Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Paul Smart - Invoice Bill.pdf

Overview

General Information

Sample name:Paul Smart - Invoice Bill.pdf
Analysis ID:1467113
MD5:39858a2a0079fbe41ce2f07a492b4ab5
SHA1:90f80d1fdb50561acc5d4767df4ed3f1f8306655
SHA256:4cfd3f5038d9688b5c14385693f672c74c1f8d3470f6362aaa3789537c3d6aad
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 1644 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Paul Smart - Invoice Bill.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 3784 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 4124 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2156 --field-trial-handle=1548,i,3961840508981448788,13254356319118314033,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficTCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global trafficTCP traffic: 23.41.168.139:443 -> 192.168.2.5:49718
Source: global trafficTCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global trafficTCP traffic: 23.41.168.139:443 -> 192.168.2.5:49718
Source: global trafficTCP traffic: 23.41.168.139:443 -> 192.168.2.5:49718
Source: global trafficTCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global trafficTCP traffic: 23.41.168.139:443 -> 192.168.2.5:49718
Source: global trafficTCP traffic: 23.41.168.139:443 -> 192.168.2.5:49718
Source: global trafficTCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global trafficTCP traffic: 23.41.168.139:443 -> 192.168.2.5:49718
Source: global trafficTCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global trafficTCP traffic: 23.41.168.139:443 -> 192.168.2.5:49718
Source: global trafficTCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global trafficTCP traffic: 23.41.168.139:443 -> 192.168.2.5:49718
Source: global trafficTCP traffic: 23.41.168.139:443 -> 192.168.2.5:49718
Source: global trafficTCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global trafficTCP traffic: 23.41.168.139:443 -> 192.168.2.5:49718
Source: global trafficTCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: Joe Sandbox ViewIP Address: 23.41.168.139 23.41.168.139
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknownTCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknownTCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknownTCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknownTCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknownTCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknownTCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknownTCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknownTCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknownTCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknownTCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknownTCP traffic detected without corresponding DNS query: 23.41.168.139
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.2.drString found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.drString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: classification engineClassification label: clean2.winPDF@15/44@0/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journalJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-03 11-46-18-181.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Paul Smart - Invoice Bill.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2156 --field-trial-handle=1548,i,3961840508981448788,13254356319118314033,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2156 --field-trial-handle=1548,i,3961840508981448788,13254356319118314033,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: Paul Smart - Invoice Bill.pdfInitial sample: PDF keyword /JS count = 0
Source: Paul Smart - Invoice Bill.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: Paul Smart - Invoice Bill.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive12
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1467113 Sample: Paul Smart - Invoice Bill.pdf Startdate: 03/07/2024 Architecture: WINDOWS Score: 2 6 Acrobat.exe 20 61 2->6         started        process3 8 AcroCEF.exe 105 6->8         started        process4 10 AcroCEF.exe 2 8->10         started        dnsIp5 13 23.41.168.139, 443, 49718 ZAYO-6461US United States 10->13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
23.41.168.139
unknownUnited States
6461ZAYO-6461USfalse

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1467113
Start date and time:2024-07-03 17:45:23 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 10s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultwindowspdfcookbook.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:10
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:Paul Smart - Invoice Bill.pdf
Detection:CLEAN
Classification:clean2.winPDF@15/44@0/1
EGA Information:Failed
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 0
  • Number of non-executed functions: 0
Cookbook Comments:
  • Found application associated with file extension: .pdf
  • Found PDF document
  • Close Viewer

Warnings

  • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 184.28.88.176, 54.224.241.105, 34.237.241.83, 50.16.47.176, 18.213.11.84, 162.159.61.3, 172.64.41.3, 2.16.241.13, 2.16.241.15, 93.184.221.240, 2.19.11.122, 2.19.11.121
  • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, identrust.edgesuite.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, wu.ec.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, wu.azureedge.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, a1952.dscq.akamai.net, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, geo2.adobe.com, apps.identrust.com, wu-b-net.trafficmanager.net
  • VT rate limit hit for: Paul Smart - Invoice Bill.pdf

Simulations

Behavior and APIs

TimeTypeDescription
11:46:28API Interceptor3x Sleep call for process: AcroCEF.exe modified

LLM Input / Output

InputOutput
URL: PDF Model: gpt-4o
```json{  "riskscore": 2,  "reasons": "The screenshot does not contain any visually prominent button or link that could mislead the user into clicking on a potentially harmful link. The text in the screenshot does not create a sense of urgency or interest typically associated with phishing attempts, such as 'Click here to view document' or 'Open the link to see your invoice.' The document appears to be an invoice with detailed payment information, which is common in legitimate business transactions. There is no impersonation of well-known brands. The only email address provided is for remittances, which does not inherently indicate a phishing attempt. However, the presence of financial information and an email address does pose a minor risk if the document is unsolicited or unexpected."}

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
23.41.168.139Confirmation For-Certara.pdfGet hashmaliciousHTMLPhisherBrowse
    Orden#46789_2024_Optoflux_mexico_sderls.exeGet hashmaliciousAgentTesla, DarkTortillaBrowse
      INQUIRY-13062024.exeGet hashmaliciousAgentTesla, DarkTortillaBrowse
        NEW ORDER.docx.docGet hashmaliciousUnknownBrowse
          FW IMPORTANT DVO 96FEJJ - Distribution_Notice.emlGet hashmaliciousHTMLPhisherBrowse
            http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdfGet hashmaliciousUnknownBrowse
              http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdfGet hashmaliciousUnknownBrowse
                Order Proforma Invoice.xlsGet hashmaliciousUnknownBrowse
                  Dokumenti za pla#U0107anje.docx.docGet hashmaliciousUnknownBrowse
                    AWB.xlsGet hashmaliciousUnknownBrowse

                      Domains

                      ⊘No context

                      ASNs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      ZAYO-6461UShttps://hamids-worker.hamidyousefi93.workers.dev/Get hashmaliciousUnknownBrowse
                      • 23.35.232.134
                      https://a289.dvq.workers.dev/Get hashmaliciousUnknownBrowse
                      • 23.35.232.134
                      https://worker2.kenneth-ho-yk.workers.dev/Get hashmaliciousUnknownBrowse
                      • 23.35.232.134
                      https://jiedian.dadabing023.workers.dev/Get hashmaliciousUnknownBrowse
                      • 23.35.232.134
                      https://iojne3.pages.dev/Get hashmaliciousUnknownBrowse
                      • 23.35.232.134
                      https://v.zzzytd.top/Get hashmaliciousUnknownBrowse
                      • 23.35.232.134
                      Confirmation For-Certara.pdfGet hashmaliciousHTMLPhisherBrowse
                      • 23.41.168.139
                      Orden#46789_2024_Optoflux_mexico_sderls.exeGet hashmaliciousAgentTesla, DarkTortillaBrowse
                      • 23.41.168.139
                      INQUIRY-13062024.exeGet hashmaliciousAgentTesla, DarkTortillaBrowse
                      • 23.41.168.139
                      NEW ORDER.docx.docGet hashmaliciousUnknownBrowse
                      • 23.41.168.139

                      JA3 Fingerprints

                      ⊘No context

                      Dropped Files

                      ⊘No context

                      Created / dropped Files

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.24350535743055
                      Encrypted:false
                      SSDEEP:6:BOWInKTSQ+q2P92nKuAl9OmbnIFUt84OWInKOgZmw+4OWInKOQVkwO92nKuAl9Oe:EPnKTSVv4HAahFUt81PnKOg/+1PnKOIE
                      MD5:6C8F08D552EF8584DC433708BB5AAA5D
                      SHA1:10A1684F47C8527CFA62CA900CD0AF5538ED4B3D
                      SHA-256:7E09E3ED724638BDAB5C0D0F1809B8A9AAEC7895C280AE24FEDAEC3BF7453E3E
                      SHA-512:470EA15416929A0983CD1143D22A6C3D98A968F5DCB8596794CEC9ECDD2A242E79C9DD625611762B5B1A2DBF5E9A34439E0DE321EA6B55B763EC638C842A0B7F
                      Malicious:false
                      Reputation:low
                      Preview:2024/07/03-11:46:16.967 1b38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/07/03-11:46:16.970 1b38 Recovering log #3.2024/07/03-11:46:16.970 1b38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.24350535743055
                      Encrypted:false
                      SSDEEP:6:BOWInKTSQ+q2P92nKuAl9OmbnIFUt84OWInKOgZmw+4OWInKOQVkwO92nKuAl9Oe:EPnKTSVv4HAahFUt81PnKOg/+1PnKOIE
                      MD5:6C8F08D552EF8584DC433708BB5AAA5D
                      SHA1:10A1684F47C8527CFA62CA900CD0AF5538ED4B3D
                      SHA-256:7E09E3ED724638BDAB5C0D0F1809B8A9AAEC7895C280AE24FEDAEC3BF7453E3E
                      SHA-512:470EA15416929A0983CD1143D22A6C3D98A968F5DCB8596794CEC9ECDD2A242E79C9DD625611762B5B1A2DBF5E9A34439E0DE321EA6B55B763EC638C842A0B7F
                      Malicious:false
                      Reputation:low
                      Preview:2024/07/03-11:46:16.967 1b38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/07/03-11:46:16.970 1b38 Recovering log #3.2024/07/03-11:46:16.970 1b38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):335
                      Entropy (8bit):5.234088105578165
                      Encrypted:false
                      SSDEEP:6:BOWInKxkQ+q2P92nKuAl9Ombzo2jMGIFUt84OWInKGwgZmw+4OWInKLQQVkwO92g:EPnKxcv4HAa8uFUt81PnKi/+1PnKLT5c
                      MD5:F79ED14996BB16BEFDC4FC57EA7E8DA7
                      SHA1:E60F79BBE1D62050089B7688E84D9B811C8F5806
                      SHA-256:A8EE9409BCE3B752550EF596F0386CFF2D3A09274EFBEF4B63A33E949BCD1E81
                      SHA-512:130F65EA8E52D05FAB10FA293E76C22A3924B431CBFBA8E38636DFC7E216350C10EEB5F7A6712BBBCE7C805D8C17FD3616ECB84A37BB746C2677E08AD9131F6E
                      Malicious:false
                      Reputation:low
                      Preview:2024/07/03-11:46:16.976 2f8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/07/03-11:46:16.977 2f8 Recovering log #3.2024/07/03-11:46:16.978 2f8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):335
                      Entropy (8bit):5.234088105578165
                      Encrypted:false
                      SSDEEP:6:BOWInKxkQ+q2P92nKuAl9Ombzo2jMGIFUt84OWInKGwgZmw+4OWInKLQQVkwO92g:EPnKxcv4HAa8uFUt81PnKi/+1PnKLT5c
                      MD5:F79ED14996BB16BEFDC4FC57EA7E8DA7
                      SHA1:E60F79BBE1D62050089B7688E84D9B811C8F5806
                      SHA-256:A8EE9409BCE3B752550EF596F0386CFF2D3A09274EFBEF4B63A33E949BCD1E81
                      SHA-512:130F65EA8E52D05FAB10FA293E76C22A3924B431CBFBA8E38636DFC7E216350C10EEB5F7A6712BBBCE7C805D8C17FD3616ECB84A37BB746C2677E08AD9131F6E
                      Malicious:false
                      Reputation:low
                      Preview:2024/07/03-11:46:16.976 2f8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/07/03-11:46:16.977 2f8 Recovering log #3.2024/07/03-11:46:16.978 2f8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):508
                      Entropy (8bit):5.037217789310696
                      Encrypted:false
                      SSDEEP:12:YH/um3RA8sqbQEsBdOg2H0Ucaq3QYiubxnP7E4T3OF+:Y2sRdsWkdMH0H3QYhbxP7nbI+
                      MD5:9E8D4BE8DD03F1DC7365242C3B830D72
                      SHA1:2D644D05169E382298CE766799FE7B0965CFC2C5
                      SHA-256:9F76A33C80F10D0EF7ECA9E6C5AEA35E97A12D06D4B7D699619497D2AA13B367
                      SHA-512:E5B211BB7040AA4BB994188B3E220BCF837AAB6B68FC1E7A41FDD3F9626DC9C00160443A00646A4A8BEF78C5C5F13270757CF4EDBD6201463197E95693E5250A
                      Malicious:false
                      Reputation:low
                      Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13364581588437843","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":152858},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fddfdc3e-b1a3-40fd-8d01-cfd6fe27bc02.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:modified
                      Size (bytes):508
                      Entropy (8bit):5.037217789310696
                      Encrypted:false
                      SSDEEP:12:YH/um3RA8sqbQEsBdOg2H0Ucaq3QYiubxnP7E4T3OF+:Y2sRdsWkdMH0H3QYhbxP7nbI+
                      MD5:9E8D4BE8DD03F1DC7365242C3B830D72
                      SHA1:2D644D05169E382298CE766799FE7B0965CFC2C5
                      SHA-256:9F76A33C80F10D0EF7ECA9E6C5AEA35E97A12D06D4B7D699619497D2AA13B367
                      SHA-512:E5B211BB7040AA4BB994188B3E220BCF837AAB6B68FC1E7A41FDD3F9626DC9C00160443A00646A4A8BEF78C5C5F13270757CF4EDBD6201463197E95693E5250A
                      Malicious:false
                      Reputation:low
                      Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13364581588437843","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":152858},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):4509
                      Entropy (8bit):5.237837142272221
                      Encrypted:false
                      SSDEEP:96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLU1RVtk0ltZ:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNL+
                      MD5:329DF43731DEF29B5D3BC7F2D7F933DC
                      SHA1:814C7050592D8C1A101394B8270652534F1FD22F
                      SHA-256:718E2469ED91F7B94C1FA0F721CF7AC8419E7E615E61046007887D2FA313425A
                      SHA-512:27C32A0AB19B87A16484BB41658716A7E4E494B4A9E7FADCD7E43D1B1ED635C65AFE5D303643CE4391A0CCCFD5EDC7A3CD64BC138EA6FBFC67D93870BADD42AB
                      Malicious:false
                      Reputation:low
                      Preview:*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):323
                      Entropy (8bit):5.238276931185311
                      Encrypted:false
                      SSDEEP:6:BOWIn//DQQ+q2P92nKuAl9OmbzNMxIFUt84OWIn/jgZmw+4OWIn/tQVkwO92nKuP:EPn//cv4HAa8jFUt81Pn/8/+1Pn/W5Lv
                      MD5:C1ADF8A6CD5A7D6AF8A3DE7F34FD2B4B
                      SHA1:4A55738C19AE3DEE96CC8FC41AFE22C20B888CF8
                      SHA-256:491A01EE402BBB7282DDCB2570932E9162EC974EBE5EDBC1A4C37CB8251E5B4A
                      SHA-512:2EAB1CCCF0CF43EB23A607AA7AD51B9A359F39DA1ADF0F6D3393578790D7746FDF03C1DBD124C47FCCDCD558120FD96E9149164893F8985B2CF1E1031F88A536
                      Malicious:false
                      Reputation:low
                      Preview:2024/07/03-11:46:17.479 2f8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/07/03-11:46:17.496 2f8 Recovering log #3.2024/07/03-11:46:17.502 2f8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):323
                      Entropy (8bit):5.238276931185311
                      Encrypted:false
                      SSDEEP:6:BOWIn//DQQ+q2P92nKuAl9OmbzNMxIFUt84OWIn/jgZmw+4OWIn/tQVkwO92nKuP:EPn//cv4HAa8jFUt81Pn/8/+1Pn/W5Lv
                      MD5:C1ADF8A6CD5A7D6AF8A3DE7F34FD2B4B
                      SHA1:4A55738C19AE3DEE96CC8FC41AFE22C20B888CF8
                      SHA-256:491A01EE402BBB7282DDCB2570932E9162EC974EBE5EDBC1A4C37CB8251E5B4A
                      SHA-512:2EAB1CCCF0CF43EB23A607AA7AD51B9A359F39DA1ADF0F6D3393578790D7746FDF03C1DBD124C47FCCDCD558120FD96E9149164893F8985B2CF1E1031F88A536
                      Malicious:false
                      Reputation:low
                      Preview:2024/07/03-11:46:17.479 2f8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/07/03-11:46:17.496 2f8 Recovering log #3.2024/07/03-11:46:17.502 2f8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240703154620Z-161.bmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
                      Category:dropped
                      Size (bytes):71190
                      Entropy (8bit):1.0073700359062276
                      Encrypted:false
                      SSDEEP:96:mNtyMhF7BsFqIcBNddgI0DNG4cRvdbQM4nH6MMMM8F8/MzMMMMWMMM+M4MMMMiMf:GXBGqIcBNfgI0sxdbM6
                      MD5:B6EFC6DB09AA9D38525BC25FC6404EAD
                      SHA1:AF5E5F6A7506B557B78480AB349745F9A7F0F675
                      SHA-256:CB7BF509180DB052D5394D804AEA64C599866E4172C55D9B573FE72DF77D4AEF
                      SHA-512:9A4B151A3695F98352D29B364D6200E57E4EA5B3DFD86C7AACB606871B97D31EE3AD21B89654C968336A0290586FC504E113D82BBE92C77F664629D0A7BD80B3
                      Malicious:false
                      Reputation:low
                      Preview:BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                      Category:dropped
                      Size (bytes):71954
                      Entropy (8bit):7.996617769952133
                      Encrypted:true
                      SSDEEP:1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
                      MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
                      SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
                      SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
                      SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
                      Malicious:false
                      Reputation:moderate, very likely benign file
                      Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):893
                      Entropy (8bit):7.366016576663508
                      Encrypted:false
                      SSDEEP:24:hBntmDvKUQQDvKUr7C5fpqp8gPvXHmXvponXux:3ntmD5QQD5XC5RqHHXmXvp++x
                      MD5:D4AE187B4574036C2D76B6DF8A8C1A30
                      SHA1:B06F409FA14BAB33CBAF4A37811B8740B624D9E5
                      SHA-256:A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
                      SHA-512:1F44A360E8BB8ADA22BC5BFE001F1BABB4E72005A46BC2A94C33C4BD149FF256CCE6F35D65CA4F7FC2A5B9E15494155449830D2809C8CF218D0B9196EC646B0C
                      Malicious:false
                      Preview:0..y..*.H.........j0..f...1.0...*.H.........N0..J0..2.......D....'..09...@k0...*.H........0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30...000930211219Z..210930140115Z0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30.."0...*.H.............0..........P..W..be......,k0.[...}.@......3vI*.?!I..N..>H.e...!.e.*.2....w..{........s.z..2..~..0....*8.y.1.P..e.Qc...a.Ka..Rk...K.(.H......>.... .[.*....p....%.tr.{j.4.0...h.{T....Z...=d.....Ap..r.&.8U9C....\@........%.......:..n.>..\..<.i....*.)W..=....]......B0@0...U.......0....0...U...........0...U.........{,q...K.u...`...0...*.H...............,...\...(f7:...?K.... ]..YD.>.>..K.t.....t..~.....K. D....}..j.....N..:.pI...........:^H...X._..Z.....Y..n......f3.Y[...sG.+..7H..VK....r2...D.SrmC.&H.Rg.X..gvqx...V..9$1....Z0G..P.......dc`........}...=2.e..|.Wv..(9..e...w.j..w.......)...55.1.

                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:data
                      Category:modified
                      Size (bytes):328
                      Entropy (8bit):3.134192963226759
                      Encrypted:false
                      SSDEEP:6:kKBI9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:5DnLNkPlE99SNxAhUe/3
                      MD5:2F1D53C64FE45C6211B8687298200016
                      SHA1:7CF0EBAA209B14A22A5B031384AC388E81E639D4
                      SHA-256:BDFE78C91EB99EAA9FBDFF577C0254091942C18596C3A524FCF50D9051A1A2A6
                      SHA-512:2D172B4BB77543B703A44892592146D39E4D944BC902A69001A2CBB7CFFA11E04B853E30D799F036E3B4CC9B28E19690A2F372540389AA89874D600BC15A7F61
                      Malicious:false
                      Preview:p...... .........n.O`...(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):252
                      Entropy (8bit):3.018531379206123
                      Encrypted:false
                      SSDEEP:3:kkFklrOFoMXfllXlE/E/KRkzllPlzRkwWBARLNDU+ZMlKlBkvclcMlVHblB8V7l3:kKtFoYxliBAIdQZV7I7kc3
                      MD5:4E688BADE7B1964ED1D9F29C89C86391
                      SHA1:E942051E43A2BFEA04C87D85DF238D47955CD978
                      SHA-256:760A40EC1D47302F8F59FDC0431FBA4CA5200F90CDACAF85A5E2366FCE2B7D0F
                      SHA-512:3F6A96FB1D9E64337692E3EF1D95D5E12822D079BD2745DDC3B869BD0773ECAA9C3A8B20641ED749E3D5DA416AB4C38E7444A5151EE2D2EDC30B983187B8FC85
                      Malicious:false
                      Preview:p...... ....`.....8+`...(....................................................... ........!.M........(...........}...h.t.t.p.:././.a.p.p.s...i.d.e.n.t.r.u.s.t...c.o.m./.r.o.o.t.s./.d.s.t.r.o.o.t.c.a.x.3...p.7.c...".3.7.d.-.6.0.7.9.b.8.c.0.9.2.9.c.0."...

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.892

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PostScript document text
                      Category:dropped
                      Size (bytes):185099
                      Entropy (8bit):5.182478651346149
                      Encrypted:false
                      SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                      MD5:94185C5850C26B3C6FC24ABC385CDA58
                      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                      Malicious:false
                      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):227002
                      Entropy (8bit):3.392780893644728
                      Encrypted:false
                      SSDEEP:1536:WKPC4iyzDtrh1cK3XEivK7VK/3AYvYwgF/rRoL+sn:DPCaJ/3AYvYwglFoL+sn
                      MD5:87EDBEE38F56C20298F25D5D3D4D1B5C
                      SHA1:7F904E9615AC3186A87472EF366DD8202855B0B7
                      SHA-256:A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
                      SHA-512:BBEBC1FCD5BC9AE042DD5782425BA8C47BF3EAC283B2487FC4E3FF6BF8101306DAB081E5135594165D4DC1AC120FF125AADBC5B3FFE7C646183C04DF77865E0D
                      Malicious:false
                      Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):295
                      Entropy (8bit):5.32990431925539
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HX5vQHIvSVY+FIbRI6XVW7+0YOR2DoAvJM3g98kUwPeUkwRe9:YvXKXCim5YpW7OsGMbLUkee9
                      MD5:98FEB1551C78D5B242BBA18A9500486F
                      SHA1:B7E81F042E3372827E9D144BFB6288DD2C31A083
                      SHA-256:8724388812FBF05BF57C79F346F8687A78E717018C264714C2E1E9A5730191BF
                      SHA-512:B527CF09F98697BDE0D156C5F52024953747AA1B764BFDA84A13AC519B239552E1DC429F7BD832DCDAC394136F796EBE77BA4896041FA99FFE3FC1BB647E4C0A
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"bbaeadab-1d54-4648-974f-a203bae30d83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1720197638420,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.268663596946009
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HX5vQHIvSVY+FIbRI6XVW7+0YOR2DoAvJfBoTfXpnrPeUkwRe9:YvXKXCim5YpW7OsGWTfXcUkee9
                      MD5:46DACE715886F6020B1B35DE88D14520
                      SHA1:84512E99B71FD45314A11FF54ACA506D1ECF20B1
                      SHA-256:F1537DD16DE2FA4BC493454CB8A8F2AF85CB67943E8304D15013D43F4ADBAD83
                      SHA-512:9D6482AE10E99D5ACD163E11FD09425F571DBA743195B7C1818840C0B94871C821732CBF702A86D4E336D6B6DC6170B72A37FCFC2435E598690DF31976B77D65
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"bbaeadab-1d54-4648-974f-a203bae30d83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1720197638420,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.248150166083411
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HX5vQHIvSVY+FIbRI6XVW7+0YOR2DoAvJfBD2G6UpnrPeUkwRe9:YvXKXCim5YpW7OsGR22cUkee9
                      MD5:54BA59FA10A6747557865A953F3E62E4
                      SHA1:59AF20E881A95776A6BC713B2DCC5DBBC6599005
                      SHA-256:715B30C5B3A64EA25EB12BB47B7D0222214E705867D5C56FFAC9C01C7CDDD09F
                      SHA-512:D93DCDF829CF73F3201561E87F0ACF44A8BFEEBC6C033DB3B83DF6E5CC77051666EC154904C0E8F44BBD4F4B2227B08B01183DADDC84C541D3618972CCF34E50
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"bbaeadab-1d54-4648-974f-a203bae30d83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1720197638420,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):285
                      Entropy (8bit):5.307623194556279
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HX5vQHIvSVY+FIbRI6XVW7+0YOR2DoAvJfPmwrPeUkwRe9:YvXKXCim5YpW7OsGH56Ukee9
                      MD5:5590380CB4649888BAAD37AFF91CAFC1
                      SHA1:B751F1E823A38DB6B1F401225038505E9DF67ADF
                      SHA-256:AC38C6797DDB56245874A5ACB0E39B8ACE95DED4F0659EB66A7D2FE2694C0A76
                      SHA-512:87C6C0756FA61E166717F7BD807645CDBB284F7F69B6C26B0F0BE6BAFE3EC3B0D2A20BE1DE88B17B154C51B193F3F55940B984032EF02CDF7F20C92C22F247EA
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"bbaeadab-1d54-4648-974f-a203bae30d83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1720197638420,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.26363785039625
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HX5vQHIvSVY+FIbRI6XVW7+0YOR2DoAvJfJWCtMdPeUkwRe9:YvXKXCim5YpW7OsGBS8Ukee9
                      MD5:1CFB27B296530E7FE4F2D2DB66AE24D7
                      SHA1:29F8E457C26E4D1D5CE37E63082D9B14EFA259D3
                      SHA-256:B01E6386FBACB8367C18A1B25919A62C8A3DA31E8954D1D471CBC3853BE542ED
                      SHA-512:07EA6812C5A7DBAA8BFEC37205D12265D01281EE3B55D437B489481E0B956F8EA4E016D7AF560F54A8CD0113F91354A4D3A6AD2C6FC3B712749497C47DBF03D6
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"bbaeadab-1d54-4648-974f-a203bae30d83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1720197638420,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.250422538147099
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HX5vQHIvSVY+FIbRI6XVW7+0YOR2DoAvJf8dPeUkwRe9:YvXKXCim5YpW7OsGU8Ukee9
                      MD5:B5B6FFF5395D8B4C50FFC2B75734A1DB
                      SHA1:58B887C68E054D4857AF380670AAFF99111C03C6
                      SHA-256:553950E0562D2D2CFBCBEA0999E8EA1168BADDF6046943ACE53EE63D905D1C9E
                      SHA-512:8B91140EB4E7D324FB0FEC9F8E28AC2BCA6AE845E63E77491DF3B56A5B1C15BCF9B3794EFA50E2E77C32C570807BF7A84CE4DE97ECDFA4942E1F047BC17AABED
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"bbaeadab-1d54-4648-974f-a203bae30d83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1720197638420,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.252730880121943
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HX5vQHIvSVY+FIbRI6XVW7+0YOR2DoAvJfQ1rPeUkwRe9:YvXKXCim5YpW7OsGY16Ukee9
                      MD5:6BBFE7BFE99F117F5C4C6F71BFF99D08
                      SHA1:2FE22B7A9B0CAE1FBFBAE2ACAF3FD3B597D52597
                      SHA-256:E1D6AE439292D0ED24C334DDCBDFD2AF591D31041FE66CFDCC91CB8490CCE43A
                      SHA-512:7DE09CC3A753DB015FBBE82F3AED213B2535E5923436899209201225541D9B91B116240116689CA6BADF3CFD29F09D0AE78B7672E28E9896E6B0A8851062C80C
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"bbaeadab-1d54-4648-974f-a203bae30d83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1720197638420,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.269047843828597
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HX5vQHIvSVY+FIbRI6XVW7+0YOR2DoAvJfFldPeUkwRe9:YvXKXCim5YpW7OsGz8Ukee9
                      MD5:100E290DE5A02275D0F4BA74920F95BE
                      SHA1:523ED350F5D3B86DBA3154D5D199A2B63FC6DA16
                      SHA-256:559D1EA94AF11EB7CBD228CF2402B0BB994261419A13D9AB9304960EA917232E
                      SHA-512:346AA9D5BAA329408AF6BA12BC9BF135487FC8F59C6E52C1E4970F81B24ABA29604F7A8D701642F4DCC24ACF94321E2E41CFC0838A85B7E3274A2056DC5B7E64
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"bbaeadab-1d54-4648-974f-a203bae30d83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1720197638420,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1372
                      Entropy (8bit):5.731847236238963
                      Encrypted:false
                      SSDEEP:24:Yv6Xdm6iOUKLgENRcbrZbq00iCCBrwJo++ns8ct4mFJNa:YvVOUEgigrNt0wSJn+ns8cvFJg
                      MD5:CE7F1A16B791FE5F02C3B7A80E74F5DE
                      SHA1:EC432981D0F55078E6211BB4B5AEB2C67F718B34
                      SHA-256:0738C9F73D2640D04D44C25FE319CD31959AA7C55D444942F2B85AB705855698
                      SHA-512:8CA9998F28B7EFE14138D1CA468C2D73FEB5CF1870EC8D6BFA05D3EA9D266AA37AAB364A8C64B6F020C210B86C116DE7478B5660F729CBD9A080DF207A74386C
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"bbaeadab-1d54-4648-974f-a203bae30d83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1720197638420,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"79887_247329ActionBlock_0","campaignId":79887,"containerId":"1","controlGroupId":"","treatmentId":"acc56846-d570-4500-a26e-7f8cf2b4acad","variationId":"247329"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJUcnkgQWNyb2JhdCBQcm8ifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNSIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTMiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIDctZGF5IHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0byBwcmVtaXVtIFBERiBhbmQgZS1zaWduaW5nIHRvb2xzLiIsImJ

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.257338857316415
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HX5vQHIvSVY+FIbRI6XVW7+0YOR2DoAvJfYdPeUkwRe9:YvXKXCim5YpW7OsGg8Ukee9
                      MD5:7DDBA0A2ED584EA21E2C3711D19753A2
                      SHA1:189063399A7A470FE9F4877396BEA2E5A98A5C7A
                      SHA-256:9C87089A6353319820292DD7E666D57DFC81027806CF4610EF09E4F1F664EF07
                      SHA-512:D718C2B931504F433FBD4C4BFF88B3DA578AD686C5368000073A72625C2BA58D063EA668CB800F7830303CB018E5F22E79033917F4B3F3CAF09409218B8713AA
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"bbaeadab-1d54-4648-974f-a203bae30d83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1720197638420,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1395
                      Entropy (8bit):5.768612073085288
                      Encrypted:false
                      SSDEEP:24:Yv6Xdm6iO7rLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNy:YvVO7HgDv3W2aYQfgB5OUupHrQ9FJU
                      MD5:FC84B43D77D3630137542FBF5B388997
                      SHA1:1F314987B3B5D90F1FAA107F5B7BB979B47AA031
                      SHA-256:5CE94DFF189CD88F823D92AEEA5675B8898EF8D0A3053D36E01D96CDA4EC2D33
                      SHA-512:2EF14EE416948EBB4F356DACFB0103477F2CEFE21FAC5E513B3A0D04DF9EA74CBAF801392C63864E989ECD52F99F38E0379622663AAD3024CA06DADB62BC1818
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"bbaeadab-1d54-4648-974f-a203bae30d83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1720197638420,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):291
                      Entropy (8bit):5.241179158720062
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HX5vQHIvSVY+FIbRI6XVW7+0YOR2DoAvJfbPtdPeUkwRe9:YvXKXCim5YpW7OsGDV8Ukee9
                      MD5:4C2826D677EE16166748AAC1D0805C99
                      SHA1:F3C6DA075A8C6311FBD7FBE9E7178889E64EDF11
                      SHA-256:AF841A1CB36B0DD16BAB1570CB88A6E9C24143546DB9B654FFF51C92376CBFD8
                      SHA-512:EF1FDB80B2A3033FB3CADD353700A2203CF1272FB00E13D112D6CA285BEE2C548B67B6724FC352D84E6034DAF94EFDC10E5192327798044C068D80F6AF4E6751
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"bbaeadab-1d54-4648-974f-a203bae30d83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1720197638420,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):287
                      Entropy (8bit):5.243101852168046
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HX5vQHIvSVY+FIbRI6XVW7+0YOR2DoAvJf21rPeUkwRe9:YvXKXCim5YpW7OsG+16Ukee9
                      MD5:BDD77924A93E379F22E584BEDA7AE56E
                      SHA1:E7FB2D0FD5C22BC71BAF5F60F461B34008273EE8
                      SHA-256:9D106F4DC8B919BBB70DC2430E5D082A80AF405C925A46EDE2C058D65852EF30
                      SHA-512:CF7CEB79A3D9D5ACAF19A20CF8CA9370F4E4DB4FD414E05045C42D62055BA5F20C77754663B7C1798DBC2067D0E1C08613C1CD124F94A043E47C901FF4B01318
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"bbaeadab-1d54-4648-974f-a203bae30d83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1720197638420,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.264173986074563
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HX5vQHIvSVY+FIbRI6XVW7+0YOR2DoAvJfbpatdPeUkwRe9:YvXKXCim5YpW7OsGVat8Ukee9
                      MD5:927117C2B02EF833353EB8B6AE5D59C8
                      SHA1:38D8EDA14BA1E8126E3C62C2E645F86FB3E92AB3
                      SHA-256:136705EAE9011719EFCFDC20EFCEC49B6C9CBE8CD0D97F25DB7A8426A291A825
                      SHA-512:0E9B769791AE6EBBE18F0F2B0DD433EC8A686DF45438F27B21970B5FC36E39D40FC46C08E4E7AA56DE3ED4BEADC15BC8A62B5BCB8DC7E077FE553D1CD58A5C45
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"bbaeadab-1d54-4648-974f-a203bae30d83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1720197638420,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):286
                      Entropy (8bit):5.215882231313449
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HX5vQHIvSVY+FIbRI6XVW7+0YOR2DoAvJfshHHrPeUkwRe9:YvXKXCim5YpW7OsGUUUkee9
                      MD5:39D438F23D52E772741504E3D870395C
                      SHA1:529BC3F14FC8F84E1CBA297B18A65AB9825170EA
                      SHA-256:A588AD7B97D706492AFD5A8454B9A0D1CCDD6C9C8853CBF6B65DABCBBD347BFB
                      SHA-512:978E40D84B379F8C5A2D58D5814121DBBC71B109D3B3DED4F4D9B51AC6EB1FE53BE8E7E183191B2F76EE31F728695955DD0A79C2152246FA9B31E206ABB91962
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"bbaeadab-1d54-4648-974f-a203bae30d83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1720197638420,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):782
                      Entropy (8bit):5.3584519248671025
                      Encrypted:false
                      SSDEEP:12:YvXKXCim5YpW7OsGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWe:Yv6Xdm6iOC168CgEXX5kcIfANhL
                      MD5:1D42AD8D00F4D636313E4300C1E169AF
                      SHA1:8926BECB386F7FA9571292FB6469ECCBF992188F
                      SHA-256:E593404573FF80FEB38716062688441673308E6CE96335859EFB8F81E31EB28F
                      SHA-512:0BB89F54AB63C3849FD79C15F65E002CE0608604256E4DFA8AC2359BFB00A47E6E03A10C2499C26A990FAC1D6769D6B6CA0F6B2C8BD6F32BF422F317F7EB1F46
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"bbaeadab-1d54-4648-974f-a203bae30d83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1720197638420,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1720021583453}}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):4
                      Entropy (8bit):0.8112781244591328
                      Encrypted:false
                      SSDEEP:3:e:e
                      MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                      SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                      SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                      SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                      Malicious:false
                      Preview:....

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):2814
                      Entropy (8bit):5.12296750207641
                      Encrypted:false
                      SSDEEP:48:YKUuLRc6mKh2YtGNrJb4mpQMcmJS/v96Zp:dUyRzldtGNrJ8memJS96Zp
                      MD5:330DCE470DB1B3B225EFCD6FD86994B3
                      SHA1:5ADAB1C7784EE5C3333743B504EF6A0F82B8C68E
                      SHA-256:EB48F0AEA886939DF51DF99E524B6246A744EB9AA3925BE7DA500BB7A0F83461
                      SHA-512:C95AA7A137FBE2B8A7BD3407BD9F0230A05710410A232FF22E077DF4FE8D4247289A99A8ED4A78FEBDF561A970902344C12068B15BC906B3326A5C91D4000B3F
                      Malicious:false
                      Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"799bf96ddca14ef4623daa811fbb354b","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1720021583000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"fc3aa5707df7f8040fd6215af56c6f19","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1372,"ts":1720021583000},{"id":"Edit_InApp_Aug2020","info":{"dg":"b6a09cf7adac9898d29be3f6c2d97225","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1720021583000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"9992325af3923ee90525cd174d310ce8","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1720021583000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"3a69258ef77cc0b1921444c14d4b90b8","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1720021583000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"007673d442bb3214d6816927ae9e101a","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1720021583000},

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
                      Category:dropped
                      Size (bytes):12288
                      Entropy (8bit):0.9845110216925558
                      Encrypted:false
                      SSDEEP:24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpH/ZM4zJwtNBwtNbRZ6bRZ4S/ZMF:TVl2GL7ms6ggOVpB3zutYtp6Pfg
                      MD5:8DEE467C0EB117234DF836E4866CEB19
                      SHA1:33019E5583963E3FA8481EB0B63D9AC17D36F8DF
                      SHA-256:4F980D0047C91A7E074E526B5464AFA7DE115BBDB75A36A5E7AF2E04742BF039
                      SHA-512:1F8A9E1A05CC09DD3672E87B9B704B946A958CE5399B26A93158461F06A170E9ABDC06F3A3FC843206B4466799D76BB42EE6EF75DD3B844E7333543DD148E821
                      Malicious:false
                      Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite Rollback Journal
                      Category:dropped
                      Size (bytes):8720
                      Entropy (8bit):1.3403553037769516
                      Encrypted:false
                      SSDEEP:24:7+tgKAD1RZKHs/Ds/SpH/ZMPzJwtNBwtNbRZ6bRZWf1RZKrqLBx/XYKQvGJF7urE:7M3GgOVpBwzutYtp6PM2qll2GL7msJ
                      MD5:DDEEB263896CF8CABCF1E80D9184607A
                      SHA1:96A22717CB4FC4C618D70AB5A125098251BA0691
                      SHA-256:2C897E76D5CA80EEF97D503653CC306B1189A128AEA6D19A9DDF1EEBE0AF0C76
                      SHA-512:8358734C5909CA7B185691F3B25D2CEFC6E4E6F9C2D9085A610D836CC2D6BA24CDD2C0D5BA2ECE1232B3FBF362676B40B80DB687A07A831D33F3696AB9553060
                      Malicious:false
                      Preview:.... .c......}.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Temp\MSI83f8f.LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):246
                      Entropy (8bit):3.522811667751431
                      Encrypted:false
                      SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K82AawCH:Qw946cPbiOxDlbYnuRKXAm
                      MD5:C2BAB7B847B0AD5404FA38C001003C80
                      SHA1:8138E76340503E4D4AEE1589D91922AFE7202877
                      SHA-256:29DB9E48892989F37C273DBC1306155ECF26C36E8BA8F63443617B5405E24515
                      SHA-512:B5A84E7129082DFFE7D55CEB0CF7D25F6DF097FD044875F97DE7F8F00409E13B9D139D08A3B22675F0FA5EB882129117DC7833A9557A8EF155FCE0D868F20D27
                      Malicious:false
                      Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .0.3./.0.7./.2.0.2.4. . .1.1.:.4.6.:.2.3. .=.=.=.....

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-03 11-46-18-181.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393)
                      Category:dropped
                      Size (bytes):16525
                      Entropy (8bit):5.376360055978702
                      Encrypted:false
                      SSDEEP:384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
                      MD5:1336667A75083BF81E2632FABAA88B67
                      SHA1:46E40800B27D95DAED0DBB830E0D0BA85C031D40
                      SHA-256:F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
                      SHA-512:D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
                      Malicious:false
                      Preview:SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393), with CRLF line terminators
                      Category:dropped
                      Size (bytes):16603
                      Entropy (8bit):5.35945682022478
                      Encrypted:false
                      SSDEEP:384:4ImBeUrbczOwjtHygu/0qGX+BgfcFtLtvttt8fs2wcW3dssGM/1sab6H/K/K3RvY:EHj5RP7J
                      MD5:3780AC52AD1B35B0ED2FBA7A6C49BD57
                      SHA1:E8E2606FF91589F9A8AE963FA451FB760C6C22CF
                      SHA-256:DF22E5333BCF99D1F8A0657476BF4D3B1AA461DDFAE0CDC1C0E50B89C7050787
                      SHA-512:9941AA755CF065A7816B1EA36BB81BB8AAE4C449EEB55C31596B92EB4DB398BD8816C7A87078EE40B2341D3AA7C9282700B193BA8564F2D233AB688E551A3E24
                      Malicious:false
                      Preview:SessionID=6376b677-3cbd-4bb9-8a8d-f77395e7a22a.1720021578192 Timestamp=2024-07-03T11:46:18:192-0400 ThreadID=4448 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=6376b677-3cbd-4bb9-8a8d-f77395e7a22a.1720021578192 Timestamp=2024-07-03T11:46:18:193-0400 ThreadID=4448 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=6376b677-3cbd-4bb9-8a8d-f77395e7a22a.1720021578192 Timestamp=2024-07-03T11:46:18:193-0400 ThreadID=4448 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=6376b677-3cbd-4bb9-8a8d-f77395e7a22a.1720021578192 Timestamp=2024-07-03T11:46:18:193-0400 ThreadID=4448 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=6376b677-3cbd-4bb9-8a8d-f77395e7a22a.1720021578192 Timestamp=2024-07-03T11:46:18:193-0400 ThreadID=4448 Component=ngl-lib_NglAppLib Description="SetConf

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):29752
                      Entropy (8bit):5.401305690860513
                      Encrypted:false
                      SSDEEP:768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbG:C
                      MD5:0364BC7C4F7B28ECF7AE7E73298216A9
                      SHA1:A60B051D6152EAE5D116F71DC86F516965957294
                      SHA-256:DAC7CF68BE5A6DEA5CCC3528981EB8E975D52BBE20693E49229450203C3442D6
                      SHA-512:98B29B3DF5004D8F234561921E25A6DF9EB52225C9C7767D8B739606AA27CF0325C7E7A265F98BAC8DF784A84FA41EDE07B44CEF32002F0F627CCB63B63F300D
                      Malicious:false
                      Preview:04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

                      C:\Users\user\AppData\Local\Temp\acrocef_low\256d3eef-647f-4cbf-af8c-b08c17d6a216.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                      Category:dropped
                      Size (bytes):758601
                      Entropy (8bit):7.98639316555857
                      Encrypted:false
                      SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                      MD5:3A49135134665364308390AC398006F1
                      SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                      SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                      SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                      Malicious:false
                      Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                      C:\Users\user\AppData\Local\Temp\acrocef_low\56dc2a90-c2fa-457c-823b-ac7d0a34e5d5.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                      Category:dropped
                      Size (bytes):386528
                      Entropy (8bit):7.9736851559892425
                      Encrypted:false
                      SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                      MD5:5C48B0AD2FEF800949466AE872E1F1E2
                      SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                      SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                      SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                      Malicious:false
                      Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                      C:\Users\user\AppData\Local\Temp\acrocef_low\a8b1bd4e-8c5a-4ef5-81fe-26e96d4f3432.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                      Category:dropped
                      Size (bytes):1419751
                      Entropy (8bit):7.976496077007677
                      Encrypted:false
                      SSDEEP:24576:/nZwYIGNPgeWL07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:fZwZG/WLxYGZN3mlind9i4ufFXpAXkru
                      MD5:1F3D69524A9D7E17BD2363C81D130F1A
                      SHA1:C2A4A08839CBA47BEE2B601975F7C4F0CC191091
                      SHA-256:D0FFBEC8502A0BE88A99F6708987658FEBE4CF3B6B79AF219C53EFF6458F9D9D
                      SHA-512:A4CBE7073A7CB4C5E33E1CD903CCD7F24B78A04C037BFA1D90D9A5BBD12AF60E3DFFD6546277D1B765CA1DAC1CDA28D24D3454C81952B72D97CAF84DF395E99A
                      Malicious:false
                      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                      C:\Users\user\AppData\Local\Temp\acrocef_low\d4229332-12cf-41fd-98a1-2f97b0ae5276.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                      Category:dropped
                      Size (bytes):1407294
                      Entropy (8bit):7.97605879016224
                      Encrypted:false
                      SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
                      MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
                      SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
                      SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
                      SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
                      Malicious:false
                      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                      Static File Info

                      General

                      File type:PDF document, version 1.7
                      Entropy (8bit):7.9062945738689425
                      TrID:
                      • Adobe Portable Document Format (5005/1) 100.00%
                      File name:Paul Smart - Invoice Bill.pdf
                      File size:86'287 bytes
                      MD5:39858a2a0079fbe41ce2f07a492b4ab5
                      SHA1:90f80d1fdb50561acc5d4767df4ed3f1f8306655
                      SHA256:4cfd3f5038d9688b5c14385693f672c74c1f8d3470f6362aaa3789537c3d6aad
                      SHA512:0be333697da5303335f4f66d912f5284c272e2d2f179510451b2c2e7ca5f3659664c21debb7d950eda4ab78529d1c0e318183c913bb9b88935cb9cccf395e8f6
                      SSDEEP:1536:Pvrqd1frfhEpzJpUhd3F/XfK0WcwPo+jOdn4TE+uqbJgdNn7faKnyI61mzyoYL:Pvrq3fLkUhd3VXC0WdoUOZ44FqbJ07f4
                      TLSH:2A830266E3492ED1B017963476005A4324DBC4DA62EE03447B7CCA761360FE7A4F7DBA
                      File Content Preview:%PDF-1.7..%......3 0 obj..<</Length 3337/Subtype/XML/Type/Metadata>>stream..<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.2-c001 63.139439, 2010/09/27-13:37:26 "><rdf:RDF xmlns:r

                      File Icon

                      Icon Hash:62cc8caeb29e8ae0

                      Static PDF Info

                      General

                      Header:%PDF-1.7
                      Total Entropy:7.906295
                      Total Bytes:86287
                      Stream Entropy:7.911950
                      Stream Bytes:84290
                      Entropy outside Streams:5.130705
                      Bytes outside Streams:1997
                      Number of EOF found:1
                      Bytes after EOF:

                      Keywords Statistics

                      NameCount
                      obj22
                      endobj22
                      stream20
                      endstream20
                      xref0
                      trailer0
                      startxref1
                      /Page1
                      /Encrypt0
                      /ObjStm1
                      /URI0
                      /JS0
                      /JavaScript0
                      /AA0
                      /OpenAction0
                      /AcroForm0
                      /JBIG2Decode0
                      /RichMedia0
                      /Launch0
                      /EmbeddedFile0

                      Network Behavior

                      Network Port Distribution

                      TCP Packets

                      TimestampSource PortDest PortSource IPDest IP
                      Jul 3, 2024 17:46:29.080009937 CEST49718443192.168.2.523.41.168.139
                      Jul 3, 2024 17:46:29.080034018 CEST4434971823.41.168.139192.168.2.5
                      Jul 3, 2024 17:46:29.080097914 CEST49718443192.168.2.523.41.168.139
                      Jul 3, 2024 17:46:29.080339909 CEST49718443192.168.2.523.41.168.139
                      Jul 3, 2024 17:46:29.080351114 CEST4434971823.41.168.139192.168.2.5
                      Jul 3, 2024 17:46:29.872153044 CEST4434971823.41.168.139192.168.2.5
                      Jul 3, 2024 17:46:29.872627020 CEST49718443192.168.2.523.41.168.139
                      Jul 3, 2024 17:46:29.872659922 CEST4434971823.41.168.139192.168.2.5
                      Jul 3, 2024 17:46:29.873783112 CEST4434971823.41.168.139192.168.2.5
                      Jul 3, 2024 17:46:29.873878002 CEST49718443192.168.2.523.41.168.139
                      Jul 3, 2024 17:46:29.877474070 CEST49718443192.168.2.523.41.168.139
                      Jul 3, 2024 17:46:29.877624035 CEST4434971823.41.168.139192.168.2.5
                      Jul 3, 2024 17:46:29.877747059 CEST49718443192.168.2.523.41.168.139
                      Jul 3, 2024 17:46:29.877768040 CEST4434971823.41.168.139192.168.2.5
                      Jul 3, 2024 17:46:29.929801941 CEST49718443192.168.2.523.41.168.139
                      Jul 3, 2024 17:46:29.977593899 CEST4434971823.41.168.139192.168.2.5
                      Jul 3, 2024 17:46:29.977751017 CEST4434971823.41.168.139192.168.2.5
                      Jul 3, 2024 17:46:29.977813959 CEST49718443192.168.2.523.41.168.139
                      Jul 3, 2024 17:46:29.978214979 CEST49718443192.168.2.523.41.168.139
                      Jul 3, 2024 17:46:29.978229046 CEST4434971823.41.168.139192.168.2.5
                      Jul 3, 2024 17:46:29.978240967 CEST49718443192.168.2.523.41.168.139
                      Jul 3, 2024 17:46:29.978286028 CEST49718443192.168.2.523.41.168.139

                      UDP Packets

                      TimestampSource PortDest PortSource IPDest IP
                      Jul 3, 2024 17:46:33.595957994 CEST53500971.1.1.1192.168.2.5

                      HTTP Request Dependency Graph

                      • armmf.adobe.com

                      HTTPS Proxied Packets

                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      0192.168.2.54971823.41.168.1394434124C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      TimestampBytes transferredDirectionData
                      2024-07-03 15:46:29 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
                      Host: armmf.adobe.com
                      Connection: keep-alive
                      Accept-Language: en-US,en;q=0.9
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
                      Sec-Fetch-Site: same-origin
                      Sec-Fetch-Mode: no-cors
                      Sec-Fetch-Dest: empty
                      Accept-Encoding: gzip, deflate, br
                      If-None-Match: "78-5faa31cce96da"
                      If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
                      2024-07-03 15:46:29 UTC198INHTTP/1.1 304 Not Modified
                      Content-Type: text/plain; charset=UTF-8
                      Last-Modified: Mon, 01 May 2023 15:02:33 GMT
                      ETag: "78-5faa31cce96da"
                      Date: Wed, 03 Jul 2024 15:46:29 GMT
                      Connection: close


                      Statistics

                      CPU Usage

                      Click to jump to process

                      Memory Usage

                      Click to jump to process

                      High Level Behavior Distribution

                      Click to dive into process behavior distribution

                      Behavior

                      Click to jump to process

                      System Behavior

                      General

                      Target ID:0
                      Start time:11:46:14
                      Start date:03/07/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Paul Smart - Invoice Bill.pdf"
                      Imagebase:0x7ff686a00000
                      File size:5'641'176 bytes
                      MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      General

                      Target ID:2
                      Start time:11:46:15
                      Start date:03/07/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                      Imagebase:0x7ff6413e0000
                      File size:3'581'912 bytes
                      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      General

                      Target ID:4
                      Start time:11:46:17
                      Start date:03/07/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2156 --field-trial-handle=1548,i,3961840508981448788,13254356319118314033,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                      Imagebase:0x7ff6413e0000
                      File size:3'581'912 bytes
                      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      Disassembly

                      ⊘No disassembly