Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
wetransfer_measles-docs_2024-10-01_1654.zip

Overview

General Information

Sample name:wetransfer_measles-docs_2024-10-01_1654.zip
Analysis ID:1523584
MD5:772fd52dc2a8cbaf64347b4d32c6238a
SHA1:ad0f2997b91a98a922474f92458644e22a5078f7
SHA256:29ae001083a6f94d5a659042d45f527a088d16c9fa05ceb82f24d969d61e5cf6
Infos:

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64_ra
  • rundll32.exe (PID: 4888 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)
  • Acrobat.exe (PID: 6672 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Temp1_wetransfer_measles-docs_2024-10-01_1654.zip\Measles IgM Assay Docs for DCN\DTX Batch Records\MAD-F-002-e Formulaire lamination.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 980 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 5080 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2268 --field-trial-handle=1608,i,15740231322271552655,9447220524649534135,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • Acrobat.exe (PID: 7924 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Temp1_wetransfer_measles-docs_2024-10-01_1654.zip\Measles IgM Assay Docs for DCN\DTX SOPs\3. MAD-I-027-a Pr paration et tra age du tampon de blocage de la membrane de nitrocellulose du test IgM rougeole.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 8136 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 6148 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2176 --field-trial-handle=1628,i,14780609754177666445,10077471866853840619,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • Acrobat.exe (PID: 7244 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Temp1_wetransfer_measles-docs_2024-10-01_1654.zip\Measles IgM Assay Docs for DCN\GADx SOPs\F012_Blocking of Measles NC_V4.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 6056 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 2060 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1376,i,13580310389225998366,7442836753837263385,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • Acrobat.exe (PID: 6660 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Temp1_wetransfer_measles-docs_2024-10-01_1654.zip\Measles IgM Assay Docs for DCN\GADx SOPs\E045 - QC Testing Procedure for Measles IgM Test Devices_V2.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
  • Acrobat.exe (PID: 7576 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Temp1_wetransfer_measles-docs_2024-10-01_1654.zip\Measles IgM Assay Docs for DCN\DTX Batch Records\MAD-F-067-b Pr paration de solution de BSA 100 mgmL.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 7784 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 6172 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2168 --field-trial-handle=1644,i,9641348054730088557,15027042306426077174,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • Acrobat.exe (PID: 8188 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Temp1_wetransfer_measles-docs_2024-10-01_1654.zip\Measles IgM Assay Docs for DCN\DTX Batch Records\MAD-F-049-b Preparation de 0.1M TAPS Acid.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknownDNS traffic detected: query: 206.23.85.13.in-addr.arpa replaycode: Name error (3)
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa
Source: 054bc852-42ca-410f-bb48-6ba63c360256.tmp.11.drString found in binary or memory: https://chrome.cloudflare-dns.com
Source: classification engineClassification label: clean1.winZIP@68/40@1/0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6488Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 13-59-27-275.logJump to behavior
Source: C:\Windows\System32\rundll32.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: unknownProcess created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknownProcess created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Temp1_wetransfer_measles-docs_2024-10-01_1654.zip\Measles IgM Assay Docs for DCN\DTX Batch Records\MAD-F-002-e Formulaire lamination.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2268 --field-trial-handle=1608,i,15740231322271552655,9447220524649534135,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Temp1_wetransfer_measles-docs_2024-10-01_1654.zip\Measles IgM Assay Docs for DCN\DTX SOPs\3. MAD-I-027-a Pr paration et tra age du tampon de blocage de la membrane de nitrocellulose du test IgM rougeole.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2176 --field-trial-handle=1628,i,14780609754177666445,10077471866853840619,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Temp1_wetransfer_measles-docs_2024-10-01_1654.zip\Measles IgM Assay Docs for DCN\GADx SOPs\F012_Blocking of Measles NC_V4.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1376,i,13580310389225998366,7442836753837263385,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Temp1_wetransfer_measles-docs_2024-10-01_1654.zip\Measles IgM Assay Docs for DCN\GADx SOPs\E045 - QC Testing Procedure for Measles IgM Test Devices_V2.pdf"
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Temp1_wetransfer_measles-docs_2024-10-01_1654.zip\Measles IgM Assay Docs for DCN\DTX Batch Records\MAD-F-067-b Pr paration de solution de BSA 100 mgmL.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2168 --field-trial-handle=1644,i,9641348054730088557,15027042306426077174,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Temp1_wetransfer_measles-docs_2024-10-01_1654.zip\Measles IgM Assay Docs for DCN\DTX Batch Records\MAD-F-049-b Preparation de 0.1M TAPS Acid.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2268 --field-trial-handle=1608,i,15740231322271552655,9447220524649534135,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2176 --field-trial-handle=1628,i,14780609754177666445,10077471866853840619,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1376,i,13580310389225998366,7442836753837263385,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2168 --field-trial-handle=1644,i,9641348054730088557,15027042306426077174,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknown
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: wetransfer_measles-docs_2024-10-01_1654.zipStatic file information: File size 41970557 > 1048576
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "c:\program files\adobe\acrobat dc\acrobat\acrobat.exe" "c:\users\user\appdata\local\temp\temp1_wetransfer_measles-docs_2024-10-01_1654.zip\measles igm assay docs for dcn\dtx sops\3. mad-i-027-a pr paration et tra age du tampon de blocage de la membrane de nitrocellulose du test igm rougeole.pdf"

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Command and Scripting Interpreter		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Non-Application Layer Protocol		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Rundll32		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Process Injection		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1523584 Sample: wetransfer_measles-docs_202... Startdate: 01/10/2024 Architecture: WINDOWS Score: 1 31 206.23.85.13.in-addr.arpa 2->31 7 Acrobat.exe 49 2->7         started        9 Acrobat.exe 48 2->9         started        11 Acrobat.exe 2->11         started        13 4 other processes 2->13 process3 process4 15 AcroCEF.exe 106 7->15         started        17 AcroCEF.exe 106 9->17         started        19 AcroCEF.exe 11->19         started        21 AcroCEF.exe 13->21         started        process5 23 AcroCEF.exe 4 15->23         started        25 AcroCEF.exe 2 17->25         started        27 AcroCEF.exe 19->27         started        29 AcroCEF.exe 21->29         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
206.23.85.13.in-addr.arpa
unknown
unknownfalse
    		unknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    https://chrome.cloudflare-dns.com054bc852-42ca-410f-bb48-6ba63c360256.tmp.11.drfalse
      		unknown

      World Map of Contacted IPs

      ⊘No contacted IP infos

      General Information

      Joe Sandbox version:41.0.0 Charoite
      Analysis ID:1523584
      Start date and time:2024-10-01 19:58:42 +02:00
      Joe Sandbox product:CloudBasic
      Overall analysis duration:0h 4m 55s
      Hypervisor based Inspection enabled:false
      Report type:full
      Cookbook file name:defaultwindowsinteractivecookbook.jbs
      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
      Number of analysed new started processes analysed:28
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • HCA enabled
      • EGA enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Sample name:wetransfer_measles-docs_2024-10-01_1654.zip
      Detection:CLEAN
      Classification:clean1.winZIP@68/40@1/0
      EGA Information:Failed
      HCA Information:
      • Successful, ratio: 100%
      • Number of executed functions: 0
      • Number of non-executed functions: 0
      Cookbook Comments:
      • Found application associated with file extension: .zip

      Warnings

      • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
      • Excluded IPs from analysis (whitelisted): 184.28.88.176, 54.144.73.197, 18.207.85.246, 34.193.227.236, 107.22.247.231, 172.64.41.3, 162.159.61.3, 52.5.13.197, 23.22.254.206, 54.227.187.23, 52.202.204.11
      • Excluded domains from analysis (whitelisted): bx-ring.msedge.net, 9fa99c95fe393109885eab24d2ebabc5.clo.footprintdns.com, e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, slscr.update.microsoft.com, arm-ring.msedge.net, ctldl.windowsupdate.com, t-ring-fdv2.msedge.net, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, o-ring-fallback.msedge.net, ssl-delivery.adobe.com.edgekey.net, a-ring.msedge.net, geo2.adobe.com
      • Not all processes where analyzed, report is missing behavior information
      • Report size exceeded maximum capacity and may have missing behavior information.
      • VT rate limit hit for: wetransfer_measles-docs_2024-10-01_1654.zip

      Simulations

      Behavior and APIs

      ⊘No simulations

      Joe Sandbox View / Context

      IPs

      ⊘No context

      Domains

      ⊘No context

      ASNs

      ⊘No context

      JA3 Fingerprints

      ⊘No context

      Dropped Files

      ⊘No context

      Created / dropped Files

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):287
      Entropy (8bit):5.098324603997015
      Encrypted:false
      SSDEEP:6:Z8Qyq2PRN2nKuAl9OmbnIFUt84rNAG1Zmw+4YQRkwORN2nKuAl9OmbjLJ:3yvaHAahFUt8sX/+qR5JHAaSJ
      MD5:03271590313B8AE7CB09C7AF7B8DA2B1
      SHA1:709E1FA5677697D625D62A0AA3E5FE78559B33F9
      SHA-256:4F4C26A1E459BBAE1617FAD638BB29080A59B5FBE0495CA18DAC385FB75E622E
      SHA-512:60A317C27684652CE84C8A8BE67948AA7A1DEBC95CCDBDA6C0152DB9050AF7FE24DAF32DE12E175F801942A124F7FD4587F4E630A2D97C8660E41881DC60AB1B
      Malicious:false
      Preview:2024/10/01-14:01:07.207 f90 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/01-14:01:07.209 f90 Recovering log #3.2024/10/01-14:01:07.210 f90 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):287
      Entropy (8bit):5.098324603997015
      Encrypted:false
      SSDEEP:6:Z8Qyq2PRN2nKuAl9OmbnIFUt84rNAG1Zmw+4YQRkwORN2nKuAl9OmbjLJ:3yvaHAahFUt8sX/+qR5JHAaSJ
      MD5:03271590313B8AE7CB09C7AF7B8DA2B1
      SHA1:709E1FA5677697D625D62A0AA3E5FE78559B33F9
      SHA-256:4F4C26A1E459BBAE1617FAD638BB29080A59B5FBE0495CA18DAC385FB75E622E
      SHA-512:60A317C27684652CE84C8A8BE67948AA7A1DEBC95CCDBDA6C0152DB9050AF7FE24DAF32DE12E175F801942A124F7FD4587F4E630A2D97C8660E41881DC60AB1B
      Malicious:false
      Preview:2024/10/01-14:01:07.207 f90 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/01-14:01:07.209 f90 Recovering log #3.2024/10/01-14:01:07.210 f90 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF557f25.TMP (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):287
      Entropy (8bit):5.098324603997015
      Encrypted:false
      SSDEEP:6:Z8Qyq2PRN2nKuAl9OmbnIFUt84rNAG1Zmw+4YQRkwORN2nKuAl9OmbjLJ:3yvaHAahFUt8sX/+qR5JHAaSJ
      MD5:03271590313B8AE7CB09C7AF7B8DA2B1
      SHA1:709E1FA5677697D625D62A0AA3E5FE78559B33F9
      SHA-256:4F4C26A1E459BBAE1617FAD638BB29080A59B5FBE0495CA18DAC385FB75E622E
      SHA-512:60A317C27684652CE84C8A8BE67948AA7A1DEBC95CCDBDA6C0152DB9050AF7FE24DAF32DE12E175F801942A124F7FD4587F4E630A2D97C8660E41881DC60AB1B
      Malicious:false
      Preview:2024/10/01-14:01:07.207 f90 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/01-14:01:07.209 f90 Recovering log #3.2024/10/01-14:01:07.210 f90 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF55b95f.TMP (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):287
      Entropy (8bit):5.098324603997015
      Encrypted:false
      SSDEEP:6:Z8Qyq2PRN2nKuAl9OmbnIFUt84rNAG1Zmw+4YQRkwORN2nKuAl9OmbjLJ:3yvaHAahFUt8sX/+qR5JHAaSJ
      MD5:03271590313B8AE7CB09C7AF7B8DA2B1
      SHA1:709E1FA5677697D625D62A0AA3E5FE78559B33F9
      SHA-256:4F4C26A1E459BBAE1617FAD638BB29080A59B5FBE0495CA18DAC385FB75E622E
      SHA-512:60A317C27684652CE84C8A8BE67948AA7A1DEBC95CCDBDA6C0152DB9050AF7FE24DAF32DE12E175F801942A124F7FD4587F4E630A2D97C8660E41881DC60AB1B
      Malicious:false
      Preview:2024/10/01-14:01:07.207 f90 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/01-14:01:07.209 f90 Recovering log #3.2024/10/01-14:01:07.210 f90 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF560eb3.TMP (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):287
      Entropy (8bit):5.098324603997015
      Encrypted:false
      SSDEEP:6:Z8Qyq2PRN2nKuAl9OmbnIFUt84rNAG1Zmw+4YQRkwORN2nKuAl9OmbjLJ:3yvaHAahFUt8sX/+qR5JHAaSJ
      MD5:03271590313B8AE7CB09C7AF7B8DA2B1
      SHA1:709E1FA5677697D625D62A0AA3E5FE78559B33F9
      SHA-256:4F4C26A1E459BBAE1617FAD638BB29080A59B5FBE0495CA18DAC385FB75E622E
      SHA-512:60A317C27684652CE84C8A8BE67948AA7A1DEBC95CCDBDA6C0152DB9050AF7FE24DAF32DE12E175F801942A124F7FD4587F4E630A2D97C8660E41881DC60AB1B
      Malicious:false
      Preview:2024/10/01-14:01:07.207 f90 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/01-14:01:07.209 f90 Recovering log #3.2024/10/01-14:01:07.210 f90 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):334
      Entropy (8bit):5.080042427717088
      Encrypted:false
      SSDEEP:6:Z73q2PRN2nKuAl9Ombzo2jMGIFUt84J5ZZmw+4hUZkwORN2nKuAl9Ombzo2jMmLJ:F3vaHAa8uFUt8MZ/+ZZ5JHAa8RJ
      MD5:C005653F933148823B6843BBC8F31359
      SHA1:4006AE6D0781997DDE8A34C7F143904D9A2B7343
      SHA-256:0360ABD4BB53EBD8B30C405484B9C7FC7D77B2165FBEF0C42875BA68E9E20E6A
      SHA-512:5C7EC208E53FDA0135C4222800D6EE392A49F5A76D96B2670520593CC2714D5CE4C4AE37760548E09D6B6043AF83A89179D1420086D0BC6CAC9BD1048CCAE9B6
      Malicious:false
      Preview:2024/10/01-14:01:07.260 1c30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/01-14:01:07.261 1c30 Recovering log #3.2024/10/01-14:01:07.262 1c30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):334
      Entropy (8bit):5.080042427717088
      Encrypted:false
      SSDEEP:6:Z73q2PRN2nKuAl9Ombzo2jMGIFUt84J5ZZmw+4hUZkwORN2nKuAl9Ombzo2jMmLJ:F3vaHAa8uFUt8MZ/+ZZ5JHAa8RJ
      MD5:C005653F933148823B6843BBC8F31359
      SHA1:4006AE6D0781997DDE8A34C7F143904D9A2B7343
      SHA-256:0360ABD4BB53EBD8B30C405484B9C7FC7D77B2165FBEF0C42875BA68E9E20E6A
      SHA-512:5C7EC208E53FDA0135C4222800D6EE392A49F5A76D96B2670520593CC2714D5CE4C4AE37760548E09D6B6043AF83A89179D1420086D0BC6CAC9BD1048CCAE9B6
      Malicious:false
      Preview:2024/10/01-14:01:07.260 1c30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/01-14:01:07.261 1c30 Recovering log #3.2024/10/01-14:01:07.262 1c30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old~RF557f44.TMP (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):334
      Entropy (8bit):5.080042427717088
      Encrypted:false
      SSDEEP:6:Z73q2PRN2nKuAl9Ombzo2jMGIFUt84J5ZZmw+4hUZkwORN2nKuAl9Ombzo2jMmLJ:F3vaHAa8uFUt8MZ/+ZZ5JHAa8RJ
      MD5:C005653F933148823B6843BBC8F31359
      SHA1:4006AE6D0781997DDE8A34C7F143904D9A2B7343
      SHA-256:0360ABD4BB53EBD8B30C405484B9C7FC7D77B2165FBEF0C42875BA68E9E20E6A
      SHA-512:5C7EC208E53FDA0135C4222800D6EE392A49F5A76D96B2670520593CC2714D5CE4C4AE37760548E09D6B6043AF83A89179D1420086D0BC6CAC9BD1048CCAE9B6
      Malicious:false
      Preview:2024/10/01-14:01:07.260 1c30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/01-14:01:07.261 1c30 Recovering log #3.2024/10/01-14:01:07.262 1c30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old~RF55b97e.TMP (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):334
      Entropy (8bit):5.080042427717088
      Encrypted:false
      SSDEEP:6:Z73q2PRN2nKuAl9Ombzo2jMGIFUt84J5ZZmw+4hUZkwORN2nKuAl9Ombzo2jMmLJ:F3vaHAa8uFUt8MZ/+ZZ5JHAa8RJ
      MD5:C005653F933148823B6843BBC8F31359
      SHA1:4006AE6D0781997DDE8A34C7F143904D9A2B7343
      SHA-256:0360ABD4BB53EBD8B30C405484B9C7FC7D77B2165FBEF0C42875BA68E9E20E6A
      SHA-512:5C7EC208E53FDA0135C4222800D6EE392A49F5A76D96B2670520593CC2714D5CE4C4AE37760548E09D6B6043AF83A89179D1420086D0BC6CAC9BD1048CCAE9B6
      Malicious:false
      Preview:2024/10/01-14:01:07.260 1c30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/01-14:01:07.261 1c30 Recovering log #3.2024/10/01-14:01:07.262 1c30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old~RF560ee2.TMP (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):334
      Entropy (8bit):5.080042427717088
      Encrypted:false
      SSDEEP:6:Z73q2PRN2nKuAl9Ombzo2jMGIFUt84J5ZZmw+4hUZkwORN2nKuAl9Ombzo2jMmLJ:F3vaHAa8uFUt8MZ/+ZZ5JHAa8RJ
      MD5:C005653F933148823B6843BBC8F31359
      SHA1:4006AE6D0781997DDE8A34C7F143904D9A2B7343
      SHA-256:0360ABD4BB53EBD8B30C405484B9C7FC7D77B2165FBEF0C42875BA68E9E20E6A
      SHA-512:5C7EC208E53FDA0135C4222800D6EE392A49F5A76D96B2670520593CC2714D5CE4C4AE37760548E09D6B6043AF83A89179D1420086D0BC6CAC9BD1048CCAE9B6
      Malicious:false
      Preview:2024/10/01-14:01:07.260 1c30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/01-14:01:07.261 1c30 Recovering log #3.2024/10/01-14:01:07.262 1c30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\054bc852-42ca-410f-bb48-6ba63c360256.tmp

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:JSON data
      Category:modified
      Size (bytes):371
      Entropy (8bit):4.981259551376632
      Encrypted:false
      SSDEEP:6:YHpoNXR8+eqq59E3MhsDHF4R8H2a9a1o3/QBR7Y53h6ubU74MS7PMVKJTnMRKXkS:YHO8sqISsBd2caq3QYiubrP7E4TX
      MD5:80425CC488EFCDBC6188C62A6B7FBD68
      SHA1:68C5507E7F1A40CCADBC03265A40841EB8157D2C
      SHA-256:244077B865F4067EE385821CB267F2901CEEC79B2860CF1CFA745920661C543E
      SHA-512:674C876AC360265267B422FA9B19444405025AAE038E92D5D6DD1531F92EB2B7E1C91112226726E91DDA0D66B53AF9E60ABDC7B96C46E22E0479C824013BA26C
      Malicious:false
      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372365571211899","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):371
      Entropy (8bit):4.981259551376632
      Encrypted:false
      SSDEEP:6:YHpoNXR8+eqq59E3MhsDHF4R8H2a9a1o3/QBR7Y53h6ubU74MS7PMVKJTnMRKXkS:YHO8sqISsBd2caq3QYiubrP7E4TX
      MD5:80425CC488EFCDBC6188C62A6B7FBD68
      SHA1:68C5507E7F1A40CCADBC03265A40841EB8157D2C
      SHA-256:244077B865F4067EE385821CB267F2901CEEC79B2860CF1CFA745920661C543E
      SHA-512:674C876AC360265267B422FA9B19444405025AAE038E92D5D6DD1531F92EB2B7E1C91112226726E91DDA0D66B53AF9E60ABDC7B96C46E22E0479C824013BA26C
      Malicious:false
      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372365571211899","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:data
      Category:dropped
      Size (bytes):8137
      Entropy (8bit):5.254765776559202
      Encrypted:false
      SSDEEP:192:OLT0bTIeYa51Ogu/0OZARBT8kN88yGY/7XH1zHTXFpe5U7CIwg8LEn25zMER:Yk31Jsp1qIO
      MD5:E40C46F5A86E72BC6AD38C09F57C0A3E
      SHA1:6BC2D4059A223A9ACBF82AE167CE73ED12E114FE
      SHA-256:001F9A08F72E908A67CCEA49A2F908AB47D111431F05E464207CF436F86FB9CB
      SHA-512:2650A543FEA8315B8BA227929F34E5FDEA0CCB166068C5C411BCBAB40235B7D798134E8245388D862E1B3F9BD4916C1BA415571C411D4428049651A56965210C
      Malicious:false
      Preview:*...#................version.1..namespace-e...o................next-map-id.1.Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/.0y.S_r................next-map-id.2.Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/.16.X:r................next-map-id.3.Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/.2.P.@o................next-map-id.4.Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/.346.+^...............Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/....^...............Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/..?&a...............Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/_...a...............Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/...o................next-map-id.5.Pnamespace-07af9ee9_2076_4f12_94b5_

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):322
      Entropy (8bit):5.059939224685856
      Encrypted:false
      SSDEEP:6:7Kq2PRN2nKuAl9OmbzNMxIFUt8XSZmw+XekwORN2nKuAl9OmbzNMFLJ:mvaHAa8jFUt8XS/+Xe5JHAa84J
      MD5:3E2EC684BAA8CE0C5AC1570680AA89D5
      SHA1:CE1F080C6309C0FB8542576179318C65C01F949C
      SHA-256:D89C03E7F2835D562FD6B671874642A7A9E6A43D096185223414C03E741B8F23
      SHA-512:14C12D008738798ED11F5715E6DA5E4B3C36733E800C4766B937E819F382752CB528A2F411EEDFBC9CA4D7905848E92BADE9D9B231F03CBFC8DD8A8525A970BF
      Malicious:false
      Preview:2024/10/01-14:01:07.302 1c30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/01-14:01:07.304 1c30 Recovering log #3.2024/10/01-14:01:07.304 1c30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):322
      Entropy (8bit):5.059939224685856
      Encrypted:false
      SSDEEP:6:7Kq2PRN2nKuAl9OmbzNMxIFUt8XSZmw+XekwORN2nKuAl9OmbzNMFLJ:mvaHAa8jFUt8XS/+Xe5JHAa84J
      MD5:3E2EC684BAA8CE0C5AC1570680AA89D5
      SHA1:CE1F080C6309C0FB8542576179318C65C01F949C
      SHA-256:D89C03E7F2835D562FD6B671874642A7A9E6A43D096185223414C03E741B8F23
      SHA-512:14C12D008738798ED11F5715E6DA5E4B3C36733E800C4766B937E819F382752CB528A2F411EEDFBC9CA4D7905848E92BADE9D9B231F03CBFC8DD8A8525A970BF
      Malicious:false
      Preview:2024/10/01-14:01:07.302 1c30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/01-14:01:07.304 1c30 Recovering log #3.2024/10/01-14:01:07.304 1c30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old~RF557f83.TMP (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):322
      Entropy (8bit):5.059939224685856
      Encrypted:false
      SSDEEP:6:7Kq2PRN2nKuAl9OmbzNMxIFUt8XSZmw+XekwORN2nKuAl9OmbzNMFLJ:mvaHAa8jFUt8XS/+Xe5JHAa84J
      MD5:3E2EC684BAA8CE0C5AC1570680AA89D5
      SHA1:CE1F080C6309C0FB8542576179318C65C01F949C
      SHA-256:D89C03E7F2835D562FD6B671874642A7A9E6A43D096185223414C03E741B8F23
      SHA-512:14C12D008738798ED11F5715E6DA5E4B3C36733E800C4766B937E819F382752CB528A2F411EEDFBC9CA4D7905848E92BADE9D9B231F03CBFC8DD8A8525A970BF
      Malicious:false
      Preview:2024/10/01-14:01:07.302 1c30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/01-14:01:07.304 1c30 Recovering log #3.2024/10/01-14:01:07.304 1c30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old~RF55b9ad.TMP (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):322
      Entropy (8bit):5.059939224685856
      Encrypted:false
      SSDEEP:6:7Kq2PRN2nKuAl9OmbzNMxIFUt8XSZmw+XekwORN2nKuAl9OmbzNMFLJ:mvaHAa8jFUt8XS/+Xe5JHAa84J
      MD5:3E2EC684BAA8CE0C5AC1570680AA89D5
      SHA1:CE1F080C6309C0FB8542576179318C65C01F949C
      SHA-256:D89C03E7F2835D562FD6B671874642A7A9E6A43D096185223414C03E741B8F23
      SHA-512:14C12D008738798ED11F5715E6DA5E4B3C36733E800C4766B937E819F382752CB528A2F411EEDFBC9CA4D7905848E92BADE9D9B231F03CBFC8DD8A8525A970BF
      Malicious:false
      Preview:2024/10/01-14:01:07.302 1c30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/01-14:01:07.304 1c30 Recovering log #3.2024/10/01-14:01:07.304 1c30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old~RF560f01.TMP (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):322
      Entropy (8bit):5.059939224685856
      Encrypted:false
      SSDEEP:6:7Kq2PRN2nKuAl9OmbzNMxIFUt8XSZmw+XekwORN2nKuAl9OmbzNMFLJ:mvaHAa8jFUt8XS/+Xe5JHAa84J
      MD5:3E2EC684BAA8CE0C5AC1570680AA89D5
      SHA1:CE1F080C6309C0FB8542576179318C65C01F949C
      SHA-256:D89C03E7F2835D562FD6B671874642A7A9E6A43D096185223414C03E741B8F23
      SHA-512:14C12D008738798ED11F5715E6DA5E4B3C36733E800C4766B937E819F382752CB528A2F411EEDFBC9CA4D7905848E92BADE9D9B231F03CBFC8DD8A8525A970BF
      Malicious:false
      Preview:2024/10/01-14:01:07.302 1c30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/01-14:01:07.304 1c30 Recovering log #3.2024/10/01-14:01:07.304 1c30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2720

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:PostScript document text
      Category:dropped
      Size (bytes):185099
      Entropy (8bit):5.182478651346149
      Encrypted:false
      SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
      MD5:94185C5850C26B3C6FC24ABC385CDA58
      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
      Malicious:false
      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6488

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:PostScript document text
      Category:dropped
      Size (bytes):185099
      Entropy (8bit):5.182478651346149
      Encrypted:false
      SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
      MD5:94185C5850C26B3C6FC24ABC385CDA58
      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
      Malicious:false
      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6572

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:PostScript document text
      Category:dropped
      Size (bytes):185099
      Entropy (8bit):5.182478651346149
      Encrypted:false
      SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
      MD5:94185C5850C26B3C6FC24ABC385CDA58
      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
      Malicious:false
      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7768

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:PostScript document text
      Category:dropped
      Size (bytes):185099
      Entropy (8bit):5.182478651346149
      Encrypted:false
      SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
      MD5:94185C5850C26B3C6FC24ABC385CDA58
      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
      Malicious:false
      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8016

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:PostScript document text
      Category:dropped
      Size (bytes):185099
      Entropy (8bit):5.182478651346149
      Encrypted:false
      SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
      MD5:94185C5850C26B3C6FC24ABC385CDA58
      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
      Malicious:false
      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:PostScript document text
      Category:dropped
      Size (bytes):185099
      Entropy (8bit):5.182478651346149
      Encrypted:false
      SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
      MD5:94185C5850C26B3C6FC24ABC385CDA58
      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
      Malicious:false
      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:data
      Category:dropped
      Size (bytes):228351
      Entropy (8bit):3.3898188882857125
      Encrypted:false
      SSDEEP:1536:qKPC4iyzDtrh1cK3XEivQ7VK/3AYvYwgF/rRoL+sn:XPCaH/3AYvYwglFoL+sn
      MD5:20A7B5B58ED072AE08A03BC126638854
      SHA1:E6F3576C1BF518BFEB2E3117C7B06D9567BDA927
      SHA-256:68FB83644BDF0195E6D962C1F7D0B84820E78B61E08558D12E7669615AAC02AA
      SHA-512:624B8D689D50CC2960E85018035D1CECE498361FD31740AABC7AF56EF0F9623B20F2E1266ACC788A7320DDAB5FF6296175600F561D38437897E3F419B8A981CC
      Malicious:false
      Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:data
      Category:dropped
      Size (bytes):4
      Entropy (8bit):0.8112781244591328
      Encrypted:false
      SSDEEP:3:e:e
      MD5:DC84B0D741E5BEAE8070013ADDCC8C28
      SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
      SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
      SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
      Malicious:false
      Preview:....

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):2145
      Entropy (8bit):5.081856935187582
      Encrypted:false
      SSDEEP:48:YRYAiESAuYCjWbj2CjxjZ4oijxi+0jPjrVbjBgajF:KKDWP2ERaTx3y7BPBgMF
      MD5:127CD4AF3A3592CBC861D5FBE774BB42
      SHA1:C67072E20C48DD961CB292F208DD44AB05909C1A
      SHA-256:EF61B95628CBE4050F69A74068C4AE0A7085CA4E834CCE07E2BDA44E489ECB79
      SHA-512:3FE04BE05EC37182B9FE2A7FB15D3309ABD376BE427564E37222509CC38B9D1B7A938FE13FEC4D90FA8F3907E1CBD00F57307B4DC8E44E28F57A53E719BD83C3
      Malicious:false
      Preview:{"all":[{"id":"TESTING","info":{"dg":"DG","sid":"TESTING"},"mimeType":"file","size":4,"ts":1727805676000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"f44756c6e08822e64c0e471a2499e34d","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1696585148000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e8f53b6740aba22a83a1a569cebedbcc","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696585148000},{"id":"DC_FirstMile_Right_Sec_Surface","info":{"dg":"cc1faa6a0c714f2f0c497731f1772fa2","sid":"DC_FirstMile_Right_Sec_Surface"},"mimeType":"file","size":294,"ts":1696585143000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"ab062dea95f25ef019cc2f5f5f0121d4","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696583346000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"65580efad4bc88b91040ff50d71bfae9","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1255,"ts":1696583346000},{"id":"DC_Reader_Edit_LHP_Banner"

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 29, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 29
      Category:dropped
      Size (bytes):12288
      Entropy (8bit):1.1283009684038534
      Encrypted:false
      SSDEEP:24:TLRx/XYKQvGJF7ursZGDAw7dw7hL8lLuZCpmQCpmS5Xn59F:T1l2GL7msue9qj4hx
      MD5:A498F56B5E1E7EAC2B94645EA1B58ED8
      SHA1:75DB53023E81E4FE178A754983887912B4E34761
      SHA-256:C301FC8668D6B98602B67B5466DDF7BE3142DF475BA1D5B99AFBD0941B9074F3
      SHA-512:BB5A77CBE65059AECE501339FB09C2A4B19052CA06706ED615418812417886713F27738CF3F5E428AA691034240FB8E5192BA90F1DFD80B486E981C8B2A92347
      Malicious:false
      Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:SQLite Rollback Journal
      Category:dropped
      Size (bytes):8720
      Entropy (8bit):1.4640878018485686
      Encrypted:false
      SSDEEP:24:7+to9uAw7dw7hL8lLuZCpmQCpmS5Xn593qLhx/XYKQvGJF7ursE:7MJe9qj4hTqFl2GL7msE
      MD5:F00F0DB94D7B1B9E0C42AA7FB78135DA
      SHA1:842F12362981BDAC218D85815F26E7BB272A69DA
      SHA-256:E7D5EA050B2B2FF502EC6773694CC2F5BE54A32D468BED1D654E7DCDAF14ED28
      SHA-512:CDE1C2F5388F3B5E001F3F733886A749FC3648CD7E29A8B1271306D2FE564879FE6423923A4FF8AF8C54912E0E6FA43B0B7A094633DD15B19C997CCF72E5CB81
      Malicious:false
      Preview:.... .c.....M.L2......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j......#...r.+.........N..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

      C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91x81oaj_150ru0r_508.tmp

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:PDF document, version 1.6, 0 pages
      Category:dropped
      Size (bytes):358
      Entropy (8bit):5.058717318417263
      Encrypted:false
      SSDEEP:6:IngVMrexJzJT0y9VEQIFVmb/eu2g/86S1kxROO0JdMCCSyAAO:IngVMre9T0HQIDmy9g06JXkfVlX
      MD5:D46A6A56330C01F666C1D5A173B3A5AC
      SHA1:8A3A2F32B8210E35EE9AB13DBFA54CD48BC47E88
      SHA-256:A8BBF3793189EE0E647F2A0CF0DFBACFB5081E1AC734B275B88C80280E4DAA05
      SHA-512:4805B1B4AB7DF582B0648AA855A8446FFAEA2911FB7197C95689F18DB661F14EF0CE4BDD0EDE5FA57CDA2238D785DB3F427262342A18189046D586F628044E44
      Malicious:false
      Preview:%PDF-1.6.%......1 0 obj.<</Pages 2 0 R/Type/Catalog>>.endobj.2 0 obj.<</Count 0/Kids[]/Type/Pages>>.endobj.3 0 obj.<<>>.endobj.xref..0 4..0000000000 65535 f..0000000016 00000 n..0000000061 00000 n..0000000107 00000 n..trailer..<</Size 4/Root 1 0 R/Info 3 0 R/ID[<C13A767E26727E47B79D45F7564BCF7B><C13A767E26727E47B79D45F7564BCF7B>]>>..startxref..127..%%EOF..

      C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9fsd4wh_1qoynke_52k.tmp

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:PDF document, version 1.6, 0 pages
      Category:dropped
      Size (bytes):358
      Entropy (8bit):5.081953283315546
      Encrypted:false
      SSDEEP:6:IngVMrexJzJT0y9VEQIFVmb/eu2g/86S1kxROOM5X4Sph5X4SSCCSyAAO:IngVMre9T0HQIDmy9g06JX85Xrh5XtlX
      MD5:9333F73A3FD8994D4F161AB0B28E8B61
      SHA1:4FD9F71EC0C051027FE87A9AB30AF5C4617C2D0B
      SHA-256:D2CE7D78BFD47221E4C7DA5C5F795D0D68ECCCBDB1D33FBCEBC68C0519B9ACF0
      SHA-512:D9F429F5DF20753F11F0F104991A22291D740EC8A2436C78DE3449DF1081E6BEA4FE4A51F877A909A14A3C11F89ADC204EA6B3C7EC122F8E9926812C29624B42
      Malicious:false
      Preview:%PDF-1.6.%......1 0 obj.<</Pages 2 0 R/Type/Catalog>>.endobj.2 0 obj.<</Count 0/Kids[]/Type/Pages>>.endobj.3 0 obj.<<>>.endobj.xref..0 4..0000000000 65535 f..0000000016 00000 n..0000000061 00000 n..0000000107 00000 n..trailer..<</Size 4/Root 1 0 R/Info 3 0 R/ID[<959A93BE6E1EB24BAA293D987E6DA7A0><959A93BE6E1EB24BAA293D987E6DA7A0>]>>..startxref..127..%%EOF..

      C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9khtni2_xax7sn_5zs.tmp

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:PDF document, version 1.6, 0 pages
      Category:dropped
      Size (bytes):358
      Entropy (8bit):5.097977590960268
      Encrypted:false
      SSDEEP:6:IngVMrexJzJT0y9VEQIFVmb/eu2g/86S1kxROOLRkkqlQVRkkqlQaTCSyAAO:IngVMre9T0HQIDmy9g06JX1UKVRUKaTR
      MD5:AE12B4B5D46AF41129A368E9CE2268E9
      SHA1:CF35CF1F910FDD0B5991FD6A0E03500BC47ACED2
      SHA-256:39C961014442DBE1DFA462D2A55E804C2E1CE0169113BDC9D715F093AC37ACCD
      SHA-512:BF3A8E389B25000086F9ED06F9C892210D5E2D900F1A6F25081414A5A916A93477C840A500301CC5C6C26D4547D33B63662EC835A801B306AC9E01B4EA9D2379
      Malicious:false
      Preview:%PDF-1.6.%......1 0 obj.<</Pages 2 0 R/Type/Catalog>>.endobj.2 0 obj.<</Count 0/Kids[]/Type/Pages>>.endobj.3 0 obj.<<>>.endobj.xref..0 4..0000000000 65535 f..0000000016 00000 n..0000000061 00000 n..0000000107 00000 n..trailer..<</Size 4/Root 1 0 R/Info 3 0 R/ID[<DEFCE4AA9180EB49A1AE3F22BAC8C757><DEFCE4AA9180EB49A1AE3F22BAC8C757>]>>..startxref..127..%%EOF..

      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 13-59-27-275.log

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:ASCII text, with very long lines (393)
      Category:dropped
      Size (bytes):16525
      Entropy (8bit):5.353642815103214
      Encrypted:false
      SSDEEP:384:tbxtsuP+XEWJJQbnR8L31M7HeltV+KYm3wsa2KjF4ODkr/O8r2IUHUHMWwEyZRN2:aPL
      MD5:91F06491552FC977E9E8AF47786EE7C1
      SHA1:8FEB27904897FFCC2BE1A985D479D7F75F11CEFC
      SHA-256:06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
      SHA-512:A63E6E0D25B88EBB6602885AB8E91167D37267B24516A11F7492F48876D3DDCAE44FFC386E146F3CF6EB4FA6AF251602143F254687B17FCFE6F00783095C5082
      Malicious:false
      Preview:SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig:

      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 14-00-32-782.log

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:ASCII text, with very long lines (393)
      Category:dropped
      Size (bytes):16529
      Entropy (8bit):5.318650629715428
      Encrypted:false
      SSDEEP:384:2KQRoSL1N21HjEoUOWK5TEoT/iK5GaeeQF4WEIWVeeFcy68Yg5l/2T25as5Dnme6:YCykLvIwpGN
      MD5:7709CAC1A1883E442F9FCD815BD578A2
      SHA1:EFE050418BCCEFD0C545D69F5E96EDEFC69F45C4
      SHA-256:0FE973FAC57D41C2C2EF4CB688726C331EE4B254D02369F341C7A4A9DB85B822
      SHA-512:53AD3913488EDDFCB992EEE7BD5435ECA500DF6AEC6BE8FE7D9FD263E038C05DA590E3ECF080310EAC6B4663405A674BB81C7E57FD04EFA47877307BF85B579F
      Malicious:false
      Preview:SessionID=97b2e29a-0b09-4708-8ec8-2329c4a97b8a.1727805567286 Timestamp=2024-10-01T13:59:27:286-0400 ThreadID=5988 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=97b2e29a-0b09-4708-8ec8-2329c4a97b8a.1727805567286 Timestamp=2024-10-01T13:59:27:288-0400 ThreadID=5988 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=97b2e29a-0b09-4708-8ec8-2329c4a97b8a.1727805567286 Timestamp=2024-10-01T13:59:27:288-0400 ThreadID=5988 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=97b2e29a-0b09-4708-8ec8-2329c4a97b8a.1727805567286 Timestamp=2024-10-01T13:59:27:288-0400 ThreadID=5988 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=97b2e29a-0b09-4708-8ec8-2329c4a97b8a.1727805567286 Timestamp=2024-10-01T13:59:27:288-0400 ThreadID=5988 Component=ngl-lib_NglAppLib Description="SetConfig:

      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 14-00-47-660.log

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:ASCII text, with very long lines (393)
      Category:dropped
      Size (bytes):16529
      Entropy (8bit):5.312174970644571
      Encrypted:false
      SSDEEP:384:UnkgqgXgCgggxg/sg5gqgEgxgDgQNgeN3NIj/jTjhjl8a828D8I8rGrgror6e+ev:+J2g
      MD5:240DD33085E618CF88915477AAB085CD
      SHA1:46710DB3782F29E787BE76850877FD1A58F6C980
      SHA-256:C44E39AFB3ED06AF8938CB6D7420A21F37B4D49F4260C62A6E56304B632181FF
      SHA-512:EFA19F54E55A7256628344057916501769FB53319839C69223B29BBDF6DE9EFA72053843F7237B6DFA0572A2DAA961DDCDA52DC5A2A741DA0471C23F32F2D80D
      Malicious:false
      Preview:SessionID=75c42b50-fbb5-4f00-b494-82246857275b.1727805632811 Timestamp=2024-10-01T14:00:32:811-0400 ThreadID=2972 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=75c42b50-fbb5-4f00-b494-82246857275b.1727805632811 Timestamp=2024-10-01T14:00:32:812-0400 ThreadID=2972 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=75c42b50-fbb5-4f00-b494-82246857275b.1727805632811 Timestamp=2024-10-01T14:00:32:812-0400 ThreadID=2972 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=75c42b50-fbb5-4f00-b494-82246857275b.1727805632811 Timestamp=2024-10-01T14:00:32:812-0400 ThreadID=2972 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=75c42b50-fbb5-4f00-b494-82246857275b.1727805632811 Timestamp=2024-10-01T14:00:32:812-0400 ThreadID=2972 Component=ngl-lib_NglAppLib Description="SetConfig:

      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 14-00-54-528.log

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:ASCII text, with very long lines (393)
      Category:dropped
      Size (bytes):16529
      Entropy (8bit):5.318363513349871
      Encrypted:false
      SSDEEP:384:O54MiMNMaMIMjM5GM7MSMAMh5MXMrM5M6zo3l3BqDBXUeUKUlUkUV8p6pCpw8k8W:ekBxrTjru
      MD5:448936B9A921E612F7FC52D769CBAC26
      SHA1:3946ACAA1C75A6814EA960E17FBE0F3428704FA7
      SHA-256:C06C0FD44832F4738708659BE36A7CC758AA811036D2D0B0FF49FD21EF1F028D
      SHA-512:6A26127B34057027DEB4312AA4D01628224555D2FBB4E6C3EFC0A4B0008834FDADC96D5B8F9D40DEBAF7EB0706AC0A27D1E20D44EBBE2CD2353920C20D46D71A
      Malicious:false
      Preview:SessionID=c4f6a921-a805-4664-9505-dd4d4683b499.1727805647670 Timestamp=2024-10-01T14:00:47:670-0400 ThreadID=1768 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=c4f6a921-a805-4664-9505-dd4d4683b499.1727805647670 Timestamp=2024-10-01T14:00:47:671-0400 ThreadID=1768 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=c4f6a921-a805-4664-9505-dd4d4683b499.1727805647670 Timestamp=2024-10-01T14:00:47:671-0400 ThreadID=1768 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=c4f6a921-a805-4664-9505-dd4d4683b499.1727805647670 Timestamp=2024-10-01T14:00:47:671-0400 ThreadID=1768 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=c4f6a921-a805-4664-9505-dd4d4683b499.1727805647670 Timestamp=2024-10-01T14:00:47:671-0400 ThreadID=1768 Component=ngl-lib_NglAppLib Description="SetConfig:

      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 14-01-09-522.log

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:ASCII text, with very long lines (393)
      Category:dropped
      Size (bytes):16529
      Entropy (8bit):5.299256046912558
      Encrypted:false
      SSDEEP:384:fopvXvCvfvBvsvVnv0v/i5iLCi+imiciGixkCkWkkkwLjLHLKLNLZh1DC1D21DMi:fW/KX5Udns3y0C1TtDsXFXF/7OpPwQOi
      MD5:6D75B11D7ADE0E39219507B720E49898
      SHA1:1D59FBAA036C3CCC6FB2E147570C24535E9D7C16
      SHA-256:9779714AA4E5CBBC9398361FB13C2C7D917F5C222A9B42CD0107873A1C31C573
      SHA-512:977027F8619D5195C216F7EE2BC6B0C1A3B3E73E201C1755D93E4FBF1CBD81AA8F87FCEBCAF7BD61D5854701287856CFB2C985F02601A0323975EFDFD58C638D
      Malicious:false
      Preview:SessionID=4afb2717-7117-4f59-bf78-49beed9c55ec.1727805654541 Timestamp=2024-10-01T14:00:54:541-0400 ThreadID=7124 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=4afb2717-7117-4f59-bf78-49beed9c55ec.1727805654541 Timestamp=2024-10-01T14:00:54:542-0400 ThreadID=7124 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=4afb2717-7117-4f59-bf78-49beed9c55ec.1727805654541 Timestamp=2024-10-01T14:00:54:542-0400 ThreadID=7124 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=4afb2717-7117-4f59-bf78-49beed9c55ec.1727805654541 Timestamp=2024-10-01T14:00:54:542-0400 ThreadID=7124 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=4afb2717-7117-4f59-bf78-49beed9c55ec.1727805654541 Timestamp=2024-10-01T14:00:54:542-0400 ThreadID=7124 Component=ngl-lib_NglAppLib Description="SetConfig:

      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 14-01-16-019.log

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:ASCII text, with very long lines (393)
      Category:dropped
      Size (bytes):16529
      Entropy (8bit):5.3107849248349845
      Encrypted:false
      SSDEEP:384:gSuZWKlq1BMiURyfcqmjWATQItka6IYoPycOoguAfZK2ExqXBeu9JyWVuY2ZI1NR:L/Nb
      MD5:D5320EF462BA454A444F6994B91EA01B
      SHA1:B5FCC9DA04F99528440076722835124938D2603E
      SHA-256:2DDAF7D7314CF72367454E0637B936DA08E2DD1076B11F531EA07BB75C194D71
      SHA-512:4CA5F643B400CC26FF5FF73EFC7D2F3479929597E8B7CE64941F3FC76250DB0CE0AF7B70A183B99B073860BF741DCBA03592ADE5630C81698B38F3ACDE1EAA92
      Malicious:false
      Preview:SessionID=d9ad88bb-bbc9-4ec6-a324-ac9eed00485a.1727805669542 Timestamp=2024-10-01T14:01:09:542-0400 ThreadID=7804 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=d9ad88bb-bbc9-4ec6-a324-ac9eed00485a.1727805669542 Timestamp=2024-10-01T14:01:09:543-0400 ThreadID=7804 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=d9ad88bb-bbc9-4ec6-a324-ac9eed00485a.1727805669542 Timestamp=2024-10-01T14:01:09:543-0400 ThreadID=7804 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=d9ad88bb-bbc9-4ec6-a324-ac9eed00485a.1727805669542 Timestamp=2024-10-01T14:01:09:543-0400 ThreadID=7804 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=d9ad88bb-bbc9-4ec6-a324-ac9eed00485a.1727805669542 Timestamp=2024-10-01T14:01:09:543-0400 ThreadID=7804 Component=ngl-lib_NglAppLib Description="SetConfig:

      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:ASCII text, with very long lines (393), with CRLF line terminators
      Category:dropped
      Size (bytes):15114
      Entropy (8bit):5.318744768577257
      Encrypted:false
      SSDEEP:384:6l5MppgMGM77qVa+8kmuguNkcv8coJlyET3bthNg1QEguivnH0he9m9M52szcJxC:nUw
      MD5:3AB85278F4FED7C91069A0D656D7FC4A
      SHA1:799EF66EEB9BE23E1306494CC708D144C791DF39
      SHA-256:A370080729EEF67C94863C90830E4FF0BB5907924AD0B29D55A0D5561F137705
      SHA-512:A144D252F8DC8B71D0601DBB1944367171E77B7ABBA59A655619899B50391EEFD70FB9A8337EB5BDAEB7AB596CA8E7163E3C92A7A435B98224A966C3B3A8762D
      Malicious:false
      Preview:SessionID=16253c40-7174-4e41-93ba-ed8c492e9b0b.1727805676028 Timestamp=2024-10-01T14:01:16:028-0400 ThreadID=8128 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=16253c40-7174-4e41-93ba-ed8c492e9b0b.1727805676028 Timestamp=2024-10-01T14:01:16:029-0400 ThreadID=8128 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=16253c40-7174-4e41-93ba-ed8c492e9b0b.1727805676028 Timestamp=2024-10-01T14:01:16:029-0400 ThreadID=8128 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=16253c40-7174-4e41-93ba-ed8c492e9b0b.1727805676028 Timestamp=2024-10-01T14:01:16:029-0400 ThreadID=8128 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=16253c40-7174-4e41-93ba-ed8c492e9b0b.1727805676028 Timestamp=2024-10-01T14:01:16:029-0400 ThreadID=8128 Component=ngl-lib_NglAppLib Description="SetConf

      C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:ASCII text, with CRLF line terminators
      Category:dropped
      Size (bytes):59597
      Entropy (8bit):5.395195806170919
      Encrypted:false
      SSDEEP:1536:g++CpSbCDnjD1yH2C1GfA2s2j7J112UCqC:K
      MD5:031A2872C926F5D19638BD866E2022FB
      SHA1:D8C196222AEF299A93EC3218F02A7B24C47900C5
      SHA-256:F2E6D33545FCA8CC51D6EE4FC22BA17C9063D81FE4122DA9475155B3884EF229
      SHA-512:E008E5CE47A0D124CEC0F1C6777BECFC88ADA8097AE565F61FEF14D81479AF5608B51034BEF21793666B7D9865459435AB8BB2A01E9AA432CECE59C81A9B5D95
      Malicious:false
      Preview:06-10-2023 10:08:42:.---2---..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 10:08:42:.Closing File..06-10-

      Static File Info

      General

      File type:Zip archive data, at least v2.0 to extract, compression method=store
      Entropy (8bit):7.716531534744486
      TrID:
      • ZIP compressed archive (8000/1) 100.00%
      File name:wetransfer_measles-docs_2024-10-01_1654.zip
      File size:41'970'557 bytes
      MD5:772fd52dc2a8cbaf64347b4d32c6238a
      SHA1:ad0f2997b91a98a922474f92458644e22a5078f7
      SHA256:29ae001083a6f94d5a659042d45f527a088d16c9fa05ceb82f24d969d61e5cf6
      SHA512:8edd44dbe04280e93bda28e21853679f4338ba25449025e4561e9de24ff0b6e386db10ed65b6905fdbf4409e796f8f03ecb128b9b10311568a326a134304e2e4
      SSDEEP:786432:04Tl+sOyWiN8RbyqMvceuspT9gyqPCrsgKzcNrD:04MfiN81IkUqHgKzWrD
      TLSH:F697BC138C089B87D52983D87E071E5C6F1A3B1DE8C63AFF15664EDB3E206265C9E11E
      File Content Preview:PK..........AY.+..........h...Measles IgM Assay Docs for DCN/GADx SOPs/E045 - QC Testing Procedure for Measles IgM Test Devices_V2.pdfUT...g).f%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en-GB) /StructTreeRoot 105 0 R/MarkInfo<</Marked true

      File Icon

      Icon Hash:1c1c1e4e4ececedc

      Network Behavior

      Network Port Distribution

      UDP Packets

      TimestampSource PortDest PortSource IPDest IP
      Oct 1, 2024 19:59:40.475090981 CEST5362348162.159.36.2192.168.2.16
      Oct 1, 2024 19:59:40.982750893 CEST6183553192.168.2.161.1.1.1
      Oct 1, 2024 19:59:40.991257906 CEST53618351.1.1.1192.168.2.16

      DNS Queries

      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
      Oct 1, 2024 19:59:40.982750893 CEST192.168.2.161.1.1.10x1829Standard query (0)206.23.85.13.in-addr.arpaPTR (Pointer record)IN (0x0001)false

      DNS Answers

      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
      Oct 1, 2024 19:59:40.991257906 CEST1.1.1.1192.168.2.160x1829Name error (3)206.23.85.13.in-addr.arpanonenonePTR (Pointer record)IN (0x0001)false

      Statistics

      CPU Usage

      Click to jump to process

      Memory Usage

      Click to jump to process

      High Level Behavior Distribution

      Click to dive into process behavior distribution

      Behavior

      Click to jump to process

      System Behavior

      General

      Target ID:0
      Start time:13:59:12
      Start date:01/10/2024
      Path:C:\Windows\System32\rundll32.exe
      Wow64 process (32bit):false
      Commandline:C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      Imagebase:0x7ff7fd230000
      File size:71'680 bytes
      MD5 hash:EF3179D498793BF4234F708D3BE28633
      Has elevated privileges:false
      Has administrator privileges:false
      Programmed in:C, C++ or other language
      Reputation:high
      Has exited:true

      General

      Target ID:9
      Start time:13:59:23
      Start date:01/10/2024
      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      Wow64 process (32bit):false
      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Temp1_wetransfer_measles-docs_2024-10-01_1654.zip\Measles IgM Assay Docs for DCN\DTX Batch Records\MAD-F-002-e Formulaire lamination.pdf"
      Imagebase:0x7ff7ee980000
      File size:5'641'176 bytes
      MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
      Has elevated privileges:false
      Has administrator privileges:false
      Programmed in:C, C++ or other language
      Reputation:high
      Has exited:true

      General

      Target ID:10
      Start time:13:59:24
      Start date:01/10/2024
      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      Wow64 process (32bit):false
      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
      Imagebase:0x7ff766070000
      File size:3'581'912 bytes
      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
      Has elevated privileges:false
      Has administrator privileges:false
      Programmed in:C, C++ or other language
      Reputation:high
      Has exited:true

      General

      Target ID:11
      Start time:13:59:25
      Start date:01/10/2024
      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      Wow64 process (32bit):false
      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2268 --field-trial-handle=1608,i,15740231322271552655,9447220524649534135,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
      Imagebase:0x7ff766070000
      File size:3'581'912 bytes
      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
      Has elevated privileges:false
      Has administrator privileges:false
      Programmed in:C, C++ or other language
      Reputation:high
      Has exited:true

      General

      Target ID:17
      Start time:14:00:29
      Start date:01/10/2024
      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      Wow64 process (32bit):false
      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Temp1_wetransfer_measles-docs_2024-10-01_1654.zip\Measles IgM Assay Docs for DCN\DTX SOPs\3. MAD-I-027-a Pr paration et tra age du tampon de blocage de la membrane de nitrocellulose du test IgM rougeole.pdf"
      Imagebase:0x7ff7ee980000
      File size:5'641'176 bytes
      MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
      Has elevated privileges:false
      Has administrator privileges:false
      Programmed in:C, C++ or other language
      Reputation:high
      Has exited:true

      General

      Target ID:18
      Start time:14:00:30
      Start date:01/10/2024
      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      Wow64 process (32bit):false
      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
      Imagebase:0x7ff766070000
      File size:3'581'912 bytes
      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
      Has elevated privileges:false
      Has administrator privileges:false
      Programmed in:C, C++ or other language
      Reputation:high
      Has exited:true

      General

      Target ID:19
      Start time:14:00:30
      Start date:01/10/2024
      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      Wow64 process (32bit):false
      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2176 --field-trial-handle=1628,i,14780609754177666445,10077471866853840619,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
      Imagebase:0x7ff766070000
      File size:3'581'912 bytes
      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
      Has elevated privileges:false
      Has administrator privileges:false
      Programmed in:C, C++ or other language
      Reputation:high
      Has exited:true

      General

      Target ID:20
      Start time:14:00:44
      Start date:01/10/2024
      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      Wow64 process (32bit):false
      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Temp1_wetransfer_measles-docs_2024-10-01_1654.zip\Measles IgM Assay Docs for DCN\GADx SOPs\F012_Blocking of Measles NC_V4.pdf"
      Imagebase:0x7ff7ee980000
      File size:5'641'176 bytes
      MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
      Has elevated privileges:false
      Has administrator privileges:false
      Programmed in:C, C++ or other language
      Reputation:high
      Has exited:true

      General

      Target ID:21
      Start time:14:00:45
      Start date:01/10/2024
      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      Wow64 process (32bit):false
      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
      Imagebase:0x7ff766070000
      File size:3'581'912 bytes
      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
      Has elevated privileges:false
      Has administrator privileges:false
      Programmed in:C, C++ or other language
      Reputation:high
      Has exited:true

      General

      Target ID:22
      Start time:14:00:45
      Start date:01/10/2024
      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      Wow64 process (32bit):false
      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1376,i,13580310389225998366,7442836753837263385,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
      Imagebase:0x7ff766070000
      File size:3'581'912 bytes
      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
      Has elevated privileges:false
      Has administrator privileges:false
      Programmed in:C, C++ or other language
      Reputation:high
      Has exited:true

      General

      Target ID:23
      Start time:14:00:51
      Start date:01/10/2024
      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      Wow64 process (32bit):false
      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Temp1_wetransfer_measles-docs_2024-10-01_1654.zip\Measles IgM Assay Docs for DCN\GADx SOPs\E045 - QC Testing Procedure for Measles IgM Test Devices_V2.pdf"
      Imagebase:0x7ff7ee980000
      File size:5'641'176 bytes
      MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
      Has elevated privileges:false
      Has administrator privileges:false
      Programmed in:C, C++ or other language
      Reputation:high
      Has exited:true

      General

      Target ID:24
      Start time:14:01:06
      Start date:01/10/2024
      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      Wow64 process (32bit):false
      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Temp1_wetransfer_measles-docs_2024-10-01_1654.zip\Measles IgM Assay Docs for DCN\DTX Batch Records\MAD-F-067-b Pr paration de solution de BSA 100 mgmL.pdf"
      Imagebase:0x7ff7ee980000
      File size:5'641'176 bytes
      MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
      Has elevated privileges:false
      Has administrator privileges:false
      Programmed in:C, C++ or other language
      Reputation:high
      Has exited:true

      General

      Target ID:25
      Start time:14:01:07
      Start date:01/10/2024
      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      Wow64 process (32bit):false
      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
      Imagebase:0x7ff766070000
      File size:3'581'912 bytes
      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
      Has elevated privileges:false
      Has administrator privileges:false
      Programmed in:C, C++ or other language
      Has exited:false

      General

      Target ID:26
      Start time:14:01:07
      Start date:01/10/2024
      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      Wow64 process (32bit):false
      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2168 --field-trial-handle=1644,i,9641348054730088557,15027042306426077174,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
      Imagebase:0x7ff766070000
      File size:3'581'912 bytes
      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
      Has elevated privileges:false
      Has administrator privileges:false
      Programmed in:C, C++ or other language
      Has exited:false

      General

      Target ID:27
      Start time:14:01:12
      Start date:01/10/2024
      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      Wow64 process (32bit):false
      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Temp1_wetransfer_measles-docs_2024-10-01_1654.zip\Measles IgM Assay Docs for DCN\DTX Batch Records\MAD-F-049-b Preparation de 0.1M TAPS Acid.pdf"
      Imagebase:0x7ff7ee980000
      File size:5'641'176 bytes
      MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
      Has elevated privileges:false
      Has administrator privileges:false
      Programmed in:C, C++ or other language
      Has exited:false

      Disassembly

      ⊘No disassembly