Joe Sandbox Cloud Basic Analysis Report
Edit tour

Windows Analysis Report
Knight Law Group ACH Information.pdf

Overview

General Information

Sample name:Knight Law Group ACH Information.pdf
Analysis ID:1676577
MD5:e3eadc211a1c5c2c9dd5645a36556dd4
SHA1:09df07cca21c3d28fc3423b2d284e0372e0086cc
SHA256:9bb15ceba006f4987825ce90cb3e8b9747af812ba05233641db7078894a43be9
Infos:

Detection

Score:2
Range:0 - 100
Confidence:60%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 3180 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Knight Law Group ACH Information.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 5460 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 1240 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1728 --field-trial-handle=1600,i,8750823394921883741,16636045827587014535,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

  • • Software Vulnerabilities
  • • Networking
  • • System Summary
  • • Hooking and other Techniques for Hiding and Protection

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficDNS query: name: c.pki.goog
Source: global trafficTCP traffic: 192.168.2.5:49697 -> 23.202.56.131:443
Source: global trafficTCP traffic: 192.168.2.5:49697 -> 23.202.56.131:443
Source: global trafficTCP traffic: 192.168.2.5:49697 -> 23.202.56.131:443
Source: global trafficTCP traffic: 192.168.2.5:49697 -> 23.202.56.131:443
Source: global trafficTCP traffic: 192.168.2.5:49697 -> 23.202.56.131:443
Source: global trafficTCP traffic: 192.168.2.5:49697 -> 23.202.56.131:443
Source: global trafficTCP traffic: 192.168.2.5:49697 -> 23.202.56.131:443
Source: global trafficTCP traffic: 192.168.2.5:49697 -> 23.202.56.131:443
Source: global trafficTCP traffic: 192.168.2.5:49697 -> 23.202.56.131:443
Source: global trafficTCP traffic: 192.168.2.5:49697 -> 23.202.56.131:443
Source: global trafficTCP traffic: 192.168.2.5:49697 -> 23.202.56.131:443
Source: global trafficTCP traffic: 192.168.2.5:49697 -> 23.202.56.131:443
Source: global trafficTCP traffic: 192.168.2.5:49697 -> 23.202.56.131:443
Source: global trafficTCP traffic: 23.202.56.131:443 -> 192.168.2.5:49697
Source: global trafficTCP traffic: 192.168.2.5:49697 -> 23.202.56.131:443
Source: global trafficTCP traffic: 192.168.2.5:49697 -> 23.202.56.131:443
Source: global trafficTCP traffic: 23.202.56.131:443 -> 192.168.2.5:49697
Source: global trafficTCP traffic: 23.202.56.131:443 -> 192.168.2.5:49697
Source: global trafficTCP traffic: 192.168.2.5:49697 -> 23.202.56.131:443
Source: global trafficTCP traffic: 192.168.2.5:49697 -> 23.202.56.131:443
Source: global trafficTCP traffic: 23.202.56.131:443 -> 192.168.2.5:49697
Source: global trafficTCP traffic: 192.168.2.5:49697 -> 23.202.56.131:443
Source: global trafficTCP traffic: 23.202.56.131:443 -> 192.168.2.5:49697
Source: global trafficTCP traffic: 23.202.56.131:443 -> 192.168.2.5:49697
Source: global trafficTCP traffic: 192.168.2.5:49697 -> 23.202.56.131:443
Source: global trafficTCP traffic: 23.202.56.131:443 -> 192.168.2.5:49697
Source: global trafficTCP traffic: 23.202.56.131:443 -> 192.168.2.5:49697
Source: global trafficTCP traffic: 192.168.2.5:49697 -> 23.202.56.131:443
Source: global trafficTCP traffic: 192.168.2.5:49697 -> 23.202.56.131:443
Source: global trafficTCP traffic: 23.202.56.131:443 -> 192.168.2.5:49697
Source: global trafficTCP traffic: 23.202.56.131:443 -> 192.168.2.5:49697
Source: global trafficTCP traffic: 192.168.2.5:49697 -> 23.202.56.131:443
Source: global trafficTCP traffic: 23.202.56.131:443 -> 192.168.2.5:49697
Source: global trafficTCP traffic: 192.168.2.5:49697 -> 23.202.56.131:443
Source: global trafficTCP traffic: 23.202.56.131:443 -> 192.168.2.5:49697
Source: global trafficTCP traffic: 192.168.2.5:49697 -> 23.202.56.131:443
Source: Joe Sandbox ViewIP Address: 23.202.56.131 23.202.56.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.56.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.56.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.56.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.56.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.56.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.56.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.56.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.56.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.56.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.56.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.56.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.56.131
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: c.pki.goog
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49697
Source: unknownNetwork traffic detected: HTTP traffic on port 49697 -> 443
Source: classification engineClassification label: clean2.winPDF@14/43@1/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journalJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-04-28 14-21-19-556.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: SharedDataEvents-journal.0.drBinary or memory string: CREATE TABLE pref_events (event_id INTEGER NOT NULL PRIMARY KEY, event_time INTEGER NOT NULL, instance_guid TEXT NOT NULL, section_name TEXT NOT NULL, pref_key TEXT, pref_value TEXT, client_nonce INTEGER NOT NULL, added INTEGER NOT NULL );
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Knight Law Group ACH Information.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1728 --field-trial-handle=1600,i,8750823394921883741,16636045827587014535,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1728 --field-trial-handle=1600,i,8750823394921883741,16636045827587014535,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: Knight Law Group ACH Information.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: Knight Law Group ACH Information.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts3
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1676577 Sample: Knight Law Group ACH Inform... Startdate: 28/04/2025 Architecture: WINDOWS Score: 2 14 pki-goog.l.google.com 2->14 16 c.pki.goog 2->16 7 Acrobat.exe 20 62 2->7         started        process3 process4 9 AcroCEF.exe 105 7->9         started        process5 11 AcroCEF.exe 3 9->11         started        dnsIp6 18 23.202.56.131, 443, 49697 AKAMAI-ASN1EU United States 11->18

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com
84.201.221.18
truefalse
    		high
    pki-goog.l.google.com
    		192.178.49.195
    		truefalse
      		high
      c.pki.goog
      		unknown
      		unknownfalse
        		high

        World Map of Contacted IPs

        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs

        Public IPs

        IPDomainCountryFlagASNASN NameMalicious
        23.202.56.131
        		unknownUnited States
        		20940AKAMAI-ASN1EUfalse

        General Information

        Joe Sandbox version:42.0.0 Malachite
        Analysis ID:1676577
        Start date and time:2025-04-28 20:20:19 +02:00
        Joe Sandbox product:CloudBasic
        Overall analysis duration:0h 4m 12s
        Hypervisor based Inspection enabled:false
        Report type:full
        Cookbook file name:defaultwindowspdfcookbook.jbs
        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
        Number of analysed new started processes analysed:9
        Number of new started drivers analysed:0
        Number of existing processes analysed:0
        Number of existing drivers analysed:0
        Number of injected processes analysed:0
        Technologies:
        • HCA enabled
        • EGA enabled
        • AMSI enabled
        Analysis Mode:default
        Analysis stop reason:Timeout
        Sample name:Knight Law Group ACH Information.pdf
        Detection:CLEAN
        Classification:clean2.winPDF@14/43@1/1
        Cookbook Comments:
        • Found application associated with file extension: .pdf
        • Found PDF document
        • Close Viewer
        • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
        • Excluded IPs from analysis (whitelisted): 23.194.100.185, 54.144.73.197, 107.22.247.231, 34.193.227.236, 18.207.85.246, 162.159.61.3, 172.64.41.3, 23.55.241.176, 23.55.241.152, 184.29.183.29
        • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com, wu-b-net.trafficmanager.net
        • Not all processes where analyzed, report is missing behavior information

        Simulations

        Behavior and APIs

        ⊘No simulations

        Joe Sandbox View / Context

        IPs

        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        23.202.56.131cv1(tareq rezq)_rcS.exeGet hashmaliciousRevengeRATBrowse
          https://vault.nimbox.co.uk/shares/file/78LUoWVICRC/Get hashmaliciousUnknownBrowse
            Bid_Proposal_1dbLOky3LggPi9T9O4s17l6Qk_Z1xyzga.pdfGet hashmaliciousHTMLPhisher, Invisible JS, Tycoon2FABrowse
              Handbook_V2_2025.pdfGet hashmaliciousHTMLPhisher, Invisible JS, Tycoon2FABrowse
                Invitation de proposition - Krispy Kernels.pdfGet hashmaliciousHTMLPhisherBrowse
                  Coterra-Employee-Handbook.pdfGet hashmaliciousInvisible JS, Tycoon2FABrowse
                    FW+GHI+Contracts+Holdings+Ltd+-+GHI+Contracts+Holdings+Ltd+555454565767675.emlGet hashmaliciousUnknownBrowse
                      REMITTANCE NOTICE.emlGet hashmaliciousHTMLPhisherBrowse
                        VIEW BID DASHBOARD.pdfGet hashmaliciousHTMLPhisherBrowse
                          Proposal Invitation #U2013Tower Arctic.pdfGet hashmaliciousHTMLPhisherBrowse

                            Domains

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.comLedger Live.exeGet hashmaliciousPureCrypterBrowse
                            • 84.201.221.26
                            _patched.exeGet hashmaliciousAmadey, CryptOne, LummaC StealerBrowse
                            • 84.201.221.26
                            Order Request No. E0147-1-T1911.xlam.xlsxGet hashmaliciousUnknownBrowse
                            • 84.201.221.37
                            Pending_Post_Tax_Payments_Detail.pdf.vbsGet hashmaliciousGuLoaderBrowse
                            • 84.201.221.42
                            250428-ekk7ra1wa1.bin.exeGet hashmaliciousSmokeLoaderBrowse
                            • 84.201.221.34
                            250428-d8ejfatjs7.bin.exeGet hashmaliciousCycbotBrowse
                            • 84.201.221.26
                            250428-aq9ebavxcs.bin.exeGet hashmaliciousUnknownBrowse
                            • 84.201.221.38
                            VisualCode.exeGet hashmaliciousAsyncRAT, LummaC Stealer, Njrat, Quasar, VidarBrowse
                            • 84.201.221.25
                            LoaderByLyTeamV10.13.exeGet hashmaliciousLummaC StealerBrowse
                            • 84.201.221.39
                            250427-2yq2gstsav.bin.exeGet hashmaliciousLummaC StealerBrowse
                            • 84.201.221.39
                            pki-goog.l.google.comsupport.ClientSetup.exeGet hashmaliciousScreenConnect ToolBrowse
                            • 192.178.49.195
                            SoftWare(2).exeGet hashmaliciousLummaC StealerBrowse
                            • 192.178.49.195
                            malware.exeGet hashmaliciousUnknownBrowse
                            • 192.178.49.195
                            Setupv.exeGet hashmaliciousLummaC StealerBrowse
                            • 192.178.49.195
                            keylogger.exeGet hashmaliciousUnknownBrowse
                            • 142.250.72.131
                            dr.ps1Get hashmaliciousLummaC StealerBrowse
                            • 192.178.49.195
                            text.bat.exeGet hashmaliciousMyDoomBrowse
                            • 192.178.49.195
                            PO9765.jsGet hashmaliciousUnknownBrowse
                            • 192.178.49.195
                            Tapflo Group.VBS.vbsGet hashmaliciousXWormBrowse
                            • 192.178.49.195
                            PO-0427-26 - 150-30.jsGet hashmaliciousFormBookBrowse
                            • 192.178.49.195

                            ASNs

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            AKAMAI-ASN1EUhttps://www.figma.com/deck/38lV4fUOP5Tv9znMAyXoGA/Untitled?node-id=0-44Get hashmaliciousHTMLPhisherBrowse
                            • 23.55.241.171
                            b727f565-6956-7fb9-d918-e30c3150187b.emlGet hashmaliciousHTMLPhisherBrowse
                            • 23.55.241.177
                            http://banks-canada.comGet hashmaliciousUnknownBrowse
                            • 23.202.58.13
                            http://sharesmorefileson.comGet hashmaliciousHTMLPhisher, Invisible JS, Tycoon2FABrowse
                            • 23.62.226.176
                            cv1(tareq rezq)_rcS.exeGet hashmaliciousRevengeRATBrowse
                            • 23.202.57.36
                            http://sprayfoamsys.comGet hashmaliciousUnknownBrowse
                            • 23.62.226.169
                            https://vault.nimbox.co.uk/shares/file/78LUoWVICRC/Get hashmaliciousUnknownBrowse
                            • 23.202.56.131
                            Bid_Proposal_1dbLOky3LggPi9T9O4s17l6Qk_Z1xyzga.pdfGet hashmaliciousHTMLPhisher, Invisible JS, Tycoon2FABrowse
                            • 23.202.56.131
                            FW_ Final Reminder Before Maintenance Day From Proofpoint, Inc.emlGet hashmaliciousUnknownBrowse
                            • 23.62.226.163
                            http://7063734195.sbsGet hashmaliciousHTMLPhisherBrowse
                            • 23.62.226.164

                            JA3 Fingerprints

                            ⊘No context

                            Dropped Files

                            ⊘No context

                            Created / dropped Files

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:ASCII text
                            Category:dropped
                            Size (bytes):291
                            Entropy (8bit):5.175668931297396
                            Encrypted:false
                            SSDEEP:6:iORE+fkq2P92nKuAl9OmbnIFUtDE+ZFZmw9E+ZXkwO92nKuAl9OmbjLJ:7Rvkv4HAahFUtDX/9F5LHAaSJ
                            MD5:302D56FD628634CAC85E1BD1CE88E392
                            SHA1:556B1BD3B994DC26AD3261997B5C156B396724D7
                            SHA-256:661A1636DD55B756D7FB4567CC50A6F627390AF0DBCA3A2D3E16C21DE06067DF
                            SHA-512:1464B07B8B2A82A7D363CA12AB7CAFE489D2FB2E272207C994ECD34347B1E6B00C1E902757050B31BE8ACBC283132A71A017E24E025A8BC0FB4F34E461118882
                            Malicious:false
                            Reputation:low
                            Preview:2025/04/28-14:21:17.842 420 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/04/28-14:21:17.844 420 Recovering log #3.2025/04/28-14:21:17.844 420 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:ASCII text
                            Category:dropped
                            Size (bytes):291
                            Entropy (8bit):5.175668931297396
                            Encrypted:false
                            SSDEEP:6:iORE+fkq2P92nKuAl9OmbnIFUtDE+ZFZmw9E+ZXkwO92nKuAl9OmbjLJ:7Rvkv4HAahFUtDX/9F5LHAaSJ
                            MD5:302D56FD628634CAC85E1BD1CE88E392
                            SHA1:556B1BD3B994DC26AD3261997B5C156B396724D7
                            SHA-256:661A1636DD55B756D7FB4567CC50A6F627390AF0DBCA3A2D3E16C21DE06067DF
                            SHA-512:1464B07B8B2A82A7D363CA12AB7CAFE489D2FB2E272207C994ECD34347B1E6B00C1E902757050B31BE8ACBC283132A71A017E24E025A8BC0FB4F34E461118882
                            Malicious:false
                            Reputation:low
                            Preview:2025/04/28-14:21:17.842 420 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/04/28-14:21:17.844 420 Recovering log #3.2025/04/28-14:21:17.844 420 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:ASCII text
                            Category:dropped
                            Size (bytes):335
                            Entropy (8bit):5.236022275359516
                            Encrypted:false
                            SSDEEP:6:iORE+m9+q2P92nKuAl9Ombzo2jMGIFUtDE+FJZmw9E+mVkwO92nKuAl9Ombzo2jz:7R1v4HAa8uFUtD1J/9G5LHAa8RJ
                            MD5:5BE0031CAFB1559C2906E407908B75FE
                            SHA1:E91C72BBF64748F7EBB17AE697244D92B52A5DC5
                            SHA-256:94B218CFF19DF1E32C7D95F5E55019F5FE1A49CF4380F2BC5172C85ABB8AD1FD
                            SHA-512:777EB98FE1E388CB1B11DE99135E663F59BC416199071C915B5B8BB0EB5EB36B9BFDAE6628BC362141CDD190DAA6379A4D585E39024D22FF428CFC90E1AE4522
                            Malicious:false
                            Reputation:low
                            Preview:2025/04/28-14:21:17.663 a58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/04/28-14:21:17.668 a58 Recovering log #3.2025/04/28-14:21:17.669 a58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:ASCII text
                            Category:dropped
                            Size (bytes):335
                            Entropy (8bit):5.236022275359516
                            Encrypted:false
                            SSDEEP:6:iORE+m9+q2P92nKuAl9Ombzo2jMGIFUtDE+FJZmw9E+mVkwO92nKuAl9Ombzo2jz:7R1v4HAa8uFUtD1J/9G5LHAa8RJ
                            MD5:5BE0031CAFB1559C2906E407908B75FE
                            SHA1:E91C72BBF64748F7EBB17AE697244D92B52A5DC5
                            SHA-256:94B218CFF19DF1E32C7D95F5E55019F5FE1A49CF4380F2BC5172C85ABB8AD1FD
                            SHA-512:777EB98FE1E388CB1B11DE99135E663F59BC416199071C915B5B8BB0EB5EB36B9BFDAE6628BC362141CDD190DAA6379A4D585E39024D22FF428CFC90E1AE4522
                            Malicious:false
                            Reputation:low
                            Preview:2025/04/28-14:21:17.663 a58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/04/28-14:21:17.668 a58 Recovering log #3.2025/04/28-14:21:17.669 a58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):508
                            Entropy (8bit):5.052763833734381
                            Encrypted:false
                            SSDEEP:12:YH/um3RA8sqVplShsBdOg2HBVWZcaq3QYiubxnP7E4T3OF+:Y2sRdsImydMHrWg3QYhbxP7nbI+
                            MD5:78BFA30BBD2F219F4C9CEB44A2550648
                            SHA1:DDD67FE9A8E7ACEBC0574A0458EA6AA1C5BCEF45
                            SHA-256:DF31861A6CF2D54E35D128E4ECE774F41E84067348366D1286B71554039EE458
                            SHA-512:7E8DC5FB601E0B176AC69F6E643B722CABA0BF8CC9D6D85E8E9DE8A6E1F988600EDFB4B80209312926C8280436D8DA6519ABFB4C08D6D901C37E1917E061B47F
                            Malicious:false
                            Reputation:low
                            Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13390424489039366","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":145596},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\TransportSecurity (copy)

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):203
                            Entropy (8bit):5.360794953893286
                            Encrypted:false
                            SSDEEP:6:YAQNhe8VXuObqJx8wXwlmUUAnIMp5Ct5SQ:YO8huObO+UAnIrt0Q
                            MD5:15B59686332304DF7094DD81346B5C28
                            SHA1:E563B82744E6480AF42ECF98F7AA5EE862E87EB4
                            SHA-256:1163A40447972C2F1B212A5280CB180CCA2C017E7B03DE0EEF21F2FB4CB841CA
                            SHA-512:09D10D7A432CD5747BE208B61B78F2DCDA5A256CAD7190DBE7D9E0D8B0DFE177CADC8900AA4BAA0E5032DAAD95B391E231EBFF2C41937003A3B892170B82FE3A
                            Malicious:false
                            Reputation:low
                            Preview:{"expect_ct":[],"sts":[{"expiry":1761416482.015727,"host":"fm9KDTkCEEOhjQ0Uz3wemEDKt2V49zM91BbUE6ob8vg=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1745864482.015732}],"version":2}

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\aa0ba777-4a8e-4f5c-8148-1b30ca2f260b.tmp

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:JSON data
                            Category:modified
                            Size (bytes):508
                            Entropy (8bit):5.052763833734381
                            Encrypted:false
                            SSDEEP:12:YH/um3RA8sqVplShsBdOg2HBVWZcaq3QYiubxnP7E4T3OF+:Y2sRdsImydMHrWg3QYhbxP7nbI+
                            MD5:78BFA30BBD2F219F4C9CEB44A2550648
                            SHA1:DDD67FE9A8E7ACEBC0574A0458EA6AA1C5BCEF45
                            SHA-256:DF31861A6CF2D54E35D128E4ECE774F41E84067348366D1286B71554039EE458
                            SHA-512:7E8DC5FB601E0B176AC69F6E643B722CABA0BF8CC9D6D85E8E9DE8A6E1F988600EDFB4B80209312926C8280436D8DA6519ABFB4C08D6D901C37E1917E061B47F
                            Malicious:false
                            Reputation:low
                            Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13390424489039366","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":145596},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\dba4d033-77c5-444e-8a8c-6bd8a4d2ffc6.tmp

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):203
                            Entropy (8bit):5.360794953893286
                            Encrypted:false
                            SSDEEP:6:YAQNhe8VXuObqJx8wXwlmUUAnIMp5Ct5SQ:YO8huObO+UAnIrt0Q
                            MD5:15B59686332304DF7094DD81346B5C28
                            SHA1:E563B82744E6480AF42ECF98F7AA5EE862E87EB4
                            SHA-256:1163A40447972C2F1B212A5280CB180CCA2C017E7B03DE0EEF21F2FB4CB841CA
                            SHA-512:09D10D7A432CD5747BE208B61B78F2DCDA5A256CAD7190DBE7D9E0D8B0DFE177CADC8900AA4BAA0E5032DAAD95B391E231EBFF2C41937003A3B892170B82FE3A
                            Malicious:false
                            Preview:{"expect_ct":[],"sts":[{"expiry":1761416482.015727,"host":"fm9KDTkCEEOhjQ0Uz3wemEDKt2V49zM91BbUE6ob8vg=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1745864482.015732}],"version":2}

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):4509
                            Entropy (8bit):5.2385528702339705
                            Encrypted:false
                            SSDEEP:96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUiwqJC+7w4M7w7D:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLD
                            MD5:D28014B9C3647BBBDE2AA66BF7C66EFB
                            SHA1:B671069A9BEABAEAF63A20581C935F14CFB32C4D
                            SHA-256:A2C230FE1338853E3161F85BB20BEE7BFA248A3055820026A6B389B8A30FAF06
                            SHA-512:FDCF434128EE4EF16D3A4977FD32375FC3C2AD32652DEF69869E9467EF5D7B11F6074807363D4D3F5043117299A7C9326A9D85850DDD97AF1E7FA9B9DE8B1B2F
                            Malicious:false
                            Preview:*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:ASCII text
                            Category:dropped
                            Size (bytes):323
                            Entropy (8bit):5.224581488472331
                            Encrypted:false
                            SSDEEP:6:iORE+P+q2P92nKuAl9OmbzNMxIFUtDE+CJZmw9E+oUJ9VkwO92nKuAl9OmbzNMFd:7RGv4HAa8jFUtDyJ/9/5LHAa84J
                            MD5:288C750CBC03FCD39E2E6AFA8400EC7B
                            SHA1:7DAB58C9AD17FE4DC79DA76B09C67EA4CBAD4A2D
                            SHA-256:3686D9C2EEA495457C7725DF5CD00D75501CE00785368B633F2C8FF2B63661C5
                            SHA-512:B76F81C41E4331969E68E51B93724569A000E3E17E32C882D223AE02DE878249DC5DE3DBCA517759E07DF9AE30FEDA7F98E0F46462C7247642544A038626FFA3
                            Malicious:false
                            Preview:2025/04/28-14:21:17.897 a58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/04/28-14:21:17.898 a58 Recovering log #3.2025/04/28-14:21:17.903 a58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:ASCII text
                            Category:dropped
                            Size (bytes):323
                            Entropy (8bit):5.224581488472331
                            Encrypted:false
                            SSDEEP:6:iORE+P+q2P92nKuAl9OmbzNMxIFUtDE+CJZmw9E+oUJ9VkwO92nKuAl9OmbzNMFd:7RGv4HAa8jFUtDyJ/9/5LHAa84J
                            MD5:288C750CBC03FCD39E2E6AFA8400EC7B
                            SHA1:7DAB58C9AD17FE4DC79DA76B09C67EA4CBAD4A2D
                            SHA-256:3686D9C2EEA495457C7725DF5CD00D75501CE00785368B633F2C8FF2B63661C5
                            SHA-512:B76F81C41E4331969E68E51B93724569A000E3E17E32C882D223AE02DE878249DC5DE3DBCA517759E07DF9AE30FEDA7F98E0F46462C7247642544A038626FFA3
                            Malicious:false
                            Preview:2025/04/28-14:21:17.897 a58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/04/28-14:21:17.898 a58 Recovering log #3.2025/04/28-14:21:17.903 a58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                            C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250428182121Z-167.bmp

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
                            Category:dropped
                            Size (bytes):71190
                            Entropy (8bit):0.37171478291258675
                            Encrypted:false
                            SSDEEP:96:5WACYGXOEMMMUOMM9MTEMLz+dcM4MmMMJO5MMqHn7MMlPMV3dMMEMMM/MVBm6:5WMGXc81
                            MD5:CFEED764C3D711124CAD2CEE7ECA5612
                            SHA1:07EBECFE98573BF4E6F9508D3618B2C9B7ECF224
                            SHA-256:7525D570BC0711F938A3794C022E7A953CD567AD12BD48FA521071E887C90E80
                            SHA-512:342B66A1460D3CA0110C23AE7BB7720CB38B06F3665F832C0D335F84F1D25FAFBACEA63F5050702FDCC1A2974DF05464B89B3B101CDE5AA3A5B3E19CF2DE4F11
                            Malicious:false
                            Preview:BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7672

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:PostScript document text
                            Category:dropped
                            Size (bytes):185099
                            Entropy (8bit):5.182478651346149
                            Encrypted:false
                            SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                            MD5:94185C5850C26B3C6FC24ABC385CDA58
                            SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                            SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                            SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                            Malicious:false
                            Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:PostScript document text
                            Category:dropped
                            Size (bytes):185099
                            Entropy (8bit):5.182478651346149
                            Encrypted:false
                            SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                            MD5:94185C5850C26B3C6FC24ABC385CDA58
                            SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                            SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                            SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                            Malicious:false
                            Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):227002
                            Entropy (8bit):3.392780893644728
                            Encrypted:false
                            SSDEEP:1536:WKPC4iyzDtrh1cK3XEivK7VK/3AYvYwgF/rRoL+sn:DPCaJ/3AYvYwglFoL+sn
                            MD5:87EDBEE38F56C20298F25D5D3D4D1B5C
                            SHA1:7F904E9615AC3186A87472EF366DD8202855B0B7
                            SHA-256:A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
                            SHA-512:BBEBC1FCD5BC9AE042DD5782425BA8C47BF3EAC283B2487FC4E3FF6BF8101306DAB081E5135594165D4DC1AC120FF125AADBC5B3FFE7C646183C04DF77865E0D
                            Malicious:false
                            Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):295
                            Entropy (8bit):5.3169030716527015
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HXDWC0+FIbRI6XVW7+0YSu2xoAvJM3g98kUwPeUkwRe9:YvXKXKCVYpW7oGMbLUkee9
                            MD5:285FA442896601D84796DFB21F4338A7
                            SHA1:FDC691AA0C86B87CCE23DE5A1590CF81D99A8D61
                            SHA-256:D27CC419730581FB28E2EDD906817CF8EF3ECCCB8AAC32287A044495968AC4C7
                            SHA-512:B6F617F88C461DA48C6F1435ED849F6071E7AF033D6B82D82BCA310AA3193E2DC556A6BBB4B77355EFC4D31F0F36FA384C7871DAAEDAAA145C868EC2E8867D73
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"432b3f11-b808-4775-a14c-1a057cf32ab2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1746038017547,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):294
                            Entropy (8bit):5.2567905752202195
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HXDWC0+FIbRI6XVW7+0YSu2xoAvJfBoTfXpnrPeUkwRe9:YvXKXKCVYpW7oGWTfXcUkee9
                            MD5:0AD352F413396AB1511EAD2ED2EEA119
                            SHA1:7E0242699A017F697E50A654424140CB2FBE8AAB
                            SHA-256:4FADF71958FB768EF1B9D6C6D9350174777DFBDAF24519396EB8571893DD86E7
                            SHA-512:3FBBD5BE96BBE52B2889B853DC49AB787B5B2DB59D472F3ACB14D0849BBE3F9EB7317BC22147184BD53905DA49EDA5CD2BD169B8AE4D7E48590D7963CD9C03DE
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"432b3f11-b808-4775-a14c-1a057cf32ab2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1746038017547,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):294
                            Entropy (8bit):5.234743175219579
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HXDWC0+FIbRI6XVW7+0YSu2xoAvJfBD2G6UpnrPeUkwRe9:YvXKXKCVYpW7oGR22cUkee9
                            MD5:7498242DCB91111ABDE7A6A4C18261A5
                            SHA1:F471031801BB758A37A83A07B81D1D17729A686E
                            SHA-256:65A959FF66080A2B9B6AA6926F386C9686FB4891BC5D185CD71F3E65EE23E9CA
                            SHA-512:9E7AC1D5C6E466546DCD6977E1B9366DA1A192D7557BCE23DA93A200CCAB308DD6536F8F2D9CCC6DDB10EB4E28A4E1A4F3DFA1BD9FAFAEFFA8B0CCA9AE2D53E9
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"432b3f11-b808-4775-a14c-1a057cf32ab2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1746038017547,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):285
                            Entropy (8bit):5.294165762827181
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HXDWC0+FIbRI6XVW7+0YSu2xoAvJfPmwrPeUkwRe9:YvXKXKCVYpW7oGH56Ukee9
                            MD5:C7F8845F1554C8C278A5FD63070163D5
                            SHA1:ABB76A73E0CD7A83AE2E0DE1065C18B74B977263
                            SHA-256:6EDE7BB7665E86B8BAD85BDE2EDBD51FA47A66DB376EEEA1BBC2975EFFF68D16
                            SHA-512:47481742F7F3EC9B827678ECBB4000F07516758937DF126EA75696FAFD45F83183B63DC88E92EE7029EAF3118BF4416912858D263E21FD242D2344DC9C25BFD4
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"432b3f11-b808-4775-a14c-1a057cf32ab2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1746038017547,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):2213
                            Entropy (8bit):5.8458236112282576
                            Encrypted:false
                            SSDEEP:24:Yv6XleilpLgEGycjycR84b0nNFmerISIedJGWQxiEDtbpEsrAr3IAHlO25FEEDi5:YvU5lhgly48zFm/TWCt8KOP/nDi/VD
                            MD5:0323DCC4BAD845532243885F869E34C2
                            SHA1:E0CE9D298CBDB47EE0B74AC3DACFA5E1EE4C9B5F
                            SHA-256:92A05CF0AD8283C19C463E7065A3A8CDB952CB8660BD790BF9D2A0AEE5FB6E78
                            SHA-512:AB6F0ED009439C77A523BC8C468AE9D44116C72394BB410C217A12F4B80161AD626DA2A5D5704C7E5C717DC94E13AD7167180EBEDFE0D7CEBCB975D28667AAB9
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"432b3f11-b808-4775-a14c-1a057cf32ab2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1746038017547,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"102656_316349ActionBlock_1","campaignId":102656,"containerId":"1","controlGroupId":"","treatmentId":"5a9d1955-ab74-4b89-837a-074b702313c0","variationId":"316349"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJkYXRhIjp7ImxocFYyQnlQYXRoIjp7Iml0ZW0iOnsiX3BhdGgiOiIvY29udGVudC9kYW0vYWNyb2JhdGRlc2t0b3AvZ3Jvd3RoL3JlYWRlci9lbi11cy9saHAtYmFubmVyL3YyL2NvbnZlcnQiLCJfaWQiOiJlYjYyOWYwOC00YmZiLTRkYmEtYjQzNC01MzUyZTg1MGU4NWYiLCJfdmFyaWF0aW9uIjoicmdzMDM2MS0wIiwidGl0bGUiOm51bGwsImRlc2NyaXB0aW9uIjoiRXhwb3J0IFBERnMgdG8gTWljcm9zb2Z0IFdvcmQgYW5kIEV4Y2VsLiIsImN0YUxhYmVsIjpudWxsLCJjdGFCZW

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):289
                            Entropy (8bit):5.243246377090272
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HXDWC0+FIbRI6XVW7+0YSu2xoAvJf8dPeUkwRe9:YvXKXKCVYpW7oGU8Ukee9
                            MD5:788C189666726058E8AD8EB3C1F3C8BF
                            SHA1:F1EB587DD67DA3BA91B6C786C1D74123BC22568B
                            SHA-256:57D246533E5B833247CFDF8B860764D99987AF735A483E929667D56DD9A4CD06
                            SHA-512:D75DF1985D286E69CE2D9D15B589828EF8B263DFB03AC1087380D425C2AFBE2A2F93F68521306A9FDC6AC30F8AE62E87E6C8B42D0D1B82EDC535D1D4A835C7A1
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"432b3f11-b808-4775-a14c-1a057cf32ab2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1746038017547,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):292
                            Entropy (8bit):5.245693457847278
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HXDWC0+FIbRI6XVW7+0YSu2xoAvJfQ1rPeUkwRe9:YvXKXKCVYpW7oGY16Ukee9
                            MD5:F6C91B3E4FF11D2E2644DB8224A7CEA1
                            SHA1:32D003952167AD9ABB1932B4FC6F09C9BBA9ECBC
                            SHA-256:00BE738054235CABAABF66883804C8DBA414632F25DE42B36E6039D66EF5095D
                            SHA-512:525D3F2EDBED81DF1BC8213CAF6287E49286E0741008AFDF15A5E1C78D67B0C3D34BF6CBC11C90D1B7934121AFA9454DC5CC8CEB49594D949B144034EEC2F2E1
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"432b3f11-b808-4775-a14c-1a057cf32ab2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1746038017547,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):2160
                            Entropy (8bit):5.831441366216108
                            Encrypted:false
                            SSDEEP:48:YvU5YogbN48uOQ/GiyL4TwKOkQJi+ohJD:Gcg54nf/IQOkQJiFr
                            MD5:64688B2F6786B7949164D712834A799E
                            SHA1:721FDA0FCE64C265FCB860185E99A8BC79AFEA53
                            SHA-256:4F26A2B56BF9A01796D493EE07DC666A156C38DA1FCECD3D5413E1DF6EF23A53
                            SHA-512:9FAE951114812566FA9AB66D17973142F083CB1140826825F9FABB853F2B356A81B1DB8D68A5DDD30BF002108768431D0525AFFDC0A029D578FD45308A090F1C
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"432b3f11-b808-4775-a14c-1a057cf32ab2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1746038017547,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"102656_316349ActionBlock_2","campaignId":102656,"containerId":"1","controlGroupId":"","treatmentId":"164bf29d-ee04-491c-adf2-c0bfeedb2d1b","variationId":"316349"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJkYXRhIjp7ImxocFYyQnlQYXRoIjp7Iml0ZW0iOnsiX3BhdGgiOiIvY29udGVudC9kYW0vYWNyb2JhdGRlc2t0b3AvZ3Jvd3RoL3JlYWRlci9lbi11cy9saHAtYmFubmVyL3YyL2VkaXQiLCJfaWQiOiIzNzkzMGExNC1kOGMwLTRlZDYtYjI0Yi0zZGUzY2FlZjZlNjAiLCJfdmFyaWF0aW9uIjoicmdzMDM2MS0wIiwidGl0bGUiOm51bGwsImRlc2NyaXB0aW9uIjpudWxsLCJjdGFMYWJlbCI6bnVsbCwiY3RhQmVoYXZpb3IiOm51bGwsImN0YVVybCI6bnVsbCwiY3RhVXJsVHlwZSI6bnVsbCwidHJ

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):295
                            Entropy (8bit):5.271888985695477
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HXDWC0+FIbRI6XVW7+0YSu2xoAvJfzdPeUkwRe9:YvXKXKCVYpW7oGb8Ukee9
                            MD5:2BB2FD44E13B16B5149F721DA792803A
                            SHA1:CA1568246C05ED3D7C6F9B3AFAD46829DD2BE397
                            SHA-256:DC9248C9F1227945C7633476C8929EB7C9D25B273487B1E8543448F6C2D9BE64
                            SHA-512:A4E06A7949B7ADB17621A30A3E5CF86ACF838FA45B33AA37E82B60548686F96BA2CD0D37DFBE5C998473339DEADD5628C465FD5F290D71F27A0B7936190E4F37
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"432b3f11-b808-4775-a14c-1a057cf32ab2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1746038017547,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):289
                            Entropy (8bit):5.2518245734291025
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HXDWC0+FIbRI6XVW7+0YSu2xoAvJfYdPeUkwRe9:YvXKXKCVYpW7oGg8Ukee9
                            MD5:1110AAC60FC7EAE290237720D413DA70
                            SHA1:9EC0AFFB1965C29E16C44EA7654FA586E95334D6
                            SHA-256:79B31C8724A3F427FC9E1D3B5152E3B4DB739237F7AE93994DFDBC12DF8707D4
                            SHA-512:E2D9100BE8317994C9372A839DB80230D14DB6FD458B98702F0A7390B75002A09A50F6FC2C1F1290E180365906BB6DD2AC24FBCAD1F1969CF084A853DFA56269
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"432b3f11-b808-4775-a14c-1a057cf32ab2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1746038017547,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):284
                            Entropy (8bit):5.236709085800433
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HXDWC0+FIbRI6XVW7+0YSu2xoAvJf+dPeUkwRe9:YvXKXKCVYpW7oG28Ukee9
                            MD5:05FA5547A74501219FAC9BECCBD5EF0F
                            SHA1:6EBBFD8522254AF3497B298E1422247C13DAD298
                            SHA-256:4763F02574F6C55BB034D942C843A66EEC23ECA2AB9E3575851D4102D0305531
                            SHA-512:83B3ECFCE2C0A5538ADFDDCE4635973EC24CB83BA8DCEF8F85779686B1E637B2515C4C4BBD3ACA41E03426F16D3E39AE374771FBE9DB3E77AFDC864A7941A4CF
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"432b3f11-b808-4775-a14c-1a057cf32ab2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1746038017547,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):291
                            Entropy (8bit):5.235702773691082
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HXDWC0+FIbRI6XVW7+0YSu2xoAvJfbPtdPeUkwRe9:YvXKXKCVYpW7oGDV8Ukee9
                            MD5:3C78DAE24B68A965C0575168A944EDD2
                            SHA1:285DEA642367977F15B0A19EB961FE68AE60B98C
                            SHA-256:D77418AE919595451F1292047F5F4D78E844964C16FC7706240B88585AADE145
                            SHA-512:8E22873DDB263B36DB6D8859DE3ED4101A444ADD3EFF8CAD31B39AC9FB573593021AB4EA3743853B45690563FA62FA8DED034F08B531A82B0FCCE60C3AFD6648
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"432b3f11-b808-4775-a14c-1a057cf32ab2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1746038017547,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):287
                            Entropy (8bit):5.237005038714922
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HXDWC0+FIbRI6XVW7+0YSu2xoAvJf21rPeUkwRe9:YvXKXKCVYpW7oG+16Ukee9
                            MD5:9F3A68F03B017F3EC9681B433B12FEAA
                            SHA1:DD14A4C871C5E4F766887A3AA799F028F1A9CDBA
                            SHA-256:D323B35D204ECCADE56C6B8118861C90057650FCE96E9433AF779C52C6C831EA
                            SHA-512:1797A1056EDE6201A75FB619476796526930A54BBD0893FEAB72A19B1ED82AAF95063A52E5D26A5D7313E56CDD687412BC70AAF3D93F29C0F3909122A8FEF523
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"432b3f11-b808-4775-a14c-1a057cf32ab2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1746038017547,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):2112
                            Entropy (8bit):5.84890596093179
                            Encrypted:false
                            SSDEEP:24:Yv6Xlei9amXayLgEdycgNaLcR84brvXJkoerISIQ1iyLVFgKy1N8IAHlOBJEEDYH:YvU5RBgBG48kJko/SiyL4T0AFDA/VD
                            MD5:407F5EA6583F21F7DCD1A794E06F209C
                            SHA1:17091AF4779407027C4F99F75E99BAB5500EC323
                            SHA-256:F9576BFD20E1872AFD8425E418ADE940D808C3CE3CA698B9BBF394F68E5A3DD1
                            SHA-512:6DF6574AEF5DA32613F1FE9ACB8A1FD8FA5871312CA70068AD9F1980FAE418EA4DB508A92E8ABD93AD14EF9FFBA72637E460095105BC54BF6AFEE5F985ADEAA0
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"432b3f11-b808-4775-a14c-1a057cf32ab2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1746038017547,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"102656_316349ActionBlock_0","campaignId":102656,"containerId":"1","controlGroupId":"","treatmentId":"339c0ba6-2e61-4622-82f6-f07787d206b8","variationId":"316349"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJkYXRhIjp7ImxocFYyQnlQYXRoIjp7Iml0ZW0iOnsiX3BhdGgiOiIvY29udGVudC9kYW0vYWNyb2JhdGRlc2t0b3AvZ3Jvd3RoL3JlYWRlci9lbi11cy9saHAtYmFubmVyL3YyL3NpZ24iLCJfaWQiOiJkMDQzMmY0Yy1hNTM2LTRlMzktOGNkNS1jYThiYjRhZTY2YzIiLCJfdmFyaWF0aW9uIjoicmdzMDM2MS0wIiwidGl0bGUiOm51bGwsImRlc2NyaXB0aW9uIjoiRWFzaWx5IGZpbGwgYW5kIHNpZ24gUERGcy4iLCJjdGFMYWJlbCI6bnVsbCwiY3RhQmVoYXZpb3IiOm51bGwsImN0YVVybCI6bnV

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):286
                            Entropy (8bit):5.212832679739927
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HXDWC0+FIbRI6XVW7+0YSu2xoAvJfshHHrPeUkwRe9:YvXKXKCVYpW7oGUUUkee9
                            MD5:9760184D9E62D0CC0A02C8D55288103E
                            SHA1:BF8436C4C42FFD806CED1D21B1082DDCB3D390FA
                            SHA-256:26DA5F1776DD2B600DF0F0AE77E7FFE84AF50440F373FACFD123A8B649495AE3
                            SHA-512:18DC404969061788709AAE4C855CB1F7179594530ABF180ECEEC80B03EF275C4CEBB5BA8B36D10A69800780E2EC63FDF15F01966312EE51DF054C7ECA2BE76EA
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"432b3f11-b808-4775-a14c-1a057cf32ab2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1746038017547,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):282
                            Entropy (8bit):5.219210959134965
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HXDWC0+FIbRI6XVW7+0YSu2xoAvJTqgFCrPeUkwRe9:YvXKXKCVYpW7oGTq16Ukee9
                            MD5:60C161D9DE7A17527C8640059A2ACB28
                            SHA1:A15385278BAA2459C2E555E85EB6E1108EB85C8C
                            SHA-256:6E26BA198D9B129FEFA20F6BC1AC03D39493A16C3814CC246F4D32BB972178DC
                            SHA-512:4E30A9F2139825FCE022958F3F05631012D4B6313997AA0419A13A0BF70C1F17DCB54B9B914E93B96AF081F04B76DA5462CCCA3DA9E8593518EE733869EEA316
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"432b3f11-b808-4775-a14c-1a057cf32ab2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1746038017547,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):4
                            Entropy (8bit):0.8112781244591328
                            Encrypted:false
                            SSDEEP:3:e:e
                            MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                            SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                            SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                            SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                            Malicious:false
                            Preview:....

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):2815
                            Entropy (8bit):5.125891785812459
                            Encrypted:false
                            SSDEEP:48:YQ+gQ99Uap6f60c6T1PrgKU7mLGH8eiHUq9O:kgQ/5pg6x65z3W8eibO
                            MD5:BE1B8683F86647BF6B360F334751DCD6
                            SHA1:C2FC72AF173A4718FBDC08A842A681540A3A0F18
                            SHA-256:DDB14506B52FA6D0F3DC2C3AE415AC6B0699259D1A13C4BF506DACE5FDFC4E31
                            SHA-512:C647DEFF02E9E3B371ACB4D2935043A63276DCB33F896CAC27B34A14D8718F9C7F457806048F03A23A66D36521185EC8A8A932865DA9184CC6C5A7DE8796B45A
                            Malicious:false
                            Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"6ec8c309770b27d180071d06d251cc0d","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1745864482000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"975f26bde8215ab27865c43b09b5ff8a","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":2112,"ts":1745864482000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"fd148e5763ffcdde558ce2fdb2957c6e","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":2213,"ts":1745864482000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"97defd00dfb1cb99c3641425b1c2b14e","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":2160,"ts":1745864482000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"e36a29dd116d5ceae0fffbc87192bda0","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1745864482000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"4cc91ca85a220e458c5f06a3462cb0ae","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file",

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
                            Category:dropped
                            Size (bytes):12288
                            Entropy (8bit):0.9856939211982958
                            Encrypted:false
                            SSDEEP:24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpNmtk4zJwtNBwtNbRZ6bRZ46mtkF:TVl2GL7ms6ggOVpoPzutYtp6PGo
                            MD5:A7331A41D0AF1BF4266EB774167C5178
                            SHA1:E8B5F93682123763A03DF4BD9834CFC45BD438B3
                            SHA-256:AF534841E4604D92152C9822A7D452310B6E7F971CB1E61745C623010122CDC0
                            SHA-512:A59CB348F8D57C8F99158D71CE8729F5C398D9FD88CFAD3B6A085F68A795C631CDFA86B4FE7D87FADCAF37C0E75E383BC21DEBABFE3D15FCFB3EB8431644EA94
                            Malicious:false
                            Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:SQLite Rollback Journal
                            Category:dropped
                            Size (bytes):8720
                            Entropy (8bit):1.3398580535045943
                            Encrypted:false
                            SSDEEP:24:7+tzAD1RZKHs/Ds/SpNmtkPzJwtNBwtNbRZ6bRZWf1RZKu6qLBx/XYKQvGJF7urE:7MzGgOVpo4zutYtp6PMf6qll2GL7msV
                            MD5:640BD4565F6D16783823F3ABDFD72B50
                            SHA1:4CBB0A1E4743E9A0FFE95DE32400867AFBF64CDC
                            SHA-256:6A4BE5DB777B42017297825D6CAE302D3F1D3D2EEFC46B3E6E2EEF1CB781A023
                            SHA-512:94B4D6C21B1C1EBD702B0CABD7C5D2649A00374E08D42E1F2341BAC82D067850BA3EDF00839BC7090AC008F836AF96DA43F092646A57A0EC0C7D7B11C34F18AD
                            Malicious:false
                            Preview:.... .c.....;.'.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Temp\MSIab6c7.LOG

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):246
                            Entropy (8bit):3.51161293806784
                            Encrypted:false
                            SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8jClERSo9:Qw946cPbiOxDlbYnuRKet
                            MD5:7F0BCE18EF5A94CCC768EDA536B77C37
                            SHA1:4E508D54D090C53230E612331D80C13D7373B11C
                            SHA-256:89CFF0871B2E91D6BA93761930A8FC1C25FE86602698C6199464DDAE71E33B51
                            SHA-512:8A0B816C6DAD9807C8C6E25B8A90E6A617DF3244D5E0479153DAE0B822925D9DA6947FAFE829638FBD2913A5D2312795D9834AA2B11B972A5BD68161BE0238F8
                            Malicious:false
                            Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.8./.0.4./.2.0.2.5. . .1.4.:.2.1.:.2.7. .=.=.=.....

                            C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-04-28 14-21-19-556.log

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:ASCII text, with very long lines (393)
                            Category:dropped
                            Size (bytes):16525
                            Entropy (8bit):5.376360055978702
                            Encrypted:false
                            SSDEEP:384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
                            MD5:1336667A75083BF81E2632FABAA88B67
                            SHA1:46E40800B27D95DAED0DBB830E0D0BA85C031D40
                            SHA-256:F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
                            SHA-512:D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
                            Malicious:false
                            Preview:SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

                            C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:ASCII text, with very long lines (393), with CRLF line terminators
                            Category:dropped
                            Size (bytes):16603
                            Entropy (8bit):5.346424072014392
                            Encrypted:false
                            SSDEEP:384:uT9OFbkDbsVfcJzD917NMDN/DvctHxUg/3JGeiewxMxgx3PWPlCanBNeN/a+jn2O:SlOp
                            MD5:52D0BADBD9E0CF73D3EF715C752C7698
                            SHA1:4CE51D27A737C3AE976AA551AE71C0BE58A3A1FD
                            SHA-256:6A3C38CFC560260A31633C41DE2AA56D69F5EA717E8378353E80F6FD95FA1922
                            SHA-512:931B4A2BA0B14F5A73CDCFA88F187FD7AF64D54B6CAC57433C187552AD38547F25B326643E13E97BE6A22C15138883BBF41EB22840974354ACB27FBD82A6B4D8
                            Malicious:false
                            Preview:SessionID=2ba89ea0-3ca0-4b47-b91c-719e7c3332c2.1745864479575 Timestamp=2025-04-28T14:21:19:575-0400 ThreadID=8480 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=2ba89ea0-3ca0-4b47-b91c-719e7c3332c2.1745864479575 Timestamp=2025-04-28T14:21:19:579-0400 ThreadID=8480 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=2ba89ea0-3ca0-4b47-b91c-719e7c3332c2.1745864479575 Timestamp=2025-04-28T14:21:19:579-0400 ThreadID=8480 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=2ba89ea0-3ca0-4b47-b91c-719e7c3332c2.1745864479575 Timestamp=2025-04-28T14:21:19:579-0400 ThreadID=8480 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=2ba89ea0-3ca0-4b47-b91c-719e7c3332c2.1745864479575 Timestamp=2025-04-28T14:21:19:580-0400 ThreadID=8480 Component=ngl-lib_NglAppLib Description="SetConf

                            C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):29845
                            Entropy (8bit):5.392427128080463
                            Encrypted:false
                            SSDEEP:768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbU:SxxNidwN40C4Y9UkNO
                            MD5:175CE0BCBE52E2F4944C592FEF830650
                            SHA1:9453C01026B8F7C2AA8582008103247C149CB1F0
                            SHA-256:1847D19B6546FBE254F217B87F42C3DD3B1C93D22CA78F1BBAFE0A4DA56E5117
                            SHA-512:A2F5DFA838223F7792043E571B5F2707BC6642EFC5AEC40A8C921469D69F2BEA746567EB5619D78BC3AE70930BAA3A40140C3D6BAC45CFA7E66AB6694A8CF8AE
                            Malicious:false
                            Preview:04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

                            C:\Users\user\AppData\Local\Temp\acrocef_low\2c7c96d0-6dbe-4ac4-9a3e-3364dc542925.tmp

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                            Category:dropped
                            Size (bytes):758601
                            Entropy (8bit):7.98639316555857
                            Encrypted:false
                            SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                            MD5:3A49135134665364308390AC398006F1
                            SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                            SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                            SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                            Malicious:false
                            Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                            C:\Users\user\AppData\Local\Temp\acrocef_low\50b33b00-fcfb-4fe5-bf78-a41cabe76e12.tmp

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                            Category:dropped
                            Size (bytes):386528
                            Entropy (8bit):7.9736851559892425
                            Encrypted:false
                            SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                            MD5:5C48B0AD2FEF800949466AE872E1F1E2
                            SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                            SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                            SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                            Malicious:false
                            Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                            C:\Users\user\AppData\Local\Temp\acrocef_low\d63eb713-e382-4e7d-9648-eb2317c1d6fc.tmp

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                            Category:dropped
                            Size (bytes):1407294
                            Entropy (8bit):7.97605879016224
                            Encrypted:false
                            SSDEEP:24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
                            MD5:716C2C392DCD15C95BBD760EEBABFCD0
                            SHA1:4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
                            SHA-256:DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
                            SHA-512:E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
                            Malicious:false
                            Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                            C:\Users\user\AppData\Local\Temp\acrocef_low\e30c5581-2652-4af7-a622-e5e5f4a8691a.tmp

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
                            Category:dropped
                            Size (bytes):1419751
                            Entropy (8bit):7.976496077007677
                            Encrypted:false
                            SSDEEP:24576:/rwYIGNPtdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL57oXGZfjs:TwZGD3mlind9i4ufFXpAXkrfUs0qWLqN
                            MD5:24D4B0DD6EAAFB4D02EDEDF25B0FCD92
                            SHA1:F60075C44E0F633C967304915975D160A1183F75
                            SHA-256:4CFA93E01E7E524C467430EAA0DD107EFD3AB66BC41F153494C72A7FDFC3EE90
                            SHA-512:0DFFA50EB40861872F29551B915942C420E61D71E843FEFBCDC2873AB63E5F0102C8CBF1FF786FE8E30DFD05179DF6A45291D0518A274BE5830EC29791146660
                            Malicious:false
                            Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                            Static File Info

                            General

                            File type:PDF document, version 1.3, 1 pages
                            Entropy (8bit):7.928951449992473
                            TrID:
                            • Adobe Portable Document Format (5005/1) 100.00%
                            File name:Knight Law Group ACH Information.pdf
                            File size:47'376 bytes
                            MD5:e3eadc211a1c5c2c9dd5645a36556dd4
                            SHA1:09df07cca21c3d28fc3423b2d284e0372e0086cc
                            SHA256:9bb15ceba006f4987825ce90cb3e8b9747af812ba05233641db7078894a43be9
                            SHA512:ab2914cce1f735535ee13b255afe6b9321b7f1958acec7446015f080fcecf5a11e387e4acc893018371c89b5884f748ab6429d0af26945bd482300c816691f96
                            SSDEEP:768:NrXrGLVqP70/aFMpXhgSCdZpoUXN1pzFhnOM5Xdn+siQLHJQT8pfNH8u9IZd4Xi:R7GLVC7kakXaSMZ5XNXRhnOsNn+snLpy
                            TLSH:8223D07BD905951EED028293883BF6568F5C31F37DC83C812C7CCA8BA186854E93F956
                            File Content Preview:%PDF-1.3.%............3 0 obj.<< /Filter /FlateDecode /Length 1462 >>.stream.x..X.r.6...+nv.L...";...n;...L...T.NR[vb'...{...DR.l....xpq.......Otr. h.@<.?l..3..}..\0/i....-9..;ZmH.8....T.K..f....J...../f......[E.....Z...F(.......7i7e..q&..s..p..X.c..s....

                            File Icon

                            Icon Hash:62cc8caeb29e8ae0

                            Static PDF Info

                            General

                            Header:%PDF-1.3
                            Total Entropy:7.928951
                            Total Bytes:47376
                            Stream Entropy:7.972972
                            Stream Bytes:43091
                            Entropy outside Streams:5.023889
                            Bytes outside Streams:4285
                            Number of EOF found:1
                            Bytes after EOF:
                            NameCount
                            obj23
                            endobj23
                            stream9
                            endstream9
                            xref1
                            trailer1
                            startxref1
                            /Page1
                            /Encrypt0
                            /ObjStm0
                            /URI0
                            /JS1
                            /JavaScript0
                            /AA0
                            /OpenAction0
                            /AcroForm0
                            /JBIG2Decode0
                            /RichMedia0
                            /Launch0
                            /EmbeddedFile0
                            IDDHASHMD5Preview
                            120000000000000000edea3a2cb29d1afa2a48ec857fa00eed

                            Network Behavior

                            Download Network PCAP: filtered – full

                            Network Port Distribution

                            • Total Packets: 13
                            • • 443 (HTTPS)
                            • • 53 (DNS)
                            TimestampSource PortDest PortSource IPDest IP
                            Apr 28, 2025 20:21:29.703545094 CEST49697443192.168.2.523.202.56.131
                            Apr 28, 2025 20:21:29.703593016 CEST4434969723.202.56.131192.168.2.5
                            Apr 28, 2025 20:21:29.703692913 CEST49697443192.168.2.523.202.56.131
                            Apr 28, 2025 20:21:29.704282045 CEST49697443192.168.2.523.202.56.131
                            Apr 28, 2025 20:21:29.704298019 CEST4434969723.202.56.131192.168.2.5
                            Apr 28, 2025 20:21:30.004652023 CEST4434969723.202.56.131192.168.2.5
                            Apr 28, 2025 20:21:30.004710913 CEST49697443192.168.2.523.202.56.131
                            Apr 28, 2025 20:21:30.019880056 CEST49697443192.168.2.523.202.56.131
                            Apr 28, 2025 20:21:30.019898891 CEST4434969723.202.56.131192.168.2.5
                            Apr 28, 2025 20:21:30.020292044 CEST49697443192.168.2.523.202.56.131
                            Apr 28, 2025 20:21:30.020297050 CEST4434969723.202.56.131192.168.2.5
                            Apr 28, 2025 20:21:30.020502090 CEST4434969723.202.56.131192.168.2.5
                            Apr 28, 2025 20:21:30.020629883 CEST49697443192.168.2.523.202.56.131
                            Apr 28, 2025 20:21:30.021109104 CEST4434969723.202.56.131192.168.2.5
                            Apr 28, 2025 20:21:30.021301031 CEST4434969723.202.56.131192.168.2.5
                            Apr 28, 2025 20:21:30.021339893 CEST49697443192.168.2.523.202.56.131
                            Apr 28, 2025 20:21:30.021745920 CEST49697443192.168.2.523.202.56.131
                            Apr 28, 2025 20:21:30.064277887 CEST4434969723.202.56.131192.168.2.5
                            Apr 28, 2025 20:21:30.176644087 CEST4434969723.202.56.131192.168.2.5
                            Apr 28, 2025 20:21:30.177464008 CEST49697443192.168.2.523.202.56.131
                            Apr 28, 2025 20:21:30.177481890 CEST4434969723.202.56.131192.168.2.5
                            Apr 28, 2025 20:21:40.838901997 CEST49697443192.168.2.523.202.56.131
                            Apr 28, 2025 20:21:40.840101004 CEST4434969723.202.56.131192.168.2.5
                            Apr 28, 2025 20:21:40.840152979 CEST49697443192.168.2.523.202.56.131
                            TimestampSource PortDest PortSource IPDest IP
                            Apr 28, 2025 20:21:13.447273016 CEST6473253192.168.2.51.1.1.1
                            Apr 28, 2025 20:21:13.587775946 CEST53647321.1.1.1192.168.2.5

                            DNS Queries

                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                            Apr 28, 2025 20:21:13.447273016 CEST192.168.2.51.1.1.10x2fafStandard query (0)c.pki.googA (IP address)IN (0x0001)false

                            DNS Answers

                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                            Apr 28, 2025 20:21:12.687674046 CEST1.1.1.1192.168.2.50x7413No error (0)edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com84.201.221.18A (IP address)IN (0x0001)false
                            Apr 28, 2025 20:21:12.687674046 CEST1.1.1.1192.168.2.50x7413No error (0)edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com84.201.221.21A (IP address)IN (0x0001)false
                            Apr 28, 2025 20:21:12.687674046 CEST1.1.1.1192.168.2.50x7413No error (0)edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com84.201.221.37A (IP address)IN (0x0001)false
                            Apr 28, 2025 20:21:12.687674046 CEST1.1.1.1192.168.2.50x7413No error (0)edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com84.201.221.22A (IP address)IN (0x0001)false
                            Apr 28, 2025 20:21:12.687674046 CEST1.1.1.1192.168.2.50x7413No error (0)edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com84.201.221.20A (IP address)IN (0x0001)false
                            Apr 28, 2025 20:21:12.687674046 CEST1.1.1.1192.168.2.50x7413No error (0)edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com84.201.221.26A (IP address)IN (0x0001)false
                            Apr 28, 2025 20:21:12.687674046 CEST1.1.1.1192.168.2.50x7413No error (0)edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com84.201.221.34A (IP address)IN (0x0001)false
                            Apr 28, 2025 20:21:12.687674046 CEST1.1.1.1192.168.2.50x7413No error (0)edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com84.201.221.23A (IP address)IN (0x0001)false
                            Apr 28, 2025 20:21:13.587775946 CEST1.1.1.1192.168.2.50x2fafNo error (0)c.pki.googpki-goog.l.google.comCNAME (Canonical name)IN (0x0001)false
                            Apr 28, 2025 20:21:13.587775946 CEST1.1.1.1192.168.2.50x2fafNo error (0)pki-goog.l.google.com192.178.49.195A (IP address)IN (0x0001)false

                            Statistics

                            CPU Usage

                            020406080100s020406080100

                            Click to jump to process

                            Memory Usage

                            020406080100s0.00204060MB

                            Click to jump to process

                            High Level Behavior Distribution

                            • • File
                            • • Registry

                            Click to dive into process behavior distribution

                            Behavior

                            Click to jump to process

                            System Behavior

                            General

                            Target ID:0
                            Start time:14:21:15
                            Start date:28/04/2025
                            Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            Wow64 process (32bit):false
                            Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Knight Law Group ACH Information.pdf"
                            Imagebase:0x7ff605f00000
                            File size:5'641'176 bytes
                            MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true
                            Show Windows behavior

                            File Activities

                            Show Windows behavior

                            Section Activities

                            Show Windows behavior

                            Registry Activities

                            Show Windows behavior

                            COM Activities

                            Show Windows behavior

                            Mutex Activities

                            Show Windows behavior

                            Process Activities

                            Show Windows behavior

                            Thread Activities

                            Show Windows behavior

                            Memory Activities

                            Show Windows behavior

                            System Activities

                            There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                            Show Windows behavior

                            Windows UI Activities

                            There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                            There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                            There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                            General

                            Target ID:1
                            Start time:14:21:16
                            Start date:28/04/2025
                            Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            Wow64 process (32bit):false
                            Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                            Imagebase:0x7ff7340a0000
                            File size:3'581'912 bytes
                            MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true
                            Show Windows behavior

                            File Activities

                            Show Windows behavior

                            Section Activities

                            There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                            Show Windows behavior

                            Mutex Activities

                            Show Windows behavior

                            Process Activities

                            Show Windows behavior

                            Thread Activities

                            Show Windows behavior

                            Memory Activities

                            There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                            There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                            There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                            Show Windows behavior

                            Process Token Activities

                            There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                            General

                            Target ID:2
                            Start time:14:21:17
                            Start date:28/04/2025
                            Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            Wow64 process (32bit):false
                            Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1728 --field-trial-handle=1600,i,8750823394921883741,16636045827587014535,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                            Imagebase:0x7ff7340a0000
                            File size:3'581'912 bytes
                            MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true
                            There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                            Show Windows behavior

                            Section Activities

                            There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                            There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                            Show Windows behavior

                            Process Activities

                            Show Windows behavior

                            Thread Activities

                            Show Windows behavior

                            Memory Activities

                            There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                            There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                            There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                            Disassembly

                            ⊘No disassembly