Windows Analysis Report
End of Year Accounting for The Estate of Janet Delesanti-2.pdf

Overview

General Information

Sample name: End of Year Accounting for The Estate of Janet Delesanti-2.pdf
Analysis ID: 1580457
MD5: c37012ba15a5dd1c1ae109d07c4e6417
SHA1: 752014043e65f3bc49704cdae2a9e26a0a6fa82a
SHA256: 7a4fc14999cc545e5fc14502b74ee87e3d50b33c531eef64c6c531952f6f8394
Infos:

Detection

Score: 4
Range: 0 - 100
Whitelisted: false
Confidence: 60%

Signatures

Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Document contains embedded VBA macros
Document misses a certain OLE stream usually present in this Microsoft Office document type
Drops files with a non-matching file extension (content does not match file extension)
Potential document exploit detected (performs DNS queries)
Queries the volume information (name, serial number etc) of a device
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: srtb.msn.com
Source: global traffic DNS query: name: assets.msn.com
Source: global traffic DNS query: name: tse1.mm.bing.net
Source: global traffic DNS query: name: ims-na1.adobelogin.com
Source: global traffic DNS query: name: res.public.onecdn.static.microsoft
Source: global traffic DNS query: name: assets.msn.com
Source: global traffic DNS query: name: c.pki.goog
Source: global traffic DNS query: name: aefd.nelreports.net
Source: global traffic DNS query: name: x1.c.lencr.org
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: srtb.msn.com
Source: global traffic DNS traffic detected: DNS query: assets.msn.com
Source: global traffic DNS traffic detected: DNS query: tse1.mm.bing.net
Source: global traffic DNS traffic detected: DNS query: ims-na1.adobelogin.com
Source: global traffic DNS traffic detected: DNS query: res.public.onecdn.static.microsoft
Source: global traffic DNS traffic detected: DNS query: c.pki.goog
Source: global traffic DNS traffic detected: DNS query: aefd.nelreports.net
Source: global traffic DNS traffic detected: DNS query: x1.c.lencr.org
Source: AdobeCollabSync.exe, 00000006.00000003.12906410227.000001C3B1B00000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12744361459.000001C3B1B00000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12610599667.000001C3B1B00000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12544927311.000001C3B1B00000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12921164988.000001C3B1B00000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12706103173.000001C3B1B00000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12598102374.000001C3B1B00000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12624482939.000001C3B1B00000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12584407626.000001C3B1B00000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12678940161.000001C3B1B00000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12780995225.000001C3B1AFA000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12041204194.000001C3B1B00000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12382005306.000001C3B1B00000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12652084595.000001C3B1AFA000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000002.13035817304.000001C3B1AFA000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12725582402.000001C3B1B00000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12762628925.000001C3B1B00000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12868364536.000001C3B1B00000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12572408933.000001C3B1B00000.00000004.00000020.00020000.00000000.sdmp, adobe_licensing_wf_acro.exe, 0000000E.00000002.12346583614.0000021A33CF9000.00000004.00000020.00020000.00000000.sdmp, adobe_licensing_wf_acro.exe, 0000000E.00000003.12325297270.0000021A33CF8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11951333988.0000457601C04000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000012.00000002.12351535245.00004576023AC000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11951900795.0000457600C04000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000002.12181978104.00002C36025AC000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11947315564.00002C3600C04000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11947130774.00002C3601E04000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://css3pie.com
Source: adobe_licensing_wf_acro.exe, 0000000E.00000002.12347339054.0000021A33D47000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://e5.i.lencr.org/
Source: adobe_licensing_wf_acro.exe, 0000000E.00000003.12325865497.0000021A33D46000.00000004.00000020.00020000.00000000.sdmp, adobe_licensing_wf_acro.exe, 0000000E.00000003.12325297270.0000021A33D26000.00000004.00000020.00020000.00000000.sdmp, adobe_licensing_wf_acro.exe, 0000000E.00000002.12347339054.0000021A33D47000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://e5.o.lenc
Source: adobe_licensing_wf_acro.exe, 0000000E.00000003.12325865497.0000021A33D46000.00000004.00000020.00020000.00000000.sdmp, adobe_licensing_wf_acro.exe, 0000000E.00000003.12325297270.0000021A33D26000.00000004.00000020.00020000.00000000.sdmp, adobe_licensing_wf_acro.exe, 0000000E.00000002.12347339054.0000021A33D47000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://e5.o.lenc_
Source: adobe_licensing_wf_acro.exe, 0000000E.00000003.12325865497.0000021A33D46000.00000004.00000020.00020000.00000000.sdmp, adobe_licensing_wf_acro.exe, 0000000E.00000003.12325297270.0000021A33D26000.00000004.00000020.00020000.00000000.sdmp, adobe_licensing_wf_acro.exe, 0000000E.00000002.12347339054.0000021A33D47000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://e5.o.lencr.org1.3.6.1.5.5.7.48.2http://e5.i.lencr.org/
Source: adobe_licensing_wf_acro.exe, 0000000E.00000003.12325865497.0000021A33D46000.00000004.00000020.00020000.00000000.sdmp, adobe_licensing_wf_acro.exe, 0000000E.00000003.12325297270.0000021A33D26000.00000004.00000020.00020000.00000000.sdmp, adobe_licensing_wf_acro.exe, 0000000E.00000002.12347339054.0000021A33D47000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://e5.o.lencr.org1.3.6.1.5.5.7.48.2http://e5.i.lencr.org/gC
Source: adobe_licensing_wf_helper_acro.exe, 00000017.00000002.12311362860.0000020B216C3000.00000004.00000020.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000003.12179993294.0000020B216C2000.00000004.00000020.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000003.12155929004.0000020B216C2000.00000004.00000020.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000003.12184881547.0000020B216C2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://en.w
Source: adobe_licensing_wf_helper_acro.exe, 00000012.00000002.12318083316.000001D86D0D2000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000002.12149381573.00000202E9802000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: adobe_licensing_wf_helper_acro.exe, 00000012.00000002.12353883388.000045760260C000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11951333988.0000457601C04000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11968222782.00004576023BC000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11964838628.00002C36025BC000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11947130774.00002C3601E04000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000002.12176375920.00002C3600A0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://jquery.com/
Source: adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11986714713.0000457601204000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000012.00000002.12353883388.000045760260C000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11951333988.0000457601C04000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11968222782.00004576023BC000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11964838628.00002C36025BC000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11947130774.00002C3601E04000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000002.12176375920.00002C3600A0C000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11970754643.00002C3601204000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://jquery.org/license
Source: adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11994239661.00004576026A0000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11978400087.00002C3600AA0000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000003.12245592951.00001D16009DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://lists.w3.org/Archives/Public/public-svg-wg/2008JulSep/0347.html
Source: adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11986714713.0000457601204000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000012.00000002.12353883388.000045760260C000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11951333988.0000457601C04000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11968222782.00004576023BC000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11964838628.00002C36025BC000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11947130774.00002C3601E04000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000002.12176375920.00002C3600A0C000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11970754643.00002C3601204000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://sizzlejs.com/
Source: adobe_licensing_wf_acro.exe, 0000000E.00000002.12356539412.0000559000250000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://unisolated.invalid/
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12318733317.0000414600230000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://wpad/wpad.dat
Source: adobe_licensing_wf_acro.exe, 0000000E.00000002.12346583614.0000021A33CF9000.00000004.00000020.00020000.00000000.sdmp, adobe_licensing_wf_acro.exe, 0000000E.00000003.12325865497.0000021A33D46000.00000004.00000020.00020000.00000000.sdmp, adobe_licensing_wf_acro.exe, 0000000E.00000003.12325297270.0000021A33CF8000.00000004.00000020.00020000.00000000.sdmp, adobe_licensing_wf_acro.exe, 0000000E.00000003.12325297270.0000021A33D26000.00000004.00000020.00020000.00000000.sdmp, adobe_licensing_wf_acro.exe, 0000000E.00000002.12347339054.0000021A33D47000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/
Source: adobe_licensing_wf_acro.exe, 0000000E.00000003.12325995983.0000021A33CD7000.00000004.00000020.00020000.00000000.sdmp, adobe_licensing_wf_acro.exe, 0000000E.00000003.12327798802.0000021A33CD7000.00000004.00000020.00020000.00000000.sdmp, adobe_licensing_wf_acro.exe, 0000000E.00000002.12345870709.0000021A33CD7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: adobe_licensing_wf_acro.exe, 0000000E.00000002.12346583614.0000021A33CF9000.00000004.00000020.00020000.00000000.sdmp, adobe_licensing_wf_acro.exe, 0000000E.00000003.12325297270.0000021A33CF8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/Q
Source: adobe_licensing_wf_acro.exe, 0000000E.00000003.12325995983.0000021A33CD7000.00000004.00000020.00020000.00000000.sdmp, adobe_licensing_wf_acro.exe, 0000000E.00000003.12327798802.0000021A33CD7000.00000004.00000020.00020000.00000000.sdmp, adobe_licensing_wf_acro.exe, 0000000E.00000002.12345870709.0000021A33CD7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: adobe_licensing_wf_helper_acro.exe, 00000017.00000002.12312453313.00001D1600220000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/
Source: adobe_licensing_wf_helper_acro.exe, 00000017.00000002.12315494822.00001D1600498000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/gsi/
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12321965380.0000414600396000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/gsi/;
Source: adobe_licensing_wf_helper_acro.exe, 00000017.00000002.12315494822.00001D1600498000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://adobe-api.arkoselabs.com
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://alekberg.net/privacy
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://alekberg.net/privacybN
Source: adobe_licensing_wf_acro.exe, 0000000E.00000002.12354124020.00005590000E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://auth.services.
Source: adobe_licensing_wf_helper_acro.exe, 00000017.00000002.12315494822.00001D1600498000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.arkoselabs.com
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.cloudflare-dns.com/dns-query
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.cloudflare-dns.com/dns-queryAF$
Source: adobe_licensing_wf_helper_acro.exe, 00000012.00000002.12324549999.0000457600235000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000002.12154806027.00002C3600235000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000002.12312549948.00001D1600235000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore
Source: adobe_licensing_wf_helper_acro.exe, 00000012.00000002.12324549999.0000457600235000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000002.12154806027.00002C3600235000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000002.12312549948.00001D1600235000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore--device-scale-factor=1--num-raster-threads=2enable-main-frame-bef
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromium.dns.nextdns.io
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromium.dns.nextdns.iohttps://nextdns.io/privacyhttps://public.dns.iij.jp/https://dns.sb/pr
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cleanbrowsing.org/privacy
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cleanbrowsing.org/privacy2-
Source: adobe_licensing_wf_helper_acro.exe, 00000017.00000003.12223225656.00001D160084C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://client-v.adobe.i//core-mdetectiotion-pubeedge.neH$
Source: adobe_licensing_wf_helper_acro.exe, 00000012.00000002.12324549999.0000457600235000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000002.12154806027.00002C3600235000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000002.12312549948.00001D1600235000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: adobe_licensing_wf_helper_acro.exe, 00000012.00000002.12324549999.0000457600235000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx15--launch-time-ticks=5260462015--launch-time-ticks=5
Source: adobe_licensing_wf_helper_acro.exe, 00000013.00000002.12154806027.00002C3600235000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crxle--launch-time-ticks=5261158621WebRtcHideLocalIpsWit
Source: adobe_licensing_wf_helper_acro.exe, 00000017.00000002.12312549948.00001D1600235000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crxle--launch-time-ticks=5279044279WebRtcHideLocalIpsWit
Source: AdobeCollabSync.exe, 00000006.00000003.11801311784.000001C3B19EA000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000002.13035038964.000001C3B1971000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://comments.adobe.
Source: AdobeCollabSync.exe, 00000006.00000002.13035038964.000001C3B1971000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://comments.adobe.io
Source: AdobeCollabSync.exe, 00000006.00000003.11801366009.000001C3B1ADC000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.11801311784.000001C3B19EA000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.11801824863.000001C3B1AE5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://comments.adobe.io/schem
Source: AdobeCollabSync.exe, 00000006.00000003.11801479728.000001C3B1AF4000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.11801311784.000001C3B19EA000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.11801852814.000001C3B1AEA000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.11801824863.000001C3B1AE5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://comments.adobe.io/schemas
Source: AdobeCollabSync.exe, 00000006.00000002.13033996111.000001C3AFB87000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://comments.adobe.io/schemas/bulk_entity_v1.json
Source: AdobeCollabSync.exe, 00000006.00000003.11801506274.000001C3B19CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://comments.adobe.io/schemas/enti
Source: AdobeCollabSync.exe, 00000006.00000003.11801506274.000001C3B19CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://comments.adobe.io/schemas/entiog
Source: AdobeCollabSync.exe, 00000006.00000003.11801311784.000001C3B19EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://comments.adobe.io/schemas/entit
Source: AdobeCollabSync.exe, 00000006.00000003.11801311784.000001C3B19EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://comments.adobe.io/schemas/entitG
Source: AdobeCollabSync.exe, 00000006.00000003.12149739133.000001C3B19EE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://comments.adobe.io/schemas/entity_v1.json
Source: AdobeCollabSync.exe, 00000006.00000003.11801506274.000001C3B19CE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://comments.adobe.io/schemas/entiws
Source: AdobeCollabSync.exe, 00000006.00000003.12149739133.000001C3B19EE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://comments.adobe.io/sync/
Source: AdobeCollabSync.exe, 00000006.00000003.11801311784.000001C3B19F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://comments.adobe.io/sync/)
Source: AdobeCollabSync.exe, 00000006.00000003.11801428363.000001C3B1AD8000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.11802566669.000001C3B1AD8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://comments.adobe.io/sync/.adobe.i=
Source: AdobeCollabSync.exe, 00000006.00000003.11801311784.000001C3B19F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://comments.adobe.io/sync//comment
Source: AdobeCollabSync.exe, 00000006.00000002.13035038964.000001C3B1971000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://comments.adobe.io/sync/494:
Source: AdobeCollabSync.exe, 00000006.00000003.11802319349.000001C3B1AE0000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.11801366009.000001C3B1ADC000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.11801824863.000001C3B1AE5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://comments.adobe.io/sync/bat_desk
Source: AdobeCollabSync.exe, 00000006.00000003.11801428363.000001C3B1AD8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://comments.adobe.io/sync/e.io/schj
Source: AdobeCollabSync.exe, 00000006.00000003.11801506274.000001C3B19AD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://comments.adobe.io/sync/extheade
Source: AdobeCollabSync.exe, 00000006.00000003.11801428363.000001C3B1AD8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://comments.adobe.io/sync/ontexth
Source: AdobeCollabSync.exe, 00000006.00000003.11802319349.000001C3B1AE0000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.11801366009.000001C3B1ADC000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.11801824863.000001C3B1AE5000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.11802566669.000001C3B1AD8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://comments.adobe.io/sync/robat5
Source: AdobeCollabSync.exe, 00000006.00000003.11801428363.000001C3B1AD8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://comments.adobe.io/sync/v
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/AF%
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12321703397.0000414600378000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developers.google.com/speed/public-dns/privacy
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12321703397.0000414600378000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://developers.google.com/speed/public-dns/privacyquery
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dns.google/dns-query
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dns.quad9.net/dns-query
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dns.sb/privacy/
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dns.switch.ch/dns-query
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dns.switch.ch/dns-queryhttps://dns.quad9.net/dns-query
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dns10.quad9.net/dns-query
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dns10.quad9.net/dns-query2-
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dns11.quad9.net/dns-query
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dns11.quad9.net/dns-query2-
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dns64.dns.google/dns-query
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dnsnl.alekberg.net/dns-query
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://doh-01.spectrum.com/dns-query
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://doh-02.spectrum.com/dns-query
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12321703397.0000414600378000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://doh.cleanbrowsing.org/doh/adult-filter
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12321703397.0000414600378000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://doh.cleanbrowsing.org/doh/family-filter
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12321703397.0000414600378000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://doh.cleanbrowsing.org/doh/security-filter
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://doh.cox.net/dns-query
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://doh.dns.sb/dns-query
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12321703397.0000414600378000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://doh.familyshield.opendns.com/dns-query
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://doh.opendns.com/dns-query
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://doh.quickline.ch/dns-query
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://doh.xfinity.com/dns-query
Source: adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11994239661.00004576026A0000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11978400087.00002C3600AA0000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000003.12245592951.00001D16009DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drafts.csswg.org/css-color-adjust-1/#forced-colors-properties
Source: adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11962224811.000045760199C000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11963122481.00004576019A4000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11956154447.00002C3601BA0000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11957871262.00002C3601BA8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.com/go/lic_cloH
Source: adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11962224811.000045760199C000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11963122481.00004576019A4000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11956154447.00002C3601BA0000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11957871262.00002C3601BA8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.com/go/lic_conerror_tw
Source: adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11962224811.000045760199C000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11963122481.00004576019A4000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11956154447.00002C3601BA0000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11957871262.00002C3601BA8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.com/go/lic_errcn(
Source: adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11962069584.0000457601974000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11961800563.000045760196C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.com/go/lic_pro
Source: adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11962521123.00004576018E4000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11962813106.00004576018EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://e.com/go/lic_proX
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000003.12150769074.000041460064C000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000011.00000003.12150494489.0000414600624000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000011.00000003.12150769074.0000414600668000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000002.12325583510.00001D1600E0C000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000003.12229300052.00001D1600944000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000002.12317247925.00001D16005E8000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000002.12317325570.00001D16005F0000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000002.12325583510.00001D1600E1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/WebReflection/url-search-params/blob/master/README.md#ios-10--other-platforms-bug
Source: adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11941318590.00004576003A0000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11943963205.0000457600480000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11944089164.0000457600480000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11940265263.00004576003BC000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11943963205.0000457600474000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11939370284.00002C3600474000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11939566083.00002C3600480000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11939370284.00002C3600480000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11930327772.00002C36003BC000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11931550725.00002C36003A0000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000003.12098256616.00001D1600480000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000003.12097812980.00001D1600394000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000003.12098045059.00001D1600474000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000003.12098045059.00001D1600480000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000003.12097737303.00001D16003B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/C/#the-details-and-summary-elements
Source: adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11941318590.00004576003A0000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11943963205.0000457600480000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11944089164.0000457600480000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11940265263.00004576003BC000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11943963205.0000457600474000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11939370284.00002C3600474000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11939566083.00002C3600480000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11939370284.00002C3600480000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11930327772.00002C36003BC000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11931550725.00002C36003A0000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000003.12098256616.00001D1600480000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000003.12097812980.00001D1600394000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000003.12098045059.00001D1600474000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000003.12098045059.00001D1600480000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000003.12097737303.00001D16003B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/rendering.html#hidden-elements
Source: adobe_licensing_wf_acro.exe, 0000000E.00000002.12345631765.0000021A33C80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ims-na1-stg1.adobelogin.com/ims/jump/
Source: adobe_licensing_wf_acro.exe, 0000000E.00000003.12326823988.0000021A300C0000.00000004.00000020.00020000.00000000.sdmp, adobe_licensing_wf_acro.exe, 0000000E.00000002.12347339054.0000021A33D47000.00000004.00000020.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000002.12314187307.00001D1600350000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000003.12229343280.00001D160093C000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000002.12315713087.00001D16004C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ims-na1.adobelogin.com/ims/authorize/v3?client_id=ngl_acrobat_reader1&response_type=device&h
Source: adobe_licensing_wf_acro.exe, 0000000E.00000002.12345631765.0000021A33C80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ims-na1.adobelogin.com/ims/jump/
Source: adobe_licensing_wf_helper_acro.exe, 00000017.00000002.12312756074.00001D1600288000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://k.kakaocdn.net
Source: adobe_licensing_wf_helper_acro.exe, 00000017.00000002.12312756074.00001D1600288000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://k.kakaocdn.net2429d559f4
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nextdns.io/privacy
Source: adobe_licensing_wf_helper_acro.exe, 00000017.00000002.12328043258.00001D160100C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://npms.io/search?q=ponyfill.
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://odvr.nic.cz/doh
Source: adobe_licensing_wf_helper_acro.exe, 00000017.00000002.12315494822.00001D1600498000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://p.typekit.net
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://public.dns.iij.jp/
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://public.dns.iij.jp/dns-query
Source: AdobeCollabSync.exe, 00000006.00000002.13035038964.000001C3B1971000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://reviews.adobe.io
Source: AdobeCollabSync.exe, 00000006.00000002.13035038964.000001C3B1971000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://reviews.adobe.ios://com
Source: adobe_licensing_wf_acro.exe, 0000000E.00000002.12354996262.000055900015C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: adobe_licensing_wf_acro.exe, 0000000E.00000002.12354996262.000055900015C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=dummytoken
Source: adobe_licensing_wf_acro.exe, 0000000E.00000002.12354996262.000055900015C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=dummytokenU
Source: adobe_licensing_wf_acro.exe, 0000000E.00000002.12356252837.000055900020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: adobe_licensing_wf_acro.exe, 0000000E.00000002.12356252837.000055900020C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: adobe_licensing_wf_helper_acro.exe, 00000012.00000003.11994239661.00004576026A0000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000013.00000003.11978400087.00002C3600AA0000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000003.12245592951.00001D16009DC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://svgwg.org/svg2-draft/single-page.html#render-OverflowAndClipProperties
Source: AdobeCollabSync.exe, 00000006.00000003.12041049145.000001C3B1C16000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://trustlist.aU
Source: AdobeCollabSync.exe, 00000006.00000003.12069146468.000001C3B1E4C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://trustlist.aW
Source: AdobeCollabSync.exe, 00000006.00000003.12780543325.000001C3B1C12000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://trustlist.adobe.c
Source: AdobeCollabSync.exe, 00000006.00000003.11919732842.000001C3B1BEF000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.11960854278.000001C3B1BE8000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.11962428656.000001C3B1C10000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.11960854278.000001C3B1C10000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://trustlist.adobe.co
Source: adobe_licensing_wf_helper_acro.exe, 00000017.00000002.12314987787.00001D1600420000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://use.typekit.net
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12321965380.0000414600396000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://use.typekit.net;
Source: adobe_licensing_wf_helper_acro.exe, 00000017.00000003.12280829158.00001D160206C000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000002.12347337766.00001D160207C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.behance.net/leonardoworx
Source: adobe_licensing_wf_helper_acro.exe, 00000017.00000003.12280829158.00001D160206C000.00000004.00000800.00020000.00000000.sdmp, adobe_licensing_wf_helper_acro.exe, 00000017.00000002.12347337766.00001D160207C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.behance.net/michaelschauer
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12321703397.0000414600378000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.cisco.com/c/en/us/about/legal/privacy-full.html
Source: adobe_licensing_wf_helper_acro.exe, 00000017.00000002.12317671099.00001D1600828000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.nic.cz/odvr/
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12319002502.000041460023C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.quad9.net/home/privacy/
Document contains embedded VBA macros
Source: SecuritySettings.xml.1.dr OLE indicator, VBA macros: true
Source: SecuritySettings.xml0.1.dr OLE indicator, VBA macros: true
Source: SecuritySettings.xml1.1.dr OLE indicator, VBA macros: true
Source: SecuritySettings.xml2.1.dr OLE indicator, VBA macros: true
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: SecuritySettings.xml.1.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: SecuritySettings.xml0.1.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: SecuritySettings.xml1.1.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: SecuritySettings.xml2.1.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: classification engine Classification label: clean4.winPDF@35/70@9/0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9ilqxat_bl0li2_68o.tmp Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: AdobeCollabSync.exe, 00000006.00000003.12096501309.000001C3B19F5000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12149739133.000001C3B19F5000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12519228404.000001C3B19F5000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12745420122.000001C3B19F5000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12066452867.000001C3B19F5000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12328239833.000001C3B19F5000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000002.13035038964.000001C3B19F5000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12799794798.000001C3B19F5000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12508822368.000001C3B19F5000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12472880187.000001C3B19F5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SELECT * FROM device_mappings WHERE( content_item_type = :resourceType);
Source: AdobeCollabSync.exe, 00000006.00000003.12382005306.000001C3B1B00000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: select lock from resources where rid=?;A
Source: AdobeCollabSync.exe, 00000006.00000003.12096501309.000001C3B19F5000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12149739133.000001C3B19F5000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12519228404.000001C3B19F5000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12745420122.000001C3B19F5000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12066452867.000001C3B19F5000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12328239833.000001C3B19F5000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000002.13035038964.000001C3B19F5000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12799794798.000001C3B19F5000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12508822368.000001C3B19F5000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12472880187.000001C3B19F5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SELECT pending_request_id, request_type, content_item_id, context, pending_request_created, request_status, message, status_code, device_mapping_id FROM pending_requests;
Source: AdobeCollabSync.exe, 00000006.00000003.12780252082.000001C3B1C4C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE resources_items(id integer0;
Source: unknown Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\End of Year Accounting for The Estate of Janet Delesanti-2.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c --type=collab-renderer --proc=8232
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/24.4.20272 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\UserData" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2068 --field-trial-handle=1652,i,9816887814325324639,16998118217230622433,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe" GetChannelUri
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe 8088
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe" --type=gpu-process --no-sandbox --log-severity=disable --lang=en-US --cef-dll-path="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1" --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\debug.log" --mojo-platform-channel-handle=1512 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=WebRtcHideLocalIpsWithMdns /prefetch:2
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --lang=en-US --cef-dll-path="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\debug.log" --mojo-platform-channel-handle=1912 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=WebRtcHideLocalIpsWithMdns /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe" --type=renderer --log-severity=disable --cef-dll-path="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1" --first-renderer-process --no-sandbox --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\debug.log" --touch-events=enabled --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=5260462015 --mojo-platform-channel-handle=2180 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=WebRtcHideLocalIpsWithMdns /prefetch:1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe" --type=renderer --log-severity=disable --cef-dll-path="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1" --no-sandbox --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\debug.log" --touch-events=enabled --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --launch-time-ticks=5261158621 --mojo-platform-channel-handle=2268 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=WebRtcHideLocalIpsWithMdns /prefetch:1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe" --type=gpu-process --no-sandbox --log-severity=disable --lang=en-US --cef-dll-path="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1" --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\debug.log" --mojo-platform-channel-handle=2400 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=WebRtcHideLocalIpsWithMdns /prefetch:2
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe" --type=renderer --log-severity=disable --cef-dll-path="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1" --no-sandbox --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\debug.log" --touch-events=enabled --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --launch-time-ticks=5279044279 --mojo-platform-channel-handle=2912 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=WebRtcHideLocalIpsWithMdns /prefetch:1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe 8088 Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c --type=collab-renderer --proc=8232 Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe" GetChannelUri
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/24.4.20272 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\UserData" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2068 --field-trial-handle=1652,i,9816887814325324639,16998118217230622433,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe" --type=gpu-process --no-sandbox --log-severity=disable --lang=en-US --cef-dll-path="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1" --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\debug.log" --mojo-platform-channel-handle=1512 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=WebRtcHideLocalIpsWithMdns /prefetch:2
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --lang=en-US --cef-dll-path="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\debug.log" --mojo-platform-channel-handle=1912 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=WebRtcHideLocalIpsWithMdns /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe" --type=renderer --log-severity=disable --cef-dll-path="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1" --first-renderer-process --no-sandbox --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\debug.log" --touch-events=enabled --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=5260462015 --mojo-platform-channel-handle=2180 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=WebRtcHideLocalIpsWithMdns /prefetch:1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe" --type=renderer --log-severity=disable --cef-dll-path="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1" --no-sandbox --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\debug.log" --touch-events=enabled --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --launch-time-ticks=5261158621 --mojo-platform-channel-handle=2268 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=WebRtcHideLocalIpsWithMdns /prefetch:1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe" --type=gpu-process --no-sandbox --log-severity=disable --lang=en-US --cef-dll-path="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1" --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\debug.log" --mojo-platform-channel-handle=2400 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=WebRtcHideLocalIpsWithMdns /prefetch:2
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe" --type=renderer --log-severity=disable --cef-dll-path="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1" --no-sandbox --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\debug.log" --touch-events=enabled --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --launch-time-ticks=5279044279 --mojo-platform-channel-handle=2912 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=WebRtcHideLocalIpsWithMdns /prefetch:1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe Section loaded: vccorlib140.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe Section loaded: msvcp140.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe Section loaded: vcruntime140.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe Section loaded: appcontracts.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe Section loaded: wintypes.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: version.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: wininet.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: credui.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: windows.storage.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: wintypes.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: uxtheme.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: profapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: libcef.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: dbghelp.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: winmm.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: iphlpapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: dxgi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: propsys.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: uiautomationcore.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: oleacc.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: secur32.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: userenv.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: netapi32.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: wtsapi32.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: hid.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: chrome_elf.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: dwrite.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: dwmapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: ncrypt.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: usp10.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: urlmon.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: d3d9.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: dxva2.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: winhttp.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: wevtapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: cryptui.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: dhcpcsvc.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: esent.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: iertutil.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: srvcli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: netutils.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: srvcli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: netutils.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: dxcore.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: sspicli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: dsrole.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: wkscli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: samcli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: msasn1.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: cryptbase.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: ntasn1.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: powrprof.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: umpdc.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: dpapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: nlansp_c.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: dhcpcsvc6.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: dnsapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: textinputframework.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: gpapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: mmdevapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: devobj.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: cfgmgr32.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: cfgmgr32.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: cfgmgr32.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: winsta.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: mscms.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: windows.ui.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: mdmregistration.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: mdmregistration.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: msvcp110_win.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: omadmapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: dsreg.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: apphelp.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: dataexchange.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: twinapi.appcore.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: twinapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: atlthunk.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: directmanipulation.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: cryptsp.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: rsaenh.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: cryptnet.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Section loaded: coremessaging.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: libcef.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dbghelp.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: winmm.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: iphlpapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dxgi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: propsys.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: uiautomationcore.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: oleacc.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: secur32.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: userenv.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: netapi32.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wtsapi32.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: hid.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: chrome_elf.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: version.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dwrite.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dwmapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: uxtheme.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: ncrypt.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: usp10.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: urlmon.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: d3d9.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dxva2.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: winhttp.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wevtapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: cryptui.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: credui.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dhcpcsvc.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wininet.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: esent.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: iertutil.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: srvcli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: netutils.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: srvcli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: netutils.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dxcore.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: sspicli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dsrole.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wkscli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: samcli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: msasn1.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: cryptbase.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: ntasn1.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: windows.storage.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wintypes.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: resourcepolicyclient.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: directxdatabasehelper.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: mf.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: mfplat.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: cfgmgr32.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: rtworkq.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: msmpeg2vdec.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: mfperfhelper.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: msvproc.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: d3dcompiler_47.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: d3dcompiler_47.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: cryptsp.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: comppkgsup.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: libcef.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dbghelp.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: winmm.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: iphlpapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dxgi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: propsys.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: uiautomationcore.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: oleacc.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: secur32.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: userenv.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: netapi32.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wtsapi32.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: hid.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: chrome_elf.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: version.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dwrite.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dwmapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: uxtheme.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: ncrypt.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: usp10.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: urlmon.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: d3d9.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dxva2.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: winhttp.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wevtapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: cryptui.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: credui.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dhcpcsvc.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wininet.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: esent.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: iertutil.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: srvcli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: netutils.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: srvcli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: netutils.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dxcore.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: sspicli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dsrole.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wkscli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: samcli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: msasn1.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: cryptbase.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: ntasn1.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: windows.storage.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wintypes.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dhcpcsvc6.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: nlansp_c.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dnsapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: mswsock.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: rasadhlp.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: fwpuclnt.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: libcef.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dbghelp.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: winmm.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: iphlpapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dxgi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: propsys.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: uiautomationcore.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: oleacc.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: secur32.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: userenv.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: netapi32.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wtsapi32.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: hid.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: chrome_elf.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: version.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dwrite.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dwmapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: uxtheme.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: ncrypt.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: usp10.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: urlmon.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: d3d9.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dxva2.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: winhttp.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wevtapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: cryptui.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: credui.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dhcpcsvc.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wininet.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: esent.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: iertutil.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: srvcli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: netutils.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: srvcli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: netutils.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dxcore.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: sspicli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dsrole.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wkscli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: samcli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: msasn1.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: cryptbase.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: ntasn1.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: windows.storage.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wintypes.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: libcef.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dbghelp.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: winmm.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: iphlpapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dxgi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: propsys.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: uiautomationcore.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: oleacc.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: secur32.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: userenv.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: netapi32.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wtsapi32.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: hid.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: chrome_elf.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: version.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dwrite.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dwmapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: uxtheme.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: ncrypt.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: usp10.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: urlmon.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: d3d9.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dxva2.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: winhttp.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wevtapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: cryptui.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: credui.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dhcpcsvc.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wininet.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: esent.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: iertutil.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: srvcli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: netutils.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: srvcli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: netutils.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dxcore.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: sspicli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dsrole.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wkscli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: samcli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: msasn1.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: cryptbase.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: ntasn1.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: windows.storage.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wintypes.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: libcef.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dbghelp.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: winmm.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: iphlpapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dxgi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: propsys.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: uiautomationcore.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: oleacc.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: secur32.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: userenv.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: netapi32.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wtsapi32.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: hid.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: chrome_elf.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: version.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dwrite.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dwmapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: uxtheme.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: ncrypt.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: usp10.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: urlmon.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: d3d9.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dxva2.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: winhttp.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wevtapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: cryptui.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: credui.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dhcpcsvc.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wininet.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: esent.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: iertutil.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: srvcli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: netutils.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: srvcli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: netutils.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dxcore.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: sspicli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dsrole.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wkscli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: samcli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: msasn1.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: cryptbase.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: ntasn1.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: windows.storage.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wintypes.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: mf.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: mfplat.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: cfgmgr32.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: rtworkq.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: msmpeg2vdec.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: mfperfhelper.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: msvproc.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dcomp.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: libcef.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dbghelp.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: winmm.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: iphlpapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dxgi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: propsys.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: uiautomationcore.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: oleacc.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: secur32.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: userenv.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: netapi32.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wtsapi32.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: hid.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: chrome_elf.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: version.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dwrite.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dwmapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: uxtheme.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: ncrypt.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: usp10.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: urlmon.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: d3d9.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dxva2.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: winhttp.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wevtapi.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: cryptui.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: credui.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dhcpcsvc.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wininet.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: esent.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: iertutil.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: srvcli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: netutils.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dxcore.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: sspicli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: dsrole.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wkscli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: samcli.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: msasn1.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: cryptbase.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: ntasn1.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: windows.storage.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Section loaded: wintypes.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Word\Addins\PDFMaker.OfficeAddin Jump to behavior
Source: End of Year Accounting for The Estate of Janet Delesanti-2.pdf Static file information: File size 13329417 > 6291456
Source: End of Year Accounting for The Estate of Janet Delesanti-2.pdf Initial sample: PDF keyword /JS count = 0
Source: End of Year Accounting for The Estate of Janet Delesanti-2.pdf Initial sample: PDF keyword /JavaScript count = 0
Source: download-20.6.dr Initial sample: PDF keyword /JS count = 0
Source: download-20.6.dr Initial sample: PDF keyword /JavaScript count = 0
Source: download-18.6.dr Initial sample: PDF keyword /JS count = 0
Source: download-18.6.dr Initial sample: PDF keyword /JavaScript count = 0
Source: End of Year Accounting for The Estate of Janet Delesanti-2.pdf Initial sample: PDF keyword /Page count = 114
Source: End of Year Accounting for The Estate of Janet Delesanti-2.pdf Initial sample: PDF keyword stream count = 1846
Source: End of Year Accounting for The Estate of Janet Delesanti-2.pdf Initial sample: PDF keyword /EmbeddedFile count = 0
Source: End of Year Accounting for The Estate of Janet Delesanti-2.pdf Initial sample: PDF keyword /ObjStm count = 12
Source: End of Year Accounting for The Estate of Janet Delesanti-2.pdf Initial sample: PDF keyword endobj count = 1963
Source: End of Year Accounting for The Estate of Janet Delesanti-2.pdf Initial sample: PDF keyword endstream count = 1846
Source: End of Year Accounting for The Estate of Janet Delesanti-2.pdf Initial sample: PDF keyword obj count = 1963
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\inprogress\download-20 Jump to dropped file
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\inprogress\download-18 Jump to dropped file
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\inprogress\download-19 Jump to dropped file
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\inprogress\download-21 Jump to dropped file
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Contains long sleeps (>= 3 min)
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe Thread delayed: delay time: 21600000
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe Thread delayed: delay time: 21599999
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe Thread delayed: delay time: 30000
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe Thread delayed: delay time: 21600000
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe Thread delayed: delay time: 21599999
Source: AdobeCollabSync.exe, 00000005.00000002.13032563411.000001701A078000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll5'
Source: AdobeCollabSync.exe, 00000006.00000003.12678940161.000001C3B1B25000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000002.13035892796.000001C3B1B25000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12329965695.000001C3B1B24000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12799945374.000001C3B1B24000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12931979972.000001C3B1B25000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12744361459.000001C3B1B00000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12835830272.000001C3B1B25000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12573110573.000001C3B1B24000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12584407626.000001C3B1B25000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000006.00000003.12727102101.000001C3B1B24000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWf
Source: AdobeCollabSync.exe, 00000006.00000002.13033996111.000001C3AFB24000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWh
Source: AdobeCollabSync.exe, 00000006.00000002.13035038964.000001C3B1971000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWen-USn
Source: adobe_licensing_wf_acro.exe, 0000000E.00000003.12328845195.0000021A30110000.00000004.00000020.00020000.00000000.sdmp, adobe_licensing_wf_acro.exe, 0000000E.00000002.12343601573.0000021A30110000.00000004.00000020.00020000.00000000.sdmp, adobe_licensing_wf_acro.exe, 0000000E.00000003.12324872711.0000021A30110000.00000004.00000020.00020000.00000000.sdmp, adobe_licensing_wf_acro.exe, 0000000E.00000003.12335390568.0000021A30110000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: adobe_licensing_wf_helper_acro.exe, 00000011.00000002.12316008829.0000015FD7DF4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWle%SystemRoot%\system32\mswsock.dll-log-file=C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\debug.log--mojo-platform-channel-handle=1912--field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072--disable-features=WebRtcHideLocalIp<
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe" --type=gpu-process --no-sandbox --log-severity=disable --lang=en-US --cef-dll-path="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1" --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\debug.log" --mojo-platform-channel-handle=1512 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=WebRtcHideLocalIpsWithMdns /prefetch:2
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --lang=en-US --cef-dll-path="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\debug.log" --mojo-platform-channel-handle=1912 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=WebRtcHideLocalIpsWithMdns /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe" --type=renderer --log-severity=disable --cef-dll-path="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1" --first-renderer-process --no-sandbox --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\debug.log" --touch-events=enabled --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=5260462015 --mojo-platform-channel-handle=2180 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=WebRtcHideLocalIpsWithMdns /prefetch:1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe" --type=renderer --log-severity=disable --cef-dll-path="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1" --no-sandbox --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\debug.log" --touch-events=enabled --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --launch-time-ticks=5261158621 --mojo-platform-channel-handle=2268 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=WebRtcHideLocalIpsWithMdns /prefetch:1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe" --type=gpu-process --no-sandbox --log-severity=disable --lang=en-US --cef-dll-path="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1" --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\debug.log" --mojo-platform-channel-handle=2400 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=WebRtcHideLocalIpsWithMdns /prefetch:2
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe" --type=renderer --log-severity=disable --cef-dll-path="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1" --no-sandbox --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\debug.log" --touch-events=enabled --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --launch-time-ticks=5279044279 --mojo-platform-channel-handle=2912 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=WebRtcHideLocalIpsWithMdns /prefetch:1
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "c:\program files\adobe\acrobat dc\acrobat\ngl\cefworkflow\adobe_licensing_wf_helper_acro.exe" --type=gpu-process --no-sandbox --log-severity=disable --lang=en-us --cef-dll-path="c:\program files\adobe\acrobat dc\acrobat\acrocef_1" --gpu-preferences=uaaaaaaaaadgacayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaegaaaaaaaaasaaaaaaaaaayaaaaagaaabaaaaaaaaaagaaaaaaaaaaqaaaaaaaaaaaaaaaoaaaaeaaaaaaaaaabaaaadgaaaagaaaaaaaaacaaaaaaaaaa= --use-gl=angle --use-angle=swiftshader-webgl --log-file="c:\program files\adobe\acrobat dc\acrobat\ngl\cefworkflow\debug.log" --mojo-platform-channel-handle=1512 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=webrtchidelocalipswithmdns /prefetch:2
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "c:\program files\adobe\acrobat dc\acrobat\ngl\cefworkflow\adobe_licensing_wf_helper_acro.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-us --service-sandbox-type=none --no-sandbox --log-severity=disable --lang=en-us --cef-dll-path="c:\program files\adobe\acrobat dc\acrobat\acrocef_1" --log-file="c:\program files\adobe\acrobat dc\acrobat\ngl\cefworkflow\debug.log" --mojo-platform-channel-handle=1912 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=webrtchidelocalipswithmdns /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "c:\program files\adobe\acrobat dc\acrobat\ngl\cefworkflow\adobe_licensing_wf_helper_acro.exe" --type=renderer --log-severity=disable --cef-dll-path="c:\program files\adobe\acrobat dc\acrobat\acrocef_1" --first-renderer-process --no-sandbox --log-file="c:\program files\adobe\acrobat dc\acrobat\ngl\cefworkflow\debug.log" --touch-events=enabled --disable-gpu-compositing --lang=en-us --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=5260462015 --mojo-platform-channel-handle=2180 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=webrtchidelocalipswithmdns /prefetch:1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "c:\program files\adobe\acrobat dc\acrobat\ngl\cefworkflow\adobe_licensing_wf_helper_acro.exe" --type=renderer --log-severity=disable --cef-dll-path="c:\program files\adobe\acrobat dc\acrobat\acrocef_1" --no-sandbox --log-file="c:\program files\adobe\acrobat dc\acrobat\ngl\cefworkflow\debug.log" --touch-events=enabled --disable-gpu-compositing --lang=en-us --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --launch-time-ticks=5261158621 --mojo-platform-channel-handle=2268 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=webrtchidelocalipswithmdns /prefetch:1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "c:\program files\adobe\acrobat dc\acrobat\ngl\cefworkflow\adobe_licensing_wf_helper_acro.exe" --type=gpu-process --no-sandbox --log-severity=disable --lang=en-us --cef-dll-path="c:\program files\adobe\acrobat dc\acrobat\acrocef_1" --gpu-preferences=uaaaaaaaaadgacayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaegaaaaaaaaasaaaaaaaaaayaaaaagaaabaaaaaaaaaagaaaaaaaaaaqaaaaaaaaaaaaaaaoaaaaeaaaaaaaaaabaaaadgaaaagaaaaaaaaacaaaaaaaaaa= --use-gl=disabled --log-file="c:\program files\adobe\acrobat dc\acrobat\ngl\cefworkflow\debug.log" --mojo-platform-channel-handle=2400 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=webrtchidelocalipswithmdns /prefetch:2
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "c:\program files\adobe\acrobat dc\acrobat\ngl\cefworkflow\adobe_licensing_wf_helper_acro.exe" --type=renderer --log-severity=disable --cef-dll-path="c:\program files\adobe\acrobat dc\acrobat\acrocef_1" --no-sandbox --log-file="c:\program files\adobe\acrobat dc\acrobat\ngl\cefworkflow\debug.log" --touch-events=enabled --disable-gpu-compositing --lang=en-us --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --launch-time-ticks=5279044279 --mojo-platform-channel-handle=2912 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=webrtchidelocalipswithmdns /prefetch:1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "c:\program files\adobe\acrobat dc\acrobat\ngl\cefworkflow\adobe_licensing_wf_helper_acro.exe" --type=gpu-process --no-sandbox --log-severity=disable --lang=en-us --cef-dll-path="c:\program files\adobe\acrobat dc\acrobat\acrocef_1" --gpu-preferences=uaaaaaaaaadgacayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaegaaaaaaaaasaaaaaaaaaayaaaaagaaabaaaaaaaaaagaaaaaaaaaaqaaaaaaaaaaaaaaaoaaaaeaaaaaaaaaabaaaadgaaaagaaaaaaaaacaaaaaaaaaa= --use-gl=angle --use-angle=swiftshader-webgl --log-file="c:\program files\adobe\acrobat dc\acrobat\ngl\cefworkflow\debug.log" --mojo-platform-channel-handle=1512 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=webrtchidelocalipswithmdns /prefetch:2
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "c:\program files\adobe\acrobat dc\acrobat\ngl\cefworkflow\adobe_licensing_wf_helper_acro.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-us --service-sandbox-type=none --no-sandbox --log-severity=disable --lang=en-us --cef-dll-path="c:\program files\adobe\acrobat dc\acrobat\acrocef_1" --log-file="c:\program files\adobe\acrobat dc\acrobat\ngl\cefworkflow\debug.log" --mojo-platform-channel-handle=1912 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=webrtchidelocalipswithmdns /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "c:\program files\adobe\acrobat dc\acrobat\ngl\cefworkflow\adobe_licensing_wf_helper_acro.exe" --type=renderer --log-severity=disable --cef-dll-path="c:\program files\adobe\acrobat dc\acrobat\acrocef_1" --first-renderer-process --no-sandbox --log-file="c:\program files\adobe\acrobat dc\acrobat\ngl\cefworkflow\debug.log" --touch-events=enabled --disable-gpu-compositing --lang=en-us --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=5260462015 --mojo-platform-channel-handle=2180 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=webrtchidelocalipswithmdns /prefetch:1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "c:\program files\adobe\acrobat dc\acrobat\ngl\cefworkflow\adobe_licensing_wf_helper_acro.exe" --type=renderer --log-severity=disable --cef-dll-path="c:\program files\adobe\acrobat dc\acrobat\acrocef_1" --no-sandbox --log-file="c:\program files\adobe\acrobat dc\acrobat\ngl\cefworkflow\debug.log" --touch-events=enabled --disable-gpu-compositing --lang=en-us --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --launch-time-ticks=5261158621 --mojo-platform-channel-handle=2268 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=webrtchidelocalipswithmdns /prefetch:1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "c:\program files\adobe\acrobat dc\acrobat\ngl\cefworkflow\adobe_licensing_wf_helper_acro.exe" --type=gpu-process --no-sandbox --log-severity=disable --lang=en-us --cef-dll-path="c:\program files\adobe\acrobat dc\acrobat\acrocef_1" --gpu-preferences=uaaaaaaaaadgacayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaegaaaaaaaaasaaaaaaaaaayaaaaagaaabaaaaaaaaaagaaaaaaaaaaqaaaaaaaaaaaaaaaoaaaaeaaaaaaaaaabaaaadgaaaagaaaaaaaaacaaaaaaaaaa= --use-gl=disabled --log-file="c:\program files\adobe\acrobat dc\acrobat\ngl\cefworkflow\debug.log" --mojo-platform-channel-handle=2400 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=webrtchidelocalipswithmdns /prefetch:2
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe "c:\program files\adobe\acrobat dc\acrobat\ngl\cefworkflow\adobe_licensing_wf_helper_acro.exe" --type=renderer --log-severity=disable --cef-dll-path="c:\program files\adobe\acrobat dc\acrobat\acrocef_1" --no-sandbox --log-file="c:\program files\adobe\acrobat dc\acrobat\ngl\cefworkflow\debug.log" --touch-events=enabled --disable-gpu-compositing --lang=en-us --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --launch-time-ticks=5279044279 --mojo-platform-channel-handle=2912 --field-trial-handle=1680,i,5279835371788169838,14382164728314779093,131072 --disable-features=webrtchidelocalipswithmdns /prefetch:1
Queries the volume information (name, serial number etc) of a device
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1580457 Sample: End of Year Accounting for ... Startdate: 24/12/2024 Architecture: WINDOWS Score: 4 30 x1.c.lencr.org 2->30 32 www.msn.com 2->32 34 18 other IPs or domains 2->34 8 Acrobat.exe 27 151 2->8         started        process3 process4 10 adobe_licensing_wf_acro.exe 8->10         started        12 AdobeCollabSync.exe 3 8->12         started        14 AcroCEF.exe 8->14         started        process5 16 adobe_licensing_wf_helper_acro.exe 10->16         started        18 adobe_licensing_wf_helper_acro.exe 10->18         started        20 adobe_licensing_wf_helper_acro.exe 10->20         started        26 3 other processes 10->26 22 AdobeCollabSync.exe 10 131 12->22         started        24 AcroCEF.exe 14->24         started        process6 28 FullTrustNotifier.exe 22->28         started       
⊘No contacted IP infos

Contacted Domains

Name IP Active
resources-prod.licensingstack.com 18.161.92.206 true
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com 217.20.58.98 true
ax-0001.ax-msedge.net 150.171.27.10 true
pki-goog.l.google.com 142.250.181.99 true
fp2e7a.wpc.phicdn.net 192.229.221.95 true
sni1gl.wpc.sigmacdn.net 152.199.21.175 true
assets.msn.com unknown unknown
x1.c.lencr.org unknown unknown
ims-na1.adobelogin.com unknown unknown
srtb.msn.com unknown unknown
res.public.onecdn.static.microsoft unknown unknown
tse1.mm.bing.net unknown unknown
c.pki.goog unknown unknown
aefd.nelreports.net unknown unknown