Edit tour

Windows Analysis Report
SIBZ3SUD0124112517250.pdf

Overview

General Information

Sample name:	SIBZ3SUD0124112517250.pdf
Analysis ID:	1562880
MD5:	40e4924a1498bd865e42c20f0e94521a
SHA1:	62aefb8b6218720c03310efa68b451d87e99ec13
SHA256:	022d78b26004791e5579dfc7f5e1625d2fc6ba09ac89c5359b2a27a1c76e07da
Infos:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

PDF has an OpenAction (likely to launch a dropper script)

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 7260 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\SIBZ3SUD0124112517250.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7484 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7668 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1740,i,15043513092136630955,4285387801381004547,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global traffic

DNS query: name: x1.i.lencr.org

Source: global traffic	TCP traffic: 192.168.2.9:49717 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.9:49717 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.9:49717 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.9:49717 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.9:49717 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.9:49717 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.9:49717 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.9:49717 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.9:49717 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.9:49717 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.9:49717 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.9:49717 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.9:49717 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.9:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.9:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.9:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.9:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.9:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.9:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.9:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.9:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.9:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.9:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.9:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.9:49721 -> 23.47.168.24:443

Source: global traffic	TCP traffic: 192.168.2.9:49717 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.9:49717
Source: global traffic	TCP traffic: 192.168.2.9:49717 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.9:49717 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.9:49717
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.9:49717
Source: global traffic	TCP traffic: 192.168.2.9:49717 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.9:49717
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.9:49717
Source: global traffic	TCP traffic: 192.168.2.9:49717 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.9:49717
Source: global traffic	TCP traffic: 192.168.2.9:49717 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.9:49717 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.9:49717
Source: global traffic	TCP traffic: 192.168.2.9:49717 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.9:49717
Source: global traffic	TCP traffic: 192.168.2.9:49717 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.9:49717
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.9:49717
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.9:49717
Source: global traffic	TCP traffic: 192.168.2.9:49717 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.9:49717 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.9:49717 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.9:49717
Source: global traffic	TCP traffic: 192.168.2.9:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.9:49721
Source: global traffic	TCP traffic: 192.168.2.9:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.9:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.9:49721
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.9:49721
Source: global traffic	TCP traffic: 192.168.2.9:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.9:49721
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.9:49721
Source: global traffic	TCP traffic: 192.168.2.9:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.9:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.9:49721
Source: global traffic	TCP traffic: 192.168.2.9:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.9:49721
Source: global traffic	TCP traffic: 192.168.2.9:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.9:49721
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.9:49721
Source: global traffic	TCP traffic: 192.168.2.9:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.9:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.9:49721
Source: global traffic	TCP traffic: 192.168.2.9:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.9:49721 -> 23.47.168.24:443

Source: Joe Sandbox View	IP Address: 23.47.168.24 23.47.168.24
Source: Joe Sandbox View	IP Address: 52.6.155.20 52.6.155.20

Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: fdf9e666-cbf4-4e86-8c83-d46a601e2046x-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: fdf9e666-cbf4-4e86-8c83-d46a601e2046x-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: ReaderMessages.0.dr	String found in binary or memory: https://www.adobe.co

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443

Source: classification engine

Classification label: clean3.winPDF@14/52@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-26 02-24-58-382.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\SIBZ3SUD0124112517250.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1740,i,15043513092136630955,4285387801381004547,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1740,i,15043513092136630955,4285387801381004547,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: SIBZ3SUD0124112517250.pdf	Initial sample: PDF keyword /JS count = 0
Source: SIBZ3SUD0124112517250.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: SIBZ3SUD0124112517250.pdf

Initial sample: PDF keyword stream count = 93

Source: SIBZ3SUD0124112517250.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: SIBZ3SUD0124112517250.pdf

Initial sample: PDF keyword obj count = 191

Source: SIBZ3SUD0124112517250.pdf

Initial sample: PDF keyword /OpenAction

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Exploitation for Client Execution	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	13 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SIBZ3SUD0124112517250.pdf	0%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.2.dr	false		high
https://www.adobe.co	ReaderMessages.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.47.168.24	unknown	United States		16625	AKAMAI-ASUS	false
52.6.155.20	unknown	United States		14618	AMAZON-AESUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562880
Start date and time:	2024-11-26 08:23:58 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SIBZ3SUD0124112517250.pdf
Detection:	CLEAN
Classification:	clean3.winPDF@14/52@1/2
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 69.192.160.136, 172.64.41.3, 162.159.61.3, 18.213.11.84, 34.237.241.83, 50.16.47.176, 54.224.241.105, 23.195.39.65, 199.232.210.172, 23.32.238.200, 23.32.238.226, 23.32.238.243, 23.32.238.235, 23.32.238.185, 23.32.238.234, 23.32.238.233, 23.32.238.232, 23.32.238.211
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com, wu-b-net.trafficmanager.net, storeedgefd.dsx.mp.microsoft.com, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
02:25:06	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Input	Output
URL: PDF document Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: PDF document Model: Joe Sandbox AI	{ "brands": [] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
23.47.168.24	Finish_Agreement_DocuSign.pdf	Get hash	malicious	Unknown	Browse
	Vendor Agreement Ready for Your Signature November 22 2024 at 084923 PM.msg	Get hash	malicious	HTMLPhisher	Browse
	canva.bat	Get hash	malicious	Unknown	Browse
	careus.bat	Get hash	malicious	Unknown	Browse
	Complete_with_DocuSign_49584.pdf	Get hash	malicious	HTMLPhisher	Browse
	ZGMW2wgPzY.lnk	Get hash	malicious	Ducktail	Browse
	XUpERCR9nC.lnk	Get hash	malicious	Ducktail	Browse
	Heritage Commercial Flooring.pdf	Get hash	malicious	Unknown	Browse
	copyright_infringement_evidence_1.exe	Get hash	malicious	Unknown	Browse
	cleu.cmD	Get hash	malicious	Unknown	Browse
52.6.155.20	https://acrobat.adobe.com/id/urn:aaid:sc:EU:98ca4a25-984a-4511-9eb1-b7e6c5c56a12	Get hash	malicious	HTMLPhisher	Browse
	Fw INVOICE TEST-4 - INTUIT QUICKBOOKS - 399.00 USD.zip	Get hash	malicious	Unknown	Browse
	EXTERN Zahlungsbest#U00e4tigung.msg	Get hash	malicious	CVE-2024-21412	Browse
	Please_Docusign_this_document_July 2024_2471.pdf	Get hash	malicious	Unknown	Browse
	PO.pdf	Get hash	malicious	Unknown	Browse
	Absa Eft.pdf	Get hash	malicious	HTMLPhisher	Browse
	Complete with Docusign andrew.pdf	Get hash	malicious	Tycoon2FA	Browse
	http://icloudtw.applelostsupporttw.com/	Get hash	malicious	Unknown	Browse
	Toconnor-all accumulated bonus.pdf	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	2024-07-06 14-00.pdf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.214.172
	Fumari INC.eml	Get hash	malicious	Unknown	Browse	199.232.210.172
	fpAb6lVZ9A.dll	Get hash	malicious	CobaltStrike	Browse	199.232.214.172
	Customer forms.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	IJ9n6ms5CT.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	Evidence of copyright infringement.bat	Get hash	malicious	Unknown	Browse	199.232.214.172
	AccountDocuments - chrisuserl.docx	Get hash	malicious	Unknown	Browse	199.232.214.172
	Disputes.accdb	Get hash	malicious	Unknown	Browse	199.232.214.172
	ZwmyzMxFKL.exe	Get hash	malicious	BlackMoon	Browse	199.232.210.172
	PVJ6cLZQ0T.xls	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-AESUS	fbot.spc.elf	Get hash	malicious	Mirai, Moobot	Browse	54.7.75.208
	fbot.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	34.198.43.225
	fbot.arm.elf	Get hash	malicious	Mirai, Moobot	Browse	54.137.39.229
	Encrypt DOC2024.11.19.1983928 shared with you! (203 KB).msg	Get hash	malicious	Unknown	Browse	35.173.12.189
	AccountDocuments - chrisuserl.docx	Get hash	malicious	Unknown	Browse	52.21.15.185
	https://app.smartsheet.com/b/form/40653cfc74264be5801922c41bc80ae9	Get hash	malicious	Unknown	Browse	54.211.140.94
	https://protection.cloze.email/r/EKJc7NAc1aGPd0140vt6MnJzYkpI4pQCyldpUEBtdFT8T8dhNmmHodcXxvKddJW4AhfqaDIQj32BX0HxSGbmPeDqDQs/n/SlBNQ05FV1NMRVRURVI/y52l9ppb.r.ap-northeast-1.awstrack.me/L0/https:%2F%2Fcloudprotectionc5f91e84a2b3d9e748f2a1d9b7e5f0c4a2b3d9e7a5pages.dynamixs.workers.dev%2F/1/010601933048cf65-492c630f-d6b3-471e-a31f-bf186231f1e8-000000/SL9CcqykWh2mQIC7eGiOMwzMSpk=185	Get hash	malicious	Unknown	Browse	3.232.168.51
	http://ti-17-0.914trk.com	Get hash	malicious	Unknown	Browse	18.205.42.100
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	54.157.44.82
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	35.170.19.66
AKAMAI-ASUS	Finish_Agreement_DocuSign.pdf	Get hash	malicious	Unknown	Browse	23.47.168.24
	kkEzK284oT.exe	Get hash	malicious	HTMLPhisher	Browse	23.50.131.88
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.57.90.171
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.57.90.156
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.57.90.161
	fbot.arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	104.85.197.166
	fbot.mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	92.123.108.251
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.200.88.38
	AccountDocuments - chrisuserl.docx	Get hash	malicious	Unknown	Browse	184.30.24.109
	https://ymcajeffco-my.sharepoint.com/:u:/g/personal/rcampbell_mtvernonymca_org/Eb_PxgSrk7VCrlppYfmkXowB9vCdCR2cgdVG8AQkH7BcbQ?e=b9efJ2	Get hash	malicious	HTMLPhisher	Browse	2.19.198.232

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.207270073672038
Encrypted:	false
SSDEEP:	6:HYu4q2PqLTwi2nKuAl9OmbnIFUt8YYVYXJZmw+YYVYXDkwOqLTwi2nKuAl9Ombjd:l4v8wZHAahFUt8+XJ/++XD5TwZHAaSJ
MD5:	8B0AC8AADC6E820F26B9EF9C75A78C55
SHA1:	A6622D4524E960C928D8EB52E828E09A9674BDBD
SHA-256:	B4E35FEED901EBAB4EB11E75E7A3E6A8B5AA9066E35B485342CAEBA095815D43
SHA-512:	9F77D361675496E2484ADEE9271B3EFC377C9C7EAA4374ED78A58774DC8B9EE84DC560298E36533BF524B2B7E4C2EC5483290F1998445F6A69777C26784702BD
Malicious:	false
Reputation:	low
Preview:	2024/11/26-02:24:55.910 1d64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/26-02:24:55.921 1d64 Recovering log #3.2024/11/26-02:24:55.921 1d64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.207270073672038
Encrypted:	false
SSDEEP:	6:HYu4q2PqLTwi2nKuAl9OmbnIFUt8YYVYXJZmw+YYVYXDkwOqLTwi2nKuAl9Ombjd:l4v8wZHAahFUt8+XJ/++XD5TwZHAaSJ
MD5:	8B0AC8AADC6E820F26B9EF9C75A78C55
SHA1:	A6622D4524E960C928D8EB52E828E09A9674BDBD
SHA-256:	B4E35FEED901EBAB4EB11E75E7A3E6A8B5AA9066E35B485342CAEBA095815D43
SHA-512:	9F77D361675496E2484ADEE9271B3EFC377C9C7EAA4374ED78A58774DC8B9EE84DC560298E36533BF524B2B7E4C2EC5483290F1998445F6A69777C26784702BD
Malicious:	false
Reputation:	low
Preview:	2024/11/26-02:24:55.910 1d64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/26-02:24:55.921 1d64 Recovering log #3.2024/11/26-02:24:55.921 1d64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.129318309714634
Encrypted:	false
SSDEEP:	6:HYuHu0q2PqLTwi2nKuAl9Ombzo2jMGIFUt8YYuASXZmw+YYuBOzkwOqLTwi2nKuA:bnv8wZHAa8uFUt8uAS/+uBOz5TwZHAaU
MD5:	182AAE0B6355ED606B7DF25DA9073C89
SHA1:	6BBD74AE82480B260F0AEFA08A815ABB78A4DF86
SHA-256:	0C20763C2FF501088CEBC6C85EAC8CBA3D431CFA206A8BEBD6C9ECE52A6E60FC
SHA-512:	CBA81A1F6F4C2524E6EB3665A6A7C65D76EEAACD615DFBC43FEB156F05B0F1B631CF6F14393280E04290CF2432E6B43A1845377E847E04E363D4AC63FD97608B
Malicious:	false
Reputation:	low
Preview:	2024/11/26-02:24:56.022 1e30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/11/26-02:24:56.023 1e30 Recovering log #3.2024/11/26-02:24:56.024 1e30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.129318309714634
Encrypted:	false
SSDEEP:	6:HYuHu0q2PqLTwi2nKuAl9Ombzo2jMGIFUt8YYuASXZmw+YYuBOzkwOqLTwi2nKuA:bnv8wZHAa8uFUt8uAS/+uBOz5TwZHAaU
MD5:	182AAE0B6355ED606B7DF25DA9073C89
SHA1:	6BBD74AE82480B260F0AEFA08A815ABB78A4DF86
SHA-256:	0C20763C2FF501088CEBC6C85EAC8CBA3D431CFA206A8BEBD6C9ECE52A6E60FC
SHA-512:	CBA81A1F6F4C2524E6EB3665A6A7C65D76EEAACD615DFBC43FEB156F05B0F1B631CF6F14393280E04290CF2432E6B43A1845377E847E04E363D4AC63FD97608B
Malicious:	false
Reputation:	low
Preview:	2024/11/26-02:24:56.022 1e30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/11/26-02:24:56.023 1e30 Recovering log #3.2024/11/26-02:24:56.024 1e30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\60168a38-55c5-4283-ab29-17c8511690ab.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96165270016851
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxpsBdOg2Hl/2caq3QYiub5P7E4TX:Y2sRds+6dMHlR3QYhbt7n7
MD5:	ACCB522AE87A739BDC04EB5A34975EEB
SHA1:	A41FED54445E729A85E7017A002D4FF6FCAFEC93
SHA-256:	C7106DE6A60A389FB9B4BBC9971C9922919583A3C382664F3E78DFDC2A95AE96
SHA-512:	5B35F36E3C53CC53F90AEA276934753CAD809640E7447BD9F7AAFF48FD46EFBE5FFDEEBC19770D7D0550E67624AB76571D64525F00B82430534576B3015EFF3B
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341057329405343","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149545},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96165270016851
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxpsBdOg2Hl/2caq3QYiub5P7E4TX:Y2sRds+6dMHlR3QYhbt7n7
MD5:	ACCB522AE87A739BDC04EB5A34975EEB
SHA1:	A41FED54445E729A85E7017A002D4FF6FCAFEC93
SHA-256:	C7106DE6A60A389FB9B4BBC9971C9922919583A3C382664F3E78DFDC2A95AE96
SHA-512:	5B35F36E3C53CC53F90AEA276934753CAD809640E7447BD9F7AAFF48FD46EFBE5FFDEEBC19770D7D0550E67624AB76571D64525F00B82430534576B3015EFF3B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341057329405343","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149545},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5d3a74.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96165270016851
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxpsBdOg2Hl/2caq3QYiub5P7E4TX:Y2sRds+6dMHlR3QYhbt7n7
MD5:	ACCB522AE87A739BDC04EB5A34975EEB
SHA1:	A41FED54445E729A85E7017A002D4FF6FCAFEC93
SHA-256:	C7106DE6A60A389FB9B4BBC9971C9922919583A3C382664F3E78DFDC2A95AE96
SHA-512:	5B35F36E3C53CC53F90AEA276934753CAD809640E7447BD9F7AAFF48FD46EFBE5FFDEEBC19770D7D0550E67624AB76571D64525F00B82430534576B3015EFF3B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341057329405343","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149545},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c1f44fb3-8d3d-416e-a7ed-4ea77f0f9bb1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.978235956891848
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq2LLsBdOg2HA2caq3QYiub5P7E4TX:Y2sRdsFIdMHAJ3QYhbt7n7
MD5:	C7CF8AB1A457BAE0D5465DEBE68A1430
SHA1:	15368E3A7DABC16132831EAD70AD653111F1075D
SHA-256:	AE6207C0297C9C87A84FD652D7B7E291D4B7DDBE645758D0850ED3A75C6AC1C7
SHA-512:	892536B52332860BDC850810B17E384853EB2348329C426DC507E896560FE15D6EA67CD6F8D8610C831254FC52BD158D31F5D3738D31AD9E293366142788413A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377165908522625","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":600672},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4288
Entropy (8bit):	5.2164866864321455
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068Oz8S5bXzbjZ:1CDLCmPj8j0/8qKgwPHYPx8xemT8Oz8W
MD5:	7A914A38791CA938F81F3A7C9DE129F8
SHA1:	0419425A3863E4D8AD66C2907B1CF4FD80C2E9D5
SHA-256:	E05D389BC5156DCF3E06DA284D0E7C1876B8CC5E13AF6265A552ACBB011E10CA
SHA-512:	07221E25C338D8C6E350FD0BA22BF201858B4E4D0790CBBB724ACED8EBDC0B7703C6A1C9DC95896DA9FDB342C5A64F5CA91662CCAFAA65CEFCBAE059977F2197
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.184758756139449
Encrypted:	false
SSDEEP:	6:HYsmq2PqLTwi2nKuAl9OmbzNMxIFUt8YYlZmw+YYq8kwOqLTwi2nKuAl9OmbzNMT:cv8wZHAa8jFUt8l/+q85TwZHAa84J
MD5:	6EEC677BFAD5C47E5F31E592A9023B50
SHA1:	25A1A6033C09F331A6FB42F8F6B2DDF55DB744C7
SHA-256:	3A84477CD0D522955CF80673DE836C9240CF0BF12A7A9F16461AC04FC8FAF329
SHA-512:	B60E2577CA7D0FF8F38FD10830F6E9ABD8B84B70062499BFC24DF8771B3EAD69C40D3CE713BA17DBF66A020A7F23088AE908850F4599F08CBD4DF5A2BACDA16B
Malicious:	false
Preview:	2024/11/26-02:24:56.298 1e30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/11/26-02:24:56.350 1e30 Recovering log #3.2024/11/26-02:24:56.482 1e30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.184758756139449
Encrypted:	false
SSDEEP:	6:HYsmq2PqLTwi2nKuAl9OmbzNMxIFUt8YYlZmw+YYq8kwOqLTwi2nKuAl9OmbzNMT:cv8wZHAa8jFUt8l/+q85TwZHAa84J
MD5:	6EEC677BFAD5C47E5F31E592A9023B50
SHA1:	25A1A6033C09F331A6FB42F8F6B2DDF55DB744C7
SHA-256:	3A84477CD0D522955CF80673DE836C9240CF0BF12A7A9F16461AC04FC8FAF329
SHA-512:	B60E2577CA7D0FF8F38FD10830F6E9ABD8B84B70062499BFC24DF8771B3EAD69C40D3CE713BA17DBF66A020A7F23088AE908850F4599F08CBD4DF5A2BACDA16B
Malicious:	false
Preview:	2024/11/26-02:24:56.298 1e30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/11/26-02:24:56.350 1e30 Recovering log #3.2024/11/26-02:24:56.482 1e30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241126072500Z-174.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
Category:	dropped
Size (bytes):	65110
Entropy (8bit):	2.9021432638641906
Encrypted:	false
SSDEEP:	384:PE7D4CCv2Y84BIgKaWMM2rQCR1NZj1/864llXmRDTJwD1P:wUCul88F1oCRvqllEY
MD5:	4977612267EA36C9973D149F36AA7577
SHA1:	74D24E76FF388FC9987CDB5CA65FE325F37A3BB9
SHA-256:	EA357E4FA55D4E718EC1C1A3ABB62F2C2F67753DC2F4428D49DC2C8679145002
SHA-512:	D784363D921C65ED2090375C94C6FAC4FCB3270EEF56792941A0487558267B35B3CC0951E138C8CF72D09687A60642FE84E1DA40F63DFFB870A37248179A369B
Malicious:	false
Preview:	BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4385135328749925
Encrypted:	false
SSDEEP:	384:ye+ci5G1iBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:p5urVgazUpUTTGt
MD5:	98C5A9F8B298C5A74EBC8D73117A659F
SHA1:	F203E2429B124D77792890BBB40DB6AF182B1EEC
SHA-256:	B3D4AAFA8090E7EF8F7FA6BDEF64F60F6ABA179D4825F282C34133F042D11C10
SHA-512:	523A3DA4BD2BAE9EA9BF04035CD7AA7B5741098049EAA5E839E9C5C08A31AE4B2AD8C85EEE9E477CBD4303681BBCA876107376D661AB76DC3B4A035DB351A7A1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7657148289611952
Encrypted:	false
SSDEEP:	48:7MFJioyV6fioyH8oy1C7oy16oy1JaKOioy1noy1AYoy1Wioy1oioykioyBoy1no3:7aJu6f+BISXjBiNb9IVXEBodRBkW
MD5:	97E5961A4121C703B621D976F8E9476A
SHA1:	A31ABB574EAA5BAB0B94D9CBE5ECB3CCBD3C7CA6
SHA-256:	0929B8B93D7203A2120C4A1F9DA4D278A43A319FC3068188738D01629CDEFAD8
SHA-512:	80DF9AB47A049BEE5F10E3F33E5A79C0521C1336F67133840391A78AE96BA6805FB5C40127BDECA6E72FF7FF6C3E729974CD22C07E4198E50F56891E03757988
Malicious:	false
Preview:	.... .c.......N,...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkloILPkltfllXlE/HT8kzlZNNX8RolJuRdxLlGB9lQRYwpDdt:kKx8PseT8cl3NMa8RdWBwRd
MD5:	2994DA9B13192755FB3954EB4CF17960
SHA1:	C576D67770AA43677ED2715CF7DB8EC0EFA7AEA0
SHA-256:	DEDC8936F7DAC0F447321361728E10FB458CD80E2B4CF02D7F78BA985AD33701
SHA-512:	E2ECE88F920DEFB9A6493F09AC9631C7830EB514F6BF2A97C0C6F10796A41CBCC9C6CF62E3FD78B6F263CD5A2C299C96E8BF6C061EB8B4B16DB972F0A7E99600
Malicious:	false
Preview:	p...... .........m.P.?..(....................................................... ..........W....c...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKNtL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:FtiDImsLNkPlE99SNxAhUe/3
MD5:	1E8FFF6A28AF49947BBC0CA0E1632C1E
SHA1:	6B5B9825EA5FEC3FC7F7282CDFA38FEBE48E3ADC
SHA-256:	50C9CF8980D0BBACB535A71070C4835A6B7E1B4A87D1712053276026FA938437
SHA-512:	CBCF50AA8280EF129CED7CF6B6B842EA12F4F60185217A227EC668C66E8CD21FA13F3F644C1FF8525698DE773769C79A42CA28D16BA23E89CB5F15F4ABDD7782
Malicious:	false
Preview:	p...... ..........c.?..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7344

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7344

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	227002
Entropy (8bit):	3.392780893644728
Encrypted:	false
SSDEEP:	1536:WKPC4iyzDtrh1cK3XEiv07VK/3AYvYwgF/rRoL+sn:DPCaL/3AYvYwglFoL+sn
MD5:	11F2FC7F8C64BEAE994575ECEF93CFFF
SHA1:	75014E1BF55814F00BDD25BB8D290A2FFE881A3A
SHA-256:	962CBFB11B6666C900037518E4F69ACA3B2633A3A522D2BFB830A4868EA366CB
SHA-512:	ECE2F0B04DB5A01316ED75FFD2AB381EC035636B758A20E58C355AEEB4E5032102A279EB97FBC0CC8617BCC47DBF7ECBB3BE15994342CC5B56B4C56999956975
Malicious:	false
Preview:	Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.330227746040961
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/BHGIaR8WmSg1c2LjcWkHvR0YS+xoAvJM3g98kUwPeUkwRe9:YvXKX/QPcT5LjIPW+OGMbLUkee9
MD5:	7830BB708BA710198E5B13157A9242D5
SHA1:	BFAB89D8DCDD029EA88C18EDBADDDC0573786A55
SHA-256:	E99E37D45AD94A1B4A4A218DFE3A2A69FF23F966307DD5F691D00969EF4AA480
SHA-512:	5D83CC6207072D5061A717A929EC504EE3316C5AA36FA11DE8B9658AAE4029FFCADE869845D8F0E579B5980126312D17EFCE495AC77C77E6C6A7A39093B7D8F7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13aa93cb-79ab-4d1b-92ec-e0d0aeccf007","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1732783567050,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2800422378142615
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/BHGIaR8WmSg1c2LjcWkHvR0YS+xoAvJfBoTfXpnrPeUkwRe9:YvXKX/QPcT5LjIPW+OGWTfXcUkee9
MD5:	0F9713694BDD90BD9E7A6B7B9CC775F2
SHA1:	78D5A52834735787DCDD93CAE56F17D01D6793F0
SHA-256:	1FF3ABBB20E83087D3E2FC63442500E139EAF816BC9785AD1A722AA18B61A970
SHA-512:	DA7074A901408E2ED75F717AECFE290F0D947E3813DF8422F6E53BC1A3B53801797451511940F7C450B12D8AAB49914C68830ECEF1C37DE7C95B3D33A3E0BB27
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13aa93cb-79ab-4d1b-92ec-e0d0aeccf007","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1732783567050,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.258076066705681
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/BHGIaR8WmSg1c2LjcWkHvR0YS+xoAvJfBD2G6UpnrPeUkwRe9:YvXKX/QPcT5LjIPW+OGR22cUkee9
MD5:	E2CEFE9B646B9FBB570F73A4242E0B95
SHA1:	50479EDE63EA217DF2895E3BDA329B771AF833F0
SHA-256:	7CFDDB4FAD742D42E29C8E2BA23A639169682373F2FDFE51C4EC8513CF77A0C4
SHA-512:	2A8C06E6E923716838C4BB2412AF21B08B44D47D5A02288A3C9586885AF99503995440AAB3958987BD6F8D7341E275706D8CB1F516AF1CF07E78165D2856DBBC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13aa93cb-79ab-4d1b-92ec-e0d0aeccf007","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1732783567050,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.310067124554924
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/BHGIaR8WmSg1c2LjcWkHvR0YS+xoAvJfPmwrPeUkwRe9:YvXKX/QPcT5LjIPW+OGH56Ukee9
MD5:	790C5A82374E1F61B884EE1365A285EA
SHA1:	717E4961D3E71FACB7EAFC09FD4CC6E3A5B780B0
SHA-256:	8ED1CF64BD48C12C4FF7F9ACD988ABF40347D332EDFFEAB28474E61E64C065AA
SHA-512:	C539FBDE0459BD87409CDD1AB74812DD9DC9EC2E1717685CA55E1014534771C14110079C87C3835FBDB29920B2138D05DF2527C874415CBF3222C921BBDDE9F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13aa93cb-79ab-4d1b-92ec-e0d0aeccf007","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1732783567050,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.685764452424386
Encrypted:	false
SSDEEP:	24:Yv6XycT5XIumpLgE9cQx8LennAvzBvkn0RCmK8czOCCSN1:YvN4Xahgy6SAFv5Ah8cv/N1
MD5:	F409E37C91BAF8CD11D523AFEB27734F
SHA1:	3571DA53695ED1B5EED7D8E8CB34D4CCEDBAC213
SHA-256:	586A0D61DF58C58F2B3D282579B0A99BA92638E93379FD4B211C3819504395DB
SHA-512:	F7413258ACFEE49D42BE697771C0F3EA20D5369236CD18165BEE7D00739E31501C7C5352D705D57806D80E80D45E7BCB4A2FB0465E8D5B273F2362286560F665
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13aa93cb-79ab-4d1b-92ec-e0d0aeccf007","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1732783567050,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1122
Entropy (8bit):	5.678291723294955
Encrypted:	false
SSDEEP:	24:Yv6XycT5XIuQVLgEwcp06ybnAvz7xHn0RCmK8czOCYHfl8zdBc1:YvN4X8FgSNycJUAh8cvYH71
MD5:	656DB89A94A2CBA61185C95390F79B54
SHA1:	3B13DE228F2FE7025027A0BE59D9CAF1CA46874C
SHA-256:	B74E5981CD31256A9E8D776E194874A5778ABECC32546537218C58ED7E15F349
SHA-512:	0CA94ED3ABD5A62D66F0D1E91D62BCCD267BFC377D13EED6E9DC9ED10CCB8FD5AB242E9696D5F89E32220435C1561F5689DBAE4EE28A90EA163D8437D005B1FD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13aa93cb-79ab-4d1b-92ec-e0d0aeccf007","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1732783567050,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93181_288855ActionBlock_0","campaignId":93181,"containerId":"1","controlGroupId":"","treatmentId":"1aad653c-ef44-43f7-be1c-3a2ba2cf2cfc","variationId":"288855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuIFBERiBmb3JtcyAmIGFncmVlbWVudHMuIn0sInRjY

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.270491389751093
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/BHGIaR8WmSg1c2LjcWkHvR0YS+xoAvJfQ1rPeUkwRe9:YvXKX/QPcT5LjIPW+OGY16Ukee9
MD5:	84A6BEC93C749B7ACE0959AB60DABB3C
SHA1:	A39E94CFFAD9C6D17EAA7FFF966B208B8ACEB9B5
SHA-256:	0630E267D64C4CC6A671251381A062CBF71AF68F435224EDC33349454DFD42DD
SHA-512:	F956F2FB46B692941681D1CA5B8D19ECBDBBAAEEE10ACEF945A6FF3BFE6799A950664F6B1C3149E98531704891B85C46BC1DFF324C29F271C15240963A255C85
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13aa93cb-79ab-4d1b-92ec-e0d0aeccf007","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1732783567050,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1102
Entropy (8bit):	5.664291213279789
Encrypted:	false
SSDEEP:	24:Yv6XycT5XIu12LgErcXWl7y0nAvzIBcSJCBViVc1:YvN4XhogH47yfkB5kVN1
MD5:	A4D9337F8D9F77E0DF15B10DF6A5E73F
SHA1:	4984216DF02EA7EA114F21E7E7BC3265DD26BEC1
SHA-256:	BB2C079DA9162CC5D89EE1563C94E519F7544CD57ED79738BBBC8200D9980784
SHA-512:	8FE92DA951D1B82F7A7DCF38A1720C66879613B9BDFC8DB0DB900D64187A23CB6EF06F7F6AB9D07F4C9B96EC6FB79928851E007C1BC6D3FDAEC0738DBCC5A52C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13aa93cb-79ab-4d1b-92ec-e0d0aeccf007","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1732783567050,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93181_288855ActionBlock_1","campaignId":93181,"containerId":"1","controlGroupId":"","treatmentId":"533ab5eb-b236-4889-89a5-ac002261d71e","variationId":"288855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkVkaXRQREZSZHJBcHBGdWxsIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTRweCIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTJweCIsImZvbnRfc3R5bGUiOiItMSJ9LCJ0aXRsZSI6bnVsbCwiZGVzY3JpcHRpb24iOiJFZGl0IHRleHQsIGltYWdlcywgcGFnZXMsIGFuZCBtb3JlLiJ9LCJ0Y2F0SWQiOm51bGx9","da

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1164
Entropy (8bit):	5.695322920532019
Encrypted:	false
SSDEEP:	24:Yv6XycT5XIudKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK5c1:YvN4XhEgqprtrS5OZjSlwTmAfSKq1
MD5:	DEE7DF95A4D863AF22DB7398A893E4B5
SHA1:	1A57A96DD88EEFDA30570D35A4286304A847C542
SHA-256:	45D45D29B288854C7C9EE58602157BA7C625570BF26D2910C58C61C45E1165B2
SHA-512:	2A45583E057661995CE8E76695F4AD3D026D0B6D88E41A2B94DFDCFBF3E971C8D717ABD7B2F96AC700C4CAF724A54FD26E427AE7D6A57A41BC238495C575EB38
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13aa93cb-79ab-4d1b-92ec-e0d0aeccf007","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1732783567050,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.285950006789672
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/BHGIaR8WmSg1c2LjcWkHvR0YS+xoAvJfYdPeUkwRe9:YvXKX/QPcT5LjIPW+OGg8Ukee9
MD5:	CC66270E1B06C9D88875F3E308518A4D
SHA1:	671CB935B1207B188416EBC6BE27836A23B10CD2
SHA-256:	B61A0C3A59B39A072AA61A36469D0A026E9AB9679FD3E634C59385FD8740F2C4
SHA-512:	F5BF172599932B89C2B087551464F2428D726525B5699BA1BBB4ECEABEED25B63080FDC399951A79FC9D5FAF8724C4D76D2F8934E1302449725BAB2714522A5A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13aa93cb-79ab-4d1b-92ec-e0d0aeccf007","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1732783567050,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.272334374197614
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/BHGIaR8WmSg1c2LjcWkHvR0YS+xoAvJf+dPeUkwRe9:YvXKX/QPcT5LjIPW+OG28Ukee9
MD5:	193FBAA045539BB3FEA66764F84EE13E
SHA1:	E1ACFAFCA2894893753148A2D4F6ADD190A38C53
SHA-256:	DE1DC37A0B4B2E447889E9AECB70959E72B24680641335D9A3E274D276C8C1AA
SHA-512:	07ACB1FE25DA03614FB22AED442029A3A854C6DEFE2EEAD1B609D63F4929AFA37BBC219F68ADAA023F4706E072BF3ED8E0CA12A9D6B65F73540C47CC0164A324
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13aa93cb-79ab-4d1b-92ec-e0d0aeccf007","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1732783567050,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.269593667990756
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/BHGIaR8WmSg1c2LjcWkHvR0YS+xoAvJfbPtdPeUkwRe9:YvXKX/QPcT5LjIPW+OGDV8Ukee9
MD5:	088EE07DDFAB528EFD9A8343B1F58579
SHA1:	BD979F4E74DD3C5CEBE0F86E642873B7EC0E8D92
SHA-256:	16848A9E1574CC07EE3A2A12CF01A00E8CE870356256C308D67D62F939957DDF
SHA-512:	2C45E2741DC8187254836827CF5444917885384C809AA1187389E73E66C9859D1E494ECA7E19C1C6A91F8BE5DDFBF7F54742F21F1E6CF3DC3847FA60C7FFC1EE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13aa93cb-79ab-4d1b-92ec-e0d0aeccf007","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1732783567050,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.262048779982525
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/BHGIaR8WmSg1c2LjcWkHvR0YS+xoAvJf21rPeUkwRe9:YvXKX/QPcT5LjIPW+OG+16Ukee9
MD5:	6674380ADC08FDA5544380565A62A563
SHA1:	1FB8618602F2B620279CC9639CD149900B1DB55F
SHA-256:	9CC04F81412AF98A3934AC1D2D5BD59F66FBBE920216475343115064D0CD3053
SHA-512:	AC1C151DC3ECCAA683A1CFD9880631DC6200B84288969BC99665FEA8E738AF781E01981BB45C8D8FF098706FE2324FDF7363C31C140ABE13B257815D25EC505D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13aa93cb-79ab-4d1b-92ec-e0d0aeccf007","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1732783567050,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.660806027031568
Encrypted:	false
SSDEEP:	24:Yv6XycT5XIu6amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSS:YvN4XIBgkDMUJUAh8cvMS
MD5:	4568BABAD5B7573E85F7334DBC07BE43
SHA1:	99854B6D99D82675462003F0AAD1DEDFDD44E399
SHA-256:	28B31EA76BA3FD5B70639D77828C9E446B95EE1C9504757C3762E04B301EFC7B
SHA-512:	4360CD3095FBD9AC94DF26DD789AD35F476D6045A4BAB768D56D4F269E59A5C5025CB5D6BE71CE60E255CE2F2D19C911ABDB08405AB73AFFC2C1E0A74AA71B3D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13aa93cb-79ab-4d1b-92ec-e0d0aeccf007","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1732783567050,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.23544141208397
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/BHGIaR8WmSg1c2LjcWkHvR0YS+xoAvJfshHHrPeUkwRe9:YvXKX/QPcT5LjIPW+OGUUUkee9
MD5:	DA98E28FE06B17F9674B0659A314F458
SHA1:	7525952497EBA4D812BAF3D0437E4A766595F575
SHA-256:	238B8059A226CD5E38FB287D65D57BEECB1122CA857B423796B9A7CB7297C870
SHA-512:	75FB75354BAC03B4F8DCA044FBDB98196D0F88F7F55FB01384D42256D1112D1ADEF48F5FA123501EB4CF87060997E76B77CFF8070FBEABFB5B5FB6309A9C11A0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13aa93cb-79ab-4d1b-92ec-e0d0aeccf007","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1732783567050,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.239660193160434
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/BHGIaR8WmSg1c2LjcWkHvR0YS+xoAvJTqgFCrPeUkwRe9:YvXKX/QPcT5LjIPW+OGTq16Ukee9
MD5:	EB21D2FE7AA5630C5A4A27B9F728430D
SHA1:	DFA04443D9551EB1915B5D26307AB3B1EE5A5CA9
SHA-256:	EF3386F05B75A2D46FAA54FAFE8D7C0AB44F16A436320D4C4EE4B51ADB485BEE
SHA-512:	611797DEFF03C52AB8304BDE197AC8B111165B43F6704DFA91924CFA28E134566BBA56A4C993BBF8D0B416463D5E48FE6135E6D8263299D942231DD2090806C3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13aa93cb-79ab-4d1b-92ec-e0d0aeccf007","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1732783567050,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2817
Entropy (8bit):	5.135084584645557
Encrypted:	false
SSDEEP:	48:YB2XlV8x09Gx3Ar/xyjjQWG7gvpdM1O3Tdampgcm9uYMb:q2XlSx09Gx3ADxqjQWG7KP4lmpgDuYu
MD5:	D29418FC37B705AA791628E034B8DA58
SHA1:	A5892BBF20B19D1C4C1BC38EFFBCC183F93DD43D
SHA-256:	47C4C1A5C2260FF3D8FF7AD15CB3926DB7AE9A8D23F3E70DD942D0C1E7217DB9
SHA-512:	0207CAFA186EA278F2BE5301B5104DBF93F0CCDCCFB58829DD9A82D01F8A8C218F4AAA24DA16D19BF94ACA554C53BAFBE01966FEBB1342C41640F6D6C52291A8
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"fcb7401e8101ef3a657953e27ad6e923","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1122,"ts":1732605906000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"c8f773f827b00fe3e456191199e14550","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1732605906000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"17639b2b3f2e966a69682895a9827ccb","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1732605906000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"fe8c294e714c5786711a28b27375431f","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1732605906000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"82467922f5155327700d02e6873437d8","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1102,"ts":1732605906000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"fef15dc85f1322039cd2814fb715e03c","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3668040442787304
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDuPXKdqEKfS8EKfM1baHF:Tll2GL7msMcKTlS8fcsuEfIl
MD5:	658E1629BCF068AB5A7A5172F309CF6A
SHA1:	933AF42A8B5EBE92344B61E7B50AF0F326E3087A
SHA-256:	D41F0B1592A09A636663AFD8046B4D32A6ABF60018D8B9B41AB4FC0076A4005C
SHA-512:	74F906E711F953F07714482D710FFBD272A38653813496446EC8BEEE4801A3CC6E5F7E0468C364089806A9E1D8FFECFA930799935DC7583BB7363C306855635D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8423754634082612
Encrypted:	false
SSDEEP:	24:7+tUPZ6bqyKn6ylSTofcNqDuP+KdqEKfS8EKfM1banbqZnqLKufx/XYKQvGJF7u7:7MUhcKTlS8fcsudfIMnqGufl2GL7msm
MD5:	71A777165B51199D930A225DDB75D2F3
SHA1:	758E51141A5AD3A32A427A892C0B3FA08881C9F2
SHA-256:	EC5FAD657D766C601B05525EE2F4F0D4A509C28A60446B60E4EE812FE16994F6
SHA-512:	4737F661E83D835384C524DFEB7C89606F8D1C25B906CEFB0E64F18C6FFF806F78B3BFD6C43C6B66670AED743EBB879339F2849085D87E67BFD30D8A265D94F9
Malicious:	false
Preview:	.... .c........"..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgtd9nEWQvc3Xgi6LEa2D+3i0MvYyu:6a6TZ44ADEtd9EWQUHgj3i0CK
MD5:	FADDE5ED761013E6FD04C1F65A467B16
SHA1:	3EAC8B322D81545E42A9C13B810E34CD7A13A32A
SHA-256:	92BBF58EA51C3B94FFC488B645165F8F97281869600272052A1685C1F40C5C95
SHA-512:	15658FAD5CF8B313E1ECB9ADFDB5C3A4A5E1895D77D6C1240708F4413E104594FA420E6C8153AA5A5A3B34440F7405FA0D7AC8E1260957DB2D42CCE42DE79DA0
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Temp\MSIcfd1d.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.516674370985874
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8mOKhiwCH:Qw946cPbiOxDlbYnuRKvOBl
MD5:	E04182FBFEC75B4A14AA35E28AEC9E61
SHA1:	749C6A13918A5630B8066DDD4579B8AAEA50380C
SHA-256:	3A62DACA4030A3DC361EEE6C75F47E9451DEA81B45D12F1D140AE4C7F31E8309
SHA-512:	6E8BBBAF852B9C72AC0E680CD3091E443EFD94759EFC29A82F99A3BBD2540BF91B8C1000E0F43DD94ED7D3E19D6B3CB90F6BDC52673C64E5CE001D73EA5408B8
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.6./.1.1./.2.0.2.4. . .0.2.:.2.5.:.0.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-26 02-24-58-382.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	16603
Entropy (8bit):	5.3640834130777755
Encrypted:	false
SSDEEP:	384:OC4jQCtBslYaVmxFe0wo0m1wMPi9j19Gq1Lp4Q+i77rZn/2Os5asUlUlcnVLMXn/:cVkw
MD5:	1E1DEDE07E6F5027B9C8A17FEF920F20
SHA1:	8EA7BB49DF5CEF7A9640CBEA76C947ED53DCF4B2
SHA-256:	A1D34F1348D7A0773C0634DC97C1AFC8738E838873E6CA09FD61723981AE4BE1
SHA-512:	C4AC2A51FE85302D024199701F6F77D4FBDF0A4ED776D406DD0757BB5796A4AA270FF1F298AA5EDAB60510CB2CCAE1CD33DE57ACC20340E561717A9853A87C65
Malicious:	false
Preview:	SessionID=2cf5130f-728a-43be-9638-2baade7d53d2.1732605898391 Timestamp=2024-11-26T02:24:58:391-0500 ThreadID=6264 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=2cf5130f-728a-43be-9638-2baade7d53d2.1732605898391 Timestamp=2024-11-26T02:24:58:392-0500 ThreadID=6264 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=2cf5130f-728a-43be-9638-2baade7d53d2.1732605898391 Timestamp=2024-11-26T02:24:58:392-0500 ThreadID=6264 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=2cf5130f-728a-43be-9638-2baade7d53d2.1732605898391 Timestamp=2024-11-26T02:24:58:392-0500 ThreadID=6264 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=2cf5130f-728a-43be-9638-2baade7d53d2.1732605898391 Timestamp=2024-11-26T02:24:58:392-0500 ThreadID=6264 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.387843066184151
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmFPcbUI+nnJ71yXYMcbUcbSiWk:8qnXopZ50r4+R
MD5:	C0A44D286FBA161C31F8F78C3C407770
SHA1:	B608814B6B8DE633FE79E638430851530F872CF5
SHA-256:	EB899F17722483CB299757B5B656C813D88B3C2772F9FA0044255E523281C004
SHA-512:	DCC8757EBCA9F575EA3305D475B78C2FAB05126DF2DA1BF3479B38B4BB36C594C4C864B80DA5467ACD52EDFFF3710008BF395C88AB043D0C3C4E52E4F3D39823
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\6ca7e36f-df69-4ad7-bd31-97bc93399368.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\85ab561f-ceea-4cc8-a310-f3faa474c559.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\8715ae80-80a4-403c-a09d-fe0d9556a61e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f1166e8e-5762-40a2-a891-6304a2ea48c8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

Static File Info

General

File type:	PDF document, version 1.4, 1 pages
Entropy (8bit):	7.696147766582621
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	SIBZ3SUD0124112517250.pdf
File size:	172'310 bytes
MD5:	40e4924a1498bd865e42c20f0e94521a
SHA1:	62aefb8b6218720c03310efa68b451d87e99ec13
SHA256:	022d78b26004791e5579dfc7f5e1625d2fc6ba09ac89c5359b2a27a1c76e07da
SHA512:	97b179367faec2acab3a7c4503b245041449310a8537802c5c34978dcfb02910de31d9b4f3df4b71779a048b15898d5e44709bcf7a5a1f7042f1e54c43be0836
SSDEEP:	3072:zDGeqJwwrVdZbEoObCL1qUrj0eeG6H3t3eJhMn4xuAPvbOIHg93i:HGowrVdFEXbu1Fj0eeGUwJzvbOUci
TLSH:	AAF3BFB0901559AACC8A92C09F20351F8CEEF16389CF5AE135FD87849F08F5EF4A56E5
File Content Preview:	%PDF-1.4.%......1 0 obj.<</Type /Page./Parent 2 0 R./MediaBox [ 0 0 595.200 841.680 ]./Resources <</XObject 3 0 R /ProcSet [ /PDF /Text /ImageB /ImageC /ImageI ]>>/Contents [ 4 0 R ]./Rotate 0.>>..endobj.5 0 obj.<</Type /XObject /Subtype /Image./Name /JI1

File Icon


Icon Hash:	62cc8caeb29e8ae0

Static PDF Info

General
Header:	%PDF-1.4
Total Entropy:	7.696148
Total Bytes:	172310
Stream Entropy:	7.790369
Stream Bytes:	143578
Entropy outside Streams:	5.173513
Bytes outside Streams:	28732
Number of EOF found:	1
Bytes after EOF:

Keywords Statistics

Name	Count
obj	191
endobj	191
stream	93
endstream	93
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	0
/JS	0
/JavaScript	0
/AA	0
/OpenAction	1
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2024 08:25:05.336407900 CET	49717	443	192.168.2.9	52.6.155.20
Nov 26, 2024 08:25:05.336445093 CET	443	49717	52.6.155.20	192.168.2.9
Nov 26, 2024 08:25:05.336921930 CET	49717	443	192.168.2.9	52.6.155.20
Nov 26, 2024 08:25:05.336921930 CET	49717	443	192.168.2.9	52.6.155.20
Nov 26, 2024 08:25:05.336972952 CET	443	49717	52.6.155.20	192.168.2.9
Nov 26, 2024 08:25:06.749720097 CET	443	49717	52.6.155.20	192.168.2.9
Nov 26, 2024 08:25:06.750025034 CET	49717	443	192.168.2.9	52.6.155.20
Nov 26, 2024 08:25:06.750042915 CET	443	49717	52.6.155.20	192.168.2.9
Nov 26, 2024 08:25:06.751116991 CET	443	49717	52.6.155.20	192.168.2.9
Nov 26, 2024 08:25:06.751202106 CET	49717	443	192.168.2.9	52.6.155.20
Nov 26, 2024 08:25:06.751210928 CET	443	49717	52.6.155.20	192.168.2.9
Nov 26, 2024 08:25:06.751280069 CET	49717	443	192.168.2.9	52.6.155.20
Nov 26, 2024 08:25:06.751646042 CET	49717	443	192.168.2.9	52.6.155.20
Nov 26, 2024 08:25:06.751704931 CET	443	49717	52.6.155.20	192.168.2.9
Nov 26, 2024 08:25:06.752206087 CET	49717	443	192.168.2.9	52.6.155.20
Nov 26, 2024 08:25:06.752221107 CET	443	49717	52.6.155.20	192.168.2.9
Nov 26, 2024 08:25:06.797677994 CET	49717	443	192.168.2.9	52.6.155.20
Nov 26, 2024 08:25:07.258537054 CET	443	49717	52.6.155.20	192.168.2.9
Nov 26, 2024 08:25:07.258564949 CET	443	49717	52.6.155.20	192.168.2.9
Nov 26, 2024 08:25:07.258640051 CET	443	49717	52.6.155.20	192.168.2.9
Nov 26, 2024 08:25:07.258666992 CET	49717	443	192.168.2.9	52.6.155.20
Nov 26, 2024 08:25:07.259073973 CET	49717	443	192.168.2.9	52.6.155.20
Nov 26, 2024 08:25:07.264146090 CET	49717	443	192.168.2.9	52.6.155.20
Nov 26, 2024 08:25:07.264172077 CET	443	49717	52.6.155.20	192.168.2.9
Nov 26, 2024 08:25:09.877240896 CET	49721	443	192.168.2.9	23.47.168.24
Nov 26, 2024 08:25:09.877279997 CET	443	49721	23.47.168.24	192.168.2.9
Nov 26, 2024 08:25:09.877356052 CET	49721	443	192.168.2.9	23.47.168.24
Nov 26, 2024 08:25:09.877558947 CET	49721	443	192.168.2.9	23.47.168.24
Nov 26, 2024 08:25:09.877573013 CET	443	49721	23.47.168.24	192.168.2.9
Nov 26, 2024 08:25:11.461112976 CET	443	49721	23.47.168.24	192.168.2.9
Nov 26, 2024 08:25:11.461611986 CET	49721	443	192.168.2.9	23.47.168.24
Nov 26, 2024 08:25:11.461625099 CET	443	49721	23.47.168.24	192.168.2.9
Nov 26, 2024 08:25:11.462709904 CET	443	49721	23.47.168.24	192.168.2.9
Nov 26, 2024 08:25:11.462919950 CET	49721	443	192.168.2.9	23.47.168.24
Nov 26, 2024 08:25:11.508554935 CET	49721	443	192.168.2.9	23.47.168.24
Nov 26, 2024 08:25:11.508646965 CET	443	49721	23.47.168.24	192.168.2.9
Nov 26, 2024 08:25:11.508846998 CET	49721	443	192.168.2.9	23.47.168.24
Nov 26, 2024 08:25:11.508862972 CET	443	49721	23.47.168.24	192.168.2.9
Nov 26, 2024 08:25:11.552067995 CET	49721	443	192.168.2.9	23.47.168.24
Nov 26, 2024 08:25:11.833539963 CET	443	49721	23.47.168.24	192.168.2.9
Nov 26, 2024 08:25:11.833743095 CET	443	49721	23.47.168.24	192.168.2.9
Nov 26, 2024 08:25:11.833807945 CET	49721	443	192.168.2.9	23.47.168.24
Nov 26, 2024 08:25:11.834108114 CET	49721	443	192.168.2.9	23.47.168.24
Nov 26, 2024 08:25:11.834126949 CET	443	49721	23.47.168.24	192.168.2.9
Nov 26, 2024 08:25:11.834137917 CET	49721	443	192.168.2.9	23.47.168.24
Nov 26, 2024 08:25:11.834214926 CET	49721	443	192.168.2.9	23.47.168.24

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2024 08:25:05.800019979 CET	52363	53	192.168.2.9	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 26, 2024 08:25:05.800019979 CET	192.168.2.9	1.1.1.1	0xf2d9	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 26, 2024 08:25:05.944483042 CET	1.1.1.1	192.168.2.9	0xf2d9	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:25:07.725951910 CET	1.1.1.1	192.168.2.9	0xf7d6	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:25:07.725951910 CET	1.1.1.1	192.168.2.9	0xf7d6	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

p13n.adobe.io

armmf.adobe.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49717	52.6.155.20	443	7668	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:06 UTC	1473	OUT	GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1 Host: p13n.adobe.io Connection: keep-alive sec-ch-ua: "Chromium";v="105" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 x-adobe-uuid: fdf9e666-cbf4-4e86-8c83-d46a601e2046 x-adobe-uuid-type: visitorId x-api-key: AdobeReader9 sec-ch-ua-platform: "Windows" Origin: https://rna-resource.acrobat.com Accept-Language: en-US,en;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://rna-resource.acrobat.com/ Accept-Encoding: gzip, deflate, br
2024-11-26 07:25:07 UTC	608	IN	HTTP/1.1 200 Server: openresty Date: Tue, 26 Nov 2024 07:25:07 GMT Content-Type: application/json;charset=UTF-8 Content-Length: 4762 Connection: close x-request-id: J0IZpziyWcp3NfojueouhjLreHPXNTD5 vary: accept-encoding Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Headers: Authorization,Content-Type,X-Api-Key,cache-control,User-Agent,If-None-Match,x-adobe-uuid,x-adobe-uuid-type, X-Request-Id Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: x-request-id Strict-Transport-Security: max-age=15552000; includeSubDomains
2024-11-26 07:25:07 UTC	4762	IN	Data Raw: 7b 22 73 75 72 66 61 63 65 73 22 3a 7b 22 44 43 5f 52 65 61 64 65 72 5f 48 6f 6d 65 5f 4c 48 50 5f 54 72 69 61 6c 5f 42 61 6e 6e 65 72 22 3a 7b 22 63 6f 6e 74 61 69 6e 65 72 73 22 3a 5b 7b 22 63 6f 6e 74 61 69 6e 65 72 49 64 22 3a 31 2c 22 63 6f 6e 74 61 69 6e 65 72 4c 61 62 65 6c 22 3a 22 4a 53 4f 4e 20 66 6f 72 20 44 43 5f 52 65 61 64 65 72 5f 48 6f 6d 65 5f 4c 48 50 5f 54 72 69 61 6c 5f 42 61 6e 6e 65 72 22 2c 22 64 61 74 61 54 79 70 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 2c 22 64 61 74 61 22 3a 22 65 79 4a 6a 64 47 45 69 4f 6e 73 69 64 47 56 34 64 43 49 36 49 6c 52 79 65 53 42 42 59 33 4a 76 59 6d 46 30 49 46 42 79 62 79 4a 39 4c 43 4a 31 61 53 49 36 65 79 4a 30 61 58 52 73 5a 56 39 7a 64 48 6c 73 61 57 35 6e 49 6a 70 37 49 6d Data Ascii: {"surfaces":{"DC_Reader_Home_LHP_Trial_Banner":{"containers":[{"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","dataType":"application/json","data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7Im

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49721	23.47.168.24	443	7668	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:25:11 UTC	475	OUT	GET /onboarding/smskillreader.txt HTTP/1.1 Host: armmf.adobe.com Connection: keep-alive Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br If-None-Match: "78-5faa31cce96da" If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
2024-11-26 07:25:11 UTC	198	IN	HTTP/1.1 304 Not Modified Content-Type: text/plain; charset=UTF-8 Last-Modified: Mon, 01 May 2023 15:02:33 GMT ETag: "78-5faa31cce96da" Date: Tue, 26 Nov 2024 07:25:11 GMT Connection: close

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Acrobat.exePID: 7260, Parent PID: 3504

General

Target ID:	0
Start time:	02:24:54
Start date:	26/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\SIBZ3SUD0124112517250.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: AcroCEF.exePID: 7484, Parent PID: 7260

General

Target ID:	2
Start time:	02:24:55
Start date:	26/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: AcroCEF.exePID: 7668, Parent PID: 7484

General

Target ID:	4
Start time:	02:24:55
Start date:	26/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1740,i,15043513092136630955,4285387801381004547,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SIBZ3SUD0124112517250.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\60168a38-55c5-4283-ab29-17c8511690ab.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5d3a74.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c1f44fb3-8d3d-416e-a7ed-4ea77f0f9bb1.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241126072500Z-174.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7344

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7344

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Windows Analysis Report
SIBZ3SUD0124112517250.pdf