Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
CJ-241115826_CJ_430448_OE_BMSCAD.pdf

Overview

General Information

Sample name:CJ-241115826_CJ_430448_OE_BMSCAD.pdf
Analysis ID:1558820
MD5:8b7dcee56b4a8a1c85180efd916f4057
SHA1:2a11fc0fec727b5293a87e7e47550178a748ce7a
SHA256:c3c590c7beb7883610edc82c7fa47d09e1ba7b9251d9745da14582ca440ccefb
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 1856 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\CJ-241115826_CJ_430448_OE_BMSCAD.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 5424 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 7248 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1676,i,1745309769064675600,3028205725165205519,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficDNS query: name: x1.i.lencr.org
Source: global trafficDNS query: name: x1.i.lencr.org
Source: global trafficTCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global trafficTCP traffic: 23.203.104.175:443 -> 192.168.2.5:49733
Source: global trafficTCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global trafficTCP traffic: 23.203.104.175:443 -> 192.168.2.5:49733
Source: global trafficTCP traffic: 23.203.104.175:443 -> 192.168.2.5:49733
Source: global trafficTCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global trafficTCP traffic: 23.203.104.175:443 -> 192.168.2.5:49733
Source: global trafficTCP traffic: 23.203.104.175:443 -> 192.168.2.5:49733
Source: global trafficTCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global trafficTCP traffic: 23.203.104.175:443 -> 192.168.2.5:49733
Source: global trafficTCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global trafficTCP traffic: 23.203.104.175:443 -> 192.168.2.5:49733
Source: global trafficTCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global trafficTCP traffic: 23.203.104.175:443 -> 192.168.2.5:49733
Source: global trafficTCP traffic: 23.203.104.175:443 -> 192.168.2.5:49733
Source: global trafficTCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global trafficTCP traffic: 23.203.104.175:443 -> 192.168.2.5:49733
Source: Joe Sandbox ViewIP Address: 23.203.104.175 23.203.104.175
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknownTCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknownTCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknownTCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknownTCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknownTCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknownTCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknownTCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknownTCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknownTCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global trafficDNS traffic detected: DNS query: x1.i.lencr.org
Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.drString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.drString found in binary or memory: http://x1.i.lencr.org/
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: classification engineClassification label: clean2.winPDF@14/49@2/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4564Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-19 14-39-01-679.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\CJ-241115826_CJ_430448_OE_BMSCAD.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1676,i,1745309769064675600,3028205725165205519,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1676,i,1745309769064675600,3028205725165205519,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: CJ-241115826_CJ_430448_OE_BMSCAD.pdfInitial sample: PDF keyword /JS count = 0
Source: CJ-241115826_CJ_430448_OE_BMSCAD.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: CJ-241115826_CJ_430448_OE_BMSCAD.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts3
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media2
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive13
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1558820 Sample: CJ-241115826_CJ_430448_OE_B... Startdate: 19/11/2024 Architecture: WINDOWS Score: 2 14 x1.i.lencr.org 2->14 7 Acrobat.exe 17 65 2->7         started        process3 process4 9 AcroCEF.exe 106 7->9         started        process5 11 AcroCEF.exe 2 9->11         started        dnsIp6 16 23.203.104.175, 443, 49733 AKAMAI-ASUS United States 11->16

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
windowsupdatebg.s.llnwi.net
87.248.205.0
truefalse
    		high
    x1.i.lencr.org
    		unknown
    		unknownfalse
      		high

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      http://x1.i.lencr.org/2D85F72862B55C4EADD9E66E06947F3D0.2.drfalse
        		high

        World Map of Contacted IPs

        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs

        Public IPs

        IPDomainCountryFlagASNASN NameMalicious
        23.203.104.175
        		unknownUnited States
        		16625AKAMAI-ASUSfalse

        General Information

        Joe Sandbox version:41.0.0 Charoite
        Analysis ID:1558820
        Start date and time:2024-11-19 20:38:01 +01:00
        Joe Sandbox product:CloudBasic
        Overall analysis duration:0h 4m 9s
        Hypervisor based Inspection enabled:false
        Report type:full
        Cookbook file name:defaultwindowspdfcookbook.jbs
        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
        Number of analysed new started processes analysed:9
        Number of new started drivers analysed:0
        Number of existing processes analysed:0
        Number of existing drivers analysed:0
        Number of injected processes analysed:0
        Technologies:
        • EGA enabled
        • AMSI enabled
        Analysis Mode:default
        Analysis stop reason:Timeout
        Sample name:CJ-241115826_CJ_430448_OE_BMSCAD.pdf
        Detection:CLEAN
        Classification:clean2.winPDF@14/49@2/1
        Cookbook Comments:
        • Found application associated with file extension: .pdf
        • Found PDF document
        • Close Viewer

        Warnings

        • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
        • Excluded IPs from analysis (whitelisted): 184.28.88.176, 23.22.254.206, 52.5.13.197, 52.202.204.11, 54.227.187.23, 162.159.61.3, 172.64.41.3, 87.248.205.0, 2.23.197.184, 2.19.126.143, 2.19.126.149
        • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
        • VT rate limit hit for: CJ-241115826_CJ_430448_OE_BMSCAD.pdf

        Simulations

        Behavior and APIs

        TimeTypeDescription
        14:39:12API Interceptor2x Sleep call for process: AcroCEF.exe modified

        LLM Input / Output

        Joe Sandbox View / Context

        IPs

        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        23.203.104.175Benefit Enrollment -eGz8VNb.pdfGet hashmaliciousUnknownBrowse
          Carboline Quote Request.emlGet hashmaliciousHTMLPhisherBrowse
            Patrick-In service Agreement-0483___fdp.pdfGet hashmaliciousUnknownBrowse
              brayton HR Bulletin_270852_3BU4-ZSJO2U-JMY3.pdfGet hashmaliciousUnknownBrowse
                PO01282Speyside.pdfGet hashmaliciousHtmlDropperBrowse
                  original.emlGet hashmaliciousHtmlDropperBrowse
                    Demande de proposition de AVANTAGE INDUSTRIEL INC.pdfGet hashmaliciousHtmlDropperBrowse
                      Proposal From Transom.pdfGet hashmaliciousHtmlDropperBrowse
                        Visix Digital Signage.pdfGet hashmaliciousUnknownBrowse
                          Final_Contract_Copy-532392974.pdfGet hashmaliciousUnknownBrowse

                            Domains

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            windowsupdatebg.s.llnwi.netAirtame-4.11.0-setup.msiGet hashmaliciousUnknownBrowse
                            • 87.248.204.0
                            q1M9Xfi0yC.exeGet hashmaliciousScreenConnect ToolBrowse
                            • 87.248.205.0
                            8DHbFKl94l.pdfGet hashmaliciousUnknownBrowse
                            • 87.248.205.0
                            https://us.services.docusign.net/webforms-ux/v1.0/forms/de9dbdc77cc2367bb50c45c4d2a0b8c4Get hashmaliciousUnknownBrowse
                            • 87.248.205.0
                            https://buycode.us/Get hashmaliciousUnknownBrowse
                            • 87.248.204.0
                            https://drive.google.com/uc?export=download&id=1iaK9ppq5gLIgMAIIEMZ874KKXqw8TPYHGet hashmaliciousUnknownBrowse
                            • 87.248.202.1
                            Pmendon.ext_Reord_Adjustment.docxGet hashmaliciousCaptcha PhishBrowse
                            • 87.248.205.0
                            apptext.dll.dllGet hashmaliciousBruteRatel, LatrodectusBrowse
                            • 46.228.146.0
                            https://temp.farenheit.net/XNmRkL0JpUmxBQTZuV2tIZUROa0lqeFhjbUlHS1FUR2d2YjZVKzQrNmxLeGxNOWRBLzMrc0pQRERZejVvZTA2ZENOTU5qV1hoaG1oL2JqQit5cE9DdEs1OS9NbVRVQUlObzNpVFlGMmZDT2lrWUVmeGVHNHU4REdtb04vME5iTDZBbVZ5cVc3ZXRxVnE1YkE0eWd3Z3RFVFYvWXh2OHJGRTVOaTJ5b0pPVEpsNDhXZnM5M1B2S3RPYU54MjZCRENPdjJ5bGl6bmxDc3IvOW1Ub3JsaXpaTWRsU0FlcU1pU2NzbzdrcXc9PS0tRTRqMzk0TUpka2xBNHo0Wi0tMTBZdXRlVmpmTWI1WnVlQkhpazZ1dz09?cid=2268024181Get hashmaliciousKnowBe4Browse
                            • 87.248.202.1
                            http://103.227.62.185:83Get hashmaliciousUnknownBrowse
                            • 178.79.238.0

                            ASNs

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            AKAMAI-ASUSCustomer forms.pdfGet hashmaliciousUnknownBrowse
                            • 104.78.188.188
                            Benefit Enrollment -eGz8VNb.pdfGet hashmaliciousUnknownBrowse
                            • 23.203.104.175
                            Integration.pdf www.skype.com.lnkGet hashmaliciousUnknownBrowse
                            • 96.17.64.171
                            b.pdfGet hashmaliciousUnknownBrowse
                            • 23.217.172.185
                            https://www.bing.com/ck/a?!&&p=5ceef533778c3decJmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MA&ptn=3&ver=2&hsh=3&fclid=364f65e8-e56c-619d-1257-713ee42a6012&u=a1aHR0cHM6Ly9sZXhpbnZhcmlhbnQuY29tLw#aHR0cHM6Ly9HMTAuZHpwdndvYnIucnUvdkd5c2dQdC8=Get hashmaliciousUnknownBrowse
                            • 92.122.18.57
                            file.exeGet hashmaliciousLummaC, Amadey, Stealc, VidarBrowse
                            • 23.200.88.15
                            https://nam.dcv.ms/WLtyQ3priBGet hashmaliciousHTMLPhisherBrowse
                            • 2.18.121.138
                            V6QED2Q1WBYVOPEGet hashmaliciousUnknownBrowse
                            • 23.195.93.152
                            f5dc5302-022c-8bef-7a8e-e20ea821f59b.emlGet hashmaliciousHTMLPhisherBrowse
                            • 2.19.126.160
                            phish_alert_sp2_2.0.0.0 (7).emlGet hashmaliciousUnknownBrowse
                            • 2.19.126.160

                            JA3 Fingerprints

                            ⊘No context

                            Dropped Files

                            ⊘No context

                            Created / dropped Files

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:ASCII text
                            Category:dropped
                            Size (bytes):294
                            Entropy (8bit):5.190398426321159
                            Encrypted:false
                            SSDEEP:6:HU/VMtDM+q2P92nKuAl9OmbnIFUt8YU/VdSgZmw+YU/VdSDMVkwO92nKuAl9Omb5:IGG+v4HAahFUt8BXX/+BX3V5LHAaSJ
                            MD5:BF827A3BA4C43B9221B0384DDDB7B4D6
                            SHA1:ADE2C7653FA5C5BFDB5EFF494E4611571ECC3712
                            SHA-256:8D4EFABC399FA1C34D15E72767D47DE2BE9BE0C1238ECDB060790FC2741C1DD2
                            SHA-512:C502B1E3E5F2B3619415B1B653B27E14DD8C902972D21609BDFDC9204DEEC2765C0CF5D742A7AA976EB81D0E06A8FF07A36A6BE644FAF038C98112363AF5AFA5
                            Malicious:false
                            Reputation:low
                            Preview:2024/11/19-14:38:59.420 1c1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/19-14:38:59.422 1c1c Recovering log #3.2024/11/19-14:38:59.422 1c1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:ASCII text
                            Category:dropped
                            Size (bytes):294
                            Entropy (8bit):5.190398426321159
                            Encrypted:false
                            SSDEEP:6:HU/VMtDM+q2P92nKuAl9OmbnIFUt8YU/VdSgZmw+YU/VdSDMVkwO92nKuAl9Omb5:IGG+v4HAahFUt8BXX/+BX3V5LHAaSJ
                            MD5:BF827A3BA4C43B9221B0384DDDB7B4D6
                            SHA1:ADE2C7653FA5C5BFDB5EFF494E4611571ECC3712
                            SHA-256:8D4EFABC399FA1C34D15E72767D47DE2BE9BE0C1238ECDB060790FC2741C1DD2
                            SHA-512:C502B1E3E5F2B3619415B1B653B27E14DD8C902972D21609BDFDC9204DEEC2765C0CF5D742A7AA976EB81D0E06A8FF07A36A6BE644FAF038C98112363AF5AFA5
                            Malicious:false
                            Reputation:low
                            Preview:2024/11/19-14:38:59.420 1c1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/19-14:38:59.422 1c1c Recovering log #3.2024/11/19-14:38:59.422 1c1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:ASCII text
                            Category:dropped
                            Size (bytes):338
                            Entropy (8bit):5.2052659690077965
                            Encrypted:false
                            SSDEEP:6:HU/TGM+q2P92nKuAl9Ombzo2jMGIFUt8YU/TxXZmw+YU/TVpMVkwO92nKuAl9OmT:ITGM+v4HAa8uFUt8BTxX/+BTVpMV5LHA
                            MD5:E1ED166E46B3BDE52106D28B80D05DEA
                            SHA1:E75B94DB27F87784D7C71A4CE65F1FEA208764B6
                            SHA-256:D1584D76DC524150B1EF566CEA06C56F3A9CA61BF181DB7396EDABF847F2A589
                            SHA-512:B1C5A83AF0D1B8F07B50D73F5709FC8843DA402A847A244A17F8E755E2446F93B5D30775B7EDD9370935D23285DBC773545AA0DDBF3C589C80EF28F09C885F38
                            Malicious:false
                            Reputation:low
                            Preview:2024/11/19-14:38:59.445 1c8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/11/19-14:38:59.447 1c8c Recovering log #3.2024/11/19-14:38:59.448 1c8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:ASCII text
                            Category:dropped
                            Size (bytes):338
                            Entropy (8bit):5.2052659690077965
                            Encrypted:false
                            SSDEEP:6:HU/TGM+q2P92nKuAl9Ombzo2jMGIFUt8YU/TxXZmw+YU/TVpMVkwO92nKuAl9OmT:ITGM+v4HAa8uFUt8BTxX/+BTVpMV5LHA
                            MD5:E1ED166E46B3BDE52106D28B80D05DEA
                            SHA1:E75B94DB27F87784D7C71A4CE65F1FEA208764B6
                            SHA-256:D1584D76DC524150B1EF566CEA06C56F3A9CA61BF181DB7396EDABF847F2A589
                            SHA-512:B1C5A83AF0D1B8F07B50D73F5709FC8843DA402A847A244A17F8E755E2446F93B5D30775B7EDD9370935D23285DBC773545AA0DDBF3C589C80EF28F09C885F38
                            Malicious:false
                            Reputation:low
                            Preview:2024/11/19-14:38:59.445 1c8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/11/19-14:38:59.447 1c8c Recovering log #3.2024/11/19-14:38:59.448 1c8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):508
                            Entropy (8bit):5.061602859316414
                            Encrypted:false
                            SSDEEP:12:YH/um3RA8sqK7ksBdOg2HpB2caq3QYiubxnP7E4T3OF+:Y2sRds/7JdMHF3QYhbxP7nbI+
                            MD5:6E09B6D7F813CFFBFFFB5B603CF094C6
                            SHA1:E368D6F49165F700A1CAC673020B3B648672EA8B
                            SHA-256:EFE94457A80BD9F7FD629EBE0F73BF2C82E66FC1A1992B5AEE887FD77B13466F
                            SHA-512:723F287C801264A5B6861377C1FF91594B7157641B44AF14ADFF53C307D20046A44E49DADB79A86BFBC3D43EDA5844BD6FE18B38E14405863ECAD578163521B4
                            Malicious:false
                            Reputation:low
                            Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376605152062912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123701},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ad5e8410-3024-42a8-ad15-45f37d047dae.tmp

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:JSON data
                            Category:modified
                            Size (bytes):508
                            Entropy (8bit):5.061602859316414
                            Encrypted:false
                            SSDEEP:12:YH/um3RA8sqK7ksBdOg2HpB2caq3QYiubxnP7E4T3OF+:Y2sRds/7JdMHF3QYhbxP7nbI+
                            MD5:6E09B6D7F813CFFBFFFB5B603CF094C6
                            SHA1:E368D6F49165F700A1CAC673020B3B648672EA8B
                            SHA-256:EFE94457A80BD9F7FD629EBE0F73BF2C82E66FC1A1992B5AEE887FD77B13466F
                            SHA-512:723F287C801264A5B6861377C1FF91594B7157641B44AF14ADFF53C307D20046A44E49DADB79A86BFBC3D43EDA5844BD6FE18B38E14405863ECAD578163521B4
                            Malicious:false
                            Reputation:low
                            Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376605152062912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123701},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):4509
                            Entropy (8bit):5.236418664495832
                            Encrypted:false
                            SSDEEP:96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUPHiA/ZFZ3CAZ:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLa
                            MD5:29346C772949E3150AFFFBABC7409CA9
                            SHA1:8E406254D5D5BF0D29D7C470D9DAF554656E953C
                            SHA-256:905F6F2DE93E12E938C84CC1D598B138167D758E1FE37118145BB3E5CE57BAB2
                            SHA-512:3DB811CF1F38DDF3C9C0F2E716353B9C2D97E30704636E048DB856D73910846E20F39113788D70D9BD1A1033C7929BFA6E5BFDDDB5641D9D7BD5917FC42F4E74
                            Malicious:false
                            Reputation:low
                            Preview:*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:ASCII text
                            Category:dropped
                            Size (bytes):326
                            Entropy (8bit):5.252271465124272
                            Encrypted:false
                            SSDEEP:6:HU/kqM+q2P92nKuAl9OmbzNMxIFUt8YU/+5Zmw+YU/+sMVkwO92nKuAl9OmbzNMT:IDM+v4HAa8jFUt8Bq/+B1MV5LHAa84J
                            MD5:FB414F494CCCC298C1FB253F4A626F1E
                            SHA1:5E969A232C5F15BECA212EA5E951A1503ACBDDD0
                            SHA-256:3DCA9445753163E022A3759E52AC6C1FF8DE7B5E6462986244BF4CF1FCD34BDD
                            SHA-512:A63CFE1790E3B8D083BEF1E2580EF91183F28D4541A8E8407B50E7C0F9A5DFE297D300432821232652A91719C84D132C05B088FFCE5BAB985331ED32B28F3DE7
                            Malicious:false
                            Reputation:low
                            Preview:2024/11/19-14:38:59.761 1c8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/11/19-14:38:59.763 1c8c Recovering log #3.2024/11/19-14:38:59.763 1c8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:ASCII text
                            Category:dropped
                            Size (bytes):326
                            Entropy (8bit):5.252271465124272
                            Encrypted:false
                            SSDEEP:6:HU/kqM+q2P92nKuAl9OmbzNMxIFUt8YU/+5Zmw+YU/+sMVkwO92nKuAl9OmbzNMT:IDM+v4HAa8jFUt8Bq/+B1MV5LHAa84J
                            MD5:FB414F494CCCC298C1FB253F4A626F1E
                            SHA1:5E969A232C5F15BECA212EA5E951A1503ACBDDD0
                            SHA-256:3DCA9445753163E022A3759E52AC6C1FF8DE7B5E6462986244BF4CF1FCD34BDD
                            SHA-512:A63CFE1790E3B8D083BEF1E2580EF91183F28D4541A8E8407B50E7C0F9A5DFE297D300432821232652A91719C84D132C05B088FFCE5BAB985331ED32B28F3DE7
                            Malicious:false
                            Preview:2024/11/19-14:38:59.761 1c8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/11/19-14:38:59.763 1c8c Recovering log #3.2024/11/19-14:38:59.763 1c8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                            C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241119193904Z-171.bmp

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
                            Category:dropped
                            Size (bytes):65110
                            Entropy (8bit):1.3184543741795909
                            Encrypted:false
                            SSDEEP:96:I6MA9IXSNW3KR4J5fM3Sc2MqgYKyg1F4AlPQH:Np99NWrwSSYKffo
                            MD5:893651C6D9EB1B14514A6BC2BCE2C295
                            SHA1:4EE5D3CF2D101E88D062B7D60EAA780A2C618FFC
                            SHA-256:1DE8D9832BDDF537AA017AAECF7A30E635DB307449C33166E94C8D0C984C4E1A
                            SHA-512:BF41016A14C93C4A665008C140B297B813DC49C980B6099285D47D4529FAD86063945F2A1DB97DC076DA158D600CF22B47B4C769A11BBC5A5D9C84054515F2CA
                            Malicious:false
                            Preview:BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:Certificate, Version=3
                            Category:dropped
                            Size (bytes):1391
                            Entropy (8bit):7.705940075877404
                            Encrypted:false
                            SSDEEP:24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
                            MD5:0CD2F9E0DA1773E9ED864DA5E370E74E
                            SHA1:CABD2A79A1076A31F21D253635CB039D4329A5E8
                            SHA-256:96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
                            SHA-512:3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
                            Malicious:false
                            Preview:0..k0..S............@.YDc.c...0...*.H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0...*.H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I.....*.A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.|C.t..t.....0.[q6....00\H..;..}`...).........A.......|.;F.H*..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..|o..;.....'...}~.."......

                            C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                            Category:dropped
                            Size (bytes):71954
                            Entropy (8bit):7.996617769952133
                            Encrypted:true
                            SSDEEP:1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
                            MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
                            SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
                            SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
                            SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
                            Malicious:false
                            Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

                            C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):192
                            Entropy (8bit):2.739999945580075
                            Encrypted:false
                            SSDEEP:3:kkFklcwjNvfllXlE/HT8kvrlXNNX8RolJuRdxLlGB9lQRYwpDdt:kKFemT8m/NMa8RdWBwRd
                            MD5:990E5005C4580D5077177EF453F8F55B
                            SHA1:A8C3B8EAA3B6C1CE1A5F4F6022E334CEDD0A7908
                            SHA-256:B8893FE25503DBC2937B9233350ADCC999DB93E68834A0CD1F81BA714CE0B633
                            SHA-512:F7B6EEFF24D9D5E0660BE527C3B3EC362DCF5049F2068F092962BCC35693281ED0C95DFB2652C1919EF0CC7B534A704F173F1543C5B6AB8D45B939549DA9B322
                            Malicious:false
                            Preview:p...... ......../....:..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

                            C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:data
                            Category:modified
                            Size (bytes):290
                            Entropy (8bit):2.9775254079344555
                            Encrypted:false
                            SSDEEP:6:kKDD9Usw9L+N+SkQlPlEGYRMY9z+4KlDA3RUe/:mD9LNkPlE99SNxAhUe/
                            MD5:544994C380F12CCFCDB1896751345AA8
                            SHA1:FDC16BBC55507600E9D763A6CA3B839C0994F19B
                            SHA-256:A4435FF1DC2E42AAB72F3B4CA4186DE21F00411714BC1DA5D89C6616E47C52C2
                            SHA-512:ADF6BAE113D4140E6A0D7EE3AE1CD583E205D9E0C95A0CF6E3859B5129BC6A2AC12F4BCB9FC358BA26A44A4FE0C28600FD5E0293A3917E6011BB3E9C6855B081
                            Malicious:false
                            Preview:p...... ........\...:..(....................................................... ........G..@.......................h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:PostScript document text
                            Category:dropped
                            Size (bytes):1233
                            Entropy (8bit):5.233980037532449
                            Encrypted:false
                            SSDEEP:24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
                            MD5:8BA9D8BEBA42C23A5DB405994B54903F
                            SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
                            SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
                            SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
                            Malicious:false
                            Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4564

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:PostScript document text
                            Category:dropped
                            Size (bytes):1233
                            Entropy (8bit):5.233980037532449
                            Encrypted:false
                            SSDEEP:24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
                            MD5:8BA9D8BEBA42C23A5DB405994B54903F
                            SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
                            SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
                            SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
                            Malicious:false
                            Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:PostScript document text
                            Category:dropped
                            Size (bytes):1233
                            Entropy (8bit):5.233980037532449
                            Encrypted:false
                            SSDEEP:24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
                            MD5:8BA9D8BEBA42C23A5DB405994B54903F
                            SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
                            SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
                            SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
                            Malicious:false
                            Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:PostScript document text
                            Category:dropped
                            Size (bytes):10880
                            Entropy (8bit):5.214360287289079
                            Encrypted:false
                            SSDEEP:192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
                            MD5:B60EE534029885BD6DECA42D1263BDC0
                            SHA1:4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
                            SHA-256:B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
                            SHA-512:52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
                            Malicious:false
                            Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4564

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:PostScript document text
                            Category:dropped
                            Size (bytes):10880
                            Entropy (8bit):5.214360287289079
                            Encrypted:false
                            SSDEEP:192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
                            MD5:B60EE534029885BD6DECA42D1263BDC0
                            SHA1:4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
                            SHA-256:B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
                            SHA-512:52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
                            Malicious:false
                            Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):227002
                            Entropy (8bit):3.392780893644728
                            Encrypted:false
                            SSDEEP:1536:WKPC4iyzDtrh1cK3XEivK7VK/3AYvYwgF/rRoL+sn:DPCaJ/3AYvYwglFoL+sn
                            MD5:87EDBEE38F56C20298F25D5D3D4D1B5C
                            SHA1:7F904E9615AC3186A87472EF366DD8202855B0B7
                            SHA-256:A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
                            SHA-512:BBEBC1FCD5BC9AE042DD5782425BA8C47BF3EAC283B2487FC4E3FF6BF8101306DAB081E5135594165D4DC1AC120FF125AADBC5B3FFE7C646183C04DF77865E0D
                            Malicious:false
                            Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):295
                            Entropy (8bit):5.281598521702584
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HXB6aCnx+FIbRI6XVW7+0YzJHKoAvJM3g98kUwPeUkwRe9:YvXKXBonUYpW7KJZGMbLUkee9
                            MD5:8D3B7C8C8486548628DD92CD54023EEC
                            SHA1:1EFFD9CB39D0194635707EE6F7D1C9A8AA18ACD0
                            SHA-256:335624B0A5B97F9A8C2FA2AD131C5E3E2A353F332405CBE94F22ACB1DB4CE031
                            SHA-512:B7F953351D7B0428CCBCF067E1025D9EB3164728E96127488E2F63F1432F2298CEF7B86CA81FAD90D26805E5185547DE76E4D4312C4B17804C11B662354CF561
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"60d6daca-d3e2-401e-b35c-d6cbe6deaa0d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1732223391345,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):294
                            Entropy (8bit):5.217898803517534
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HXB6aCnx+FIbRI6XVW7+0YzJHKoAvJfBoTfXpnrPeUkwRe9:YvXKXBonUYpW7KJZGWTfXcUkee9
                            MD5:BB5526E2CCEAA690D01716FFB46F79C4
                            SHA1:BBFC3FFF6A616F46C00EDC2E274C9D199A3787F8
                            SHA-256:E5A31B61AC7A44246FB3B026164EEE98E4CFCF6A412F5BC7C382A8CA640DAB1C
                            SHA-512:FF1AEA21B100365B5A5E89E509F3E21B2C59B1B90C2457AE82A9C52B73D8EC14F7691EEF5B6130A19CD3816F27B05E902B8B800C8A3EEFFFCD08FAE3C6E8331A
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"60d6daca-d3e2-401e-b35c-d6cbe6deaa0d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1732223391345,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):294
                            Entropy (8bit):5.196568865941758
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HXB6aCnx+FIbRI6XVW7+0YzJHKoAvJfBD2G6UpnrPeUkwRe9:YvXKXBonUYpW7KJZGR22cUkee9
                            MD5:3864B6619C1ABA494D61C405A7289009
                            SHA1:6630AE5CE6B306D3E6EA1867D684CF5A1E6197EB
                            SHA-256:41841CC57A75245A9EC74ED1ED7F7F7DC15158727E4976EEC61A8392FED7A1B9
                            SHA-512:D3F0DF1BE665F3314282CBB0036910C99DA26BFF4DB4E6CD96D725CCA09DD016707CB9DF141B3A11EF3B3796B78013CF47DA0A7FB3A88445CE08876B8BDDE3C8
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"60d6daca-d3e2-401e-b35c-d6cbe6deaa0d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1732223391345,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):285
                            Entropy (8bit):5.2576224567384635
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HXB6aCnx+FIbRI6XVW7+0YzJHKoAvJfPmwrPeUkwRe9:YvXKXBonUYpW7KJZGH56Ukee9
                            MD5:3F0D8471F993776B75A59F61BFF1386F
                            SHA1:6050E67001DFD973DA05DAB26CBBF45851B2E36B
                            SHA-256:4DCB4DA6184A430CEFAEDBFC968C2597A187D814C6C1078E5FD7F590F5F9D237
                            SHA-512:6B3F534749F8F28D49AE1BD63B116A9E2833511513BAA47510D21533325D4DD632F3E68C5B6577CCF4A42D5EE818EEE58ECE8A071689707443EC9AD4B3267DAA
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"60d6daca-d3e2-401e-b35c-d6cbe6deaa0d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1732223391345,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):1123
                            Entropy (8bit):5.669560705194153
                            Encrypted:false
                            SSDEEP:24:Yv6XBQijpLgE9cQx8LennAvzBvkn0RCmK8czOCCS9K1:YvEHjhgy6SAFv5Ah8cv/G
                            MD5:58C973DD3B389AF73B6DD7B71E453495
                            SHA1:292130558A0A58E6B7089B1138D4CCF8CE275556
                            SHA-256:2C96B7FCA399B1DFBAFA2C3C7079C602E88276B7F6A3DCFE02C1549952F894B5
                            SHA-512:17EB815E9C65238A4468A4B28BD2D169DF88A8F5B71FCE393471805726F52935E6746ECB4C513B05297E334B761B81A94CF6DF99A543869AE6E64F4D71A3466D
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"60d6daca-d3e2-401e-b35c-d6cbe6deaa0d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1732223391345,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):1122
                            Entropy (8bit):5.660993760986116
                            Encrypted:false
                            SSDEEP:24:Yv6XBQi/VLgEwcp06ybnAvz7xHn0RCmK8czOCYHfl8zdBqK1:YvEH/FgSNycJUAh8cvYHM
                            MD5:9E9F558A15732350453CC01C0318877B
                            SHA1:FEC0E4DE75BA8A35F3DC656F851FAAA68B9A0813
                            SHA-256:52C7023E4DF3A868412374943E193FAB587A90A7AE995A9A2CF60E1F55F4DD37
                            SHA-512:BF9C52F24C5623FF709EBEFBEB2642303F1A84280214BB593E7AC5D0ADCF242CE4DED3B04C4EF3991AFBF4D39E13CAFA37A6E440BF8CAEC3F8373AA04835C71C
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"60d6daca-d3e2-401e-b35c-d6cbe6deaa0d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1732223391345,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93181_288855ActionBlock_0","campaignId":93181,"containerId":"1","controlGroupId":"","treatmentId":"1aad653c-ef44-43f7-be1c-3a2ba2cf2cfc","variationId":"288855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuIFBERiBmb3JtcyAmIGFncmVlbWVudHMuIn0sInRjY

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):292
                            Entropy (8bit):5.1982152372189905
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HXB6aCnx+FIbRI6XVW7+0YzJHKoAvJfQ1rPeUkwRe9:YvXKXBonUYpW7KJZGY16Ukee9
                            MD5:E3904C71D204B388F18DCDB18762CDF4
                            SHA1:B4212B4BF18F24CB99649ABDEA15C9C595A0370F
                            SHA-256:5169BFFB5FE3D513157386D56A9597AEB554F14716C2F515E23AD1FADEEF4564
                            SHA-512:565F96D53519DDA449AF1CE47DB7082260B4C1785863469AA6737B7D84CE2DF53093C7D0E66ABFFD3DB26B5902C4CE42B241839806F09F649EE9775758F5226D
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"60d6daca-d3e2-401e-b35c-d6cbe6deaa0d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1732223391345,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):1102
                            Entropy (8bit):5.6575420945717925
                            Encrypted:false
                            SSDEEP:24:Yv6XBQiO2LgErcXWl7y0nAvzIBcSJCBViVqK1:YvEHOogH47yfkB5kVG
                            MD5:6572A686C43A0AAEB06BBA3A47F871C1
                            SHA1:75127EFC16175ED1C09EED7737FA89DA6751C000
                            SHA-256:565FACD8BEDF31220BC72357C70650ED8368B6EF16A57986AE0272E9D8F9E7CF
                            SHA-512:F3760BBC44E04E58EE15A5A162DDABDC20E86CC882B150AB4347E180AF1CD064C19EE34FE1581B4A1E3ED59177A88E06882E3CBF05A367629FEE8B7674BA811B
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"60d6daca-d3e2-401e-b35c-d6cbe6deaa0d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1732223391345,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93181_288855ActionBlock_1","campaignId":93181,"containerId":"1","controlGroupId":"","treatmentId":"533ab5eb-b236-4889-89a5-ac002261d71e","variationId":"288855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkVkaXRQREZSZHJBcHBGdWxsIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTRweCIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTJweCIsImZvbnRfc3R5bGUiOiItMSJ9LCJ0aXRsZSI6bnVsbCwiZGVzY3JpcHRpb24iOiJFZGl0IHRleHQsIGltYWdlcywgcGFnZXMsIGFuZCBtb3JlLiJ9LCJ0Y2F0SWQiOm51bGx9","da

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):1164
                            Entropy (8bit):5.6808166104706235
                            Encrypted:false
                            SSDEEP:24:Yv6XBQiCKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK5qK1:YvEHCEgqprtrS5OZjSlwTmAfSKV
                            MD5:742D73A0513F623D9D621A1F990B6D79
                            SHA1:0D7856E826CC18D96A50CA1265E54D12FE8F1C10
                            SHA-256:E6122B80D5B58C1A169A5D134FD14E974CFAE50D018517B49BFCC9B27EC635BA
                            SHA-512:6B789A7D3FFBAAC6C0AA57D3B06038FE24AE5026EA41ECCE2D33FB4E4866C8472E50868A62F2C32782C3C0DBE0110256B416DE049348EFF8938D0A83C2ECE20C
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"60d6daca-d3e2-401e-b35c-d6cbe6deaa0d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1732223391345,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):289
                            Entropy (8bit):5.204030469343586
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HXB6aCnx+FIbRI6XVW7+0YzJHKoAvJfYdPeUkwRe9:YvXKXBonUYpW7KJZGg8Ukee9
                            MD5:21660A2CC148D59C52E9B3FDA0ACB47B
                            SHA1:D612FB69F84F3D4ABD49845A3707F8D1531E8AFC
                            SHA-256:FD8EA0DBBDE4A42460A37CAC9FC28D4559B5593893B89240E5DC87DDB4E8EB65
                            SHA-512:DCCD6C3A84CCB974D744647E66C83A69AAE79E512BF6A7BE93E1C5838BB3ED52B390BF32434307560C42C47FA5B68E127D5241A457CC11E938F281D0E6B9E44B
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"60d6daca-d3e2-401e-b35c-d6cbe6deaa0d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1732223391345,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):284
                            Entropy (8bit):5.189240078743155
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HXB6aCnx+FIbRI6XVW7+0YzJHKoAvJf+dPeUkwRe9:YvXKXBonUYpW7KJZG28Ukee9
                            MD5:1C9703372F384EB90EC52BAC1CE4D4D3
                            SHA1:6AA7D1CB577A501F38E329E4F1DCB5045536F8FC
                            SHA-256:0F9A5DFA89A1FDF36AFD956C323550935009335ED60C4B5FCE8842EFC09AF2E0
                            SHA-512:BE0405063DBC525177E9DB04A02875570EF34FBD9B170463434B960D866D18087AB439C08BD0346701AC92DAE6D11DDB63EE1382161AA32AFE2FE33EE7B6D4D4
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"60d6daca-d3e2-401e-b35c-d6cbe6deaa0d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1732223391345,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):291
                            Entropy (8bit):5.188237151420587
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HXB6aCnx+FIbRI6XVW7+0YzJHKoAvJfbPtdPeUkwRe9:YvXKXBonUYpW7KJZGDV8Ukee9
                            MD5:02D3F6CCE329A50B86C24AFE1AE65586
                            SHA1:CC9F64BA9749B713D3EC2ECD973D36497DB5A5F6
                            SHA-256:AFB947FBD796CD2CB7692D75ED9496E9689331D2403CD115BCC8C7B8F2C6DCBC
                            SHA-512:6CD7DA7324B8EA9D705B10758EA42D29970041C31D894E28FF6A9AE3FD653BD8F9FA1441D3B3AFA3E163E8BC0E7EDA4E7191994300D60C65DB396755B565F363
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"60d6daca-d3e2-401e-b35c-d6cbe6deaa0d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1732223391345,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):287
                            Entropy (8bit):5.1891572858370365
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HXB6aCnx+FIbRI6XVW7+0YzJHKoAvJf21rPeUkwRe9:YvXKXBonUYpW7KJZG+16Ukee9
                            MD5:C72A963E6C2F93D51A92DA7C4E39E219
                            SHA1:81EE533BB06B89AEFBE0333DB369EDF0E96FF8C6
                            SHA-256:2C6A81BEE27887A5E45BAAA03421C6E3219DF5526C3BA9C8B6A4625D0164CE9C
                            SHA-512:99852133644E6FDED82039CD47C162A42B8090BBD1FADF7E1F55094FB8BAB366A3B4832FDA314549E886281866195F37CFBFA3D272CA05B43CC537BE8344E685
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"60d6daca-d3e2-401e-b35c-d6cbe6deaa0d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1732223391345,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):1090
                            Entropy (8bit):5.637268095164837
                            Encrypted:false
                            SSDEEP:24:Yv6XBQiTamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS9K1:YvEHDBgkDMUJUAh8cvMG
                            MD5:B689C8DCFA0BBEEE0B42EEDC3EC889CB
                            SHA1:BC2EBC9545BB673CD9D2BF8E3F7A26F18E432744
                            SHA-256:DB28D3C4BFBB0BF030FD6A8EA9876E5A2B97E291B43099B54EC2BBFC6EEFAFCE
                            SHA-512:B72B3A67FB1D5B33B70275CE652B97077E6F578697190C13905C4F1DFBA29544B59B12BC008FC4246DCF213074FC204B9267A795FCD458B352ECEF258C93F5F7
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"60d6daca-d3e2-401e-b35c-d6cbe6deaa0d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1732223391345,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):286
                            Entropy (8bit):5.160643723647889
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HXB6aCnx+FIbRI6XVW7+0YzJHKoAvJfshHHrPeUkwRe9:YvXKXBonUYpW7KJZGUUUkee9
                            MD5:0968337BBAD44E2C5114B4234D66C1B4
                            SHA1:2A9C9602DA5E0972DC655ED8860920BEC8D102CD
                            SHA-256:C82D5587F4B396AB4711DFABACEFCCCACA20F81312C9ADBFB55972FDD2CAA506
                            SHA-512:8B13C9C873BC6DF0AAB4897ABBF86A1256BB42D577C38787FDA56302408DDFBFC7A3B612CC425500DF7BAC1A8E7C2AB50EA08769E6E5B8A6F6F0DAD01C7FE742
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"60d6daca-d3e2-401e-b35c-d6cbe6deaa0d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1732223391345,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):782
                            Entropy (8bit):5.342526650439071
                            Encrypted:false
                            SSDEEP:12:YvXKXBonUYpW7KJZGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWmK1:Yv6XBQiQ168CgEXX5kcIfANh9K1
                            MD5:298E67B69E54DF9F9F77F56D35CB2F6D
                            SHA1:A0FF6986ED9A97619A3C9FE32C263BBB6EB55120
                            SHA-256:8CD29BA7BC1EA1923EC231E7364B2D48C4316793E2820664CC96A6DFFC3541EC
                            SHA-512:24F7F85394DDC303A3E37624F25C9C1473157FA5A5748079802A296A950E4E727AA18CA20F792F16FF257D69D32EC4A0807F9235E7FDFBE1CDB04F809EAFD26A
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"60d6daca-d3e2-401e-b35c-d6cbe6deaa0d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1732223391345,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1732045146375}}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):4
                            Entropy (8bit):0.8112781244591328
                            Encrypted:false
                            SSDEEP:3:e:e
                            MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                            SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                            SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                            SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                            Malicious:false
                            Preview:....

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):2817
                            Entropy (8bit):5.13230050074588
                            Encrypted:false
                            SSDEEP:24:Yv/lv6+e6c9aGUayoSnaxaOCP6Vm6AgS3MGrRiDikujU4j0Sa8ob7PFPp2jvf2Ld:Y3FeHrXCkmjg2SaU6ab7zOXpe/Q+h9f
                            MD5:094B8C79DE0D064E820756C0DAF4DFD2
                            SHA1:3966F34B3D208E9203CBE6C4FE60C88EEB2862EC
                            SHA-256:516956E9353BEF034ADDC2FC76D2019A2CFB3EDEFFF337617E509C3F69BD487D
                            SHA-512:AB905D99A3938D97F68C585E9D5888E710CB349A15B09404412A31068EC4306F4EC3D4AE5E3AA15D53C6A9DDFA626975256EECE80562F12B55AA99979044E17F
                            Malicious:false
                            Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"8804a8cac6c565ca9bd0018705a0a259","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1122,"ts":1732045145000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"68cabdc5e614794dd1e67159779cb259","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1732045145000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"23049d1b46c9852d92ae5d2220bca6fd","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1732045145000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"239487fe1b2e6ec0f1aab52739634f9a","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1732045145000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"d40251983a47dcadf6671dc2ea411289","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1102,"ts":1732045145000},{"id":"Edit_InApp_Aug2020","info":{"dg":"5dbf8be808988372c61e60fd953a3bf7","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":17

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
                            Category:dropped
                            Size (bytes):12288
                            Entropy (8bit):0.9861900034211576
                            Encrypted:false
                            SSDEEP:24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Spxmn4zJwtNBwtNbRZ6bRZ4CmnF:TVl2GL7ms6ggOVpxDzutYtp6PP8
                            MD5:98A644EC9E26E16D67CA57B03B2D6648
                            SHA1:1652D6C825FF853C31C9F14D85AFFD7285200827
                            SHA-256:F201B1EC08E1957AD6F89623925E0F4B9D051A237B087E804B28AE8406BAF184
                            SHA-512:ED20FB2EF6230AB52C33477F615A1B3B9BC184FB322DC3A622C110BDCF458B254254CE9F37267AEF533A67F191F4C284E6D9291B708A6EC2A6E6ABB77D853418
                            Malicious:false
                            Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:SQLite Rollback Journal
                            Category:dropped
                            Size (bytes):8720
                            Entropy (8bit):1.3412258338058918
                            Encrypted:false
                            SSDEEP:24:7+tnAD1RZKHs/Ds/SpxmnPzJwtNBwtNbRZ6bRZWf1RZKRqLBx/XYKQvGJF7ursk:7MnGgOVpx8zutYtp6PMoqll2GL7msk
                            MD5:4DA0DA02C80AAAEB570D4D7B6FE79034
                            SHA1:3955EFC646E9567CFE5E2F655D7BF67FEA38722C
                            SHA-256:EBBFB1515BFB1FD939E6DDCD0D79A6B1AFF3BC458085E3A8BD02F70A6911BD61
                            SHA-512:1E8D1145646DB128E83D5CEC3D285D23319B913AE5E6E30046FF29DEC61915965D4A06AB184F65FA4AD2153C0542B02883C0E0EA8CFE711EFF6E4E90B9E594D7
                            Malicious:false
                            Preview:.... .c......w\^......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):66726
                            Entropy (8bit):5.392739213842091
                            Encrypted:false
                            SSDEEP:768:RNOpblrU6TBH44ADKZEgFyxvwr06ufZTcblrAZbSaXI17QotYyu:6a6TZ44ADEFyxJ6ufObi5IrK
                            MD5:C61434893A0D16238A6D7C3565C5C3BC
                            SHA1:44248939A3452930FA3D233EC6487B49CE3304E8
                            SHA-256:DEFB55E28D6303ABF4E05F0FB8BEFD04B970963397BAB077B8AE075512973942
                            SHA-512:19E741621FFA1110F35D90D9B51147BA68FFDA95B8618A8E7EF60C29BD3F00423BEECFCD9693F39AAE576CAD15CEECF6D583446756F77D336F4EC3F15D59AC05
                            Malicious:false
                            Preview:4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

                            C:\Users\user\AppData\Local\Temp\MSI7c9ff.LOG

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):246
                            Entropy (8bit):3.516674370985874
                            Encrypted:false
                            SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8mUl8vR4l:Qw946cPbiOxDlbYnuRK4l
                            MD5:B3828CA8D3B8709BCB817113BF2EA9F5
                            SHA1:034C5DCB01CC6D1CF4CAFEF571278B7AEAEE2BD6
                            SHA-256:FFB547A60AF14E423731AF8428138C94A8A320E1F3243F1456FA850CB319F6F0
                            SHA-512:4179A47762EB770998CFE55398E5756268B13B5F6D0A2C5FF3DE73790F7871F62AD767A54C9A1A8BF18703BCC2F04BDD745EAC4071E6B01A97DC4461CAC31C89
                            Malicious:false
                            Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.9./.1.1./.2.0.2.4. . .1.4.:.3.9.:.0.7. .=.=.=.....

                            C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-19 14-39-01-679.log

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:ASCII text, with very long lines (393)
                            Category:dropped
                            Size (bytes):16525
                            Entropy (8bit):5.376360055978702
                            Encrypted:false
                            SSDEEP:384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
                            MD5:1336667A75083BF81E2632FABAA88B67
                            SHA1:46E40800B27D95DAED0DBB830E0D0BA85C031D40
                            SHA-256:F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
                            SHA-512:D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
                            Malicious:false
                            Preview:SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

                            C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:ASCII text, with very long lines (393), with CRLF line terminators
                            Category:dropped
                            Size (bytes):15114
                            Entropy (8bit):5.358872844758653
                            Encrypted:false
                            SSDEEP:384:me4Twehx8ZZHIG5U4mY5FINt3I+muS2W3EYsCmyz6sSXtBOSINq4wJwo5bBhrKqG:E+P
                            MD5:3D86DC3B148C4E3F525FA7C963AAFEB3
                            SHA1:60EEA6144A4785891D159A34409D31E89CD7882C
                            SHA-256:D559DFC5B269681CD8F6E63D77AD0D2CA0F28EC1167D994D8A225523DE0ACE4D
                            SHA-512:BE27763C07E6F6A37A988E2C11941D17544DAF40DAB72723B4C6155E594DB4EF2E4D9C6E8BE44BEB77B06ED659D8284CFF791C7D58FFCF1F47E5EAB663C57EA9
                            Malicious:false
                            Preview:SessionID=d9e2cffc-44d9-4243-b268-b2ddc29cbd9b.1732045141703 Timestamp=2024-11-19T14:39:01:703-0500 ThreadID=2848 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=d9e2cffc-44d9-4243-b268-b2ddc29cbd9b.1732045141703 Timestamp=2024-11-19T14:39:01:704-0500 ThreadID=2848 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=d9e2cffc-44d9-4243-b268-b2ddc29cbd9b.1732045141703 Timestamp=2024-11-19T14:39:01:704-0500 ThreadID=2848 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=d9e2cffc-44d9-4243-b268-b2ddc29cbd9b.1732045141703 Timestamp=2024-11-19T14:39:01:704-0500 ThreadID=2848 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=d9e2cffc-44d9-4243-b268-b2ddc29cbd9b.1732045141703 Timestamp=2024-11-19T14:39:01:704-0500 ThreadID=2848 Component=ngl-lib_NglAppLib Description="SetConf

                            C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):29752
                            Entropy (8bit):5.400405556758583
                            Encrypted:false
                            SSDEEP:768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbV:4z0
                            MD5:F1E46BB897C2B33A092DC4AB9C7E6EC7
                            SHA1:FA816433A059FF5412B395231E39BBE1DFC390A2
                            SHA-256:11F6495FEBD11D98D9A6EFACCAC41C8FAE6F91537F1C5000354288EE3C84C26E
                            SHA-512:53D51715541D032A5F360492B8D68E1FD06ECAF606071EC5AEDE303A68BF37DA6C139E468F674744B07F71C54EB305D12FD2D6B076DBEBC6889C7BD88FF0A314
                            Malicious:false
                            Preview:04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

                            C:\Users\user\AppData\Local\Temp\acrocef_low\15984eb7-c458-4be4-868b-eaedb537f09a.tmp

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                            Category:dropped
                            Size (bytes):386528
                            Entropy (8bit):7.9736851559892425
                            Encrypted:false
                            SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                            MD5:5C48B0AD2FEF800949466AE872E1F1E2
                            SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                            SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                            SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                            Malicious:false
                            Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                            C:\Users\user\AppData\Local\Temp\acrocef_low\2ab1a692-a1e9-4b5f-949b-2cad9ee8fa2e.tmp

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                            Category:dropped
                            Size (bytes):1407294
                            Entropy (8bit):7.97605879016224
                            Encrypted:false
                            SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
                            MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
                            SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
                            SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
                            SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
                            Malicious:false
                            Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                            C:\Users\user\AppData\Local\Temp\acrocef_low\7eefb852-2dce-475d-9ea2-b58d3d3251a0.tmp

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                            Category:dropped
                            Size (bytes):758601
                            Entropy (8bit):7.98639316555857
                            Encrypted:false
                            SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                            MD5:3A49135134665364308390AC398006F1
                            SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                            SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                            SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                            Malicious:false
                            Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                            C:\Users\user\AppData\Local\Temp\acrocef_low\db3a378e-55ca-41c5-95c7-e7adb6ab5d17.tmp

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                            Category:dropped
                            Size (bytes):1419751
                            Entropy (8bit):7.976496077007677
                            Encrypted:false
                            SSDEEP:24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
                            MD5:CA6B0D9F8DDC295DACE8157B69CA7CF6
                            SHA1:6299B4A49AB28786E7BF75E1481D8011E6022AF4
                            SHA-256:A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
                            SHA-512:9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
                            Malicious:false
                            Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                            Static File Info

                            General

                            File type:PDF document, version 1.5, 2 pages (zip deflate encoded)
                            Entropy (8bit):7.940902653829558
                            TrID:
                            • Adobe Portable Document Format (5005/1) 100.00%
                            File name:CJ-241115826_CJ_430448_OE_BMSCAD.pdf
                            File size:20'159 bytes
                            MD5:8b7dcee56b4a8a1c85180efd916f4057
                            SHA1:2a11fc0fec727b5293a87e7e47550178a748ce7a
                            SHA256:c3c590c7beb7883610edc82c7fa47d09e1ba7b9251d9745da14582ca440ccefb
                            SHA512:df0fb99380783c4a86065e9854142b8169a538b9a6d93eb85e0ddad08430ccb2b798fd6d06ccdb4d45ae782cf310e0451a1171d0417ef7d8f8fff871ab932438
                            SSDEEP:384:D84gyhZz9WYWVxQxIe7Ox4YYe9CplRd925TilLVpHrYrUtnq:9gyv9XAVe7Y4fuCp7dYsVJMz
                            TLSH:C792DF4FEEE74828D225753939003555193E395CD6EA36824A1B0F98B0E0FC82B83BF7
                            File Content Preview:%PDF-1.5.%.....4 0 obj.<</ColorSpace[/Indexed/DeviceRGB 15(.........fff333.................................)]/Subtype/Image/Height 284/Filter/FlateDecode/Type/XObject/Width 734/Length 5512/BitsPerComponent 4>>stream.x...M{.....N.NR.....q....'6...r,..f....

                            File Icon

                            Icon Hash:62cc8caeb29e8ae0

                            Static PDF Info

                            General

                            Header:%PDF-1.5
                            Total Entropy:7.940903
                            Total Bytes:20159
                            Stream Entropy:7.984447
                            Stream Bytes:18080
                            Entropy outside Streams:5.373938
                            Bytes outside Streams:2079
                            Number of EOF found:1
                            Bytes after EOF:

                            Keywords Statistics

                            NameCount
                            obj14
                            endobj14
                            stream3
                            endstream3
                            xref1
                            trailer1
                            startxref1
                            /Page2
                            /Encrypt0
                            /ObjStm0
                            /URI0
                            /JS0
                            /JavaScript0
                            /AA0
                            /OpenAction0
                            /AcroForm0
                            /JBIG2Decode0
                            /RichMedia0
                            /Launch0
                            /EmbeddedFile0

                            Network Behavior

                            Network Port Distribution

                            TCP Packets

                            TimestampSource PortDest PortSource IPDest IP
                            Nov 19, 2024 20:39:13.132625103 CET49733443192.168.2.523.203.104.175
                            Nov 19, 2024 20:39:13.132725954 CET4434973323.203.104.175192.168.2.5
                            Nov 19, 2024 20:39:13.132814884 CET49733443192.168.2.523.203.104.175
                            Nov 19, 2024 20:39:13.132975101 CET49733443192.168.2.523.203.104.175
                            Nov 19, 2024 20:39:13.133008003 CET4434973323.203.104.175192.168.2.5
                            Nov 19, 2024 20:39:13.690857887 CET4434973323.203.104.175192.168.2.5
                            Nov 19, 2024 20:39:13.691144943 CET49733443192.168.2.523.203.104.175
                            Nov 19, 2024 20:39:13.691190004 CET4434973323.203.104.175192.168.2.5
                            Nov 19, 2024 20:39:13.692399979 CET4434973323.203.104.175192.168.2.5
                            Nov 19, 2024 20:39:13.692482948 CET49733443192.168.2.523.203.104.175
                            Nov 19, 2024 20:39:13.719398022 CET49733443192.168.2.523.203.104.175
                            Nov 19, 2024 20:39:13.719552040 CET4434973323.203.104.175192.168.2.5
                            Nov 19, 2024 20:39:13.719594002 CET49733443192.168.2.523.203.104.175
                            Nov 19, 2024 20:39:13.767333984 CET4434973323.203.104.175192.168.2.5
                            Nov 19, 2024 20:39:13.771526098 CET49733443192.168.2.523.203.104.175
                            Nov 19, 2024 20:39:13.771550894 CET4434973323.203.104.175192.168.2.5
                            Nov 19, 2024 20:39:13.817651987 CET4434973323.203.104.175192.168.2.5
                            Nov 19, 2024 20:39:13.817754030 CET49733443192.168.2.523.203.104.175
                            Nov 19, 2024 20:39:13.818217993 CET49733443192.168.2.523.203.104.175
                            Nov 19, 2024 20:39:13.818238974 CET4434973323.203.104.175192.168.2.5

                            UDP Packets

                            TimestampSource PortDest PortSource IPDest IP
                            Nov 19, 2024 20:39:12.671195984 CET5537453192.168.2.51.1.1.1
                            Nov 19, 2024 20:39:26.649657965 CET6372553192.168.2.51.1.1.1

                            DNS Queries

                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                            Nov 19, 2024 20:39:12.671195984 CET192.168.2.51.1.1.10x6cc9Standard query (0)x1.i.lencr.orgA (IP address)IN (0x0001)false
                            Nov 19, 2024 20:39:26.649657965 CET192.168.2.51.1.1.10xb06fStandard query (0)x1.i.lencr.orgA (IP address)IN (0x0001)false

                            DNS Answers

                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                            Nov 19, 2024 20:39:10.488892078 CET1.1.1.1192.168.2.50x218eNo error (0)windowsupdatebg.s.llnwi.net87.248.205.0A (IP address)IN (0x0001)false
                            Nov 19, 2024 20:39:12.679743052 CET1.1.1.1192.168.2.50x6cc9No error (0)x1.i.lencr.orgcrl.root-x1.letsencrypt.org.edgekey.netCNAME (Canonical name)IN (0x0001)false
                            Nov 19, 2024 20:39:26.657202959 CET1.1.1.1192.168.2.50xb06fNo error (0)x1.i.lencr.orgcrl.root-x1.letsencrypt.org.edgekey.netCNAME (Canonical name)IN (0x0001)false

                            HTTP Request Dependency Graph

                            • armmf.adobe.com

                            HTTPS Proxied Packets

                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            0192.168.2.54973323.203.104.1754437248C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            TimestampBytes transferredDirectionData
                            2024-11-19 19:39:13 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
                            Host: armmf.adobe.com
                            Connection: keep-alive
                            Accept-Language: en-US,en;q=0.9
                            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
                            Sec-Fetch-Site: same-origin
                            Sec-Fetch-Mode: no-cors
                            Sec-Fetch-Dest: empty
                            Accept-Encoding: gzip, deflate, br
                            If-None-Match: "78-5faa31cce96da"
                            If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
                            2024-11-19 19:39:13 UTC198INHTTP/1.1 304 Not Modified
                            Content-Type: text/plain; charset=UTF-8
                            Last-Modified: Mon, 01 May 2023 15:02:33 GMT
                            ETag: "78-5faa31cce96da"
                            Date: Tue, 19 Nov 2024 19:39:13 GMT
                            Connection: close


                            Statistics

                            CPU Usage

                            Click to jump to process

                            Memory Usage

                            Click to jump to process

                            High Level Behavior Distribution

                            Click to dive into process behavior distribution

                            Behavior

                            Click to jump to process

                            System Behavior

                            General

                            Target ID:0
                            Start time:14:38:58
                            Start date:19/11/2024
                            Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            Wow64 process (32bit):false
                            Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\CJ-241115826_CJ_430448_OE_BMSCAD.pdf"
                            Imagebase:0x7ff686a00000
                            File size:5'641'176 bytes
                            MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true

                            General

                            Target ID:2
                            Start time:14:38:59
                            Start date:19/11/2024
                            Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            Wow64 process (32bit):false
                            Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                            Imagebase:0x7ff6413e0000
                            File size:3'581'912 bytes
                            MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true

                            General

                            Target ID:4
                            Start time:14:38:59
                            Start date:19/11/2024
                            Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            Wow64 process (32bit):false
                            Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1676,i,1745309769064675600,3028205725165205519,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                            Imagebase:0x7ff6413e0000
                            File size:3'581'912 bytes
                            MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true

                            Disassembly

                            ⊘No disassembly