Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
unity.pdf

Overview

General Information

Sample name:unity.pdf
Analysis ID:1467958
MD5:cc4676ef08e8aecbe22b9232f27b2141
SHA1:03bb3a2cb2c8a5cf7b93cf7c666c470144cfd724
SHA256:48331ea4e205e07525f47149d19c8f78dba24ee63147a74f7d0a443008e4587d
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

IP address seen in connection with other malware
PDF has an OpenAction (likely to launch a dropper script)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 5740 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\unity.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 7248 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 7444 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1596,i,11792256941342271432,3541520970309768941,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: Joe Sandbox ViewIP Address: 23.47.168.24 23.47.168.24
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.1.drString found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.drString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: classification engineClassification label: clean2.winPDF@14/47@0/1
Source: unity.pdfInitial sample: mailto:trademarks@unity.com
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4080Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-05 00-48-19-930.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\unity.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1596,i,11792256941342271432,3541520970309768941,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1596,i,11792256941342271432,3541520970309768941,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: unity.pdfInitial sample: PDF keyword /JS count = 0
Source: unity.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: unity.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: unity.pdfInitial sample: PDF keyword /OpenAction
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire Infrastructure1
Spearphishing Link		2
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive12
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1467958 Sample: unity.pdf Startdate: 05/07/2024 Architecture: WINDOWS Score: 2 6 Acrobat.exe 20 72 2->6         started        process3 8 AcroCEF.exe 106 6->8         started        process4 10 AcroCEF.exe 2 8->10         started        dnsIp5 13 23.47.168.24, 443, 49742 AKAMAI-ASUS United States 10->13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
unity.pdf0%VirustotalBrowse
unity.pdf0%ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

SourceDetectionScannerLabelLink
bg.microsoft.map.fastly.net0%VirustotalBrowse

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
bg.microsoft.map.fastly.net
199.232.210.172
truefalseunknown

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
23.47.168.24
unknownUnited States
16625AKAMAI-ASUSfalse

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1467958
Start date and time:2024-07-05 06:47:17 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 13s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultwindowspdfcookbook.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:11
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:unity.pdf
Detection:CLEAN
Classification:clean2.winPDF@14/47@0/1
EGA Information:Failed
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 0
  • Number of non-executed functions: 0
Cookbook Comments:
  • Found application associated with file extension: .pdf
  • Found PDF document
  • Close Viewer

Warnings

  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 184.28.88.176, 34.237.241.83, 50.16.47.176, 54.224.241.105, 18.213.11.84, 2.16.202.91, 2.16.202.73, 172.64.41.3, 162.159.61.3, 2.16.202.123, 95.101.54.195, 199.232.210.172, 2.19.126.149, 2.19.126.143
  • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, identrust.edgesuite.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, a1952.dscq.akamai.net, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com, apps.identrust.com, wu-b-net.trafficmanager.net
  • Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

TimeTypeDescription
00:48:30API Interceptor3x Sleep call for process: AcroCEF.exe modified

LLM Input / Output

InputOutput
URL: PDF Model: gpt-4o
```json{  "riskscore": 1,  "reasons": "The provided screenshot does not contain any visually prominent button or link that could mislead the user into clicking on a potentially harmful link. The text in the screenshot does not create a sense of urgency or interest that is typically associated with phishing attempts. There are no phrases like 'Click here to view document' or 'Open the link to see your invoice.' The document appears to be informational and related to Unity Engine, a well-known brand. There is no indication of impersonation of other brands. The overall content is educational and does not prompt immediate action from the user."}

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
23.47.168.24xJwSq336bs.pdfGet hashmaliciousUnknownBrowse
    Invoice - 13604562148823146027218688082530555300774892366170 - Pilatus-aircraft.pdfGet hashmaliciousHTMLPhisherBrowse
      Encrypted Doc-[Ogi-5917842].pdfGet hashmaliciousHTMLPhisherBrowse
        Novolog (Pharm-Up 1966) LTD_SKM_C590368369060_417161.pdfGet hashmaliciousHTMLPhisherBrowse
          Invoice - 21153253589581947197326090404964329500290845699807 - Toyotaconnected.pdfGet hashmaliciousUnknownBrowse
            Hilcorp-updated agreement.pdfGet hashmaliciousUnknownBrowse
              Invoice - 07776611412802924323813205194919526056527884439486 - Kforce.pdfGet hashmaliciousUnknownBrowse
                invoicepast.pdf.lnk.mal.lnkGet hashmaliciousScreenConnect ToolBrowse
                  PG96120000311.pdf.lnk.mal.lnkGet hashmaliciousUnknownBrowse
                    Absa.pdfGet hashmaliciousHTMLPhisherBrowse

                      Domains

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      bg.microsoft.map.fastly.nethttps://rb.gy/zsqpjaGet hashmaliciousHTMLPhisherBrowse
                      • 199.232.210.172
                      https://singingfiles.com/show.php?l=0&u=2156442&id=64574Get hashmaliciousUnknownBrowse
                      • 199.232.210.172
                      https://metamesklogni.webflow.io/Get hashmaliciousUnknownBrowse
                      • 199.232.210.172
                      https://rules-pear-kft5d2.mystrikingly.com/Get hashmaliciousUnknownBrowse
                      • 199.232.214.172
                      https://sula.starladeroff.com/Get hashmaliciousUnknownBrowse
                      • 199.232.214.172
                      http://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/Get hashmaliciousHTMLPhisherBrowse
                      • 199.232.214.172
                      http://helpdesk-advertising-review-id-9865133.d3m7n55z273utf.amplifyapp.com/index.htmlGet hashmaliciousUnknownBrowse
                      • 199.232.210.172
                      https://delivery.attempt.failure.ebbs.co.za/public/MY096OineFzTCVJ56qDw3aMDByE0CDQ1Get hashmaliciousUnknownBrowse
                      • 199.232.210.172
                      http://dana-aktivasi-paylater.myindo.me/Get hashmaliciousUnknownBrowse
                      • 199.232.210.172
                      https://mail.support-xfinity.152-42-227-61.cprapid.com/Billing_Pay_Online.html?Review-VerificationMyAccountGet hashmaliciousUnknownBrowse
                      • 199.232.214.172

                      ASNs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      AKAMAI-ASUShttps://pub-fb608504b57048a1b1ca54c74dbf132d.r2.dev/ront.html?ccsendGet hashmaliciousHTMLPhisherBrowse
                      • 23.3.110.134
                      https://1drv.ms/b/c/76a2f2769a0f2d92/EVBBlcPr69hPlwB4teIJkR8BhOEwtE3haDg1sSdukRfZrw?e=geYoLrGet hashmaliciousHTMLPhisherBrowse
                      • 2.19.198.80
                      https://1drv.ms/b/c/76a2f2769a0f2d92/EVBBlcPr69hPlwB4teIJkR8BhOEwtE3haDg1sSdukRfZrw?e=geYoLrGet hashmaliciousHTMLPhisherBrowse
                      • 23.38.98.104
                      xJwSq336bs.pdfGet hashmaliciousUnknownBrowse
                      • 23.47.168.24
                      file.exeGet hashmaliciousVidarBrowse
                      • 23.192.247.89
                      http://sharepoint-stonecuttercapital.comGet hashmaliciousHTMLPhisherBrowse
                      • 23.38.98.114
                      https://lantzlagetnet-my.sharepoint.com/:b:/g/personal/christian_lantzlaget_net/EfvDbyrsR1JBhKxhyaS6aX8BVyu8MWIYIqkyeRAJSRL2yA?e=6Phvc1Get hashmaliciousUnknownBrowse
                      • 23.214.40.215
                      205.185.124.50-mips-2024-07-03T23_47_54.elfGet hashmaliciousMirai, MoobotBrowse
                      • 2.17.90.178
                      https://wellbeingcaresolutions%5B.%5Dfreshdesk%5B.%5Dcom/support/solutions/articles/201000067168-wellbeing-care-solutions-ltdGet hashmaliciousHTMLPhisherBrowse
                      • 23.212.88.20
                      95DVgihS4k.elfGet hashmaliciousUnknownBrowse
                      • 184.26.133.196

                      JA3 Fingerprints

                      ⊘No context

                      Dropped Files

                      ⊘No context

                      Created / dropped Files

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.195297940586218
                      Encrypted:false
                      SSDEEP:6:BOQIgL+q2Pwkn2nKuAl9OmbnIFUt84OQIgDuFZZmw+4OQIgDuFNVkwOwkn2nKuAR:EQhyvYfHAahFUt81QhDKZ/+1QhDKz5JK
                      MD5:E23269790D1F900BC613CD45AC4EFC33
                      SHA1:B8B0DDCA9F1B18639860246289E6BFCAF6F9CE78
                      SHA-256:6D9DADE853E422F878FFD875D0CFE80D08B79D2E86EFE9D420BE3B90CAA847D5
                      SHA-512:5A184319FB9736F9138C3E57990853CE21209F5F22553667B67BD25167F3D4E91E40D823D37AD1B8CF1692BFF89BB11C0219E52A8E511B0732378B54860D3EB8
                      Malicious:false
                      Reputation:low
                      Preview:2024/07/05-00:48:17.604 1c78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/07/05-00:48:17.607 1c78 Recovering log #3.2024/07/05-00:48:17.607 1c78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.195297940586218
                      Encrypted:false
                      SSDEEP:6:BOQIgL+q2Pwkn2nKuAl9OmbnIFUt84OQIgDuFZZmw+4OQIgDuFNVkwOwkn2nKuAR:EQhyvYfHAahFUt81QhDKZ/+1QhDKz5JK
                      MD5:E23269790D1F900BC613CD45AC4EFC33
                      SHA1:B8B0DDCA9F1B18639860246289E6BFCAF6F9CE78
                      SHA-256:6D9DADE853E422F878FFD875D0CFE80D08B79D2E86EFE9D420BE3B90CAA847D5
                      SHA-512:5A184319FB9736F9138C3E57990853CE21209F5F22553667B67BD25167F3D4E91E40D823D37AD1B8CF1692BFF89BB11C0219E52A8E511B0732378B54860D3EB8
                      Malicious:false
                      Reputation:low
                      Preview:2024/07/05-00:48:17.604 1c78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/07/05-00:48:17.607 1c78 Recovering log #3.2024/07/05-00:48:17.607 1c78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):336
                      Entropy (8bit):5.202830509788736
                      Encrypted:false
                      SSDEEP:6:BOQIg8yq2Pwkn2nKuAl9Ombzo2jMGIFUt84OQIg711Zmw+4OQIgm9RkwOwkn2nK3:EQhxvYfHAa8uFUt81Qh711/+1Qhm75JI
                      MD5:06C31562257D49386BB9868A76C6A48F
                      SHA1:C4FBD374229B563E3760A3F82D9BFEDBCFAD4EDD
                      SHA-256:E12D2D1EEEA390122ADECD8EB11F8A96551E0C443F07F6116D8D9568EEBE87A6
                      SHA-512:B69471DBD61002E9E53EE9AF38A6FA82DBF1D1DC5BDF97FEF4B7938F99FD54A88E36FB507769111B616319ECEFD24547B25A72A942B8190C97D72A7A1065BA4B
                      Malicious:false
                      Reputation:low
                      Preview:2024/07/05-00:48:17.662 1d30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/07/05-00:48:17.663 1d30 Recovering log #3.2024/07/05-00:48:17.664 1d30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):336
                      Entropy (8bit):5.202830509788736
                      Encrypted:false
                      SSDEEP:6:BOQIg8yq2Pwkn2nKuAl9Ombzo2jMGIFUt84OQIg711Zmw+4OQIgm9RkwOwkn2nK3:EQhxvYfHAa8uFUt81Qh711/+1Qhm75JI
                      MD5:06C31562257D49386BB9868A76C6A48F
                      SHA1:C4FBD374229B563E3760A3F82D9BFEDBCFAD4EDD
                      SHA-256:E12D2D1EEEA390122ADECD8EB11F8A96551E0C443F07F6116D8D9568EEBE87A6
                      SHA-512:B69471DBD61002E9E53EE9AF38A6FA82DBF1D1DC5BDF97FEF4B7938F99FD54A88E36FB507769111B616319ECEFD24547B25A72A942B8190C97D72A7A1065BA4B
                      Malicious:false
                      Reputation:low
                      Preview:2024/07/05-00:48:17.662 1d30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/07/05-00:48:17.663 1d30 Recovering log #3.2024/07/05-00:48:17.664 1d30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):475
                      Entropy (8bit):4.965339752641168
                      Encrypted:false
                      SSDEEP:12:YH/um3RA8sqysBdOg2HpWfcaq3QYiubInP7E4T3y:Y2sRdsadMH33QYhbG7nby
                      MD5:48871E9D909CE1B0DFD6E84B3BBAC287
                      SHA1:FC7FCC4ED469A183D00C5870F9C3A06582A9C6B6
                      SHA-256:9AAA39371E870FAA27A0BE357CF0C765A6D5E35BA0635481093C1988B80010BC
                      SHA-512:82FC5A78DC51D95E4240D4966DA2EAF42850248019EA00BB5EBC86D6CDAFD4E782796305748C14D2228810A5D4A7940E3653C1E0C280DC14B685532548D355C4
                      Malicious:false
                      Reputation:low
                      Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13364714910164158","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":147903},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fa98b2a6-1c3a-4f7d-bef1-474939b73aaa.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:modified
                      Size (bytes):475
                      Entropy (8bit):4.965339752641168
                      Encrypted:false
                      SSDEEP:12:YH/um3RA8sqysBdOg2HpWfcaq3QYiubInP7E4T3y:Y2sRdsadMH33QYhbG7nby
                      MD5:48871E9D909CE1B0DFD6E84B3BBAC287
                      SHA1:FC7FCC4ED469A183D00C5870F9C3A06582A9C6B6
                      SHA-256:9AAA39371E870FAA27A0BE357CF0C765A6D5E35BA0635481093C1988B80010BC
                      SHA-512:82FC5A78DC51D95E4240D4966DA2EAF42850248019EA00BB5EBC86D6CDAFD4E782796305748C14D2228810A5D4A7940E3653C1E0C280DC14B685532548D355C4
                      Malicious:false
                      Reputation:low
                      Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13364714910164158","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":147903},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):4730
                      Entropy (8bit):5.25850639043607
                      Encrypted:false
                      SSDEEP:96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7ZSf0lZ:etJCV4FiN/jTN/2r8Mta02fEhgO73god
                      MD5:4820CBA09471B1C8AFC76770F95CB6AD
                      SHA1:6743EDB50893958A7BCFDFB50F2CF852B9F47C31
                      SHA-256:308C495627B7814FC0EDCA7C626CEBB9EF7896557A4F5753CEACDFC48EB05549
                      SHA-512:E5B7C1029AC4D450DFFBCB4600514FFC4571110D0EBA98EDB74461548B10A0EBEA1B5E97F21C9FFD49CE457976F19BC9FA8F2BA790FB097643C8BCBA4806BAD0
                      Malicious:false
                      Reputation:low
                      Preview:*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):324
                      Entropy (8bit):5.180496918532221
                      Encrypted:false
                      SSDEEP:6:BOQIgkyq2Pwkn2nKuAl9OmbzNMxIFUt84OQIg5/1Zmw+4OQIgL59RkwOwkn2nKuP:EQh5vYfHAa8jFUt81Qh5/1/+1Qh95Jfv
                      MD5:187F2B003D9097E23F386A7F9EE0422C
                      SHA1:47F7DE1ABBF205D803416F3CCD7015685C61FFF5
                      SHA-256:431FE9DE5CC289A41E9987C334DDB75D16818650E8C7C40551D5925411C7A55A
                      SHA-512:F85D6C7CE1FDDB639B70C392C59241CD5638A78D12CF74CF3541741C9D5904166B35FA2D0BE30EA4402541B8826139343C803F22D5A0F0B239C9FFDCB4B5E6F6
                      Malicious:false
                      Reputation:low
                      Preview:2024/07/05-00:48:18.434 1d30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/07/05-00:48:18.439 1d30 Recovering log #3.2024/07/05-00:48:18.440 1d30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):324
                      Entropy (8bit):5.180496918532221
                      Encrypted:false
                      SSDEEP:6:BOQIgkyq2Pwkn2nKuAl9OmbzNMxIFUt84OQIg5/1Zmw+4OQIgL59RkwOwkn2nKuP:EQh5vYfHAa8jFUt81Qh5/1/+1Qh95Jfv
                      MD5:187F2B003D9097E23F386A7F9EE0422C
                      SHA1:47F7DE1ABBF205D803416F3CCD7015685C61FFF5
                      SHA-256:431FE9DE5CC289A41E9987C334DDB75D16818650E8C7C40551D5925411C7A55A
                      SHA-512:F85D6C7CE1FDDB639B70C392C59241CD5638A78D12CF74CF3541741C9D5904166B35FA2D0BE30EA4402541B8826139343C803F22D5A0F0B239C9FFDCB4B5E6F6
                      Malicious:false
                      Reputation:low
                      Preview:2024/07/05-00:48:18.434 1d30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/07/05-00:48:18.439 1d30 Recovering log #3.2024/07/05-00:48:18.440 1d30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240705044821Z-159.bmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
                      Category:dropped
                      Size (bytes):65110
                      Entropy (8bit):1.794224396323186
                      Encrypted:false
                      SSDEEP:768:E3dIELwqcGkxq8nvAmp9tsezW1+FbtvPt5v:ENIVB
                      MD5:0B0EAE0EC1A466A174F322A5234DD11D
                      SHA1:BC42F4CBACC802EACB2396D11E1BFEFBFDBA873B
                      SHA-256:5BA23A6A335CA6656D8F6E4EA765842012BAE0509DC1EF96D851AB3B21E19B93
                      SHA-512:7BCA31026F5CA35759F5F8DA41483F8391AC9F325965D82EA9E1B19C46F8F4C9264615DCBBB0A1110038D19B70777A35592F8C02CEE18F235D404B032262444C
                      Malicious:false
                      Reputation:low
                      Preview:BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
                      Category:dropped
                      Size (bytes):86016
                      Entropy (8bit):4.444992498090185
                      Encrypted:false
                      SSDEEP:384:yezci5tOiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rhs3OazzU89UTTgUL
                      MD5:E2CD7E7D21F5F84101E24FCCC6E3959F
                      SHA1:AAD4220B3D1162679B699C5B04221D5BCCF1895A
                      SHA-256:CDAF6599750F1E1D1ADA4CB076FE13840926CFA34BB1242D11D83091ABFB0455
                      SHA-512:5EC8377F29F5AE3405D99F4E461EDBF34E2893B92B1339CFE14E2ECA9BB48CB71C79399E6DD9E2770DD2ECE191CF9839F94AD4CAA59AA23EF05F1DF16FAB29D4
                      Malicious:false
                      Reputation:low
                      Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite Rollback Journal
                      Category:dropped
                      Size (bytes):8720
                      Entropy (8bit):3.7719862771407104
                      Encrypted:false
                      SSDEEP:48:7Mep/E2ioyVTioy9oWoy1Cwoy1TKOioy1noy1AYoy1Wioy1hioybioyHoy1noy1C:79pjuTFSXKQ6sb9IVXEBodRBkD
                      MD5:80D984215D04B03BF800362796320691
                      SHA1:3111C9149A59313945CB580142403B6135F921C2
                      SHA-256:951017989BC201DD275033B45359A453FC17FC0DB790F2CE7290324FEE630853
                      SHA-512:88D1224A7644BF61B59A9C4D2F9447D6699D18DB3DE78E92CFD9D3F78CB74ABD32884B6635A7F02F9B56BA28B48ED894E2AB579AB1F99CDBE6851055067DBCF2
                      Malicious:false
                      Reputation:low
                      Preview:.... .c......E.J...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                      Category:dropped
                      Size (bytes):71954
                      Entropy (8bit):7.996617769952133
                      Encrypted:true
                      SSDEEP:1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
                      MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
                      SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
                      SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
                      SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
                      Malicious:false
                      Reputation:moderate, very likely benign file
                      Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):893
                      Entropy (8bit):7.366016576663508
                      Encrypted:false
                      SSDEEP:24:hBntmDvKUQQDvKUr7C5fpqp8gPvXHmXvponXux:3ntmD5QQD5XC5RqHHXmXvp++x
                      MD5:D4AE187B4574036C2D76B6DF8A8C1A30
                      SHA1:B06F409FA14BAB33CBAF4A37811B8740B624D9E5
                      SHA-256:A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
                      SHA-512:1F44A360E8BB8ADA22BC5BFE001F1BABB4E72005A46BC2A94C33C4BD149FF256CCE6F35D65CA4F7FC2A5B9E15494155449830D2809C8CF218D0B9196EC646B0C
                      Malicious:false
                      Preview:0..y..*.H.........j0..f...1.0...*.H.........N0..J0..2.......D....'..09...@k0...*.H........0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30...000930211219Z..210930140115Z0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30.."0...*.H.............0..........P..W..be......,k0.[...}.@......3vI*.?!I..N..>H.e...!.e.*.2....w..{........s.z..2..~..0....*8.y.1.P..e.Qc...a.Ka..Rk...K.(.H......>.... .[.*....p....%.tr.{j.4.0...h.{T....Z...=d.....Ap..r.&.8U9C....\@........%.......:..n.>..\..<.i....*.)W..=....]......B0@0...U.......0....0...U...........0...U.........{,q...K.u...`...0...*.H...............,...\...(f7:...?K.... ]..YD.>.>..K.t.....t..~.....K. D....}..j.....N..:.pI...........:^H...X._..Z.....Y..n......f3.Y[...sG.+..7H..VK....r2...D.SrmC.&H.Rg.X..gvqx...V..9$1....Z0G..P.......dc`........}...=2.e..|.Wv..(9..e...w.j..w.......)...55.1.

                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:data
                      Category:modified
                      Size (bytes):328
                      Entropy (8bit):3.247897867253902
                      Encrypted:false
                      SSDEEP:6:kKpMT9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:KqDImsLNkPlE99SNxAhUe/3
                      MD5:E3D8E908007899B6CA38E942864CCE86
                      SHA1:0306752D17AEAA73132C2DA3AC9B7D4BDB531C29
                      SHA-256:5407AF8548847BD79771708AA63815242A366E69174DA02C26FC33B316BAF6BE
                      SHA-512:902C8F3E81B7477F6E3E3353529F8C29156019120C42692B4BEDFAA14EB43C2C34D517FF0BFA5F26E8F5B30C54C1E524EF242FF93F2385E9ADC305C51DE79210
                      Malicious:false
                      Preview:p...... ..........f.....(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):252
                      Entropy (8bit):3.0215269645321685
                      Encrypted:false
                      SSDEEP:3:kkFklhzvfllXlE/E/KRkzllPlzRkwWBARLNDU+ZMlKlBkvclcMlVHblB8V7lnklc:kKgxliBAIdQZV7I7kc3
                      MD5:67F69FE02A06F298CC5178FAF067C316
                      SHA1:FFD217AAF3894530EEA1DF47015B933F5F4536B5
                      SHA-256:56901C945B21DB272A8F6DB8232C12AAB10C107A6BA6F7E630F54D3A0449326F
                      SHA-512:AA670F3184CB2DA7909107D4B02B378CBA4A76C7BE7D043D0FE4698F0DF6F15B14487049100CDDA803D053AD14AF3AF74BD6125CA7D781CC38C451E5F18C357A
                      Malicious:false
                      Preview:p...... ....`....0.....(....................................................... ........!.M........(...........}...h.t.t.p.:././.a.p.p.s...i.d.e.n.t.r.u.s.t...c.o.m./.r.o.o.t.s./.d.s.t.r.o.o.t.c.a.x.3...p.7.c...".3.7.d.-.6.0.7.9.b.8.c.0.9.2.9.c.0."...

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4080

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PostScript document text
                      Category:dropped
                      Size (bytes):185099
                      Entropy (8bit):5.182478651346149
                      Encrypted:false
                      SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                      MD5:94185C5850C26B3C6FC24ABC385CDA58
                      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                      Malicious:false
                      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PostScript document text
                      Category:dropped
                      Size (bytes):185099
                      Entropy (8bit):5.182478651346149
                      Encrypted:false
                      SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                      MD5:94185C5850C26B3C6FC24ABC385CDA58
                      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                      Malicious:false
                      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):247234
                      Entropy (8bit):3.3245480448633247
                      Encrypted:false
                      SSDEEP:1536:mKPCPiyzDtrh1cK3XEivK7VK/3AYvYwgqUrRo+RQn:TPClJ/3AYvYwglFo+RQn
                      MD5:F7B75939ED43CD13BC5FA5A7E72C9C16
                      SHA1:2FB9185CFEB8001598A301C83ECA9948420007ED
                      SHA-256:2D50A4E5C21D7154373C0DF9DAF523FF54E48551510828BDD08D0E3B24125055
                      SHA-512:E7AB73FFC3402C06D67410C52140A801A7FCBA9B8D248F6C6A069A31FB14437B347BB2973DE361B395E49E50A0A11E515F3E9EC1A73B568421B64E059B883758
                      Malicious:false
                      Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):295
                      Entropy (8bit):5.367980757957825
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXsGot7MH9VoZcg1vRcR0YOqS23oAvJM3g98kUwPeUkwRe9:YvXKXsGTHEZc0vV2YGMbLUkee9
                      MD5:710999C6FB08C713D9F4515AE539B663
                      SHA1:FC875769554BF478E4889B77FFDB63FE0D7212A7
                      SHA-256:E598A1B1586A0BC633E680A056909E8C7049D4D0A5505CFBE733676DAEE57AC8
                      SHA-512:7D1352589B2F539146799ECEC0031F087A4DBF413D4025143E82679A2BBAA83E8A02761951820E65E9E7312CC4CD06C8A2542107546BE653B324E77B04E588D3
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"1cee9105-2c7b-4cef-906b-34dfa35e852f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720328273359,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.313412779968036
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXsGot7MH9VoZcg1vRcR0YOqS23oAvJfBoTfXpnrPeUkwRe9:YvXKXsGTHEZc0vV2YGWTfXcUkee9
                      MD5:4939BD4ACB499B90284930D54B09A4E6
                      SHA1:39ED7F920C0F32D5A4ADD8024F3051281FFD3E92
                      SHA-256:C17F9C42E3CEE7046DFFF7C16188117CDA86CB345BB9E978774704731E62DE12
                      SHA-512:78C21B01AF1D1A83C213B3F56D6A192E159A2DE5EDF534E0DD67E1254ACB6569D6A582DA6261FE66146CEDF16A50BD7081DFDD4ECA2344C5C82DEAB59088596E
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"1cee9105-2c7b-4cef-906b-34dfa35e852f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720328273359,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.292082842392261
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXsGot7MH9VoZcg1vRcR0YOqS23oAvJfBD2G6UpnrPeUkwRe9:YvXKXsGTHEZc0vV2YGR22cUkee9
                      MD5:E22EBB46CADEDC62FC948B8598A3198A
                      SHA1:CE4F2D6E488D16D5B2E12F2C52770BE477D0D13D
                      SHA-256:6ED3AFE83F67EE33463975CAB1E12AF21B3919C63A198EC425FB1FB240B0A6FE
                      SHA-512:A415175122D5BF78119E5638A2E995A67E5282C226490E2BD6B1AFC1331C943C2B1224F4F226B3D9A0BD0FB12D445990C551EB831C9DF950FE6FC242894C34C2
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"1cee9105-2c7b-4cef-906b-34dfa35e852f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720328273359,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):285
                      Entropy (8bit):5.355153277193006
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXsGot7MH9VoZcg1vRcR0YOqS23oAvJfPmwrPeUkwRe9:YvXKXsGTHEZc0vV2YGH56Ukee9
                      MD5:8831A96EE7800A4A18A0E42463374065
                      SHA1:FB467E6BB50792FEFE666A86484ACD6A2AA2FBFE
                      SHA-256:636A8F5C0A873B8399E85361E2C558F4507FC67E6F792FC461A1CD50A56B2C5D
                      SHA-512:39C19B5211DF5CF4834EA1650261EA0DCDB1C7C59ED3D325F77009E23238ACC0B81D96D89EEA7BBD17D50DD91DB57A01F7A6F8C8CEE3A1418A07D80E89EA964F
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"1cee9105-2c7b-4cef-906b-34dfa35e852f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720328273359,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.313455888637547
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXsGot7MH9VoZcg1vRcR0YOqS23oAvJfJWCtMdPeUkwRe9:YvXKXsGTHEZc0vV2YGBS8Ukee9
                      MD5:B7531D136134843D9631D81D14B4A290
                      SHA1:0B7F707F3A929C9F581972F93D28259BB8089121
                      SHA-256:933D26FA8F24DF69D867F995935DAEA6DAF2284735ADF6289B28DC4ACDC73EC0
                      SHA-512:A53673B67C6DF3432A3B0BFFDACC0C35A0C9982735E7E44C58347180C81E3AD1C181F684151079CAF9B280304BE7E0B980F084BAF64A90472D18BF2628429503
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"1cee9105-2c7b-4cef-906b-34dfa35e852f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720328273359,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.300464076723209
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXsGot7MH9VoZcg1vRcR0YOqS23oAvJf8dPeUkwRe9:YvXKXsGTHEZc0vV2YGU8Ukee9
                      MD5:F6AF54D2510B43B80F448F54D6546125
                      SHA1:0ADEEC2B2ED19A18F71E3897F80DED990BEAFF4E
                      SHA-256:0D3DA9C13674373E86C1F54440834BCBC7F3E19AD57B4F585E7F9A40154A3834
                      SHA-512:2E7E1C50F563681945A4F341D9E6DB0FD423F397F0516E7D8C36D29ECC494515268004D48619A4D87D2A1EFD3E08ED88F5196A862AE8AF17271B2801FE79009C
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"1cee9105-2c7b-4cef-906b-34dfa35e852f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720328273359,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.303516161377797
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXsGot7MH9VoZcg1vRcR0YOqS23oAvJfQ1rPeUkwRe9:YvXKXsGTHEZc0vV2YGY16Ukee9
                      MD5:608A445F38C268ADD0BE7198A40F82ED
                      SHA1:A6B73FAF6DFFD5D9A811B5EB02421E68EF4DF927
                      SHA-256:06228E50D3002A6838F958F17C50854CA21939569FA162B1A367ED6414437FB9
                      SHA-512:F6C13ED50B08A047943C419EE18339AEED51CA510A206CDABB2D1D4754A56F76968B404DB7A2F93788F6F457FE4625F414A921ABB9978186874B7CD5FFF189C8
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"1cee9105-2c7b-4cef-906b-34dfa35e852f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720328273359,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.3112267780919
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXsGot7MH9VoZcg1vRcR0YOqS23oAvJfFldPeUkwRe9:YvXKXsGTHEZc0vV2YGz8Ukee9
                      MD5:E31618089D5E5FADEE34B7851D350795
                      SHA1:3438B2F58AFC37DB37D11003716F0F3C49B9BD33
                      SHA-256:C30C46064F443E3193AD1EB12C17824023D10989C41F62C8A89D6B71A8B6A31F
                      SHA-512:BDE410D3EC2DB9FF9FCC686783155F6F72A0F0BD9FE7DA9E74E43D77155EEF229E6ED21D7975C9A49A7A75294C253FD2E0700AC70EFD76799FADFED90E8BC9A6
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"1cee9105-2c7b-4cef-906b-34dfa35e852f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720328273359,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1372
                      Entropy (8bit):5.734274714218843
                      Encrypted:false
                      SSDEEP:24:Yv6XsGTHEzvVjKLgENRcbrZbq00iCCBrwJo++ns8ct4mFJNx:YvlJdEgigrNt0wSJn+ns8cvFJv
                      MD5:25F0AE8E95D91957CEEADE34A6C3BFE5
                      SHA1:3D8416D10A397C3F9FFC4F1BF6BC1E47CE297107
                      SHA-256:E48749F78C9A044E4D849BB9989A592F3155E4D3686C78F17417054C7B90CB56
                      SHA-512:3BB21571D3E31E165B83DDE3153314706A75F820302FF25FA8F09D4146256C5F7C664454DC354B72B81FC499505674F1F387A1F94D4664920D37B26A8E92676A
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"1cee9105-2c7b-4cef-906b-34dfa35e852f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720328273359,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"79887_247329ActionBlock_0","campaignId":79887,"containerId":"1","controlGroupId":"","treatmentId":"acc56846-d570-4500-a26e-7f8cf2b4acad","variationId":"247329"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJUcnkgQWNyb2JhdCBQcm8ifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNSIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTMiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIDctZGF5IHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0byBwcmVtaXVtIFBERiBhbmQgZS1zaWduaW5nIHRvb2xzLiIsImJ

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.306668868081139
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXsGot7MH9VoZcg1vRcR0YOqS23oAvJfYdPeUkwRe9:YvXKXsGTHEZc0vV2YGg8Ukee9
                      MD5:7149EC6D6BA5666AEF399D26E3D07BAB
                      SHA1:A8C78866B124860DECBEE5A507D3EEAD3E95BEF9
                      SHA-256:F1A614295481A0A4D184362F011845515ADFF8F8AD961721824992C32AEAEC54
                      SHA-512:24FC801F0B0763F96DECA6B598479E099DAFE186F721951000FBEB90FCCF1F39B1C83641E00F00DBC564905F805F99CF54B26AB003B0314863CECA7CD30E576F
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"1cee9105-2c7b-4cef-906b-34dfa35e852f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720328273359,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1395
                      Entropy (8bit):5.771768865209673
                      Encrypted:false
                      SSDEEP:24:Yv6XsGTHEzvV+rLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNZ:YvlJgHgDv3W2aYQfgB5OUupHrQ9FJ7
                      MD5:EABA9BF78B4B71AD2DE148D9781E203D
                      SHA1:ADE9E9E48E9C51E9BF348C6F3AC0E5826A39519C
                      SHA-256:74131FCAA8B34B0304290AE584AD8A41A1204999302DB37C5DCCA00F9225DD01
                      SHA-512:673B54B642FB070E5B1650248F2CE86D09A9B40D2B7075831124940A7E826D6587378A3227E6CEFDC52B01C205E35D1702A2B8E166B2DCE671E0D01F5964DEA9
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"1cee9105-2c7b-4cef-906b-34dfa35e852f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720328273359,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):291
                      Entropy (8bit):5.2901701316101155
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXsGot7MH9VoZcg1vRcR0YOqS23oAvJfbPtdPeUkwRe9:YvXKXsGTHEZc0vV2YGDV8Ukee9
                      MD5:355440ABDB4B28A3290D1DF9C061BEB4
                      SHA1:700FFEFF7F1159324894DED6DC260052112351E7
                      SHA-256:1FF0D5A372822C8AA5CFCE7EAFE01B0B7815D856DBE9430FB834F92FE1CD7166
                      SHA-512:98B86F7D3D95D29FDE6FE14A561DF8EF124081EAE8B36E676CE3359403AF78BC4931BFC3689A22B8F8569E467D24393591EDF3A7D1800EA74040A10005ABD791
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"1cee9105-2c7b-4cef-906b-34dfa35e852f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720328273359,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):287
                      Entropy (8bit):5.294599510728436
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXsGot7MH9VoZcg1vRcR0YOqS23oAvJf21rPeUkwRe9:YvXKXsGTHEZc0vV2YG+16Ukee9
                      MD5:6DEFAD47A540CC712B1DE8A27734D756
                      SHA1:36AB72721A431478C06BA2816347C9F9B1B2AB05
                      SHA-256:539C099A3018BFD902D97611415D0AD8EFB9F031D133A67D93D86C04E2ECCF53
                      SHA-512:FC6A45DD074C7E832B7C76A9394A7C715271B32ABDF346EEB413DEE9AA7F6941D78728B8784CAFF2AEDF25D930BA5F050D12E6FB69AAED4FA8FB9ADDD44AA74C
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"1cee9105-2c7b-4cef-906b-34dfa35e852f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720328273359,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.314044333924454
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXsGot7MH9VoZcg1vRcR0YOqS23oAvJfbpatdPeUkwRe9:YvXKXsGTHEZc0vV2YGVat8Ukee9
                      MD5:79FFDC9C632A8BA8B06A0AE77EF71924
                      SHA1:1C381D6055F9314BA0FD596E9DC91E7399770560
                      SHA-256:27D828703BB000D64A6C4E496AEB3EA2EA13FC98D582E1BADD073C4FFD19B382
                      SHA-512:8B49D400AAC5863F6D569BA4A6C1F3285CC1EDD33A214B7076269226D68EB6E34D8BC9AF84B99844A79C36387E156A0709BBDB20B71CFB1679A6A56E23F4B75E
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"1cee9105-2c7b-4cef-906b-34dfa35e852f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720328273359,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):286
                      Entropy (8bit):5.27214043597074
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXsGot7MH9VoZcg1vRcR0YOqS23oAvJfshHHrPeUkwRe9:YvXKXsGTHEZc0vV2YGUUUkee9
                      MD5:9ABF6B94275E448CF26F75C4895E2C77
                      SHA1:D114E8EEB461507466C874872023F357BC6D7B5E
                      SHA-256:F4DA5FF6A2B5A26A2E7D47C8A064934AB1994102BE9A378CA1B9C0A5DF0B1932
                      SHA-512:F68E24793D8EDCF751829126A99CF7ABA65E7620F47931E5E0A7DF34F189A9D8193C77DDA649651BF8C5FEB18DBF12955D748C655F743DE18277BBEF44BC502C
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"1cee9105-2c7b-4cef-906b-34dfa35e852f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720328273359,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):782
                      Entropy (8bit):5.365442877518175
                      Encrypted:false
                      SSDEEP:12:YvXKXsGTHEZc0vV2YGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWN:Yv6XsGTHEzvV7168CgEXX5kcIfANh4
                      MD5:EBCFBE9013510A72101E0959137D9183
                      SHA1:CF25F89B8AAE0577792FE82F0DD573C89D9DCE30
                      SHA-256:A527CA1EEE43FE17E1DB24476DD2D248B38D33D0583E4377B912AD8D26746B3F
                      SHA-512:B96C7E7E8F3055030E17933763BD7C9952EAD3D516D221E6A3E50E8D49F53F3671D2AACE28012D528EDDA0C5D6F077228ED31563E88D50868478121FB61BC107
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"1cee9105-2c7b-4cef-906b-34dfa35e852f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720328273359,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1720154903392}}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):4
                      Entropy (8bit):0.8112781244591328
                      Encrypted:false
                      SSDEEP:3:e:e
                      MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                      SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                      SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                      SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                      Malicious:false
                      Preview:....

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):2814
                      Entropy (8bit):5.131171914795866
                      Encrypted:false
                      SSDEEP:24:YZFd5CxDYGarnqXy5BBKaQayP5W/nXSB4qjDwOj0SqfF0a2Q/2LS03B5xY0h9JJb:YbboD8rqA9ynv0B/m3BLY0h9/sO
                      MD5:0A3AF5B0285F558A09C18D41AD73E60C
                      SHA1:CE7516F7247665A79D1D2D41CAFB2CE596D76567
                      SHA-256:3F14C5B6EA66C001D73FAA29413C2D6D815493CBE88AA9D60D1CD4748C215082
                      SHA-512:F1268D254E778C0D23413778050C8C9EAEE34B1956BA4CE8C6C38507F528405AE9984969B35234108BFC7079D0FC7BA983B91D709B225B36AD746A159CF9DAB5
                      Malicious:false
                      Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"9895bc99c69d466309dae976aac75d33","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1720154902000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"de2cef35161ac76e7a4d835cbc731ea2","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1372,"ts":1720154902000},{"id":"Edit_InApp_Aug2020","info":{"dg":"a9a8385a44ba3c9b67b01996755aeb63","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1720154902000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"576b5603230500aae2992ad4f3b3589a","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1720154902000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"bb4b3a28429291381a6bdccc88d66ed8","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1720154902000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"819a4954c93abc86912c91d451acbe15","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1720154902000},

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
                      Category:dropped
                      Size (bytes):12288
                      Entropy (8bit):1.1885817222339128
                      Encrypted:false
                      SSDEEP:48:TGufl2GL7msEHUUUUUUUUPSvR9H9vxFGiDIAEkGVvpD:lNVmswUUUUUUUUP+FGSItP
                      MD5:760E2663EF873A4FE5857D44920C414B
                      SHA1:896B916E18958325DF4255945AC7ADE9A30E3D18
                      SHA-256:2B8F0FD15E3ED6E9410780C0C14D95C76B9DF0CB3A5461AB07F0386CB6A52607
                      SHA-512:29E94F7A01FC83C6BD17A36F53544115A673333BF1DE8A4509721566AF718E33D4C228E06F3E0749ADBEFF118A84250A23D99203B363E52F0DAF9DDB00672511
                      Malicious:false
                      Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite Rollback Journal
                      Category:dropped
                      Size (bytes):8720
                      Entropy (8bit):1.608827381250937
                      Encrypted:false
                      SSDEEP:48:7MxTKUUUUUUUUUUzvR9H9vxFGiDIAEkGVvEKqFl2GL7msP:7cmUUUUUUUUUUjFGSIt2KKVmsP
                      MD5:AE5979D3C018185B3AA61D7055EABA51
                      SHA1:02C6C499B37387623EB1F573E73DBFAF48EC055A
                      SHA-256:EE5BA41AC461125026A9B02F9CEF737D1F8CCA1DF069F2657DF9416B4697F12D
                      SHA-512:5F94E6839C059D35E33960374918E7F8D3A492AC2870B204358A8F473A96595E0CC761CB6AA330E50FA7BD48DA3237452161FD23C7A98BB51CC0DB909E6DAD5D
                      Malicious:false
                      Preview:.... .c..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Temp\MSIbb73f.LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):246
                      Entropy (8bit):3.5193370621730837
                      Encrypted:false
                      SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8wAYH:Qw946cPbiOxDlbYnuRKWW
                      MD5:2B99461A31C2369764DD45DEF055DAA1
                      SHA1:5BF87CDDE5EE32BF237BC0B406642D685AC5A88D
                      SHA-256:F45CDDB1F800F0FE7F08A8351B00EECAAD0091C26085F5E57DFEC7617B59F5BB
                      SHA-512:4DDC52F32AC1D065E9B6D26AA89ED29537F45D11D38E6CEF7EB6F3E506B6515C175A05CAD00EB9D373E7F224111992E69C31B242F2CE41F7341BD5162BF947FC
                      Malicious:false
                      Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .0.5./.0.7./.2.0.2.4. . .0.0.:.4.8.:.2.5. .=.=.=.....

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-05 00-48-19-930.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393)
                      Category:dropped
                      Size (bytes):16525
                      Entropy (8bit):5.345946398610936
                      Encrypted:false
                      SSDEEP:384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
                      MD5:8947C10F5AB6CFFFAE64BCA79B5A0BE3
                      SHA1:70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
                      SHA-256:4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
                      SHA-512:B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
                      Malicious:false
                      Preview:SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393), with CRLF line terminators
                      Category:dropped
                      Size (bytes):16603
                      Entropy (8bit):5.311355917201066
                      Encrypted:false
                      SSDEEP:384:31jc7FmpfeT92DgMuT0FBXejv4dFkJFIon+SQx9odnyaI+zYGjQTdUdg5ysWC/XE:p12t
                      MD5:E968B2E03A1E85AFFC8052A4C04153C8
                      SHA1:4078F9D7FB507FEA9426851560032AA11F40C0FE
                      SHA-256:CD53DB603A075F317DD195DED13DA721B1B8E4E9080DAA87946487A5D7CA17F0
                      SHA-512:2A792CA9C4FA9FEA264ABD061076986662DCD04964DEFAC7628DACD194D45D03523B52F187B0EAE1F292B4A2F6E6FFF8922980A49D0585107EE902EF598DAB87
                      Malicious:false
                      Preview:SessionID=22e407fc-dda4-4dec-9b65-0aed321eaf0f.1720154899992 Timestamp=2024-07-05T00:48:19:992-0400 ThreadID=7964 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=22e407fc-dda4-4dec-9b65-0aed321eaf0f.1720154899992 Timestamp=2024-07-05T00:48:19:993-0400 ThreadID=7964 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=22e407fc-dda4-4dec-9b65-0aed321eaf0f.1720154899992 Timestamp=2024-07-05T00:48:19:993-0400 ThreadID=7964 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=22e407fc-dda4-4dec-9b65-0aed321eaf0f.1720154899992 Timestamp=2024-07-05T00:48:19:993-0400 ThreadID=7964 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=22e407fc-dda4-4dec-9b65-0aed321eaf0f.1720154899992 Timestamp=2024-07-05T00:48:19:993-0400 ThreadID=7964 Component=ngl-lib_NglAppLib Description="SetConf

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):29752
                      Entropy (8bit):5.388653477191486
                      Encrypted:false
                      SSDEEP:768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rA:WccYToVYdZ9d4
                      MD5:FA78D1D2953E8D4C0C7802F72C6BD3FC
                      SHA1:FCB709740758C463970FB5BEA7F1E321A58558CC
                      SHA-256:1A24FB2A65BA66224022079B7F6A92DE0C1234C44AA0D228E0D591FDF7C80E6B
                      SHA-512:C9D13827DC7F9C8661B066DE0392B701FBA8E1975660DFD33938ED7535267C5AF82EF22989371EB1CDBD189B04158413818ED7414C7A0913606BCC3EE8993C9A
                      Malicious:false
                      Preview:03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

                      C:\Users\user\AppData\Local\Temp\acrocef_low\14be27ed-ae7e-4a10-9957-f1b916d0c711.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                      Category:dropped
                      Size (bytes):1419751
                      Entropy (8bit):7.976496077007677
                      Encrypted:false
                      SSDEEP:24576:/xA7ouWLaGZ7wYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVuWLaGZ7wZGk3mlind9i4ufFXpAXkru
                      MD5:13F55292D0735B9ABD4259B225D210FC
                      SHA1:810CC5D545BFA11D2825F6E1DFA69176794DA7EC
                      SHA-256:8C3FFEA68963D108599E8C5AE20DE6E9C473BF33197A03A9A7DDCD0F25A6C7F6
                      SHA-512:4F54EDA9EB61172A5243DAA718CFF42A0BF079CC0FA7BE3553CC8B79772763B49F530DD6B54A9D595C4F46B8416ADF7D5C8DAD58FC43A5C651258E669DC375DA
                      Malicious:false
                      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                      C:\Users\user\AppData\Local\Temp\acrocef_low\9004f0a6-50e4-40c7-bfb6-d1e76a1e7612.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                      Category:dropped
                      Size (bytes):386528
                      Entropy (8bit):7.9736851559892425
                      Encrypted:false
                      SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                      MD5:5C48B0AD2FEF800949466AE872E1F1E2
                      SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                      SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                      SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                      Malicious:false
                      Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                      C:\Users\user\AppData\Local\Temp\acrocef_low\9aa22250-35b0-42be-92c7-67bedf2f46a7.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                      Category:dropped
                      Size (bytes):758601
                      Entropy (8bit):7.98639316555857
                      Encrypted:false
                      SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                      MD5:3A49135134665364308390AC398006F1
                      SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                      SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                      SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                      Malicious:false
                      Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                      C:\Users\user\AppData\Local\Temp\acrocef_low\c644945e-9c28-41ce-a4d1-61647ac295e2.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                      Category:dropped
                      Size (bytes):1407294
                      Entropy (8bit):7.97605879016224
                      Encrypted:false
                      SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
                      MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
                      SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
                      SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
                      SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
                      Malicious:false
                      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                      Static File Info

                      General

                      File type:PDF document, version 1.7, 4 pages
                      Entropy (8bit):7.87858938350625
                      TrID:
                      • Adobe Portable Document Format (5005/1) 100.00%
                      File name:unity.pdf
                      File size:86'196 bytes
                      MD5:cc4676ef08e8aecbe22b9232f27b2141
                      SHA1:03bb3a2cb2c8a5cf7b93cf7c666c470144cfd724
                      SHA256:48331ea4e205e07525f47149d19c8f78dba24ee63147a74f7d0a443008e4587d
                      SHA512:a27daef2db426114f9b45f9ead7c0cf5e6c84389570e51c749c9ce9bad8ab6d2c866c54a291fa5a6d83ab7b476a00e9ad4729c92ed53b5371af7e2382ccbec96
                      SSDEEP:1536:hBhksShBntb0liRZmRKIQh13cqT+Mve6US2c6fGJ76c3oW9CMJ6yd:lk1N9bRZmRDQuUPe6US2c6No9CM3
                      TLSH:0A83E031C9DE8C9CF8C1D977DA283A7886BABD13EBC6548241DCDE867080594CBA35D7
                      File Content Preview:%PDF-1.7.%.........2 0 obj.<</Length 3 0 R/Filter/FlateDecode>>.stream.x..XK..G....(.-..R......n......B...6.8f..I.}$...3..x.Nou=.O.>.Fv .><<..~....W1.;......*..m....@.......?.?...zx.}.....$.0.....^>.......cb.t....a...8.... ...H+..}/.....2J'..s....<...p...

                      File Icon

                      Icon Hash:62cc8caeb29e8ae0

                      Static PDF Info

                      General

                      Header:%PDF-1.7
                      Total Entropy:7.878589
                      Total Bytes:86196
                      Stream Entropy:7.914682
                      Stream Bytes:78520
                      Entropy outside Streams:5.072614
                      Bytes outside Streams:7676
                      Number of EOF found:1
                      Bytes after EOF:

                      Keywords Statistics

                      NameCount
                      obj48
                      endobj48
                      stream8
                      endstream8
                      xref1
                      trailer1
                      startxref1
                      /Page2
                      /Encrypt0
                      /ObjStm0
                      /URI2
                      /JS0
                      /JavaScript0
                      /AA0
                      /OpenAction1
                      /AcroForm0
                      /JBIG2Decode0
                      /RichMedia0
                      /Launch0
                      /EmbeddedFile0

                      Image Streams

                      IDDHASHMD5Preview
                      1412b2b2b218706168058b8a9221b8d3d64d06bebd419ea56f
                      152d4d0d4d0d0e9eb638360f4ebec5b7d6cd55731a666400f4

                      Network Behavior

                      Network Port Distribution

                      TCP Packets

                      TimestampSource PortDest PortSource IPDest IP
                      Jul 5, 2024 06:48:30.901217937 CEST49742443192.168.2.423.47.168.24
                      Jul 5, 2024 06:48:30.901251078 CEST4434974223.47.168.24192.168.2.4
                      Jul 5, 2024 06:48:30.901319027 CEST49742443192.168.2.423.47.168.24
                      Jul 5, 2024 06:48:30.901496887 CEST49742443192.168.2.423.47.168.24
                      Jul 5, 2024 06:48:30.901513100 CEST4434974223.47.168.24192.168.2.4
                      Jul 5, 2024 06:48:31.479963064 CEST4434974223.47.168.24192.168.2.4
                      Jul 5, 2024 06:48:31.485327959 CEST49742443192.168.2.423.47.168.24
                      Jul 5, 2024 06:48:31.485344887 CEST4434974223.47.168.24192.168.2.4
                      Jul 5, 2024 06:48:31.486447096 CEST4434974223.47.168.24192.168.2.4
                      Jul 5, 2024 06:48:31.486516953 CEST49742443192.168.2.423.47.168.24
                      Jul 5, 2024 06:48:31.488744020 CEST49742443192.168.2.423.47.168.24
                      Jul 5, 2024 06:48:31.488805056 CEST4434974223.47.168.24192.168.2.4
                      Jul 5, 2024 06:48:31.488929033 CEST49742443192.168.2.423.47.168.24
                      Jul 5, 2024 06:48:31.488938093 CEST4434974223.47.168.24192.168.2.4
                      Jul 5, 2024 06:48:31.539403915 CEST49742443192.168.2.423.47.168.24
                      Jul 5, 2024 06:48:31.593873978 CEST4434974223.47.168.24192.168.2.4
                      Jul 5, 2024 06:48:31.593956947 CEST4434974223.47.168.24192.168.2.4
                      Jul 5, 2024 06:48:31.594018936 CEST49742443192.168.2.423.47.168.24
                      Jul 5, 2024 06:48:31.594511032 CEST49742443192.168.2.423.47.168.24
                      Jul 5, 2024 06:48:31.594528913 CEST4434974223.47.168.24192.168.2.4

                      DNS Answers

                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                      Jul 5, 2024 06:48:31.204463005 CEST1.1.1.1192.168.2.40xde35No error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
                      Jul 5, 2024 06:48:31.204463005 CEST1.1.1.1192.168.2.40xde35No error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false

                      HTTP Request Dependency Graph

                      • armmf.adobe.com

                      HTTPS Proxied Packets

                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      0192.168.2.44974223.47.168.244437444C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      TimestampBytes transferredDirectionData
                      2024-07-05 04:48:31 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
                      Host: armmf.adobe.com
                      Connection: keep-alive
                      Accept-Language: en-US,en;q=0.9
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
                      Sec-Fetch-Site: same-origin
                      Sec-Fetch-Mode: no-cors
                      Sec-Fetch-Dest: empty
                      Accept-Encoding: gzip, deflate, br
                      If-None-Match: "78-5faa31cce96da"
                      If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
                      2024-07-05 04:48:31 UTC198INHTTP/1.1 304 Not Modified
                      Content-Type: text/plain; charset=UTF-8
                      Last-Modified: Mon, 01 May 2023 15:02:33 GMT
                      ETag: "78-5faa31cce96da"
                      Date: Fri, 05 Jul 2024 04:48:31 GMT
                      Connection: close


                      Statistics

                      CPU Usage

                      Click to jump to process

                      Memory Usage

                      Click to jump to process

                      High Level Behavior Distribution

                      Click to dive into process behavior distribution

                      Behavior

                      Click to jump to process

                      System Behavior

                      General

                      Target ID:0
                      Start time:00:48:16
                      Start date:05/07/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\unity.pdf"
                      Imagebase:0x7ff7699e0000
                      File size:5'641'176 bytes
                      MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      General

                      Target ID:1
                      Start time:00:48:17
                      Start date:05/07/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                      Imagebase:0x7ff74bb60000
                      File size:3'581'912 bytes
                      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      General

                      Target ID:3
                      Start time:00:48:17
                      Start date:05/07/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1596,i,11792256941342271432,3541520970309768941,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                      Imagebase:0x7ff74bb60000
                      File size:3'581'912 bytes
                      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      Disassembly

                      ⊘No disassembly