Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Specification Sample.........pdf

Overview

General Information

Sample name:Specification Sample.........pdf
Analysis ID:1544425
MD5:aeba7f17c41f5649d00cc2d728e8d41b
SHA1:f481d17c0ea06eb8740f4034e77ac21c9e66f08d
SHA256:c0c081d9deec15050d9b50fa0f648729e87d6b393694db94ad40b20f89997429
Infos:

Detection

Score:0
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

No high impact signatures.

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 7320 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Specification Sample.........pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 7508 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 7716 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1596,i,12715773412985011628,1919190508316726040,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.drString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.drString found in binary or memory: http://x1.i.lencr.org/
Source: classification engineClassification label: clean0.winPDF@14/50@0/0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journalJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-29 07-09-23-911.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Specification Sample.........pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1596,i,12715773412985011628,1919190508316726040,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1596,i,12715773412985011628,1919190508316726040,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: Specification Sample.........pdfInitial sample: PDF keyword /JS count = 0
Source: Specification Sample.........pdfInitial sample: PDF keyword /JavaScript count = 0
Source: Specification Sample.........pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1544425 Sample: Specification Sample.........pdf Startdate: 29/10/2024 Architecture: WINDOWS Score: 0 6 Acrobat.exe 18 75 2->6         started        process3 8 AcroCEF.exe 106 6->8         started        process4 10 AcroCEF.exe 2 8->10         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Specification Sample.........pdf0%ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://x1.i.lencr.org/0%URL Reputationsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http://x1.i.lencr.org/2D85F72862B55C4EADD9E66E06947F3D0.1.drfalse
  • URL Reputation: safe
unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1544425
Start date and time:2024-10-29 12:08:19 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 14s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultwindowspdfcookbook.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:10
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:Specification Sample.........pdf
Detection:CLEAN
Classification:clean0.winPDF@14/50@0/0
EGA Information:Failed
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 0
  • Number of non-executed functions: 0
Cookbook Comments:
  • Found application associated with file extension: .pdf
  • Found PDF document
  • Close Viewer

Warnings

  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.19.126.143, 2.19.126.149, 54.144.73.197, 34.193.227.236, 107.22.247.231, 18.207.85.246, 172.64.41.3, 162.159.61.3, 192.168.2.4, 93.184.221.240, 2.23.197.184, 88.221.168.141, 23.47.194.80
  • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, e4578.dscb.akamaiedge.net, acroipm2.adobe.com, wu.azureedge.net, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, ssl.adobe.com.edgekey.net, armmf.adobe.com, geo2.adobe.com
  • Not all processes where analyzed, report is missing behavior information
  • VT rate limit hit for: Specification Sample.........pdf

Simulations

Behavior and APIs

TimeTypeDescription
07:09:34API Interceptor2x Sleep call for process: AcroCEF.exe modified

LLM Input / Output

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:ASCII text
Category:dropped
Size (bytes):292
Entropy (8bit):5.181978853752956
Encrypted:false
SSDEEP:6:c0cfEOV+q2Pwkn2nKuAl9OmbnIFUt8H0cfGuPZmw+H0cf4kiVkwOwkn2nKuAl9Oe:plQ+vYfHAahFUt8UuP/+UyiV5JfHAaSJ
MD5:7A69F6B54B9A07CF16B8F91FFBB4D181
SHA1:9F0CE850C4C602F9CF496AAA6557DD1FE23AF841
SHA-256:B68607D7B8C86FDE1E747C9A1E6E19E7DA5039A6DE2525F3B2AD8353E205EB39
SHA-512:232208D2805BD76CEEDC6082099131B641B86AC237227D1C0A53E9596125B6EFF64305E2F323EB7428696B6E3426CE8A0ABE46BF993C58787720C0C6B540FC74
Malicious:false
Reputation:low
Preview:2024/10/29-07:09:21.741 1d7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/29-07:09:21.743 1d7c Recovering log #3.2024/10/29-07:09:21.744 1d7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:ASCII text
Category:dropped
Size (bytes):292
Entropy (8bit):5.181978853752956
Encrypted:false
SSDEEP:6:c0cfEOV+q2Pwkn2nKuAl9OmbnIFUt8H0cfGuPZmw+H0cf4kiVkwOwkn2nKuAl9Oe:plQ+vYfHAahFUt8UuP/+UyiV5JfHAaSJ
MD5:7A69F6B54B9A07CF16B8F91FFBB4D181
SHA1:9F0CE850C4C602F9CF496AAA6557DD1FE23AF841
SHA-256:B68607D7B8C86FDE1E747C9A1E6E19E7DA5039A6DE2525F3B2AD8353E205EB39
SHA-512:232208D2805BD76CEEDC6082099131B641B86AC237227D1C0A53E9596125B6EFF64305E2F323EB7428696B6E3426CE8A0ABE46BF993C58787720C0C6B540FC74
Malicious:false
Reputation:low
Preview:2024/10/29-07:09:21.741 1d7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/29-07:09:21.743 1d7c Recovering log #3.2024/10/29-07:09:21.744 1d7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:ASCII text
Category:dropped
Size (bytes):336
Entropy (8bit):5.2001652243572885
Encrypted:false
SSDEEP:6:c0cf+bIq2Pwkn2nKuAl9Ombzo2jMGIFUt8H0cf+4Zmw+H0cf+/JkwOwkn2nKuAlx:pLIvYfHAa8uFUt8Uo/+Ux5JfHAa8RJ
MD5:82577FBD712531BD861AF06617CB312B
SHA1:D15A81C32095042D40CE3A9E02514EEC1747378C
SHA-256:4543AD58B82695C0D2C145953FFCC0AE8CE0E91D7F557C54316B18172BA26AC1
SHA-512:C9AA7530750956C3237E60FBE81C5C3F1503949E399195CA0E4CD7D16099CC4DB7E2917B5183A6ADE4E384B5F595467C00DE4C10959B9492F51405D1A64C8E54
Malicious:false
Reputation:low
Preview:2024/10/29-07:09:21.833 1e84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/29-07:09:21.834 1e84 Recovering log #3.2024/10/29-07:09:21.835 1e84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:ASCII text
Category:dropped
Size (bytes):336
Entropy (8bit):5.2001652243572885
Encrypted:false
SSDEEP:6:c0cf+bIq2Pwkn2nKuAl9Ombzo2jMGIFUt8H0cf+4Zmw+H0cf+/JkwOwkn2nKuAlx:pLIvYfHAa8uFUt8Uo/+Ux5JfHAa8RJ
MD5:82577FBD712531BD861AF06617CB312B
SHA1:D15A81C32095042D40CE3A9E02514EEC1747378C
SHA-256:4543AD58B82695C0D2C145953FFCC0AE8CE0E91D7F557C54316B18172BA26AC1
SHA-512:C9AA7530750956C3237E60FBE81C5C3F1503949E399195CA0E4CD7D16099CC4DB7E2917B5183A6ADE4E384B5F595467C00DE4C10959B9492F51405D1A64C8E54
Malicious:false
Reputation:low
Preview:2024/10/29-07:09:21.833 1e84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/29-07:09:21.834 1e84 Recovering log #3.2024/10/29-07:09:21.835 1e84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9525c6db-19cd-450e-99f1-c1cd200b8d0d.tmp

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:JSON data
Category:modified
Size (bytes):475
Entropy (8bit):4.970895562327589
Encrypted:false
SSDEEP:12:YH/um3RA8sqPxsBdOg2Hpwcaq3QYiubInP7E4T3y:Y2sRdsLdMHp73QYhbG7nby
MD5:FBD32379A5B7D1EA6DF6E136013608C7
SHA1:CBB2AAABAD7C0E1C0794B6B00DD1F65A7D525371
SHA-256:330058D8656F80F762E675ACC13B64383F17703C38F1CEAA5BA0BAADB6FBD171
SHA-512:E9329E0415152B9BCB9025754A4091BE1B44A307F035F0AD1BFADE7EE13D957EABA730871CDA1440E60D714F8AB2699BFF72F294BA9050DCB7C84C273A55FFE8
Malicious:false
Reputation:low
Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13374760167769428","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":234076},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:JSON data
Category:dropped
Size (bytes):475
Entropy (8bit):4.970895562327589
Encrypted:false
SSDEEP:12:YH/um3RA8sqPxsBdOg2Hpwcaq3QYiubInP7E4T3y:Y2sRdsLdMHp73QYhbG7nby
MD5:FBD32379A5B7D1EA6DF6E136013608C7
SHA1:CBB2AAABAD7C0E1C0794B6B00DD1F65A7D525371
SHA-256:330058D8656F80F762E675ACC13B64383F17703C38F1CEAA5BA0BAADB6FBD171
SHA-512:E9329E0415152B9BCB9025754A4091BE1B44A307F035F0AD1BFADE7EE13D957EABA730871CDA1440E60D714F8AB2699BFF72F294BA9050DCB7C84C273A55FFE8
Malicious:false
Reputation:low
Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13374760167769428","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":234076},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:data
Category:dropped
Size (bytes):4730
Entropy (8bit):5.252763607082367
Encrypted:false
SSDEEP:96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7diLRFZ:etJCV4FiN/jTN/2r8Mta02fEhgO73gow
MD5:A2169AF7130CE8A49B7C22D878932FB8
SHA1:B8D7CA02B9AB955C69D877437FC98ED67098E43A
SHA-256:CE29D2E8DD2C372192C3124FE3A106F77DDF83017F379B658A25DEE5AFB2FD5D
SHA-512:15202DBF6A89C98749950AF7AAE245A48DB8A56697A0B5C7344A59C3513E41F0FE3002517B65C20DBCA21145255353C51528AE56A7CD66D26900874757A65E21
Malicious:false
Reputation:low
Preview:*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:ASCII text
Category:dropped
Size (bytes):324
Entropy (8bit):5.142809910283548
Encrypted:false
SSDEEP:6:c0cfHhWyaq2Pwkn2nKuAl9OmbzNMxIFUt8H0cfHhJ9Zmw+H0cfHhJPkwOwkn2nKA:pQOvYfHAa8jFUt8UQ//+UQt5JfHAa84J
MD5:AF57335213699B607755C93952ABE9C1
SHA1:538E5331957556EDEACDE81A8DA46083FD02D849
SHA-256:02F431F5DBEFCA1CFFB0FF9FF2C58BC9806A7D9A4ED73000BC0216D9A4D08082
SHA-512:3A7CDF30309ABD08C2CC22CB1BD9FA543065BF89F810D12F641FD4E5D7BA232C11B58E0F784924D8920AB7C29EDB978D7BEB0F10DB36A62819F09F868C9A1B76
Malicious:false
Reputation:low
Preview:2024/10/29-07:09:22.039 1e84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/29-07:09:22.040 1e84 Recovering log #3.2024/10/29-07:09:22.040 1e84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:ASCII text
Category:dropped
Size (bytes):324
Entropy (8bit):5.142809910283548
Encrypted:false
SSDEEP:6:c0cfHhWyaq2Pwkn2nKuAl9OmbzNMxIFUt8H0cfHhJ9Zmw+H0cfHhJPkwOwkn2nKA:pQOvYfHAa8jFUt8UQ//+UQt5JfHAa84J
MD5:AF57335213699B607755C93952ABE9C1
SHA1:538E5331957556EDEACDE81A8DA46083FD02D849
SHA-256:02F431F5DBEFCA1CFFB0FF9FF2C58BC9806A7D9A4ED73000BC0216D9A4D08082
SHA-512:3A7CDF30309ABD08C2CC22CB1BD9FA543065BF89F810D12F641FD4E5D7BA232C11B58E0F784924D8920AB7C29EDB978D7BEB0F10DB36A62819F09F868C9A1B76
Malicious:false
Preview:2024/10/29-07:09:22.039 1e84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/29-07:09:22.040 1e84 Recovering log #3.2024/10/29-07:09:22.040 1e84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241029110925Z-160.bmp

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
Category:dropped
Size (bytes):71190
Entropy (8bit):1.2422095750571964
Encrypted:false
SSDEEP:96:MJ4HMWY6b9B/R/Q9Nhfqu6LxxAYmrlBKD7QDGiNRt2IdtpSd/AMM74L1MMOMCpHF:9ZpY9N9qTmrrKDsDGid2vW4FSX0Vja
MD5:9837849FB2060D183D66EF85E3B3D671
SHA1:C2F6FD7BE80BE2B054F95F143CCF41D48270F2D6
SHA-256:5499B33BEEFE768026421315BD4BBEA094B9E1D52C1EC29C1FA290B53DC99454
SHA-512:F253D9FCF780D5F7D644DD299D15635EA45FD418587E3BD1317A2C3C5A6334867CE926186B4EDB1888919AF7ECAAF25BFAEEEDD64ECAA13F11C88357F1307E29
Malicious:false
Preview:BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:dropped
Size (bytes):86016
Entropy (8bit):4.445000786873078
Encrypted:false
SSDEEP:384:Se9ci5tAiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:hXs3OazzU89UTTgUL
MD5:4EA5CB1C33562FC7DF6EB55DE2E5BB22
SHA1:AA8722D2ACAC080E1DB13EFFD610A29D3BA17CB6
SHA-256:65DAE4133956455E75EBF5AD3D159E5D3ABC62766404FB56223D5A5478EC0C21
SHA-512:C66E6799F82F5AB04DF10B15E797D7A77309D5857AD2D364C557D35BBD3535CFB7999E7732DFA351B8176E179D97C95AE29223B6455BED7E0216C4ABC8441AEA
Malicious:false
Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:SQLite Rollback Journal
Category:dropped
Size (bytes):8720
Entropy (8bit):2.2147259398789383
Encrypted:false
SSDEEP:48:7MfVHnClqvmFTIF3XmHjBoGGR+jMz+LhA:7w1nY79IVXEBodRBkC
MD5:8DC4DA98EB78BC9F2C2B941D18730A77
SHA1:277B3BD95E71FF6CDF205A085E2EF5180AF99CDE
SHA-256:8FB349B45D3447AF677193854AC7C64C1F5575C613885B518EF4981256C40862
SHA-512:667296F8DD7755E5AEBAFA818928AD9C23C6ED6A93DB562A9B0E6F97C9ACF8128E67D79B9B29243F5F08767CD525BF2D78B31B96E12A58EFFB80794D9E64809B
Malicious:false
Preview:.... .c......1.`........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:Certificate, Version=3
Category:dropped
Size (bytes):1391
Entropy (8bit):7.705940075877404
Encrypted:false
SSDEEP:24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:false
Preview:0..k0..S............@.YDc.c...0...*.H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0...*.H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I.....*.A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.|C.t..t.....0.[q6....00\H..;..}`...).........A.......|.;F.H*..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:dropped
Size (bytes):71954
Entropy (8bit):7.996617769952133
Encrypted:true
SSDEEP:1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:false
Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:data
Category:dropped
Size (bytes):192
Entropy (8bit):2.7386214950254373
Encrypted:false
SSDEEP:3:kkFkl57K/kNttfllXlE/HT8kE/ltNNX8RolJuRdxLlGB9lQRYwpDdt:kKBEteT89VNMa8RdWBwRd
MD5:CEBF630D81AE85A6687873BA6B74F48A
SHA1:7C4F1F10CCEBCE1B40EEAF4DE0925C3EB7D29E0C
SHA-256:A9FD5C43484CF501B440DEC4846D8D68E924E28E8864173B07DFC24138A231AD
SHA-512:91E90C423CE4C6F2888027D69799540C407B9A9BC0AB34241E7DE69E07902BAD0A1B94C0E06248F51F848B4E82732C1FAA2889008A1E87F121762F321BB35D9C
Malicious:false
Preview:p...... ........J.k..)..(....................................................... ..........W....op..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:data
Category:modified
Size (bytes):328
Entropy (8bit):3.150184159866504
Encrypted:false
SSDEEP:6:kKZlPL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:ziDnLNkPlE99SNxAhUe/3
MD5:6120B9A1333277F623AF0F88B93C1444
SHA1:6FBBEB531FC6B13295A9F8E626BA92FFB302BC15
SHA-256:15B0FE99D1710D8BA54EBB61D7137BAF225779356E0B69C9A86ACEEC94A4E7DE
SHA-512:CE97149F4E18803A17B4EE1740104CEBFE412651F64A2127F8A6116926FDEAE57CFD11DDB96161B9952C77F54C2942A0D3DC8821F2F245CD9530C7DCA16755A7
Malicious:false
Preview:p...... ........%D...)..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:data
Category:dropped
Size (bytes):243196
Entropy (8bit):3.3450692389394283
Encrypted:false
SSDEEP:1536:vKPCPiyzDtrh1cK3XEivK7VK/3AYvYwgqErRo+RQn:yPClJ/3AYvYwghFo+RQn
MD5:F5567C4FF4AB049B696D3BE0DD72A793
SHA1:EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916
SHA-256:D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
SHA-512:E769735991E5B1331E259608854D00CDA4F3E92285FDC500158CBD09CBCCEAD8A387F78256A43919B13EBE70C995D19242377C315B0CCBBD4F813251608C1D56
Malicious:false
Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):295
Entropy (8bit):5.356587010574356
Encrypted:false
SSDEEP:6:YEQXJ2HXBDVVvOi+HoQqIH9VoZcg1vRcR0YMSUoAvJM3g98kUwPeUkwRe9:YvXKXBDVxF+HoqkZc0v1SnGMbLUkee9
MD5:D044C6A2BD484EBB53FDEF2B6010624A
SHA1:D6DF9D40243443428DBA5DC479F83FC85D90C081
SHA-256:398AB1377E98B689D11AA28B998A579F0752D54ECB2D6CF93067656A9A3EF114
SHA-512:A4E3F0FFCFCC8ED2FC51835E16117F146D4E3309F20CD93BEEEA86B6F422ACC31842F0852CBB20BBFDD5E6E340C315707B2914102021DD9221F0A69147543DEC
Malicious:false
Preview:{"analyticsData":{"responseGUID":"663c400e-84a7-4add-b3cc-78b08bebf0a9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730378173274,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):294
Entropy (8bit):5.305478480655702
Encrypted:false
SSDEEP:6:YEQXJ2HXBDVVvOi+HoQqIH9VoZcg1vRcR0YMSUoAvJfBoTfXpnrPeUkwRe9:YvXKXBDVxF+HoqkZc0v1SnGWTfXcUke6
MD5:9D7D76BA9CE52FB4F8344D6135D13E88
SHA1:3137B61583C0AA61DA5659B4C1C1EC04B75DEA6E
SHA-256:BCDAEF8D520CFC5E36380FA53EE9E81891622243FB59F1CEC7EF0714033FECF6
SHA-512:938407BA4DB73582B13F5D9A332F5CC6C0F90137585FEDD2B53905FEC5869B1486EC1D711650AE836A8BD0A5A1420B0C117A99DF0AC5424BB8D7CD68E5F43084
Malicious:false
Preview:{"analyticsData":{"responseGUID":"663c400e-84a7-4add-b3cc-78b08bebf0a9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730378173274,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):294
Entropy (8bit):5.283617395400969
Encrypted:false
SSDEEP:6:YEQXJ2HXBDVVvOi+HoQqIH9VoZcg1vRcR0YMSUoAvJfBD2G6UpnrPeUkwRe9:YvXKXBDVxF+HoqkZc0v1SnGR22cUkee9
MD5:1F9237F2DDC74CD218D026F2494782B7
SHA1:7C15A3E7823040AA398BB6A1C917184722E3AE9F
SHA-256:E0DB836DAD35974A1C6F2774B805747C6B3401F1CAB0E2726B41D2C49A73C8F9
SHA-512:207AF001DFAE528649FF50BCBF00B658C163593E36F6572FE6B771B82820F8DB39502C52C9C0BFD7E70535450F03C937095561F9D9D4BDF2D5244D0E4691746A
Malicious:false
Preview:{"analyticsData":{"responseGUID":"663c400e-84a7-4add-b3cc-78b08bebf0a9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730378173274,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):285
Entropy (8bit):5.343359749199591
Encrypted:false
SSDEEP:6:YEQXJ2HXBDVVvOi+HoQqIH9VoZcg1vRcR0YMSUoAvJfPmwrPeUkwRe9:YvXKXBDVxF+HoqkZc0v1SnGH56Ukee9
MD5:CA1EE81654403842E8FFA7A8AA397559
SHA1:F99D0D3788C64DD56688F2EC792B41F33DE92092
SHA-256:1AB89FED7EF62E33CBA9F1B9A0A2200690BB904FA709FCA6E7221A4A9885E035
SHA-512:1101508E3CB9EACBA873BB81CAC0C097230B109F03725E2764FF57D0CB7B4CC4938B8CD58639BCCE382EA4ED736F33CA3191D85B49687C0F44E6A63C52D82197
Malicious:false
Preview:{"analyticsData":{"responseGUID":"663c400e-84a7-4add-b3cc-78b08bebf0a9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730378173274,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):1055
Entropy (8bit):5.660699481952072
Encrypted:false
SSDEEP:24:Yv6XBlqkzv1SspLgEscLf7nnl0RCmK8czOCCSVG:YvElqsdSshgGzaAh8cv/VG
MD5:F1BDAB1AA080E8C3D53F3A3DB6E08F76
SHA1:259897ADBF49FE21BA937F8D98528F373CE7D13B
SHA-256:2656EEC0278A54D52EF721575956FD4DCD559DAADB972823F359C43C513AEA51
SHA-512:0DF32D0D4AAAD136807FC2E93934F3B739A1E22BB8825EA92603A0210ED2A7BDDD0C843E03DD537AB2E694D6FA3378282CE96FF839275F6F1277838E5144BD35
Malicious:false
Preview:{"analyticsData":{"responseGUID":"663c400e-84a7-4add-b3cc-78b08bebf0a9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730378173274,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"92038_285529ActionBlock_1","campaignId":92038,"containerId":"1","controlGroupId":"","treatmentId":"eb1a4bce-8215-46f1-b44c-154b21a85d60","variationId":"285529"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNhdElkIjpudWxsfQ==","dataType":"application\/json","encodingScheme":tr

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):1050
Entropy (8bit):5.651705359537221
Encrypted:false
SSDEEP:24:Yv6XBlqkzv1SGVLgEF0c7sbnl0RCmK8czOCYHflEpwiVoG:YvElqsdSGFg6sGAh8cvYHWpwVG
MD5:67BD011C495549B24EB2F11354FF0C34
SHA1:9EEE64A16A750E75994ED9F6102E635E9FE6237C
SHA-256:829F7DD2BC132F06DD20BC947DEA2CCE30AEC22463A3722D36AFFB25BFB6B2D0
SHA-512:7C4CC6F26FF47CAAE72A2193E58D4D4A75E31005338B181E2430887ED3DF8D111EF9FCA480997E5278A243CC7C2F1E99CCCD1767056FB6A26680BA66D436DFDE
Malicious:false
Preview:{"analyticsData":{"responseGUID":"663c400e-84a7-4add-b3cc-78b08bebf0a9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730378173274,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_0","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"0924134e-3c59-4f53-b731-add558c56fec","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuZm9ybXMgJiBhZ3JlZW1lbnRzLiJ9LCJ0Y2F0SWQiOm51bGx9","dataType":"application\/json","encodingScheme":true},"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):292
Entropy (8bit):5.292456980041953
Encrypted:false
SSDEEP:6:YEQXJ2HXBDVVvOi+HoQqIH9VoZcg1vRcR0YMSUoAvJfQ1rPeUkwRe9:YvXKXBDVxF+HoqkZc0v1SnGY16Ukee9
MD5:02D6DBCDAAE16944C5AF3D8B4F411E58
SHA1:71D0E8FC9DF4D5E5176A4DF025223D0FA54DAACD
SHA-256:A2AD21A0CD235132607092B7D6B071906D77025C398283825EA246904B673702
SHA-512:499E03EFBDB3CFF575234CBB966873EA526C5A5AC38D2BC1844BF15AC4BFBBBBA47E17B30FBD14CE650345F875D4B43251E66AA89774E89BFF0BF428C43F3866
Malicious:false
Preview:{"analyticsData":{"responseGUID":"663c400e-84a7-4add-b3cc-78b08bebf0a9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730378173274,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):1038
Entropy (8bit):5.644748032961689
Encrypted:false
SSDEEP:24:Yv6XBlqkzv1Sz2LgEF7cciAXs0nl0RCmK8czOCAPtciBoG:YvElqsdSzogc8hAh8cvA2G
MD5:612D39EE9F11F6C9DF884EB62022885A
SHA1:DDA6DD1A078385EDBB5AD86DB9BCD14D125522F8
SHA-256:CC6081A20B9E7070CCC51170F47322BE3369C134A52EA8919F059A7F5A7E39BB
SHA-512:38B1680AA7C103FBCA5EC31E358FB10487ABFE7BD14994FD3C17D93F22DECBAE08A811A6A5CD7244735B4A77E762687545811C037A8925AA7FE936482B56A172
Malicious:false
Preview:{"analyticsData":{"responseGUID":"663c400e-84a7-4add-b3cc-78b08bebf0a9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730378173274,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_1","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"49d2f713-7aa9-44db-aa50-0a7a22add459","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVkaXQgdGV4dCwgaW1hZ2VzLCBwYWdlcywgYW5kIG1vcmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme":true},"endDTS":1744

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):1164
Entropy (8bit):5.695478020172621
Encrypted:false
SSDEEP:24:Yv6XBlqkzv1S/KLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK5oG:YvElqsdS/EgqprtrS5OZjSlwTmAfSKSG
MD5:F2195E5DA731D5CBC1B6632AD64ACC08
SHA1:7C8E08E054C402BE0ED7C5C9571007650AC9BC87
SHA-256:2C06C99D018D484971D5FBD02FC4812A25F00A1F8DA28F6207FFC3FCA0E44BAB
SHA-512:C1BB78DD09E1FFB9A7235520919A6710E78114187C54A0CB20F99E009B860429845AAC1A682910B4B6CD27304AB87759B74D835CDC1B116A48AFE552054E756D
Malicious:false
Preview:{"analyticsData":{"responseGUID":"663c400e-84a7-4add-b3cc-78b08bebf0a9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730378173274,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):289
Entropy (8bit):5.2948888625140125
Encrypted:false
SSDEEP:6:YEQXJ2HXBDVVvOi+HoQqIH9VoZcg1vRcR0YMSUoAvJfYdPeUkwRe9:YvXKXBDVxF+HoqkZc0v1SnGg8Ukee9
MD5:D96563A9C8AFB64F8026E91392A7702B
SHA1:D26A99E61163C7F2710FE335E0D6EC24DDA5F635
SHA-256:501EB9D621AFF5A7EDB37A1FB03A31DB305E694493A421F67D0378C4C5B1331E
SHA-512:380DCAF265D47CA8910A8B47DA896039CF842248EE76F26734A3271046C0B6E4B791194410D093A42C06C2DB2204B4A8AB1ACFD2AF7A2A5448037B597BEF01B8
Malicious:false
Preview:{"analyticsData":{"responseGUID":"663c400e-84a7-4add-b3cc-78b08bebf0a9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730378173274,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):1395
Entropy (8bit):5.774439062085861
Encrypted:false
SSDEEP:24:Yv6XBlqkzv1SCrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNQG:YvElqsdSCHgDv3W2aYQfgB5OUupHrQ9b
MD5:48947BB8F05D54AC0A94BEF38B7D4B29
SHA1:8783602AC788841E8D111588F4543821B6FFA8DE
SHA-256:7C67502F583A3449E5A6751EBF3A10B7748841BE67E325BEDC47428951C9A2CD
SHA-512:59BD923A32B6EA529641F9296DD47F50AEFDB12AEC35FA5C3C0267C73E246EBEF27551A4A4EC8CAB0941E4CE0FD5C03D1104BF69EC9294C81C460AC1CDD7BBF7
Malicious:false
Preview:{"analyticsData":{"responseGUID":"663c400e-84a7-4add-b3cc-78b08bebf0a9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730378173274,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):291
Entropy (8bit):5.278471088280563
Encrypted:false
SSDEEP:6:YEQXJ2HXBDVVvOi+HoQqIH9VoZcg1vRcR0YMSUoAvJfbPtdPeUkwRe9:YvXKXBDVxF+HoqkZc0v1SnGDV8Ukee9
MD5:548E5236E26D766D3ACB9520E9262847
SHA1:9D6EB6B7C57B65904FF1CF7E17C41B19A69E0248
SHA-256:3CED53AECD9BFD31803E5A971F99B47D67316F803F81AC7FD61A8C4677A2C20C
SHA-512:133B1B67A782C09CA5D9402D64062F893961F0190F48C8CA031D7AAF77AAA0ADBBF88DE538BF210ED88A69EBC81DBC6692BFA04330F88972F8D68B757E21C899
Malicious:false
Preview:{"analyticsData":{"responseGUID":"663c400e-84a7-4add-b3cc-78b08bebf0a9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730378173274,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):287
Entropy (8bit):5.2833476607282055
Encrypted:false
SSDEEP:6:YEQXJ2HXBDVVvOi+HoQqIH9VoZcg1vRcR0YMSUoAvJf21rPeUkwRe9:YvXKXBDVxF+HoqkZc0v1SnG+16Ukee9
MD5:0C84F1D7265F89D2356EE2BB07C35CA8
SHA1:F691EF85AB24D559DA6EB1003C1F09E95D75434F
SHA-256:48ACFF18A9C1FD6E90E25FB8AE88A261D7086EBB8FD26CF3E5B4A758B95A6273
SHA-512:AFE27D8664658D028E5A94222DC2280799F3BCA9A7A77B6BD1A1F6880B8C6DEF0EF407D164E8D6BA9B81E2F6777B79A05FD7CDE5C22721510FA3A165EEF8CBE1
Malicious:false
Preview:{"analyticsData":{"responseGUID":"663c400e-84a7-4add-b3cc-78b08bebf0a9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730378173274,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):1026
Entropy (8bit):5.630514957921036
Encrypted:false
SSDEEP:24:Yv6XBlqkzv1SYamXayLgE7cMCBNaqnl0RCmK8czOC/BSVG:YvElqsdSeBgACBOAh8cvMVG
MD5:0FD0C4465CA7590AFFC26CB8B3E14601
SHA1:432144135F73D23F89FBBD2151D983B61ED716EF
SHA-256:9BCDB67F812279A8856DD1109B69B1F9940E7A3AFF3A353858075C067F5AD696
SHA-512:5459D11B66E432D8C6BA3814903AB63FFCB04610142232DE40BD33DCCCC3745DA5C556B15E6CE601122114A9DAB76A553EF0BE05C43B497037223B3995DF61ED
Malicious:false
Preview:{"analyticsData":{"responseGUID":"663c400e-84a7-4add-b3cc-78b08bebf0a9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730378173274,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"92038_285529ActionBlock_0","campaignId":92038,"containerId":"1","controlGroupId":"","treatmentId":"6291f52b-6cb0-4d31-bc46-37ce85e9eb25","variationId":"285529"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme":true},"endDTS":1751323379000,"s

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):286
Entropy (8bit):5.258675145474354
Encrypted:false
SSDEEP:6:YEQXJ2HXBDVVvOi+HoQqIH9VoZcg1vRcR0YMSUoAvJfshHHrPeUkwRe9:YvXKXBDVxF+HoqkZc0v1SnGUUUkee9
MD5:FDEB5918ADC5EBB3E5ED1A26DBD61473
SHA1:6878E43C15891730EE8CB86E15E948CCC1F3E3FF
SHA-256:93AA6C52501D6E177EFB4B2713CE00EC49421A19D59F8536B0325E68ABC8E72B
SHA-512:28A9CED9C620F9D9080DBC1E7C2247C6615B0D3B4923881E4B676755017D266B4A7C51CB38422A01DE057E6DF598ECF644DF3AF47149C4FFD629D78627C9A71B
Malicious:false
Preview:{"analyticsData":{"responseGUID":"663c400e-84a7-4add-b3cc-78b08bebf0a9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730378173274,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):782
Entropy (8bit):5.364489080398874
Encrypted:false
SSDEEP:12:YvXKXBDVxF+HoqkZc0v1SnGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uK:Yv6XBlqkzv1Sn168CgEXX5kcIfANhVG
MD5:EF49DC24664EE70CEA3B1A4D6593DF38
SHA1:AE6344E301D772FAE7BF97B52FA8FBE6AF8787A5
SHA-256:1FBEDC2F5B74C6C21C7A676E8B8505FAEF35110BA656E2FA0573E6632BFF9822
SHA-512:07F4DE3168A69B7C59F8F0AE4A8E721A192C862DCD4BFBB8EE5B05615DB9994F3A41A71687C5F4EDB700E5F81CBBF530C3E19472D94E8E77F85A086833A410AA
Malicious:false
Preview:{"analyticsData":{"responseGUID":"663c400e-84a7-4add-b3cc-78b08bebf0a9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730378173274,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1730200168314}}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:data
Category:dropped
Size (bytes):4
Entropy (8bit):0.8112781244591328
Encrypted:false
SSDEEP:3:e:e
MD5:DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:false
Preview:....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:JSON data
Category:dropped
Size (bytes):2818
Entropy (8bit):5.1278480568866645
Encrypted:false
SSDEEP:48:YzGmikAKMVzYZFwVF6ONTdHXEONWPPaVQ8g4PB9YzN+t:MGNiwP6MVXUCbpB
MD5:2047D425F296CC07247AE44D172F8B34
SHA1:4CA41B22F98290346C285D6181032F3406AA48D7
SHA-256:C6932AAF087EB563335DEEDC9720532F1F07F18A721A23FCAAE9E198CCEB765A
SHA-512:439E5C0CE7A1C15E6E5BAEE4B2C333860AF8340DA6EE520D4493DF8CB0265D8EF32F839F777F801706346A79EAE9329AE6ED9A8F566620ACC0C2925C7E9C136C
Malicious:false
Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"8001ad85356dc48d0f1ac57fc91b58e2","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1050,"ts":1730200167000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"54749bc3bb1c1f7caffbc517552c0b32","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1730200167000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"8d5ac34ca0d2b6c6aa1a70e52d2b5e50","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1026,"ts":1730200167000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"ebc043bf06856bef15ab77069834886c","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1055,"ts":1730200167000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"baf4d3d1db75c063729893eecf693cfc","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1038,"ts":1730200167000},{"id":"Edit_InApp_Aug2020","info":{"dg":"6219b411baff30cd4cf794810cbfd4c4","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":17

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:dropped
Size (bytes):12288
Entropy (8bit):1.187150180838201
Encrypted:false
SSDEEP:48:TGufl2GL7msEHUUUUUUUUyT2SvR9H9vxFGiDIAEkGVvplw:lNVmswUUUUUUUUyC+FGSItG
MD5:88E77966D625B2D69C42D92CF338AD35
SHA1:8ACEDCD87E31C236E255CC580146139D86CB39F9
SHA-256:BA332BDC4D7E2E026073023CE8206527DE2BBBE4ED6E290C1676F600B620DD94
SHA-512:74D978933373B33AE2584336C9C49F5EEE73A1B6133BD6165D54DE4E53494B031A311376BFD5A320DAF0B9FD1FABDCD4E6D48E4720D07D0491E96F109C58B1A4
Malicious:false
Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:SQLite Rollback Journal
Category:dropped
Size (bytes):8720
Entropy (8bit):1.6058101615468856
Encrypted:false
SSDEEP:48:7MqKUUUUUUUUUUyTUvR9H9vxFGiDIAEkGVv5qFl2GL7ms8:7aUUUUUUUUUUyoFGSIt7KVms8
MD5:E51CD0676CEBE900F261BE0143C1B04F
SHA1:1D7212942818A939A3520399BEAB8F7E66AEF5BF
SHA-256:B5EA3627AC52A64698D1A93B7AD7796BDB2BA8B200EE46927055746ECA633FC7
SHA-512:0B1C5285D402FB1FB2B4558D048DEBAD46DB7AF05636E1F4E0631462D475813990D30A41EB198D627500ECA0E6BA29FFAD9806704306BE847422A0AB0BB9480E
Malicious:false
Preview:.... .c.......XX......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI94c2b.LOG

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:dropped
Size (bytes):246
Entropy (8bit):3.505069684106714
Encrypted:false
SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8xOlQU00Kw:Qw946cPbiOxDlbYnuRK5L9H
MD5:A93950AA0FBF0E3562ACFAED9213DFAB
SHA1:EAE4E89D1C5C7A164E6AFCA6A921C8EB188B4F5E
SHA-256:1920F74269849DD8DC706EE257BB16A6721120BB740B1D2A69D00A1517D127C3
SHA-512:98865F07E7F187183FB6BAFF2A5BD61E6AF762D823DFF6BBA2EB8CE84E9A64C0DDD9B3001F357C86238FF0F8D9D768A4DFBA7D54ED911F28C65C661751BD4501
Malicious:false
Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.9./.1.0./.2.0.2.4. . .0.7.:.0.9.:.2.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91ym1cs8_1owqx9p_5ow.tmp

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:dropped
Size (bytes):144514
Entropy (8bit):7.992637131260696
Encrypted:true
SSDEEP:3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:false
Preview:PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..|....,.A.....Z..a<.C._..../G|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9okhbi8_1owqx9o_5ow.tmp

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:dropped
Size (bytes):144514
Entropy (8bit):7.992637131260696
Encrypted:true
SSDEEP:3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:false
Preview:PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..|....,.A.....Z..a<.C._..../G|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-29 07-09-23-911.log

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:ASCII text, with very long lines (393)
Category:dropped
Size (bytes):16525
Entropy (8bit):5.345946398610936
Encrypted:false
SSDEEP:384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:false
Preview:SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:ASCII text, with very long lines (393), with CRLF line terminators
Category:dropped
Size (bytes):15114
Entropy (8bit):5.3364313551355425
Encrypted:false
SSDEEP:384:pgcJkAVOppWmwATht6M3J30hB6FmE6qsrEa4GuYIpC2SsBwjxoaxJMJMhbZScXPc:iF5
MD5:1828AA985EA2DE33B3B00DDEB6C79A04
SHA1:F6D2578FACC46BEBC948BE304945235607BF616E
SHA-256:409667434AC5C3C9BE19CB7540AA59F6D3C3B2C0F03953D95AA6CD3215559F01
SHA-512:07B2679216C2D1ECB810B3E976A08694DFF8F386AFF99CF82AB89BF6BF919A9BE6ECFFE4276B78C6B7D3B01EF2DC384474632BAF395A24CE523E6DAF00E23E24
Malicious:false
Preview:SessionID=fed20696-c607-4851-a7a8-90a78f77115a.1730200163926 Timestamp=2024-10-29T07:09:23:926-0400 ThreadID=7484 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=fed20696-c607-4851-a7a8-90a78f77115a.1730200163926 Timestamp=2024-10-29T07:09:23:927-0400 ThreadID=7484 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=fed20696-c607-4851-a7a8-90a78f77115a.1730200163926 Timestamp=2024-10-29T07:09:23:927-0400 ThreadID=7484 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=fed20696-c607-4851-a7a8-90a78f77115a.1730200163926 Timestamp=2024-10-29T07:09:23:927-0400 ThreadID=7484 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=fed20696-c607-4851-a7a8-90a78f77115a.1730200163926 Timestamp=2024-10-29T07:09:23:927-0400 ThreadID=7484 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:ASCII text, with CRLF line terminators
Category:dropped
Size (bytes):29752
Entropy (8bit):5.391337926021868
Encrypted:false
SSDEEP:768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rq:gjTz
MD5:791ABC758BA7F86D4650AB3887E8A591
SHA1:570AC96CCCA35351611DB28ED05DB86F761EFF0A
SHA-256:2D71F359A6C23E33E5D20EA76D11AA5A59B84777CFA9DC64646B49450543BD2B
SHA-512:CCAEB60B6DD45527C80765E9ADD7251301D883BE43D674B8CDB63CCB567B3CE256F02E2657EC9537D726749E3B9EFFB02327F70CD85BEF9F962402ECEAE1F993
Malicious:false
Preview:03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0199ef3c-5c05-4e27-a714-033318d41b9d.tmp

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:dropped
Size (bytes):758601
Entropy (8bit):7.98639316555857
Encrypted:false
SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:3A49135134665364308390AC398006F1
SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:false
Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\70852c7c-a4c4-4ef7-943e-9aaf64baba2d.tmp

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:dropped
Size (bytes):1407294
Entropy (8bit):7.97605879016224
Encrypted:false
SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:false
Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\75176025-d6d3-4063-963d-29ac66a380c5.tmp

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:dropped
Size (bytes):386528
Entropy (8bit):7.9736851559892425
Encrypted:false
SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:5C48B0AD2FEF800949466AE872E1F1E2
SHA1:337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:false
Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\d9387583-9424-43c1-9cff-1113f8add3fa.tmp

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:dropped
Size (bytes):1419751
Entropy (8bit):7.976496077007677
Encrypted:false
SSDEEP:24576:/x0WLGwYIGNPe7oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:J0WLGwZGtYGZn3mlind9i4ufFXpAXkru
MD5:8D0363CB6E658F9FB75DDF89015A7BE9
SHA1:DFCD52F83EB0B2771B4AB26AEC58CD3EE33CDA98
SHA-256:EC6C6ED5878F0E123E39886C673B97FFC93C42166202F31A6ED41EF39F205999
SHA-512:00EBC9F665E26390994396803A0DE99A152AB3CF505C1610F22E093F3985E04E3FA394EDE1CF50B989E981B1CF30BD3F528564F55488B7480692B983EBD21F61
Malicious:false
Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:ASCII text
Category:dropped
Size (bytes):24
Entropy (8bit):3.66829583405449
Encrypted:false
SSDEEP:3:So6FwHn:So6FwHn
MD5:DD4A3BD8B9FF61628346391EA9987E1D
SHA1:474076C122CACAAF112469FC62976BB69187AA2B
SHA-256:7C22C759CA704106556BBC4FC10B7F53404CA1F8B40F01038D3F7C4B8183F486
SHA-512:FDAF3D9F8072ED7DE9B2528376C10E3C3FDBEA74347710A4795BECF23C6577B3582B2E89D3C04EF0523C98FE0A46F2AF3629490701A20B848C63BA7B26579491
Malicious:false
Preview:<</Settings [/c <<>>].>>

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:data
Category:dropped
Size (bytes):98682
Entropy (8bit):6.445287254681573
Encrypted:false
SSDEEP:1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:7113425405A05E110DC458BBF93F608A
SHA1:88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:false
Preview:0...u0...\...0...*.H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...*B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File
Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:data
Category:dropped
Size (bytes):737
Entropy (8bit):7.501268097735403
Encrypted:false
SSDEEP:12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:false
Preview:0...0.....0...*.H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0...*.H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R*.......~....)....i.*n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

Static File Info

General

File type:PDF document, version 1.7, 1 pages
Entropy (8bit):7.983526362427687
TrID:
  • Adobe Portable Document Format (5005/1) 100.00%
File name:Specification Sample.........pdf
File size:689'620 bytes
MD5:aeba7f17c41f5649d00cc2d728e8d41b
SHA1:f481d17c0ea06eb8740f4034e77ac21c9e66f08d
SHA256:c0c081d9deec15050d9b50fa0f648729e87d6b393694db94ad40b20f89997429
SHA512:798bf387b9c02ac5e11c334f0973bfc1083fb025d69525cf388fe82a835ef32e01f8159f67a7cf787817e408bdebce209ee129bc8e85299dd117a323b3bf13c4
SSDEEP:12288:9EJhqICGoeL+jPz7jaSFEaWcak80ktC3brl5k0RlK9VNb2yT6t32IRWBzVqDD/Tl:OHbCGoNnXYkUC3brtsVNb2yT6cIMODe6
TLSH:09E4E153CC089B87A46887E9BE574EAC2F19771DE8923BFF21620ED73D501524D9E02E
File Content Preview:%PDF-1.7..4 0 obj.(Identity).endobj.5 0 obj.(Adobe).endobj.8 0 obj.<<./Filter /FlateDecode./Length 87905./Length1 368228./Type /Stream.>>.stream.x..}.`.E.........+3..L.r...@ .....AL.H....\^...x.z........D1 (.z.+....kv.[V.E.U3..U....~.|d....S...]]..U..>...

File Icon

Icon Hash:62cc8caeb29e8ae0

Static PDF Info

General

Header:%PDF-1.7
Total Entropy:7.983526
Total Bytes:689620
Stream Entropy:7.984034
Stream Bytes:682595
Entropy outside Streams:5.062642
Bytes outside Streams:7025
Number of EOF found:1
Bytes after EOF:

Keywords Statistics

NameCount
obj47
endobj47
stream12
endstream12
xref1
trailer1
startxref1
/Page1
/Encrypt0
/ObjStm0
/URI0
/JS0
/JavaScript0
/AA0
/OpenAction0
/AcroForm0
/JBIG2Decode0
/RichMedia0
/Launch0
/EmbeddedFile0

Image Streams

IDDHASHMD5Preview
4420032b3b2d0d2e6d091abe46d4b59be12e338df1bd320bff

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

General

Target ID:0
Start time:07:09:20
Start date:29/10/2024
Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):false
Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Specification Sample.........pdf"
Imagebase:0x7ff6bc1b0000
File size:5'641'176 bytes
MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:1
Start time:07:09:21
Start date:29/10/2024
Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):false
Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:0x7ff74bb60000
File size:3'581'912 bytes
MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:3
Start time:07:09:21
Start date:29/10/2024
Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):false
Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1596,i,12715773412985011628,1919190508316726040,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:0x7ff74bb60000
File size:3'581'912 bytes
MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

Disassembly

⊘No disassembly