJfshHHrPeUkwRe9:YvXKXviNR7EZc0vuGUUUkee9
MD5:33445332FABAEF4EA4211AA1691B1BB0
SHA1:975A3BFE98917EDF4D2F5B927E9C0D8EA17FB56A
SHA-256:4C7BD4C529D0ED12F0A07BFC43A569B2A84585F9EF51E79A2F05E5D0007D4150
SHA-512:6B953FFE154AE737C80B9447ED7FE78D6F828665F3F42CAD03870A4017C44C835D7E544FC4051B0571B49035E79D759844371561518990F0157BB7931D4F4E46
Malicious:false
Preview:{"analyticsData":{"responseGUID":"8efe02ef-a991-4f66-9c0c-6c1151420dc3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1715281369307,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):782
Entropy (8bit):5.361707950513898
Encrypted:false
SSDEEP:12:YvXKXviNR7EZc0vuGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhW3s1:Yv6XvuR7Ezv4168CgEXX5kcIfANhr
MD5:5987366848EE6B726D7B648ADF30CFD5
SHA1:D4F2BFA4C6E559B9769D7621368C26430B7A8C72
SHA-256:48C589170C883D8E0C228D4F6824257931B5C0477324885E07F1E7D05E5F9D6A
SHA-512:24DDDF09F1FC6AD3E77D926591D2BA5EC2A9E0EBD8655F88EBF5461F37264A92E0FB36B252B58C9E4576D3354C3FADE63303A422095120AB07C90E68C997E918
Malicious:false
Preview:{"analyticsData":{"responseGUID":"8efe02ef-a991-4f66-9c0c-6c1151420dc3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1715281369307,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1715107159341}}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:data
Category:dropped
Size (bytes):4
Entropy (8bit):0.8112781244591328
Encrypted:false
SSDEEP:3:e:e
MD5:DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:false
Preview:....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):2814
Entropy (8bit):5.126246119166831
Encrypted:false
SSDEEP:24:YjsslrFWNEA/C9EGNXalLZfdbP9sQaNjJaysQPSvYDscgY43djWj0StlzgCgg2mY:YlcpIKZfxwjdHZKoEk/ljnY9R91
MD5:5374301856523663C1F1A3F9CD5BA4FE
SHA1:608898A39A6727B2439CB32B65691AD66E840B44
SHA-256:597E11C775694C198CC85FD8F3A7EE816980E468421CC94044C3266CC2E91976
SHA-512:13EFF218F20AF4A9B43B43C796466781A22D2BE651AE78C9EE296D2B0D2F20B5D96F6C58F8595AC6FCE156212FB7C0DBA2BA967C22ED8CE00AC86D70FCEBCA86
Malicious:false
Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"761fc84dc0150ef20ddb84624d73bab2","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1715107158000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"188423c46bc9553fb56acf918d33e369","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1372,"ts":1715107158000},{"id":"Edit_InApp_Aug2020","info":{"dg":"8a3a4926420f724cbb21f2e50d7779c0","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1715107158000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"8e7a033fd1997156f28bb7d51623ac66","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1715107158000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"311014e3b4b710d4798eed4b79b13272","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1715107158000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"f67410d47336ad2bb585c3fd1b53ba8d","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1715107158000},

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:dropped
Size (bytes):12288
Entropy (8bit):1.1872246826132047
Encrypted:false
SSDEEP:48:TGufl2GL7msEHUUUUUUUUYSvR9H9vxFGiDIAEkGVvpS:lNVmswUUUUUUUUY+FGSItW
MD5:7F896E4868C84E702B60FE0FC25D8837
SHA1:F16A373B7673D8787C0A222FE8205CD5401B578D
SHA-256:9EA5FCF0EC8C32B5AEDA5B5C8548054F5CF19F43A9B61E294ABEF8CF6DF8912E
SHA-512:320C1BD1CBE8691AE2C0459A36C9108D2044109FA9CC5F4179AC5CD3DB39D988344C78E4D66E34F18827B5B96ED9CC67BA6348EB79C6D05C015BD6C4DE03AAB4
Malicious:false
Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:SQLite Rollback Journal
Category:dropped
Size (bytes):8720
Entropy (8bit):1.6071233000045446
Encrypted:false
SSDEEP:48:7M1KUUUUUUUUUU6vR9H9vxFGiDIAEkGVvsqFl2GL7msz:7DUUUUUUUUUUGFGSItCKVmsz
MD5:A906CA29BCBE363D9F98D77577076B1F
SHA1:A6695E137FC93D6EA6ABAFD50944216124F2C205
SHA-256:E70A492C21107DCDC68AE21C0C639385EE41083A9B747739869FF6613AC90F82
SHA-512:DAB45F26F9312DDFBC74C9CE118D3D60B7F5FF027161A9A8A22AE97E626D009F314DD2CAB28DB5409B805F0B05DF0F8D49BE4BF41ED85C2DC521661DFBC00941
Malicious:false
Preview:.... .c.......yg......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI2e189.LOG

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:dropped
Size (bytes):246
Entropy (8bit):3.524398495091119
Encrypted:false
SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8yQrmNlH:Qw946cPbiOxDlbYnuRKTcmN9
MD5:834539AA21F5F0E1CD1E9FF1231BE030
SHA1:AF0D1EAAF817AE8FB0453D975A70646E5DCC72C9
SHA-256:539774B5A194610FE6DFAA9C32A62D712192967924F9C0CD067C1D19EEBD5AED
SHA-512:866F6D32D32709645BFE4AB1C182702C5CFCB3689F123BB36972606E54488D370B0B570AE35DB84F70DCD6097EBD68F65AA4EA9C01F76205076D69A7F2A85C99
Malicious:false
Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .0.7./.0.5./.2.0.2.4. . .2.0.:.3.9.:.2.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9cxq7wf_1qgb8ju_5yw.tmp

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:PDF document, version 1.6, 0 pages
Category:dropped
Size (bytes):358
Entropy (8bit):5.0419887204381055
Encrypted:false
SSDEEP:6:IngVMrexJzJT0y9VEQIFVmb/eu2g/86S1kxROOfjlcO5jvcO5jRCCSyAAO:IngVMre9T0HQIDmy9g06JXZcavcaglX
MD5:0A748F005AEDD810F823D53103C2D4FF
SHA1:48BE080CC27AE1953BD9F22969ED4D1D90FB6D47
SHA-256:1FE0780366966CBDB5D2915325FB39EC902EBAE9F1864784F589C1B8115F7ED3
SHA-512:E2B244349AD0A9F23989486FACB978948C2BA9F1997EC8000CE31085E6DD2E4AF28046F86AA50FE3EA5BB4D83AEBD8079C2444C6BB9766E011352C249B2A4B38
Malicious:false
Preview:%PDF-1.6.%......1 0 obj.<</Pages 2 0 R/Type/Catalog>>.endobj.2 0 obj.<</Count 0/Kids[]/Type/Pages>>.endobj.3 0 obj.<<>>.endobj.xref..0 4..0000000000 65535 f..0000000016 00000 n..0000000061 00000 n..0000000107 00000 n..trailer..<</Size 4/Root 1 0 R/Info 3 0 R/ID[<B3FF745024F46246A2B0ABDF71EC9752><B3FF745024F46246A2B0ABDF71EC9752>]>>..startxref..127..%%EOF..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-05-07 20-39-16-409.log

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:ASCII text, with very long lines (393)
Category:dropped
Size (bytes):16525
Entropy (8bit):5.345946398610936
Encrypted:false
SSDEEP:384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:false
Preview:SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:ASCII text, with very long lines (393), with CRLF line terminators
Category:dropped
Size (bytes):16603
Entropy (8bit):5.39498909184927
Encrypted:false
SSDEEP:384:ZQ+5mk7UTuwrgAMjo/jFcVh2nTyJiS6JGwK8Eqfru6vVa+HP0daVdWnKIKdrEcM9:v6CL
MD5:11AFD094CF5E53CE53AC50751C75F688
SHA1:8EBE058D1FA651C0D2ACAAD6A05108ADD3566F9E
SHA-256:B481824ACFE295D28377A9815AC6012C3EA1FB3ACBEBD4AB1F1488F3D5D84495
SHA-512:624AADC05199869641C870A0EA9B29096F945824855BB1D100BC232AC50FC02BA081F4F38E8EBC4AAA16B634B0B51D7C60E63874796AE6E67B34F344108786E2
Malicious:false
Preview:SessionID=1325d3bb-ae2c-43bf-8cf8-809dd89cc2aa.1715107156439 Timestamp=2024-05-07T20:39:16:439+0200 ThreadID=7948 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=1325d3bb-ae2c-43bf-8cf8-809dd89cc2aa.1715107156439 Timestamp=2024-05-07T20:39:16:440+0200 ThreadID=7948 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=1325d3bb-ae2c-43bf-8cf8-809dd89cc2aa.1715107156439 Timestamp=2024-05-07T20:39:16:440+0200 ThreadID=7948 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=1325d3bb-ae2c-43bf-8cf8-809dd89cc2aa.1715107156439 Timestamp=2024-05-07T20:39:16:440+0200 ThreadID=7948 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=1325d3bb-ae2c-43bf-8cf8-809dd89cc2aa.1715107156439 Timestamp=2024-05-07T20:39:16:440+0200 ThreadID=7948 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:ASCII text, with CRLF line terminators
Category:dropped
Size (bytes):29845
Entropy (8bit):5.400448919193546
Encrypted:false
SSDEEP:768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rW:C
MD5:CAB8B4692F1FB1C2C897E480D2B17305
SHA1:A05633D803826B707EE0F93AC16AA49D58B9D7CB
SHA-256:1FC1D05094EDABE51AA5D05B8BD38035EC3DA0684026E7C308AF5AB0E3B15411
SHA-512:EDE5E00AB8F92B8335C96E2CB86827339514FB6FAD4760C8E2B64431DAE11713B48432A07D3ECE8B0E283253D0AE5F8F61C87542696C39D8E892D5023DD64627
Malicious:false
Preview:03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\19e9d5bc-31ee-4f12-afc6-efcca64fa8ee.tmp

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:dropped
Size (bytes):386528
Entropy (8bit):7.9736851559892425
Encrypted:false
SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:5C48B0AD2FEF800949466AE872E1F1E2
SHA1:337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:false
Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\4e57957b-5ec0-4b21-a7f4-b9e3e1d1b6f4.tmp

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:dropped
Size (bytes):758601
Entropy (8bit):7.98639316555857
Encrypted:false
SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:3A49135134665364308390AC398006F1
SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:false
Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\d21dba92-6f5f-4f19-af3c-a7ad346602f8.tmp

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:dropped
Size (bytes):1419751
Entropy (8bit):7.976496077007677
Encrypted:false
SSDEEP:24576:/M7ouWLaGZjZwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:RuWLaGZjZwZGk3mlind9i4ufFXpAXkru
MD5:AE1E8A5D3E7B2198980A0CA16DE5F3D3
SHA1:A1DB2C58AFC81E6A114A8EB47BE0243956F79460
SHA-256:8C2E1B13F6658714D51737D6745FE065B87497923945AB3028706A4171C8328F
SHA-512:5B36CF0982C5AFED5CCEA4B30A0B31A2B5312FBF5438623D53153E076B59F1B4BEF8C08695EA74E086BCA4EF7221889DB977B5DCFF4C684BA0683FDDECDE2EC4
Malicious:false
Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e431def9-0efa-4ad4-85f3-b145b406e1b7.tmp

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:dropped
Size (bytes):1407294
Entropy (8bit):7.97605879016224
Encrypted:false
SSDEEP:24576:/xbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R0777owWLaGZDwYIGNPJe:Jb3mlind9i4ufFXpAXkrfUs0UwWLaGZo
MD5:A292787F33B6A2690672445EB9A4F937
SHA1:ADBD2B485FF15FAC9CF0C5EAEEAFF7B4EC8AF26C
SHA-256:46FA158305389D5A7682C007E9FEBB08C4D2B57F4F590FF894AC3747EAB6C5AF
SHA-512:F94EE27708CF0B9354CCF4C3A13594266AD9074053736BDD5C679383F7E87901A3B735F33A7FE5F879B065FF2EFB9F8FE3AF71061BA4528982916CC531215093
Malicious:false
Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

Static File Info

General

File type:PDF document, version 1.6, 1 pages
Entropy (8bit):6.787418349662711
TrID:
  • Adobe Portable Document Format (5005/1) 100.00%
File name:Toyota Mot_0043394_CC367099.pdf
File size:2'417 bytes
MD5:4859953a387b32836780fc839fb02e20
SHA1:0147602ab9808dc2bf4a8b5d83aded6714af6145
SHA256:636922d548c79ab03614dab37b7896108b31bfa9a3615be1a841d99d3e089948
SHA512:5fe6df4a541bd5ff0fb6f5300ec61eb6a8d507466735f27c58e3ee3e5b1f26d226423d3ab064beba2a95f110f5a37f3b8b35e47742b0238acd214b0d36d5bb8c
SSDEEP:48:c5azOjPM61H/97em7341Z4PX9fDm1fOMkWxGvENF+TwfR7vTA+vX2Pe:c5abO7ILCXBmNkW0vENF+TwfRrTrX2W
TLSH:43418312B84F4CFCD5B95B921F24FCD66C2EB10376C8F5C0286CC25BE148F59694B912
File Content Preview:%PDF-1.6..8 0 obj..<</Type/XObject/Subtype/Form/FormType 1/BBox[0 0 612.0 792.0] /Length 92 /Filter /FlateDecode >>..stream..x.3P0.. w^..0.(...).....3T053...P074.3.T.....w3..R04P.I...0...BVm.gb..ZC!?M.U..!...!.@k.C..A..endstream..endobj..6 0 obj..<< /Leng

File Icon

Icon Hash:62cc8caeb29e8ae0

Static PDF Info

General

Header:%PDF-1.6
Total Entropy:6.787418
Total Bytes:2417
Stream Entropy:7.785368
Stream Bytes:997
Entropy outside Streams:5.027364
Bytes outside Streams:1420
Number of EOF found:1
Bytes after EOF:

Keywords Statistics

NameCount
obj11
endobj11
stream2
endstream2
xref1
trailer1
startxref1
/Page1
/Encrypt0
/ObjStm0
/URI0
/JS0
/JavaScript0
/AA0
/OpenAction0
/AcroForm0
/JBIG2Decode0
/RichMedia0
/Launch0
/EmbeddedFile0

Network Behavior

Network Port Distribution

TCP Packets

TimestampSource PortDest PortSource IPDest IP
May 7, 2024 20:39:27.393141985 CEST49740443192.168.2.4104.77.8.172
May 7, 2024 20:39:27.393182039 CEST44349740104.77.8.172192.168.2.4
May 7, 2024 20:39:27.393275023 CEST49740443192.168.2.4104.77.8.172
May 7, 2024 20:39:27.393477917 CEST49740443192.168.2.4104.77.8.172
May 7, 2024 20:39:27.393491030 CEST44349740104.77.8.172192.168.2.4
May 7, 2024 20:39:27.648861885 CEST44349740104.77.8.172192.168.2.4
May 7, 2024 20:39:27.649198055 CEST49740443192.168.2.4104.77.8.172
May 7, 2024 20:39:27.649219990 CEST44349740104.77.8.172192.168.2.4
May 7, 2024 20:39:27.650083065 CEST44349740104.77.8.172192.168.2.4
May 7, 2024 20:39:27.650134087 CEST49740443192.168.2.4104.77.8.172
May 7, 2024 20:39:27.652040005 CEST49740443192.168.2.4104.77.8.172
May 7, 2024 20:39:27.652082920 CEST44349740104.77.8.172192.168.2.4
May 7, 2024 20:39:27.652326107 CEST49740443192.168.2.4104.77.8.172
May 7, 2024 20:39:27.652331114 CEST44349740104.77.8.172192.168.2.4
May 7, 2024 20:39:27.703350067 CEST49740443192.168.2.4104.77.8.172
May 7, 2024 20:39:27.737215996 CEST44349740104.77.8.172192.168.2.4
May 7, 2024 20:39:27.737376928 CEST44349740104.77.8.172192.168.2.4
May 7, 2024 20:39:27.737529993 CEST49740443192.168.2.4104.77.8.172
May 7, 2024 20:39:27.737957954 CEST49740443192.168.2.4104.77.8.172
May 7, 2024 20:39:27.737967968 CEST44349740104.77.8.172192.168.2.4

HTTP Request Dependency Graph

  • armmf.adobe.com

HTTPS Proxied Packets

Session IDSource IPSource PortDestination IPDestination PortPIDProcess
0192.168.2.449740104.77.8.1724437996C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
TimestampBytes transferredDirectionData
2024-05-07 18:39:27 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
Host: armmf.adobe.com
Connection: keep-alive
Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: empty
Accept-Encoding: gzip, deflate, br
If-None-Match: "78-5faa31cce96da"
If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
2024-05-07 18:39:27 UTC198INHTTP/1.1 304 Not Modified
Content-Type: text/plain; charset=UTF-8
Last-Modified: Mon, 01 May 2023 15:02:33 GMT
ETag: "78-5faa31cce96da"
Date: Tue, 07 May 2024 18:39:27 GMT
Connection: close


Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

General

Target ID:0
Start time:20:39:13
Start date:07/05/2024
Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):false
Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Toyota Mot_0043394_CC367099.pdf"
Imagebase:0x7ff6bc1b0000
File size:5'641'176 bytes
MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:moderate
Has exited:true

General

Target ID:1
Start time:20:39:13
Start date:07/05/2024
Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):false
Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:0x7ff74bb60000
File size:3'581'912 bytes
MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:moderate
Has exited:true

General

Target ID:3
Start time:20:39:14
Start date:07/05/2024
Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):false
Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1656,i,9355703423911665835,3495983511669041495,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:0x7ff74bb60000
File size:3'581'912 bytes
MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:moderate
Has exited:true

Disassembly

⊘No disassembly