Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
MDE_File_Sample_63ddeafcb4a1bcf61b83f738321d223a055bb288.zip

Overview

General Information

Sample name:MDE_File_Sample_63ddeafcb4a1bcf61b83f738321d223a055bb288.zip
Analysis ID:1545913
MD5:a44fd5a1494a40049f230cc1c1075268
SHA1:5687c84a0b8c89749af05df761dbed786475e5c9
SHA256:4215f8c59cbae20156ecdaad5ccb2317bebd418b576f2f09f76ecbf4750e696f
Infos:

Detection

Score:0
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

IP address seen in connection with other malware

Classification

Process Tree

  • System is w10x64_ra
  • rundll32.exe (PID: 4344 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)
  • Acrobat.exe (PID: 1824 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_63ddeafcb4a1bcf61b83f738321d223a055bb288.zip\74976.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 5952 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 2884 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1608,i,7386602406532942348,3986300996243732554,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • Acrobat.exe (PID: 4840 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_63ddeafcb4a1bcf61b83f738321d223a055bb288.zip\74976.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 4448 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 2748 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1644,i,7049400213542787093,18250634754380356701,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: Joe Sandbox ViewIP Address: 96.7.168.138 96.7.168.138
Source: 77EC63BDA74BD0D0E0426DC8F80085060.10.drString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.10.drString found in binary or memory: http://x1.i.lencr.org/
Source: cf2b2074-fefa-4c6d-b93b-aea22ad63807.tmp.11.dr, 55ccb7eb-e7c6-4e3a-8810-f6252569267a.tmp.16.drString found in binary or memory: https://chrome.cloudflare-dns.com
Source: classification engineClassification label: clean0.winZIP@30/60@0/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6164Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-31 05-11-18-243.logJump to behavior
Source: C:\Windows\System32\rundll32.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: unknownProcess created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknownProcess created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_63ddeafcb4a1bcf61b83f738321d223a055bb288.zip\74976.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1608,i,7386602406532942348,3986300996243732554,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_63ddeafcb4a1bcf61b83f738321d223a055bb288.zip\74976.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1644,i,7049400213542787093,18250634754380356701,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1608,i,7386602406532942348,3986300996243732554,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1644,i,7049400213542787093,18250634754380356701,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Rundll32		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Process Injection		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1545913 Sample: MDE_File_Sample_63ddeafcb4a... Startdate: 31/10/2024 Architecture: WINDOWS Score: 0 6 Acrobat.exe 9 64 2->6         started        8 Acrobat.exe 53 2->8         started        10 rundll32.exe 2->10         started        process3 12 AcroCEF.exe 76 6->12         started        14 AcroCEF.exe 107 8->14         started        process4 16 AcroCEF.exe 4 12->16         started        19 AcroCEF.exe 4 14->19         started        dnsIp5 21 96.7.168.138 INTERNEXABRASILOPERADORADETELECOMUNICACOESSABR United States 16->21

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://chrome.cloudflare-dns.com0%URL Reputationsafe
http://x1.i.lencr.org/0%URL Reputationsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://chrome.cloudflare-dns.comcf2b2074-fefa-4c6d-b93b-aea22ad63807.tmp.11.dr, 55ccb7eb-e7c6-4e3a-8810-f6252569267a.tmp.16.drfalse
  • URL Reputation: safe
unknown
http://x1.i.lencr.org/2D85F72862B55C4EADD9E66E06947F3D0.10.drfalse
  • URL Reputation: safe
unknown

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
96.7.168.138
unknownUnited States
262589INTERNEXABRASILOPERADORADETELECOMUNICACOESSABRfalse

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1545913
Start date and time:2024-10-31 10:10:09 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 3m 55s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultwindowsinteractivecookbook.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:19
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:MDE_File_Sample_63ddeafcb4a1bcf61b83f738321d223a055bb288.zip
Detection:CLEAN
Classification:clean0.winZIP@30/60@0/1
EGA Information:Failed
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 0
  • Number of non-executed functions: 0
Cookbook Comments:
  • Found application associated with file extension: .zip

Warnings

  • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 2.16.202.121, 95.101.54.121, 192.168.2.16, 162.159.61.3, 172.64.41.3, 2.23.197.184, 184.28.88.176, 199.232.214.172, 2.19.126.149, 2.19.126.143, 34.193.227.236, 18.207.85.246, 107.22.247.231, 54.144.73.197
  • Excluded domains from analysis (whitelisted): chrome.cloudflare-dns.com, e4578.dscg.akamaiedge.net, fs.microsoft.com, e8652.dscx.akamaiedge.net, stls.adobe.com-cn.edgesuite.net.globalredir.akadns.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, stls.adobe.com-cn.edgesuite.net, fe3cr.delivery.mp.microsoft.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, a1815.dscr.akamai.net, geo2.adobe.com, wu-b-net.trafficmanager.net, www.adobe.com, crl.root-x1.letsencrypt.org.edgekey.net
  • Not all processes where analyzed, report is missing behavior information
  • Report size exceeded maximum capacity and may have missing behavior information.
  • Report size getting too big, too many NtCreateKey calls found.
  • Report size getting too big, too many NtWriteVirtualMemory calls found.
  • VT rate limit hit for: MDE_File_Sample_63ddeafcb4a1bcf61b83f738321d223a055bb288.zip

Simulations

Behavior and APIs

TimeTypeDescription
05:11:32API Interceptor2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
96.7.168.1380438.pdf.exeGet hashmaliciousUnknownBrowse
    0438.pdf.exeGet hashmaliciousUnknownBrowse
      401K .pdfGet hashmaliciousHTMLPhisherBrowse
        http://assets.website-files.com/65f02117700897a29c49fb10/65f7c129cb837c2310c7044e_tisamijujute.pdfGet hashmaliciousUnknownBrowse
          Oakville_Service_Update_d76b33a1-3420-40be-babd-e82e253ad25c.pdfGet hashmaliciousHTMLPhisherBrowse
            2025+Policies_645622_929-5.pdfGet hashmaliciousUnknownBrowse
              https://dl.dropboxusercontent.com/scl/fi/95is2w1ywjvorzayt88dp/DKM-0192PDF.zip?rlkey=svoej4s4tb5lwbnvthtgrmokl&st=d99zdn1k&dl=0Get hashmaliciousAbobus ObfuscatorBrowse
                0438.pdf.exeGet hashmaliciousUnknownBrowse
                  Sars Urgent Notice.pdfGet hashmaliciousUnknownBrowse
                    tue.batGet hashmaliciousUnknownBrowse

                      Domains

                      ⊘No context

                      ASNs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      INTERNEXABRASILOPERADORADETELECOMUNICACOESSABR0438.pdf.exeGet hashmaliciousUnknownBrowse
                      • 96.7.168.138
                      0438.pdf.exeGet hashmaliciousUnknownBrowse
                      • 96.7.168.138
                      401K .pdfGet hashmaliciousHTMLPhisherBrowse
                      • 96.7.168.138
                      http://assets.website-files.com/65f02117700897a29c49fb10/65f7c129cb837c2310c7044e_tisamijujute.pdfGet hashmaliciousUnknownBrowse
                      • 96.7.168.138
                      Oakville_Service_Update_d76b33a1-3420-40be-babd-e82e253ad25c.pdfGet hashmaliciousHTMLPhisherBrowse
                      • 96.7.168.138
                      2025+Policies_645622_929-5.pdfGet hashmaliciousUnknownBrowse
                      • 96.7.168.138
                      https://dl.dropboxusercontent.com/scl/fi/95is2w1ywjvorzayt88dp/DKM-0192PDF.zip?rlkey=svoej4s4tb5lwbnvthtgrmokl&st=d99zdn1k&dl=0Get hashmaliciousAbobus ObfuscatorBrowse
                      • 96.7.168.138
                      0438.pdf.exeGet hashmaliciousUnknownBrowse
                      • 96.7.168.138
                      Sars Urgent Notice.pdfGet hashmaliciousUnknownBrowse
                      • 96.7.168.138
                      la.bot.m68k.elfGet hashmaliciousUnknownBrowse
                      • 200.220.206.173

                      JA3 Fingerprints

                      ⊘No context

                      Dropped Files

                      ⊘No context

                      Created / dropped Files

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):287
                      Entropy (8bit):5.134689978537579
                      Encrypted:false
                      SSDEEP:6:UfMQq2PRN2nKuAl9OmbnIFUt89fjZmw+9f5kwORN2nKuAl9OmbjLJ:0vaHAahFUt8Z/+z5JHAaSJ
                      MD5:45425F89A9D9CBAECA6673366ED89320
                      SHA1:FEFB3B296C223FFD6F97DC8E72328939A916EB2B
                      SHA-256:6D94687A8BF1AD604FFEA9598ED6A8241CF0AAFF9948EFE9B0BF4D9667415B8E
                      SHA-512:0525A021F0CD60A5A7CE2F9813D3E4AE8C1D78736D6A8C1FF5476C587A1DA4A2C6FB83DF860E486B6966C92E182914E322EAF7CF75662093D9C633525A4947AC
                      Malicious:false
                      Reputation:low
                      Preview:2024/10/31-05:11:41.263 e20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/31-05:11:41.266 e20 Recovering log #3.2024/10/31-05:11:41.266 e20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):287
                      Entropy (8bit):5.134689978537579
                      Encrypted:false
                      SSDEEP:6:UfMQq2PRN2nKuAl9OmbnIFUt89fjZmw+9f5kwORN2nKuAl9OmbjLJ:0vaHAahFUt8Z/+z5JHAaSJ
                      MD5:45425F89A9D9CBAECA6673366ED89320
                      SHA1:FEFB3B296C223FFD6F97DC8E72328939A916EB2B
                      SHA-256:6D94687A8BF1AD604FFEA9598ED6A8241CF0AAFF9948EFE9B0BF4D9667415B8E
                      SHA-512:0525A021F0CD60A5A7CE2F9813D3E4AE8C1D78736D6A8C1FF5476C587A1DA4A2C6FB83DF860E486B6966C92E182914E322EAF7CF75662093D9C633525A4947AC
                      Malicious:false
                      Reputation:low
                      Preview:2024/10/31-05:11:41.263 e20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/31-05:11:41.266 e20 Recovering log #3.2024/10/31-05:11:41.266 e20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF48d4b6.TMP (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):287
                      Entropy (8bit):5.134689978537579
                      Encrypted:false
                      SSDEEP:6:UfMQq2PRN2nKuAl9OmbnIFUt89fjZmw+9f5kwORN2nKuAl9OmbjLJ:0vaHAahFUt8Z/+z5JHAaSJ
                      MD5:45425F89A9D9CBAECA6673366ED89320
                      SHA1:FEFB3B296C223FFD6F97DC8E72328939A916EB2B
                      SHA-256:6D94687A8BF1AD604FFEA9598ED6A8241CF0AAFF9948EFE9B0BF4D9667415B8E
                      SHA-512:0525A021F0CD60A5A7CE2F9813D3E4AE8C1D78736D6A8C1FF5476C587A1DA4A2C6FB83DF860E486B6966C92E182914E322EAF7CF75662093D9C633525A4947AC
                      Malicious:false
                      Reputation:low
                      Preview:2024/10/31-05:11:41.263 e20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/31-05:11:41.266 e20 Recovering log #3.2024/10/31-05:11:41.266 e20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):331
                      Entropy (8bit):5.18252730319891
                      Encrypted:false
                      SSDEEP:6:UfQEQ+q2PRN2nKuAl9Ombzo2jMGIFUt89fQCQgZmw+9fQQQVkwORN2nKuAl9OmbX:aVvaHAa8uFUt8Ug/+tI5JHAa8RJ
                      MD5:D9B69E55B7A8A232FAD64F20A9E56F85
                      SHA1:869E043CE05B7D08806C80779AD773EF843DFABA
                      SHA-256:9843A5EA49C0DCA0D48E3C5412B95AA1E6EDE5D41955E130DE3D684D6502ADF4
                      SHA-512:89729040D5F31EB2CA00E0F6B8F25D6568655A5ABE1BC7ABF3450D9EA75A082102049C87E35C626547E83797F27B688E72FD6D43B1F67F47B6DE4BBA44649BE0
                      Malicious:false
                      Reputation:low
                      Preview:2024/10/31-05:11:18.824 d68 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/31-05:11:18.827 d68 Recovering log #3.2024/10/31-05:11:18.828 d68 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):331
                      Entropy (8bit):5.18252730319891
                      Encrypted:false
                      SSDEEP:6:UfQEQ+q2PRN2nKuAl9Ombzo2jMGIFUt89fQCQgZmw+9fQQQVkwORN2nKuAl9OmbX:aVvaHAa8uFUt8Ug/+tI5JHAa8RJ
                      MD5:D9B69E55B7A8A232FAD64F20A9E56F85
                      SHA1:869E043CE05B7D08806C80779AD773EF843DFABA
                      SHA-256:9843A5EA49C0DCA0D48E3C5412B95AA1E6EDE5D41955E130DE3D684D6502ADF4
                      SHA-512:89729040D5F31EB2CA00E0F6B8F25D6568655A5ABE1BC7ABF3450D9EA75A082102049C87E35C626547E83797F27B688E72FD6D43B1F67F47B6DE4BBA44649BE0
                      Malicious:false
                      Reputation:low
                      Preview:2024/10/31-05:11:18.824 d68 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/31-05:11:18.827 d68 Recovering log #3.2024/10/31-05:11:18.828 d68 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old~RF48d4d6.TMP (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):331
                      Entropy (8bit):5.18252730319891
                      Encrypted:false
                      SSDEEP:6:UfQEQ+q2PRN2nKuAl9Ombzo2jMGIFUt89fQCQgZmw+9fQQQVkwORN2nKuAl9OmbX:aVvaHAa8uFUt8Ug/+tI5JHAa8RJ
                      MD5:D9B69E55B7A8A232FAD64F20A9E56F85
                      SHA1:869E043CE05B7D08806C80779AD773EF843DFABA
                      SHA-256:9843A5EA49C0DCA0D48E3C5412B95AA1E6EDE5D41955E130DE3D684D6502ADF4
                      SHA-512:89729040D5F31EB2CA00E0F6B8F25D6568655A5ABE1BC7ABF3450D9EA75A082102049C87E35C626547E83797F27B688E72FD6D43B1F67F47B6DE4BBA44649BE0
                      Malicious:false
                      Preview:2024/10/31-05:11:18.824 d68 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/31-05:11:18.827 d68 Recovering log #3.2024/10/31-05:11:18.828 d68 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\55ccb7eb-e7c6-4e3a-8810-f6252569267a.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:modified
                      Size (bytes):403
                      Entropy (8bit):4.994586495157486
                      Encrypted:false
                      SSDEEP:12:YHO8sqqsBdOg2HdXwcaq3QYiubrP7E4T3y:YXsidMHdr3QYhbz7nby
                      MD5:37D5525FB5F4401747F98EB9E249296C
                      SHA1:074D4B2FA8D62E8399B671FAD5984B53EC671DE8
                      SHA-256:B84875DC6FFACD497F11594A907D6734F67D2A8070AD82A3F7B4089E476B3405
                      SHA-512:FB3181243A8751A1353F097ADBC9C96B42EADD5DFAA42CE8EF00B0A86B845444046305989D16BBBE3DE9B76D7B46AF0908E7CDE00279174F43896AD76467D28A
                      Malicious:false
                      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13374925907095578","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":452553},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):403
                      Entropy (8bit):4.991191791548924
                      Encrypted:false
                      SSDEEP:12:YHO8sqc/sBdOg2H42caq3QYiubrP7E4TX:YXsNAdMH4J3QYhbz7n7
                      MD5:6DBDC64E073233F72687CB7936909B8C
                      SHA1:0E0418F29CC8C0EB5BEBC88D847E9DC5C5685EFD
                      SHA-256:D0A4436C9496E55FF98016AA541735B1537D7CAC190120438F3E518DF4B76C32
                      SHA-512:6B5E0CDD007D3501D62F3A63603325836F13C3210D2EABC7C49B78C498E95A85B8174DB57E447588CA20C478B551294E0C115B0490E9A9F96D1BAFF9DBB9CEFD
                      Malicious:false
                      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13374925894059009","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":244030},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF48edec.TMP (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):403
                      Entropy (8bit):4.991191791548924
                      Encrypted:false
                      SSDEEP:12:YHO8sqc/sBdOg2H42caq3QYiubrP7E4TX:YXsNAdMH4J3QYhbz7n7
                      MD5:6DBDC64E073233F72687CB7936909B8C
                      SHA1:0E0418F29CC8C0EB5BEBC88D847E9DC5C5685EFD
                      SHA-256:D0A4436C9496E55FF98016AA541735B1537D7CAC190120438F3E518DF4B76C32
                      SHA-512:6B5E0CDD007D3501D62F3A63603325836F13C3210D2EABC7C49B78C498E95A85B8174DB57E447588CA20C478B551294E0C115B0490E9A9F96D1BAFF9DBB9CEFD
                      Malicious:false
                      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13374925894059009","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":244030},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cf2b2074-fefa-4c6d-b93b-aea22ad63807.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:modified
                      Size (bytes):403
                      Entropy (8bit):4.991191791548924
                      Encrypted:false
                      SSDEEP:12:YHO8sqc/sBdOg2H42caq3QYiubrP7E4TX:YXsNAdMH4J3QYhbz7n7
                      MD5:6DBDC64E073233F72687CB7936909B8C
                      SHA1:0E0418F29CC8C0EB5BEBC88D847E9DC5C5685EFD
                      SHA-256:D0A4436C9496E55FF98016AA541735B1537D7CAC190120438F3E518DF4B76C32
                      SHA-512:6B5E0CDD007D3501D62F3A63603325836F13C3210D2EABC7C49B78C498E95A85B8174DB57E447588CA20C478B551294E0C115B0490E9A9F96D1BAFF9DBB9CEFD
                      Malicious:false
                      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13374925894059009","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":244030},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):5405
                      Entropy (8bit):5.236505853103586
                      Encrypted:false
                      SSDEEP:96:OLSw0bSwIAnrRqLX2rSq1OUxu/0OZ0xRBTxekN8xeNFhyyxvTQ4gQPZ:OLT0bTIeYa51Ogu/0OZARBT8kN88NFhb
                      MD5:7BBD95E434FD2DD98C19E286DDF8BD24
                      SHA1:51A1D74F305C169CADA62BBF65B7C404ADAD10C2
                      SHA-256:49199AFA5929BCD9806AB36EEE20109978E76B96A77D14DC8C76043D7F4DBA78
                      SHA-512:82C5B29C611DB0837F33C9E84CF37969D601F97CD71703E936BB11B5F609104D1632D5A6E2099AE3D2215D95D2ABFB652AA4F7393A080D74112EDE4772B04D1B
                      Malicious:false
                      Preview:*...#................version.1..namespace-e...o................next-map-id.1.Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/.0y.S_r................next-map-id.2.Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/.16.X:r................next-map-id.3.Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/.2.P.@o................next-map-id.4.Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/.346.+^...............Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/....^...............Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/..?&a...............Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/_...a...............Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/...o................next-map-id.5.Pnamespace-07af9ee9_2076_4f12_94b5_

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):322
                      Entropy (8bit):5.1267078968144135
                      Encrypted:false
                      SSDEEP:6:Ufg+q2PRN2nKuAl9OmbzNMxIFUt89f+YZmw+9fDiVkwORN2nKuAl9OmbzNMFLJ:l+vaHAa8jFUt8oY/+sV5JHAa84J
                      MD5:5CCB51594B776EFECAEBC335C96AE6FE
                      SHA1:A7E596C3BE6F1AC481A5D344DA5DFE4A01C07060
                      SHA-256:5F26D6B4E7FD77B48E1EBC50CD5161031A8B6DB9685D9ADF0F97D7F4444464FB
                      SHA-512:3986A6DBBF240BF70C847D8DD8AF49C8C0BAA3784841E843C3806755A8B2267291B265F642B9F7BBB3D82371E749233CA038CF9DF3ED4AC62F12EACD619CD372
                      Malicious:false
                      Preview:2024/10/31-05:11:41.360 1adc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/31-05:11:41.361 1adc Recovering log #3.2024/10/31-05:11:41.362 1adc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):322
                      Entropy (8bit):5.1267078968144135
                      Encrypted:false
                      SSDEEP:6:Ufg+q2PRN2nKuAl9OmbzNMxIFUt89f+YZmw+9fDiVkwORN2nKuAl9OmbzNMFLJ:l+vaHAa8jFUt8oY/+sV5JHAa84J
                      MD5:5CCB51594B776EFECAEBC335C96AE6FE
                      SHA1:A7E596C3BE6F1AC481A5D344DA5DFE4A01C07060
                      SHA-256:5F26D6B4E7FD77B48E1EBC50CD5161031A8B6DB9685D9ADF0F97D7F4444464FB
                      SHA-512:3986A6DBBF240BF70C847D8DD8AF49C8C0BAA3784841E843C3806755A8B2267291B265F642B9F7BBB3D82371E749233CA038CF9DF3ED4AC62F12EACD619CD372
                      Malicious:false
                      Preview:2024/10/31-05:11:41.360 1adc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/31-05:11:41.361 1adc Recovering log #3.2024/10/31-05:11:41.362 1adc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old~RF48d514.TMP (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):322
                      Entropy (8bit):5.1267078968144135
                      Encrypted:false
                      SSDEEP:6:Ufg+q2PRN2nKuAl9OmbzNMxIFUt89f+YZmw+9fDiVkwORN2nKuAl9OmbzNMFLJ:l+vaHAa8jFUt8oY/+sV5JHAa84J
                      MD5:5CCB51594B776EFECAEBC335C96AE6FE
                      SHA1:A7E596C3BE6F1AC481A5D344DA5DFE4A01C07060
                      SHA-256:5F26D6B4E7FD77B48E1EBC50CD5161031A8B6DB9685D9ADF0F97D7F4444464FB
                      SHA-512:3986A6DBBF240BF70C847D8DD8AF49C8C0BAA3784841E843C3806755A8B2267291B265F642B9F7BBB3D82371E749233CA038CF9DF3ED4AC62F12EACD619CD372
                      Malicious:false
                      Preview:2024/10/31-05:11:41.360 1adc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/31-05:11:41.361 1adc Recovering log #3.2024/10/31-05:11:41.362 1adc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2
                      Category:dropped
                      Size (bytes):57344
                      Entropy (8bit):3.291927920232006
                      Encrypted:false
                      SSDEEP:192:vedRBvVui5V4R4dcQ5V4R4RtYWtEV2UUTTchqGp8F/7/z+FP:veBci5H5FY+EUUUTTcHqFzqFP
                      MD5:A4D5FECEFE05F21D6F81ACF4D9A788CF
                      SHA1:1A9AC236C80F2A2809F7DE374072E2FCCA5A775C
                      SHA-256:83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
                      SHA-512:FF106C6B9E1EA4B1F3E3AB01FAEA21BA24A885E63DDF0C36EB0A8C3C89A9430FE676039C076C50D7C46DC4E809F6A7E35A4BFED64D9033FEBD6121AC547AA5E9
                      Malicious:false
                      Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite Rollback Journal
                      Category:dropped
                      Size (bytes):16928
                      Entropy (8bit):1.212862478336151
                      Encrypted:false
                      SSDEEP:24:7+tAjqLi+zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+ZT:7MkqLmFTIF3XmHjBoGGR+jMz+LhG
                      MD5:D387B0B6A190068C6FB723E66F282A77
                      SHA1:CE9CC7BE2E32AC2DA17A620291DDB21BB6724B26
                      SHA-256:E3EFF297E468DD036E93000184A227ABAC803DD0675B0D36BB3D1B50AF7FCED5
                      SHA-512:F283253CC7D729AE36B069976657972CBE40F95B8A8860E0F6954F81CFE71E7DD731795D3E0580A4B761BB912351617563D4D51D4677A5CA22331AB6F95C446A
                      Malicious:false
                      Preview:.... .c.....E.S.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:Certificate, Version=3
                      Category:dropped
                      Size (bytes):1391
                      Entropy (8bit):7.705940075877404
                      Encrypted:false
                      SSDEEP:24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
                      MD5:0CD2F9E0DA1773E9ED864DA5E370E74E
                      SHA1:CABD2A79A1076A31F21D253635CB039D4329A5E8
                      SHA-256:96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
                      SHA-512:3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
                      Malicious:false
                      Preview:0..k0..S............@.YDc.c...0...*.H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0...*.H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I.....*.A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.|C.t..t.....0.[q6....00\H..;..}`...).........A.......|.;F.H*..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..|o..;.....'...}~.."......

                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                      Category:dropped
                      Size (bytes):71954
                      Entropy (8bit):7.996617769952133
                      Encrypted:true
                      SSDEEP:1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
                      MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
                      SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
                      SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
                      SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
                      Malicious:false
                      Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):192
                      Entropy (8bit):2.775162490582081
                      Encrypted:false
                      SSDEEP:3:kkFklGfRKlXfllXlE/HT8ksVhlXNNX8RolJuRdxLlGB9lQRYwpDdt:kKf5K2T87zdNMa8RdWBwRd
                      MD5:379A6EC5C94C0B4D7C12A5B09127D00B
                      SHA1:CD73FE0305BB713C082EC6F570382804E1602A66
                      SHA-256:41B53341B0D77F375EC767DFB210F8052AAE2810692440033A146282DB1416B1
                      SHA-512:F83025951D3E790D2683CD909E46A7F1EF0EB0213D8AACBAB94FC95051ACA2B71D000483CF0DE036DC0D27113C97F80E4DB94C2E0EDD98A5A35E4B9BF73600CE
                      Malicious:false
                      Preview:p...... .........)..t+..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):328
                      Entropy (8bit):3.224190177427459
                      Encrypted:false
                      SSDEEP:6:kKTi9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:bdDImsLNkPlE99SNxAhUe/3
                      MD5:627D26E76C8D736031623577FB0C8F46
                      SHA1:56339DBDC45B72CD4801D59840B6F1D6486CF342
                      SHA-256:1FA8DC4A30F61EB68C9606FBBA145A9BE09408E9C40C61F3EA320A1D4D1C9CFA
                      SHA-512:3C6C78C339AD1AB78243CE1E547D134E1D76BAD39C143096B685BA90E42C37149BB92807B0BEBE0D33875A5C26F59AE34B50E1C0B3D088FA68C1A337AE10F652
                      Malicious:false
                      Preview:p...... ......../5..t+..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6164

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PostScript document text
                      Category:dropped
                      Size (bytes):185099
                      Entropy (8bit):5.182478651346149
                      Encrypted:false
                      SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                      MD5:94185C5850C26B3C6FC24ABC385CDA58
                      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                      Malicious:false
                      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PostScript document text
                      Category:dropped
                      Size (bytes):185099
                      Entropy (8bit):5.182478651346149
                      Encrypted:false
                      SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                      MD5:94185C5850C26B3C6FC24ABC385CDA58
                      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                      Malicious:false
                      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):231031
                      Entropy (8bit):3.3762863910038354
                      Encrypted:false
                      SSDEEP:1536:gpKPliyzDtrh1cK3XEi3D7Vg/3AYvYwgZbrioWisn:OKP7m/3AYvYwgNOoWisn
                      MD5:A9F6D97B95BC9531C5713A1FA0E24A63
                      SHA1:4EC20BF4C335559704D23585285D115B750C23A5
                      SHA-256:80094506B4C7B8898C738F135F94225933F40FC329B940CEB1C25170EB7446CA
                      SHA-512:3028BFE2FB61CE1AEB1D7FC403C0050E20400DF43EEBCE8C41D83CF576F31E2683774A1CB93200370828B0E465262DDAAC0CA557D127208487C38D35A53B6001
                      Malicious:false
                      Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):295
                      Entropy (8bit):5.382764871523485
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXCNUMQ5IRR4UhUR0YLfoAvJM3g98kUwPeUkwRe9:YvXKX3MQWRuUhUPgGMbLUkee9
                      MD5:C0C32F1CDAAD1863163FA25C15A82EDB
                      SHA1:F8DAB2EE7A18C7B3E5B53899D4EC3145DCA1C20F
                      SHA-256:FBBC2E755158CCD98F047D71D1C55131C80E179C9AB6C2568DFB13A3BF140260
                      SHA-512:6A938281125CC3CA1946ACF23739EDB991638C19F06A359F744E3CC7EFDAD3F112F43EB9014006D94BE43775BB38A48C00D83AC60EC8B2F922362623654179D0
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7c1dc6bd-f482-4a67-8983-0b9b0a8b7eaf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1730544646121,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.331238043401213
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXCNUMQ5IRR4UhUR0YLfoAvJfBoTfXpnrPeUkwRe9:YvXKX3MQWRuUhUPgGWTfXcUkee9
                      MD5:89EE5F2D9BE122437BF40AAEAD0C4476
                      SHA1:8341AE9E8FCEA77FAF415F9386D2BD2998094BA1
                      SHA-256:BDF6C0301BAD3C966094F99691287B10818470A6E215AC8B1B3081E3CA64A760
                      SHA-512:0BF14A231083FA79E1D07C91F0E8EFB2DBCFF8FA6CFCB79138438F6C17C984F93831D2A738B36F00B093F21ED24DFB7EBC103637B062DF5DD99D51DADAFE5C21
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7c1dc6bd-f482-4a67-8983-0b9b0a8b7eaf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1730544646121,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.309497538759021
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXCNUMQ5IRR4UhUR0YLfoAvJfBD2G6UpnrPeUkwRe9:YvXKX3MQWRuUhUPgGR22cUkee9
                      MD5:F0768A9640BD202ED8C4F4E4533917F7
                      SHA1:43D6F3E97272905983974A3B73E3636A49702D4B
                      SHA-256:8ACD71C4020FC2D93763232B5C13BC08B92F36D1FD4F0870CEC935B378E8E45E
                      SHA-512:7D103D98345FD8A2B103EC69F810A2610C0184C624FC7EFC0D7A52190A6C153E113C74FE8833A49E584244EF383DA15D0A2842814A9B5FB9773595A5A7DDAB05
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7c1dc6bd-f482-4a67-8983-0b9b0a8b7eaf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1730544646121,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):285
                      Entropy (8bit):5.371825814131368
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXCNUMQ5IRR4UhUR0YLfoAvJfPmwrPeUkwRe9:YvXKX3MQWRuUhUPgGH56Ukee9
                      MD5:6A7FDF236BF16ADD8E8B5C04BEE4C4A7
                      SHA1:D1DE9862BFC8F10199A06D8FF0D6FF0A50E9CF03
                      SHA-256:929DE604CF039FEFA3C8619F59FF17A2AF4301C866CBE568542DA027F15E05F4
                      SHA-512:B092C1B230A40B7976C776E819A71DC10CFCCAFF106F97268C8FC21C2332A7FCACAC987C630808F78A9AB63F869C087C8572EEDC2AD75CB750CFE45D19B6581F
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7c1dc6bd-f482-4a67-8983-0b9b0a8b7eaf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1730544646121,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1055
                      Entropy (8bit):5.662972018634758
                      Encrypted:false
                      SSDEEP:24:Yv6X3MRUP9pLgEscLf7nnl0RCmK8czOCCSl:YvxUP9hgGzaAh8cv/l
                      MD5:3AB35B5FF33ECB632A232EDAF95810AD
                      SHA1:96B9A5AE99A6F314B48534CB9F55EFACCEAEF84D
                      SHA-256:122049966BED5AC3083DF7D0A63EB9080929C5930E60A46AFD80A6FC873A94FB
                      SHA-512:43EFD81FF48C93D805234BDD4767A81C7DF8D320FF26032C64652655162E7DB989B85EFE9EBCCF77E247A9F158DB8EFE3B669ADCFFA04654260FAA2E91C549A4
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7c1dc6bd-f482-4a67-8983-0b9b0a8b7eaf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1730544646121,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"92038_285529ActionBlock_1","campaignId":92038,"containerId":"1","controlGroupId":"","treatmentId":"eb1a4bce-8215-46f1-b44c-154b21a85d60","variationId":"285529"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNhdElkIjpudWxsfQ==","dataType":"application\/json","encodingScheme":tr

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1050
                      Entropy (8bit):5.655455919896994
                      Encrypted:false
                      SSDEEP:24:Yv6X3MRUPhVLgEF0c7sbnl0RCmK8czOCYHflEpwiV8:YvxUPhFg6sGAh8cvYHWpwl
                      MD5:D8DB70910897FC7882CBABF0CF8BF83F
                      SHA1:FA026FBB7D1413F286B361BAE0D6F5CFAD15682B
                      SHA-256:E916E75F4251339E6402257A3C2EAD0A2F67D522FB9C5EB3A473363C588B1446
                      SHA-512:997817A8485B5F67DCB4592AE81E221ED88533E4EF94F46DD2AA14A6F855B074E368BDECCBF95E6C5AA00D605AC725A08067A6ECF60B1672B58E02C4E7748F5D
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7c1dc6bd-f482-4a67-8983-0b9b0a8b7eaf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1730544646121,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_0","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"0924134e-3c59-4f53-b731-add558c56fec","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuZm9ybXMgJiBhZ3JlZW1lbnRzLiJ9LCJ0Y2F0SWQiOm51bGx9","dataType":"application\/json","encodingScheme":true},"

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.32197305197619
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXCNUMQ5IRR4UhUR0YLfoAvJfQ1rPeUkwRe9:YvXKX3MQWRuUhUPgGY16Ukee9
                      MD5:0616AA1B1A5932558693BD455F189BE8
                      SHA1:5D00882B04E25634C7720D8A6F44229AA07B639A
                      SHA-256:52266D4EF0BC541450833E5E1A6562AB9D29354961CFFDE6BDDFEBBEFA697DDC
                      SHA-512:435B9A3E4A556F60A23D9B5A2004573B97CDD2BD2251E87A08C736FC9AD557987B149D5FF50348279CFA626C6852BBD1F1B351D9CDE1FA39238F0AFAC543E5FB
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7c1dc6bd-f482-4a67-8983-0b9b0a8b7eaf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1730544646121,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1038
                      Entropy (8bit):5.649978524201069
                      Encrypted:false
                      SSDEEP:24:Yv6X3MRUPQ2LgEF7cciAXs0nl0RCmK8czOCAPtciB8:YvxUPQogc8hAh8cvA2
                      MD5:EDDDBCE028735FAB71A3B03DA783F3D1
                      SHA1:905167EB28CBFC9A9827EB5A880A88BD1C63D236
                      SHA-256:48CAD131E3944C1B15BE4465F6FB10F9EBF3E073FF19840D3F3FEA65409D2FC7
                      SHA-512:239430943F2A66F85DA5E2902C908E7CF47DED8150154E16FA0C7B89B5942FDD94B8FD5C41CACDB020E20A5A23182E2608C8BC176C764B39A613F6E3B816D2B9
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7c1dc6bd-f482-4a67-8983-0b9b0a8b7eaf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1730544646121,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_1","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"49d2f713-7aa9-44db-aa50-0a7a22add459","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVkaXQgdGV4dCwgaW1hZ2VzLCBwYWdlcywgYW5kIG1vcmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme":true},"endDTS":1744

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1164
                      Entropy (8bit):5.699154184836258
                      Encrypted:false
                      SSDEEP:24:Yv6X3MRUPYKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK58:YvxUPYEgqprtrS5OZjSlwTmAfSK6
                      MD5:DA309EDA37022BC660E0514B1213764D
                      SHA1:D182225BF7DC4219AA8335A5AB43D7136B82F69D
                      SHA-256:69A40DA65699F03BC1491B32CC4A96E2DBB4604105A2B1EB4DDFC357B6415624
                      SHA-512:3726B374B51CF16755859029AA5CB67F93FFF58368571010ECCC5777083501E8322E20BD4463613218C33D0ABC674C6BFF858DEC8A402AA059680C04F92735DF
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7c1dc6bd-f482-4a67-8983-0b9b0a8b7eaf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1730544646121,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.325518224568998
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXCNUMQ5IRR4UhUR0YLfoAvJfYdPeUkwRe9:YvXKX3MQWRuUhUPgGg8Ukee9
                      MD5:46F525811B906C11AA0DA5E9018A06C7
                      SHA1:5AD68DE4009AFD6AB84EFA8EE5BBAA6E21722EB4
                      SHA-256:63783D0414AD676C885D7CF2AB77C8660F87C7114FFB2B912F383F1C61CB140C
                      SHA-512:9E94C2C4E7D698A54B09028450C360E7B24285152D0D469E4CD72158510B9144E7ACB03FAF6920F21CC176C3F19804463FDAB7CC69F5F9F840F4838D2BEBE86F
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7c1dc6bd-f482-4a67-8983-0b9b0a8b7eaf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1730544646121,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1395
                      Entropy (8bit):5.7766139450069796
                      Encrypted:false
                      SSDEEP:24:Yv6X3MRUP3rLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNE:YvxUP3HgDv3W2aYQfgB5OUupHrQ9FJ6
                      MD5:4F9DA9DA8B086D4A77B4884FE4DD75D7
                      SHA1:D2109B3E7E91B9C31BD89A4D72A2B3EAA0798C38
                      SHA-256:29AB06047EEB5D107F083BA2F12E5DA6DE74AFD87A36ACDACE69342BC408D1FA
                      SHA-512:FB31B08650314398C86A662E0FC9229A53B1F74980274E6A0D62765E2BF162FE1CE6E97BF7BF82979AEDB97EA3D1C9E556440DB1595243CB9984267098CAEAA4
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7c1dc6bd-f482-4a67-8983-0b9b0a8b7eaf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1730544646121,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):291
                      Entropy (8bit):5.308889939256132
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXCNUMQ5IRR4UhUR0YLfoAvJfbPtdPeUkwRe9:YvXKX3MQWRuUhUPgGDV8Ukee9
                      MD5:D35F94EF1C52A9193EFBC814029CC91E
                      SHA1:7E0308194D22D3A7A8B948190C9EC904DA89B447
                      SHA-256:C0E0E15E0230C17C73B0556299A72F66B3F329973C8CAB5001CEEA166E5A9EB4
                      SHA-512:F530B85D420E257BB2FBECCA7C9335EED9D61C631CB4B97D076C342745B17DC9324D3670726F9C28F3168A37CF735F201F17A3DD28D13B7DA8AF07EDFF2389D0
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7c1dc6bd-f482-4a67-8983-0b9b0a8b7eaf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1730544646121,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):287
                      Entropy (8bit):5.312920335492284
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXCNUMQ5IRR4UhUR0YLfoAvJf21rPeUkwRe9:YvXKX3MQWRuUhUPgG+16Ukee9
                      MD5:E853CF8088AB48F437F2106AB5F7A1B7
                      SHA1:72B49A5C69755A7B52B652E8501D08169507F3BB
                      SHA-256:F4A20CCEA7423AC1B5229C89E2FF879EDC1A786642F533D985303383A880992B
                      SHA-512:9F23917912103FBDEB12BEF023BAD5680CD72C39138347C741E242A3E215587BEC2FA865C7950AB078FFCB636DACADA87904D40FD7D37DF9CFEB5C0AE21B7A5A
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7c1dc6bd-f482-4a67-8983-0b9b0a8b7eaf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1730544646121,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1026
                      Entropy (8bit):5.633510123753392
                      Encrypted:false
                      SSDEEP:24:Yv6X3MRUPFamXayLgE7cMCBNaqnl0RCmK8czOC/BSl:YvxUP5BgACBOAh8cvMl
                      MD5:436B312FD55691B38A28DEABAEA72A77
                      SHA1:3B094999BF8E64B397C1666C4CB12AC457659C09
                      SHA-256:23C6DC15069C84EE47ADEF6EA105A05BAA391863087873FD282F6EEB9962A17F
                      SHA-512:D86E993FCB73B9E008893D312374DEE4476D39FDC968D86DE2063FA77901793EFBDEECC5F3BB5882BC7A5DD41FD04852F1725FCE98594E5140BAED086E764D84
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7c1dc6bd-f482-4a67-8983-0b9b0a8b7eaf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1730544646121,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"92038_285529ActionBlock_0","campaignId":92038,"containerId":"1","controlGroupId":"","treatmentId":"6291f52b-6cb0-4d31-bc46-37ce85e9eb25","variationId":"285529"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme":true},"endDTS":1751323379000,"s

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):286
                      Entropy (8bit):5.288054321117152
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXCNUMQ5IRR4UhUR0YLfoAvJfshHHrPeUkwRe9:YvXKX3MQWRuUhUPgGUUUkee9
                      MD5:326D187C24FCCF9533AB80D3BE0234B2
                      SHA1:3C1F7F75F4224A3F1DC6D44C322C823C6970B778
                      SHA-256:4641FFFC396D59D64AF14702C086A1540459C0F2233850A2A6A1F8835E192E9B
                      SHA-512:C240B94A3674EB9499BA3397FDFB75118C9E78D85DB2F28ADAB179F2AE7AB917058FD94B65FFBA13A17DF82A1381CBF352633C268EC292A7F3EE84EAB8655515
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7c1dc6bd-f482-4a67-8983-0b9b0a8b7eaf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1730544646121,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):782
                      Entropy (8bit):5.373926942468442
                      Encrypted:false
                      SSDEEP:12:YvXKX3MQWRuUhUPgGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWA:Yv6X3MRUPW168CgEXX5kcIfANhl
                      MD5:66C48DD169EDCB3783E12C9553E11253
                      SHA1:1D80ED4BC50F7F8D928C41A5C0756DC449968C3B
                      SHA-256:12821AAFAD9BD126F4525EC2617962BCCA9FDE89721D7CAE7F005DA31967FD0E
                      SHA-512:6C1B07285BA7FA1DAB011A08A11A2B01C32FDB7E72230CE931408B3B1BAA3F78400A9D0AE24192DEABEEA64FCE0AB92AABDA4DE85ABD931B76D6DFC5DEB7A477
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7c1dc6bd-f482-4a67-8983-0b9b0a8b7eaf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1730544646121,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1730365906182}}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):4
                      Entropy (8bit):0.8112781244591328
                      Encrypted:false
                      SSDEEP:3:e:e
                      MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                      SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                      SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                      SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                      Malicious:false
                      Preview:....

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):2818
                      Entropy (8bit):5.124576487989521
                      Encrypted:false
                      SSDEEP:24:Y6MIkjaBayXBlbIDBGHlQCBQrQLuf+VBPJwjxzj0S0lw2EJniQx2LSeUMP5dw9Ap:YIVbpC+QMLuG/Yx/1RJiQxsUMPTw94
                      MD5:B41EBB95EDD2BEF8FE461D42B86E546C
                      SHA1:A06F50972D8FC87F6D9F9DA505426989544064D9
                      SHA-256:EADE7265E8D3CF9CA433E1F51907DD31B322784BE2FE2E1010D18BBC42FC71EA
                      SHA-512:578D24086CDB67C1266798F7175FDFEB319F368892D2FBFCE505A4C62B90D35819304BD74A81BDC47F1EA89F553D5C6BBB654F690AE16311E7E870A9BFD058B2
                      Malicious:false
                      Preview:{"all":[{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"3db3652b9ce622ee31fc2bbd0ac6a269","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1730365905000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"2ccef776f498d025dec9a6c29a927f80","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1026,"ts":1730365905000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"3d91e53d62d969c483f03abfc0ccc999","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1055,"ts":1730365905000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"efe79db9f4c58061eb0bcd5c707a063d","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1038,"ts":1730365905000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"886b60ae7ce26f4536aacd60753ef32c","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1050,"ts":1730365905000},{"id":"Edit_InApp_Aug2020","info":{"dg":"e378de6d44963d387f55b31fa5aa8a73","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":17

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 22, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 22
                      Category:dropped
                      Size (bytes):12288
                      Entropy (8bit):0.9920023224206472
                      Encrypted:false
                      SSDEEP:24:TLWwx/XYKQvGJF7ursZY9QmQ6QeihGcbWUWf7JniYhF:Tll2GL7msZYXtrzckJiE
                      MD5:63952CC82F8FAD682096B569D929D933
                      SHA1:22671750A7C8E69107752B35C0AFD1EF85B7C6EE
                      SHA-256:0F55A4862EDBFD76A6655C016BE7B58BF17CDDD81C56DA5E3BB880E8ED817B3C
                      SHA-512:47D9A7C13FCF2A01FEBC8097A78DF51950FF5998692BAC5389DA38538D8064BACDA5EE9DC3C811BED401145887FC2957EFA18E89AF7CBF50FD64A0717B5ACC52
                      Malicious:false
                      Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite Rollback Journal
                      Category:dropped
                      Size (bytes):8720
                      Entropy (8bit):1.350699538628377
                      Encrypted:false
                      SSDEEP:24:7+t8V6Y9QmQ6QeihbcLEVLWf7JniYhHXvqLRx/XYKQvGJF7ursY7:7MXYXtrucIV0JikXvq1l2GL7msW
                      MD5:D205B29E72EA99A6A0BE623FD39144E2
                      SHA1:2298CB124C8A654ECB9182E22DE8425D73200F5F
                      SHA-256:087DBAB2F7CBC4A1BAB33FD49AABFF7242C27A37674D8C2B0B97A2880F7D5A28
                      SHA-512:29F9785FD2F745D672F41C4264FC35BF66C3CAD0F02C4761FCC32A1D5A4B8FC3200F60865D50292EA5642CFDDFDF0C145AF9534FD83246A0A3659B09A8B2F63E
                      Malicious:false
                      Preview:.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#...v./.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Temp\MSI8b8d2.LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):246
                      Entropy (8bit):3.5136057226030957
                      Encrypted:false
                      SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8fQRWfUOul:Qw946cPbiOxDlbYnuRKuHm
                      MD5:EC712D735BF199E7F9497EF9C0217ACD
                      SHA1:719C563F439404249E3FCDEE92865055ED9045BB
                      SHA-256:D144DEA60DA09BC39EC2054991E636F1AA40777E5AEB2DA5A398F48245413AC4
                      SHA-512:1D9BDC3CAD5915A549128C3A26907CE6D0DBF693C10D92DBED5611EF4FA55C64BEBDAEC7E0EF99EF5DE71AD1AD59D38B96EFDE6C4BD92AD78E53AF8135493A5F
                      Malicious:false
                      Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .3.1./.1.0./.2.0.2.4. . .0.5.:.1.1.:.3.4. .=.=.=.....

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91hgad6b_qiy7ve_4r8.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:HTML document, ASCII text
                      Category:dropped
                      Size (bytes):383
                      Entropy (8bit):5.3272426871592335
                      Encrypted:false
                      SSDEEP:6:wBqWjn8iTawMnraH5hS3EajrRQAtBkFKklCmvz/vbcaS3jfU0cMYz/FooA:a8eir8qEajr+AtBkFZzAjfuzk
                      MD5:5CC2355A6AD5615A4AD373DA53DB5667
                      SHA1:70E00F3E369036B32CE8C7A971C543BFCCFBEF8E
                      SHA-256:542ACC2C8E55514142D1089360F15E17B41A1E60DFB5D299B0DBCA55D9D0D94D
                      SHA-512:3E5705F388719E5EE1D4281E30A65E893D11D8E3C491C7F39BEC185FF071E4D73FA50FD04728018D7F33A3906904FD9CA3EE77269F488044723EB74B883B1DF5
                      Malicious:false
                      Preview:<HTML><HEAD>.<TITLE>Unsupported Request</TITLE>.</HEAD><BODY>.<H1>Unsupported Request</H1>.PROPFIND to http&#58;&#47;&#47;www&#46;adobe&#46;com&#47;go&#47;homeacrordrunified18&#95;2018 not supported.<P>.Reference&#32;&#35;8&#46;75ca1002&#46;1730365881&#46;1c081242.<P>https&#58;&#47;&#47;errors&#46;edgesuite&#46;net&#47;8&#46;75ca1002&#46;1730365881&#46;1c081242</P>.</BODY></HTML>.

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\A92cuwsq_qiy7vf_4r8.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PDF document, version 1.3, 2 pages
                      Category:dropped
                      Size (bytes):1734720
                      Entropy (8bit):7.999581305333742
                      Encrypted:true
                      SSDEEP:49152:Vindpk/BgYlE87nasHBpFjt6oyk5b8dk1HR7G:8ndp0BgzgLHBp9qsbxY
                      MD5:1527BBD38601C24087D9BE0F5ACCBE19
                      SHA1:0C4539A4DD2CD8302D29FB50DA4D3B5F9E65CE1F
                      SHA-256:5C2E32A79BA4E2ABA9DEF10E521ED268463288BAFE038B5CD9DE099799663DD1
                      SHA-512:00391887BCE35EEEF1636A6902FF82831E5FE600144966FDAA95276FA713FD3E5D417C79AA85947D005762B02CB9A8F5DD4C2AF1038C79D78532536CDAB6A9D4
                      Malicious:false
                      Preview:%PDF-1.3.%.....1 0 obj.<<./Metadata 2 0 R./Pages 3 0 R./Type /Catalog.>>.endobj.4 0 obj.<<./Author <BEA046C7D18BC5DA57096888CC725F4A6F>./CreationDate <A9EE11878BD89B8A001917D48A30061C58>./Creator <BABB51D3>./ModDate <A9EE11878BD89B8A001917DF8938071C2F41D99AF4C8E5>./Producer <80B540F8EACAFDD6405A4F82D521061A2C47C085E4D0809EB20A74F7AA0163DC0A39006B5A417871B5AA11A958F50176CED1FF2CEB>./Title <BAB14FD4D687CE93464606ACD87358496305CEFFE4C8FADBE25422F7FE584A8A55>.>>.endobj.2 0 obj.<<./Length 3491./Subtype /XML./Type /Metadata.>>.stream...u>..oz.~..T....H\+h.-...J.8...M....A..?dP.....:.mx..k..J.....\:..A.H"V.........y. .w.......$...c...........r.{x.r.<..m.1.L1....2.x.3...x...H....k..S\....[yFw.|.r.1.........V+..9.(..H_@>....1Mn>9w.O.A0...A..<..W.k..F+.i.34(.....D`V....I....+j.-.......oTf..P`.$..u`..gx..3...wZ...W<P..m+_b.......)o.....H.^u.e.._..?Ly.........F.,...,0...].*~.1VC..%wv<.gGd....$=(~.<U..F.i0...(J..._.r.$.........H..N.J...A...f.i%.....[$hfVM...S8.F.a......

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\A99cmgpq_qiy7vd_4r8.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:HTML document, ASCII text
                      Category:dropped
                      Size (bytes):383
                      Entropy (8bit):5.34415788556862
                      Encrypted:false
                      SSDEEP:6:wBqWjn8iTawMnraH5hS3EajrRQAtBkFKklCm862bcaS3jfU0cMFvbQoA:a8eir8qEajr+AtBkFb9jfrb2
                      MD5:C9A1FCC704FC4A259CC1C3306BA0C343
                      SHA1:28B424BADACDB9B828E669324CE227AD41D9C57A
                      SHA-256:1AD959C9DC0B66B20BAD7AB5B04D0E625FC8FFE86E892EF1CEBB970632E9BF51
                      SHA-512:56BE339F6EE09D6E8F94205FF620280B1F826E70BCA876580ED3F95CF656E8D9B0FB4D5834099D04C7BEBE45011046A6CF8677621DC87666466414F50FB61D59
                      Malicious:false
                      Preview:<HTML><HEAD>.<TITLE>Unsupported Request</TITLE>.</HEAD><BODY>.<H1>Unsupported Request</H1>.PROPFIND to http&#58;&#47;&#47;www&#46;adobe&#46;com&#47;go&#47;homeacrordrunified18&#95;2018 not supported.<P>.Reference&#32;&#35;8&#46;75ca1002&#46;1730365880&#46;1c080f90.<P>https&#58;&#47;&#47;errors&#46;edgesuite&#46;net&#47;8&#46;75ca1002&#46;1730365880&#46;1c080f90</P>.</BODY></HTML>.

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9b96ur6_qiy7vh_4r8.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:HTML document, ASCII text
                      Category:dropped
                      Size (bytes):383
                      Entropy (8bit):5.354367535947652
                      Encrypted:false
                      SSDEEP:6:wBqWjn8iTawMnraH5hS3EajrRQAtBkFKklCmro1KmebcaS3jfU0cMSo1KQ2ooA:a8eir8qEajr+AtBkF5ujfEC2+
                      MD5:04D9B43D671DD6D74330F48E2493872D
                      SHA1:B6B366A6B78865A663B377B7D1476B48EDBD08ED
                      SHA-256:25517355F0B05D882FA682E5C34790747D4A6F3D7C2E8A8D525B84567110CBA6
                      SHA-512:A2D2C4D1C608968B85FB20ACBE033E3A5C9DCEA5ADBE811BB4213C5BF7256A8E3ECB4AA13FA8679E7B182B82429E03171E253661E87A29B97CE650EF7BC95C5B
                      Malicious:false
                      Preview:<HTML><HEAD>.<TITLE>Unsupported Request</TITLE>.</HEAD><BODY>.<H1>Unsupported Request</H1>.PROPFIND to http&#58;&#47;&#47;www&#46;adobe&#46;com&#47;go&#47;homeacrordrunified18&#95;2018 not supported.<P>.Reference&#32;&#35;8&#46;75ca1002&#46;1730365890&#46;1c0827fd.<P>https&#58;&#47;&#47;errors&#46;edgesuite&#46;net&#47;8&#46;75ca1002&#46;1730365890&#46;1c0827fd</P>.</BODY></HTML>.

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-31 05-11-18-243.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393)
                      Category:dropped
                      Size (bytes):16525
                      Entropy (8bit):5.353642815103214
                      Encrypted:false
                      SSDEEP:384:tbxtsuP+XEWJJQbnR8L31M7HeltV+KYm3wsa2KjF4ODkr/O8r2IUHUHMWwEyZRN2:aPL
                      MD5:91F06491552FC977E9E8AF47786EE7C1
                      SHA1:8FEB27904897FFCC2BE1A985D479D7F75F11CEFC
                      SHA-256:06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
                      SHA-512:A63E6E0D25B88EBB6602885AB8E91167D37267B24516A11F7492F48876D3DDCAE44FFC386E146F3CF6EB4FA6AF251602143F254687B17FCFE6F00783095C5082
                      Malicious:false
                      Preview:SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig:

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-31 05-11-41-191.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393)
                      Category:dropped
                      Size (bytes):16529
                      Entropy (8bit):5.3246154948535285
                      Encrypted:false
                      SSDEEP:384:xLhocKPjqnsGYPvsyxbMXdEYMpynRzLS9sTlvXFUfVmrptLTThJviPv8jOM+M9Nr:UXXs
                      MD5:74833D9391A4F7FCD1710CBA37CAD630
                      SHA1:C9766A35F0E92F588CDB4F863FA59AEFAE5AAA79
                      SHA-256:5072ED08DA80025296E24E53987923D78D23DB99E53D759C2F46F522CB0B51B0
                      SHA-512:9A5252DC11D29789774E543EAFCD804EE66957B33F2F188827F69F9B6EE0B365C19E2039A1F5472802291032DD6315A9C89A3FAEAF0DFD16FDD325204AA373F5
                      Malicious:false
                      Preview:SessionID=804bacd0-8f23-4ece-9906-0f2047a0dd0a.1730365878259 Timestamp=2024-10-31T05:11:18:259-0400 ThreadID=2712 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=804bacd0-8f23-4ece-9906-0f2047a0dd0a.1730365878259 Timestamp=2024-10-31T05:11:18:262-0400 ThreadID=2712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=804bacd0-8f23-4ece-9906-0f2047a0dd0a.1730365878259 Timestamp=2024-10-31T05:11:18:262-0400 ThreadID=2712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=804bacd0-8f23-4ece-9906-0f2047a0dd0a.1730365878259 Timestamp=2024-10-31T05:11:18:262-0400 ThreadID=2712 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=804bacd0-8f23-4ece-9906-0f2047a0dd0a.1730365878259 Timestamp=2024-10-31T05:11:18:263-0400 ThreadID=2712 Component=ngl-lib_NglAppLib Description="SetConfig:

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393), with CRLF line terminators
                      Category:dropped
                      Size (bytes):16581
                      Entropy (8bit):5.3211172691250965
                      Encrypted:false
                      SSDEEP:384:dlLUjlWRXOrUIFwjrtL6+d58AHlNjHb9u9cWgsW8ZfpOE2npb6GSmrmL+E2G7UsV:ZLCT
                      MD5:748330513B388DFA998D9A0AE0722DC8
                      SHA1:FD2CDBD98938274D011A89DA954557E1ABA26F2B
                      SHA-256:047B3C816367A75CCC55605EEBE733B656FB5BB7CBCBD916111191F4B69B834D
                      SHA-512:47D93C3F45F89E2BA75B6ECD616598FC65BCA7DA87415B6529CF49F6E763306ACA6F9019BD3C4E8FE426952ADDDABA0DE5E7AF7B400C2156F67F5651944F9891
                      Malicious:false
                      Preview:SessionID=703531eb-5dea-4f7d-bf61-8a7790b33124.1730365901201 Timestamp=2024-10-31T05:11:41:201-0400 ThreadID=400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=703531eb-5dea-4f7d-bf61-8a7790b33124.1730365901201 Timestamp=2024-10-31T05:11:41:202-0400 ThreadID=400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=703531eb-5dea-4f7d-bf61-8a7790b33124.1730365901201 Timestamp=2024-10-31T05:11:41:202-0400 ThreadID=400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=703531eb-5dea-4f7d-bf61-8a7790b33124.1730365901201 Timestamp=2024-10-31T05:11:41:202-0400 ThreadID=400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=703531eb-5dea-4f7d-bf61-8a7790b33124.1730365901201 Timestamp=2024-10-31T05:11:41:202-0400 ThreadID=400 Component=ngl-lib_NglAppLib Description="SetConfig: N

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):35814
                      Entropy (8bit):5.413733815637046
                      Encrypted:false
                      SSDEEP:192:0cbgIhPcbocbAIlncb2cbwI/RcbNcbQIVvcbGcb81IXhcbWRcbKDIdzcbD:fhWlA/TVByXnUdI
                      MD5:F74AC1C9AFD70DE5A58E19D98BD3C8B7
                      SHA1:36379FE12A37CDEAFE3755A4023CF07C35CF0713
                      SHA-256:3398A3F3C1E74185BE8F12ED100F348DDFECC7598A887AE52D28F4C28D4CAF0E
                      SHA-512:4D5B9A15A2CF40A78BDFF8FFC46021531E5110A01436B8F115E9ECA8747F7C6ED6273CCCD1279448CF2DE66CC76E343A8D5F59CCC08DDD78AE4EEFB2DC6E4034
                      Malicious:false
                      Preview:06-10-2023 10:08:42:.---2---..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 10:08:42:.Closing File..06-10-

                      C:\Users\user\AppData\Local\Temp\acrocef_low\4d8c518c-d4d2-4142-ab6a-3f1ebe78f68e.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                      Category:dropped
                      Size (bytes):386528
                      Entropy (8bit):7.9736851559892425
                      Encrypted:false
                      SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                      MD5:5C48B0AD2FEF800949466AE872E1F1E2
                      SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                      SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                      SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                      Malicious:false
                      Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                      C:\Users\user\AppData\Local\Temp\acrocef_low\8fa6d83f-e784-4d95-abac-e5be5cfab16b.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                      Category:dropped
                      Size (bytes):1407294
                      Entropy (8bit):7.97605879016224
                      Encrypted:false
                      SSDEEP:24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
                      MD5:716C2C392DCD15C95BBD760EEBABFCD0
                      SHA1:4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
                      SHA-256:DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
                      SHA-512:E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
                      Malicious:false
                      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                      C:\Users\user\AppData\Local\Temp\acrocef_low\9ef82c97-a2f1-424d-ac1f-f65cbe46f840.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                      Category:dropped
                      Size (bytes):1407294
                      Entropy (8bit):7.97605879016224
                      Encrypted:false
                      SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
                      MD5:8B9FA2EC5118087D19CFDB20DA7C4C26
                      SHA1:E32D6A1829B18717EF1455B73E88D36E0410EF93
                      SHA-256:4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
                      SHA-512:662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
                      Malicious:false
                      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                      C:\Users\user\AppData\Local\Temp\acrocef_low\d2c9e626-200d-4175-85eb-6c0fd3f2dc73.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                      Category:dropped
                      Size (bytes):758601
                      Entropy (8bit):7.98639316555857
                      Encrypted:false
                      SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                      MD5:3A49135134665364308390AC398006F1
                      SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                      SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                      SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                      Malicious:false
                      Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                      C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):22
                      Entropy (8bit):3.4594316186372964
                      Encrypted:false
                      SSDEEP:3:3cEHn:3nHn
                      MD5:4AC65FD0505524C840E4B8ED9352125F
                      SHA1:F914B6F0DF85ED7B5AA059AFDBD993E18748493F
                      SHA-256:913EF675AA4754FBB1A0B07E73B75D515B05C2058CB1144BC115E0430A90CC11
                      SHA-512:9E8913B2E71CA3C0D422A2ED1CA6E2BEE3C7C7F493A0F79573CA4E0341946FFB1D38F669521190B1303B4F3F6F392E20B7694ED25A177301C93816BB8B073438
                      Malicious:false
                      Preview:<</global [/c <<>>].>>

                      C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):24
                      Entropy (8bit):3.66829583405449
                      Encrypted:false
                      SSDEEP:3:So6FwHn:So6FwHn
                      MD5:DD4A3BD8B9FF61628346391EA9987E1D
                      SHA1:474076C122CACAAF112469FC62976BB69187AA2B
                      SHA-256:7C22C759CA704106556BBC4FC10B7F53404CA1F8B40F01038D3F7C4B8183F486
                      SHA-512:FDAF3D9F8072ED7DE9B2528376C10E3C3FDBEA74347710A4795BECF23C6577B3582B2E89D3C04EF0523C98FE0A46F2AF3629490701A20B848C63BA7B26579491
                      Malicious:false
                      Preview:<</Settings [/c <<>>].>>

                      C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):36
                      Entropy (8bit):4.294653473544341
                      Encrypted:false
                      SSDEEP:3:8QvCyKGziFLpn:8QayKGyLpn
                      MD5:5C6B932A79952B4B27833691305E61DB
                      SHA1:09804DB0986A989C2C49CDCEA563567FB4C7B1A0
                      SHA-256:DEE5A5925227B125F4AC6D9B70A277E6EC8494FFC73D1CCE9E08CC7A78D6208A
                      SHA-512:4FAA9585BB10156D5DEA3B62D3A3A1BFA92430BA6E1E3381FC4C76C3071C85E53D5CBCE0016DBA1D1F9EA1B7AF37B4A4EFBAF4F3106B7D958B6E2E90AA0DF059
                      Malicious:false
                      Preview:%PDFTrustManagerDocsData 1.0........

                      C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):54
                      Entropy (8bit):3.7119196645733785
                      Encrypted:false
                      SSDEEP:3:8QvCxXLV1AiLKltVln:8QaRhJ2ltPn
                      MD5:6A614A7743B0C781AAECA60448E861D6
                      SHA1:67B7DF5EBEB4527E4C31F3F9B7E52A0581DC4B6D
                      SHA-256:9703120DC62C2C3F843BAD5B1E77594682CA7820F0345AE0BBD73021C1427146
                      SHA-512:3A45B27ED6F3AAA8C2113FBB21637675CC91D1239754447A7032D1A86CB1E7381575B28F992E5FFC9986354C2B9C173C614F1F703CA4C2BEE63AB3BC6ED909A6
                      Malicious:false
                      Preview:%PDFTrustManagerGroupPerms 1.0........................

                      Static File Info

                      General

                      File type:Zip archive data, at least v2.0 to extract, compression method=deflate
                      Entropy (8bit):7.9908104263283946
                      TrID:
                      • ZIP compressed archive (8000/1) 100.00%
                      File name:MDE_File_Sample_63ddeafcb4a1bcf61b83f738321d223a055bb288.zip
                      File size:28'130 bytes
                      MD5:a44fd5a1494a40049f230cc1c1075268
                      SHA1:5687c84a0b8c89749af05df761dbed786475e5c9
                      SHA256:4215f8c59cbae20156ecdaad5ccb2317bebd418b576f2f09f76ecbf4750e696f
                      SHA512:453c2840b84b96ee77369b1dd66b3cc181c8d8a4736fc72ac0886cedcc54569209ff02e06da380eb07ef76c20c087d30984ac719bc5cf42003c71ccb5fcc9211
                      SSDEEP:384:UTWYii0mSlDbwUU/lRYxCyeIy8a8kq6L8AFtMj15ywBkr05OMbFGeX241gyEz6:lSnS2UfeIHgq6L8A45Yus0Ked9H
                      TLSH:37C2E15D66969B1251021EAB0B4617E3AC83CBADB3358531700741A72BACFCDC1EE33E
                      File Content Preview:PK........$I_Y.5Wa&m........$.74976.pdf.. .............t+......t+......t+...'....P..G..../}7I(@...,...W.;..N........;D.....6[.d.._.. .m....#...r..y;..8.k....Q...2.-._P.....N.2...x.K.&1.*..I...J.....n.....x......#K...5K..h.>..`;.^.6..}5....C/..}]..:e.M:.{.

                      File Icon

                      Icon Hash:1c1c1e4e4ececedc

                      Network Behavior

                      ⊘No network behavior found

                      Statistics

                      CPU Usage

                      Click to jump to process

                      Memory Usage

                      Click to jump to process

                      High Level Behavior Distribution

                      Click to dive into process behavior distribution

                      Behavior

                      Click to jump to process

                      System Behavior

                      General

                      Target ID:0
                      Start time:05:10:40
                      Start date:31/10/2024
                      Path:C:\Windows\System32\rundll32.exe
                      Wow64 process (32bit):false
                      Commandline:C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                      Imagebase:0x7ff74d2a0000
                      File size:71'680 bytes
                      MD5 hash:EF3179D498793BF4234F708D3BE28633
                      Has elevated privileges:false
                      Has administrator privileges:false
                      Programmed in:C, C++ or other language
                      Reputation:high
                      Has exited:true

                      General

                      Target ID:9
                      Start time:05:11:14
                      Start date:31/10/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_63ddeafcb4a1bcf61b83f738321d223a055bb288.zip\74976.pdf"
                      Imagebase:0x7ff74de40000
                      File size:5'641'176 bytes
                      MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                      Has elevated privileges:false
                      Has administrator privileges:false
                      Programmed in:C, C++ or other language
                      Reputation:high
                      Has exited:true

                      General

                      Target ID:10
                      Start time:05:11:18
                      Start date:31/10/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                      Imagebase:0x7ff7763d0000
                      File size:3'581'912 bytes
                      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                      Has elevated privileges:false
                      Has administrator privileges:false
                      Programmed in:C, C++ or other language
                      Reputation:high
                      Has exited:true

                      General

                      Target ID:11
                      Start time:05:11:18
                      Start date:31/10/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1608,i,7386602406532942348,3986300996243732554,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                      Imagebase:0x7ff7763d0000
                      File size:3'581'912 bytes
                      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                      Has elevated privileges:false
                      Has administrator privileges:false
                      Programmed in:C, C++ or other language
                      Reputation:high
                      Has exited:true

                      General

                      Target ID:14
                      Start time:05:11:38
                      Start date:31/10/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_63ddeafcb4a1bcf61b83f738321d223a055bb288.zip\74976.pdf"
                      Imagebase:0x7ff74de40000
                      File size:5'641'176 bytes
                      MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                      Has elevated privileges:false
                      Has administrator privileges:false
                      Programmed in:C, C++ or other language
                      Reputation:high
                      Has exited:true

                      General

                      Target ID:15
                      Start time:05:11:41
                      Start date:31/10/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                      Imagebase:0x7ff7763d0000
                      File size:3'581'912 bytes
                      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                      Has elevated privileges:false
                      Has administrator privileges:false
                      Programmed in:C, C++ or other language
                      Reputation:high
                      Has exited:true

                      General

                      Target ID:16
                      Start time:05:11:41
                      Start date:31/10/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1644,i,7049400213542787093,18250634754380356701,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                      Imagebase:0x7ff6d4dc0000
                      File size:3'581'912 bytes
                      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                      Has elevated privileges:false
                      Has administrator privileges:false
                      Programmed in:C, C++ or other language
                      Reputation:high
                      Has exited:true

                      Disassembly

                      ⊘No disassembly