Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SOPO-PDF-83324.pdf

Overview

General Information

Sample name:SOPO-PDF-83324.pdf
Analysis ID:1500779
MD5:39aaad18c7d6fbc487e8bb3c71bbeb12
SHA1:97b2dddb385f644dccfb2d5ae059e1a18c70be66
SHA256:1d39d123dcc22348e7abd5cb61c463ed4d449636d9f4c0083c060898094434d8
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 7724 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\SOPO-PDF-83324.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 7892 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 8084 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1736,i,6818598665815656412,16629184505958586391,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.203.104.175:443
Source: global trafficTCP traffic: 23.203.104.175:443 -> 192.168.2.4:49742
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.203.104.175:443
Source: global trafficTCP traffic: 23.203.104.175:443 -> 192.168.2.4:49742
Source: global trafficTCP traffic: 23.203.104.175:443 -> 192.168.2.4:49742
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.203.104.175:443
Source: global trafficTCP traffic: 23.203.104.175:443 -> 192.168.2.4:49742
Source: global trafficTCP traffic: 23.203.104.175:443 -> 192.168.2.4:49742
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.203.104.175:443
Source: global trafficTCP traffic: 23.203.104.175:443 -> 192.168.2.4:49742
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.203.104.175:443
Source: global trafficTCP traffic: 23.203.104.175:443 -> 192.168.2.4:49742
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.203.104.175:443
Source: global trafficTCP traffic: 23.203.104.175:443 -> 192.168.2.4:49742
Source: global trafficTCP traffic: 23.203.104.175:443 -> 192.168.2.4:49742
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.203.104.175:443
Source: global trafficTCP traffic: 23.203.104.175:443 -> 192.168.2.4:49742
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.203.104.175:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.203.104.175:443
Source: Joe Sandbox ViewIP Address: 23.203.104.175 23.203.104.175
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknownTCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknownTCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknownTCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknownTCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknownTCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknownTCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknownTCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknownTCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknownTCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknownTCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknownTCP traffic detected without corresponding DNS query: 23.203.104.175
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.1.drString found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.drString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: classification engineClassification label: clean2.winPDF@14/47@0/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journalJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-08-28 16-35-49-185.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\SOPO-PDF-83324.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1736,i,6818598665815656412,16629184505958586391,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1736,i,6818598665815656412,16629184505958586391,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: SOPO-PDF-83324.pdfInitial sample: PDF keyword /JS count = 0
Source: SOPO-PDF-83324.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: SOPO-PDF-83324.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive12
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1500779 Sample: SOPO-PDF-83324.pdf Startdate: 28/08/2024 Architecture: WINDOWS Score: 2 6 Acrobat.exe 20 72 2->6         started        process3 8 AcroCEF.exe 106 6->8         started        process4 10 AcroCEF.exe 2 8->10         started        dnsIp5 13 23.203.104.175, 443, 49742 AKAMAI-ASUS United States 10->13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
bg.microsoft.map.fastly.net
199.232.210.172
truefalse
    		unknown

    World Map of Contacted IPs

    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs

    Public IPs

    IPDomainCountryFlagASNASN NameMalicious
    23.203.104.175
    		unknownUnited States
    		16625AKAMAI-ASUSfalse

    General Information

    Joe Sandbox version:40.0.0 Tourmaline
    Analysis ID:1500779
    Start date and time:2024-08-28 22:34:54 +02:00
    Joe Sandbox product:CloudBasic
    Overall analysis duration:0h 3m 54s
    Hypervisor based Inspection enabled:false
    Report type:full
    Cookbook file name:defaultwindowspdfcookbook.jbs
    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
    Number of analysed new started processes analysed:10
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • EGA enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:Timeout
    Sample name:SOPO-PDF-83324.pdf
    Detection:CLEAN
    Classification:clean2.winPDF@14/47@0/1
    Cookbook Comments:
    • Found application associated with file extension: .pdf
    • Found PDF document
    • Close Viewer

    Warnings

    • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
    • Excluded IPs from analysis (whitelisted): 184.28.88.176, 107.22.247.231, 18.207.85.246, 34.193.227.236, 54.144.73.197, 2.16.164.105, 2.16.164.64, 2.16.164.65, 2.16.164.107, 2.16.164.96, 2.16.164.75, 2.16.164.115, 2.16.164.114, 2.16.164.121, 172.64.41.3, 162.159.61.3, 2.16.241.15, 2.16.241.13, 199.232.210.172, 2.19.126.205, 2.19.126.209, 2.19.126.203
    • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, identrust.edgesuite.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, a1952.dscq.akamai.net, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com, apps.identrust.com, wu-b-net.trafficmanager.net
    • Not all processes where analyzed, report is missing behavior information
    • VT rate limit hit for: SOPO-PDF-83324.pdf

    Simulations

    Behavior and APIs

    TimeTypeDescription
    16:35:59API Interceptor3x Sleep call for process: AcroCEF.exe modified

    LLM Input / Output

    InputOutput
    URL: PDF document Model: jbxai
    {
"brand":["brand1",
"brand2"],
"contains_trigger_text":true,
"prominent_button_name":"view_shared_file",
"text_input_field_labels":["username",
"password"],
"pdf_icon_visible":true,
"has_visible_captcha":true,
"has_urgent_text":true,
"has_visible_qrcode":true}

    Joe Sandbox View / Context

    IPs

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    23.203.104.175Madisonwellsmedia546.pdfGet hashmaliciousHTMLPhisherBrowse
      crewssubaru doc.pdfGet hashmaliciousHTMLPhisherBrowse
        1U34vTVJ97.pdfGet hashmaliciousUnknownBrowse
          +10618189554_VM_Mbda-usVM.mp3.pdfGet hashmaliciousUnknownBrowse
            Pago.VHnSRZgxAc.pdfGet hashmaliciousUnknownBrowse
              2.htaGet hashmaliciousUnknownBrowse
                Secured Doc-[aQb-26731].pdfGet hashmaliciousHTMLPhisherBrowse
                  #Ud83e#Udd38_#U2642#Ufe0f Thanks! payment complete Thank you zypsryzzpaplqm 512 CHH.msgGet hashmaliciousUnknownBrowse
                    EU1RxTz1e4.exeGet hashmaliciousMetasploitBrowse
                      QLI Omaha.pdfGet hashmaliciousHTMLPhisherBrowse

                        Domains

                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        bg.microsoft.map.fastly.nethttps://07d6b6-35.myshopify.com/pages/enternal/#1aWdvYmVsaUBoaWxjb3JwLmNvbQ0=Get hashmaliciousHTMLPhisher, Tycoon2FABrowse
                        • 199.232.214.172
                        http://leembal.com.mxGet hashmaliciousUnknownBrowse
                        • 199.232.214.172
                        August Shipment - Inv No. 041.xlsGet hashmaliciousUnknownBrowse
                        • 199.232.210.172
                        http://bellantonicioccolato.it/wp-content/uploads/2020/11/gutweedtE.exeGet hashmaliciousUnknownBrowse
                        • 199.232.210.172
                        http://arianarings.comGet hashmaliciousUnknownBrowse
                        • 199.232.214.172
                        https://sway.cloud.microsoft/lKpl4nBPezd0EfSeGet hashmaliciousUnknownBrowse
                        • 199.232.214.172
                        Setup-Pro.exeGet hashmaliciousLummaCBrowse
                        • 199.232.214.172
                        http://general72.s3-website.us-east-2.amazonaws.comGet hashmaliciousUnknownBrowse
                        • 199.232.214.172
                        https://tinyurl.com/VYBGWANWGet hashmaliciousUnknownBrowse
                        • 199.232.210.172
                        goopdate.dllGet hashmaliciousUnknownBrowse
                        • 199.232.210.172

                        ASNs

                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        AKAMAI-ASUShttps://ca.docusign.net/Signing/EmailStart.aspx?a=1cdabf46-ff5a-4450-ae28-4b5293077687&etti=24&acct=938a1226-4cc2-4b96-95f9-d33be464ae6b&er=5b95ae4e-7414-40c0-b9fc-e2de228fcc1bGet hashmaliciousUnknownBrowse
                        • 2.19.126.227
                        phish_alert_iocp_v1.4.48 (43).emlGet hashmaliciousHTMLPhisherBrowse
                        • 2.19.126.147
                        file.exeGet hashmaliciousLummaC, VidarBrowse
                        • 23.199.218.33
                        file.exeGet hashmaliciousLummaC, VidarBrowse
                        • 23.192.247.89
                        https://oh3y.ulvantiro.su/82xG/Get hashmaliciousHTMLPhisherBrowse
                        • 184.30.24.22
                        file.exeGet hashmaliciousLummaC, VidarBrowse
                        • 23.192.247.89
                        https://d4g6kw04.na1.hubspotlinks.com/Ctc/I9+113/d4G6KW04/VVDXvw2129f7W9lgpSl3-BQgwW4125np5kh8PvN1n_9Xx5kBl-W50kH_H6lZ3lBW5xCLbK6c416cW6G0HMx6QhV7VVrZqSG3HBKSjV6wDNg4ZyZn6W7_FTpm1dqZm4W723tVM4rftccW3vWlSp1wGvTJW2zXXwV1X740xN1t2gyvnMRlqW7JdFVP1Ty-FHN3Fp_ww3m7TdW66_q2r1Q3VwtW7Dpks077Qf8bM1V49whQ40NW6RphCp8kpt1HV_HZcV84HKmBW5lF7ZC61FD66W73XZV57GJ9ZkVDMN0b9hXGx2W8dysfm3qm-8VMZTWKPM6VCVW6l8ws98dhwKqW4Z2gzl8fZ601N7pH1zqJ5vZ5N90-353vPlZ7VD24xR8Rht6PVyTztF65g6ScN24XQrJRlvxMW20qlrM4TTNP7W6Lc5vQ43Pq7NW32bHwR84HFLgVgWx3d5S85nlf8gcVNq04Get hashmaliciousUnknownBrowse
                        • 2.19.126.135
                        https://securemsgdesk.cam/yte67Get hashmaliciousUnknownBrowse
                        • 23.220.132.219
                        file.exeGet hashmaliciousLummaC, VidarBrowse
                        • 23.199.218.33
                        mbda-us.comAudiowav012.htmlGet hashmaliciousHTMLPhisherBrowse
                        • 2.19.224.184

                        JA3 Fingerprints

                        ⊘No context

                        Dropped Files

                        ⊘No context

                        Created / dropped Files

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):292
                        Entropy (8bit):5.327658081397646
                        Encrypted:false
                        SSDEEP:6:NLp5MGL+q2Pwkn2nKuAl9OmbnIFUt88LpY1Zmw+8LpOLVkwOwkn2nKuAl9OmbjLJ:NLpevYfHAahFUt88LpY1/+8Lpq5JfHAR
                        MD5:C4D76972C13807619BF17E7020A71E78
                        SHA1:CF6E70F9C30A6563978FD2E718E731DDE983C158
                        SHA-256:30A1C22E5AE01379FE21D2A22EBDF484F41F7868D237D787AB2019199ED35DF2
                        SHA-512:C57B63E3FA1C7243C6D16BC2B1B3C98D1BC582B76837A3C855AA9424D173EF9B425787FE7AF575E5CD3957A3D1B51289AD2808BE98CB0622F58F7D7FB90BBBF1
                        Malicious:false
                        Reputation:low
                        Preview:2024/08/28-16:35:46.949 1f78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/08/28-16:35:46.951 1f78 Recovering log #3.2024/08/28-16:35:46.951 1f78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):292
                        Entropy (8bit):5.327658081397646
                        Encrypted:false
                        SSDEEP:6:NLp5MGL+q2Pwkn2nKuAl9OmbnIFUt88LpY1Zmw+8LpOLVkwOwkn2nKuAl9OmbjLJ:NLpevYfHAahFUt88LpY1/+8Lpq5JfHAR
                        MD5:C4D76972C13807619BF17E7020A71E78
                        SHA1:CF6E70F9C30A6563978FD2E718E731DDE983C158
                        SHA-256:30A1C22E5AE01379FE21D2A22EBDF484F41F7868D237D787AB2019199ED35DF2
                        SHA-512:C57B63E3FA1C7243C6D16BC2B1B3C98D1BC582B76837A3C855AA9424D173EF9B425787FE7AF575E5CD3957A3D1B51289AD2808BE98CB0622F58F7D7FB90BBBF1
                        Malicious:false
                        Reputation:low
                        Preview:2024/08/28-16:35:46.949 1f78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/08/28-16:35:46.951 1f78 Recovering log #3.2024/08/28-16:35:46.951 1f78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):336
                        Entropy (8bit):5.236562057729282
                        Encrypted:false
                        SSDEEP:6:NLpEN9+q2Pwkn2nKuAl9Ombzo2jMGIFUt88LpH3JZmw+8Lpfk9VkwOwkn2nKuAlx:NLpw+vYfHAa8uFUt88LpHZ/+8LpfCV56
                        MD5:976A394466B4E76D58126DA00853D40C
                        SHA1:40AF98558BB5254D1B7E2FAB54D5BA98CACD1718
                        SHA-256:C7DB0C5F54B2FCD0EF508A3C6820436523CEE8942C00CC4956CBB69CAE7DA45A
                        SHA-512:529DA584864A8EB453FA94DE7BA93DA13D862ACB79470CEFA25F8A564D2B925BF8A95D28EEA19FB7925E0BBA16E0DC8F8A664F9C8FCF218F82F18244F09E65AB
                        Malicious:false
                        Reputation:low
                        Preview:2024/08/28-16:35:47.101 1fbc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/08/28-16:35:47.102 1fbc Recovering log #3.2024/08/28-16:35:47.103 1fbc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):336
                        Entropy (8bit):5.236562057729282
                        Encrypted:false
                        SSDEEP:6:NLpEN9+q2Pwkn2nKuAl9Ombzo2jMGIFUt88LpH3JZmw+8Lpfk9VkwOwkn2nKuAlx:NLpw+vYfHAa8uFUt88LpHZ/+8LpfCV56
                        MD5:976A394466B4E76D58126DA00853D40C
                        SHA1:40AF98558BB5254D1B7E2FAB54D5BA98CACD1718
                        SHA-256:C7DB0C5F54B2FCD0EF508A3C6820436523CEE8942C00CC4956CBB69CAE7DA45A
                        SHA-512:529DA584864A8EB453FA94DE7BA93DA13D862ACB79470CEFA25F8A564D2B925BF8A95D28EEA19FB7925E0BBA16E0DC8F8A664F9C8FCF218F82F18244F09E65AB
                        Malicious:false
                        Reputation:low
                        Preview:2024/08/28-16:35:47.101 1fbc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/08/28-16:35:47.102 1fbc Recovering log #3.2024/08/28-16:35:47.103 1fbc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):475
                        Entropy (8bit):4.970548621198367
                        Encrypted:false
                        SSDEEP:12:YH/um3RA8sq8TQ2sBdOg2Hacaq3QYiubInP7E4T3y:Y2sRdsvOdMHV3QYhbG7nby
                        MD5:29E8E1B8267B835DAAE0050CBE9880CC
                        SHA1:DFF5A5051F735234849109503EA3ED7E55A41BD9
                        SHA-256:05119EA31776142A23CFBD596D86B090E2FA45EA658679534AA8858AACDB2E5E
                        SHA-512:B522470FCD9CBC25839523D707EA9B3356F4719C240DB1D692C54FE9EDE7BD1086BD2DBCFF7D19216E743F3B826E2996A66397F721822EB465F38FD430BFE0C7
                        Malicious:false
                        Reputation:low
                        Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13369437359619177","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138059},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a03e1eda-6f88-43c4-b0bf-09cb02ca908a.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:JSON data
                        Category:modified
                        Size (bytes):475
                        Entropy (8bit):4.970548621198367
                        Encrypted:false
                        SSDEEP:12:YH/um3RA8sq8TQ2sBdOg2Hacaq3QYiubInP7E4T3y:Y2sRdsvOdMHV3QYhbG7nby
                        MD5:29E8E1B8267B835DAAE0050CBE9880CC
                        SHA1:DFF5A5051F735234849109503EA3ED7E55A41BD9
                        SHA-256:05119EA31776142A23CFBD596D86B090E2FA45EA658679534AA8858AACDB2E5E
                        SHA-512:B522470FCD9CBC25839523D707EA9B3356F4719C240DB1D692C54FE9EDE7BD1086BD2DBCFF7D19216E743F3B826E2996A66397F721822EB465F38FD430BFE0C7
                        Malicious:false
                        Reputation:low
                        Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13369437359619177","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138059},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):4730
                        Entropy (8bit):5.2506215810368255
                        Encrypted:false
                        SSDEEP:96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7LI3p+Lz2vzEZp+Z:etJCV4FiN/jTN/2r8Mta02fEhgO73goO
                        MD5:ED6FBCB3394D51EC17AC8A4050050D85
                        SHA1:94353BBD7A918C31E29FC8FCF922EBE8A1B92C85
                        SHA-256:8658FBE5F8E76C0280F04B717E851D18B0990B625C78085EF190B8E1676724AE
                        SHA-512:D6C210467878F42F0C7DC14115A714F69DE70EB9D4215CABF08E3E0D0FDAD748969F8F6D982BFE870A6B7CEDFDA2D3C1AA6CAD36B8A8345033785DE19710CAAA
                        Malicious:false
                        Reputation:low
                        Preview:*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):324
                        Entropy (8bit):5.275926499497365
                        Encrypted:false
                        SSDEEP:6:NLpwUiN9+q2Pwkn2nKuAl9OmbzNMxIFUt88LpUS3JZmw+8LpMF39VkwOwkn2nKuP:NLpwH3+vYfHAa8jFUt88Lp//+8LpoV51
                        MD5:B7D7EFFD7FC79D2233ACAAD5DF149FAD
                        SHA1:BC97849FDDDF6007AD6810CDAED83DD783D4A851
                        SHA-256:2A07F11F835B7F744000CDD8D756EA54CE484A1FBDABC0C7704BB0E964D43A04
                        SHA-512:86BDF583E8996944A760D498349E677DEC9BEE6DC4B79736E81DE81BB20A60FB30FADC8A0849EF2C0F491071C6D6618F37F9977569DFAEE96A4BC20C01134B0D
                        Malicious:false
                        Reputation:low
                        Preview:2024/08/28-16:35:47.563 1fbc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/08/28-16:35:47.575 1fbc Recovering log #3.2024/08/28-16:35:47.585 1fbc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):324
                        Entropy (8bit):5.275926499497365
                        Encrypted:false
                        SSDEEP:6:NLpwUiN9+q2Pwkn2nKuAl9OmbzNMxIFUt88LpUS3JZmw+8LpMF39VkwOwkn2nKuP:NLpwH3+vYfHAa8jFUt88Lp//+8LpoV51
                        MD5:B7D7EFFD7FC79D2233ACAAD5DF149FAD
                        SHA1:BC97849FDDDF6007AD6810CDAED83DD783D4A851
                        SHA-256:2A07F11F835B7F744000CDD8D756EA54CE484A1FBDABC0C7704BB0E964D43A04
                        SHA-512:86BDF583E8996944A760D498349E677DEC9BEE6DC4B79736E81DE81BB20A60FB30FADC8A0849EF2C0F491071C6D6618F37F9977569DFAEE96A4BC20C01134B0D
                        Malicious:false
                        Reputation:low
                        Preview:2024/08/28-16:35:47.563 1fbc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/08/28-16:35:47.575 1fbc Recovering log #3.2024/08/28-16:35:47.585 1fbc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240828203551Z-154.bmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
                        Category:dropped
                        Size (bytes):71190
                        Entropy (8bit):0.9694501657457111
                        Encrypted:false
                        SSDEEP:96:Ovjzzx+YsAhqRerahAe3bKmtJt+VOenynX6a90ynG4PaYHKJZA:aJ+Y2jft2gec6QaEKY
                        MD5:1E65E32DFDDDEBF790CC021A1A803F4A
                        SHA1:88EA1DA8A801399450DE1CC9E2A2DEB0B3F08CF1
                        SHA-256:0BD8A4F504E5DE54AD8647EBEBBCFFC0D65F07843A5C6D52A641A67902FFEB5C
                        SHA-512:0A8A7EFDE59B157DC4247DDF579B6762487E3BC143B47D5D3C0A4576F3E7D30547998DD093420E01F979D81F945573BA76F779141EFB2DB3DD48CCF8F40EFF8E
                        Malicious:false
                        Preview:BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
                        Category:dropped
                        Size (bytes):86016
                        Entropy (8bit):4.445632036683976
                        Encrypted:false
                        SSDEEP:384:yezci5t8iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rbs3OazzU89UTTgUL
                        MD5:BB525B1AFABE0EF9B038A0D066DDB23B
                        SHA1:A403778B4FC2D36696D03A0624DDCDC64A09CB93
                        SHA-256:843FA5340D3A4F546C2B8EB7BE426FD6FE76193781FB61B9A88065322DA78B7B
                        SHA-512:A962CD2B679AD1148BE66E2509BBEC99D54E22A2CD147099DFB20C2EEDE84367D1FACBFC320839C9E57988C4E2A3819C0BE194A6E3201A3895CDAE0EB1867B76
                        Malicious:false
                        Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:SQLite Rollback Journal
                        Category:dropped
                        Size (bytes):8720
                        Entropy (8bit):3.7752315912953565
                        Encrypted:false
                        SSDEEP:48:7Mpp/E2ioyVMioy9oWoy1Cwoy1AKOioy1noy1AYoy1Wioy1hioybioyKoy1noy1s:7KpjuMF/XKQHHb9IVXEBodRBk0
                        MD5:FE21F57F83D0AE2763E1ADFF8A905B3E
                        SHA1:FF73BF7B7963CF3F0991C70D153D162ABB96709D
                        SHA-256:426EE549D0687F5C73773788B4313516A72625092E3B7A3FB2CCC445F63B436A
                        SHA-512:84BC270C6797EE3BE4BD5185785D6820A34CE8AE1929A253C9BFDD3755E5301E7B7E50F0283432B26AB9AF890688442C491F21ACA274DC3175AA68A5A96B593D
                        Malicious:false
                        Preview:.... .c.....xvkB...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                        Category:dropped
                        Size (bytes):71954
                        Entropy (8bit):7.996617769952133
                        Encrypted:true
                        SSDEEP:1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
                        MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
                        SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
                        SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
                        SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
                        Malicious:false
                        Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

                        C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):893
                        Entropy (8bit):7.366016576663508
                        Encrypted:false
                        SSDEEP:24:hBntmDvKUQQDvKUr7C5fpqp8gPvXHmXvponXux:3ntmD5QQD5XC5RqHHXmXvp++x
                        MD5:D4AE187B4574036C2D76B6DF8A8C1A30
                        SHA1:B06F409FA14BAB33CBAF4A37811B8740B624D9E5
                        SHA-256:A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
                        SHA-512:1F44A360E8BB8ADA22BC5BFE001F1BABB4E72005A46BC2A94C33C4BD149FF256CCE6F35D65CA4F7FC2A5B9E15494155449830D2809C8CF218D0B9196EC646B0C
                        Malicious:false
                        Preview:0..y..*.H.........j0..f...1.0...*.H.........N0..J0..2.......D....'..09...@k0...*.H........0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30...000930211219Z..210930140115Z0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30.."0...*.H.............0..........P..W..be......,k0.[...}.@......3vI*.?!I..N..>H.e...!.e.*.2....w..{........s.z..2..~..0....*8.y.1.P..e.Qc...a.Ka..Rk...K.(.H......>.... .[.*....p....%.tr.{j.4.0...h.{T....Z...=d.....Ap..r.&.8U9C....\@........%.......:..n.>..\..<.i....*.)W..=....]......B0@0...U.......0....0...U...........0...U.........{,q...K.u...`...0...*.H...............,...\...(f7:...?K.... ]..YD.>.>..K.t.....t..~.....K. D....}..j.....N..:.pI...........:^H...X._..Z.....Y..n......f3.Y[...sG.+..7H..VK....r2...D.SrmC.&H.Rg.X..gvqx...V..9$1....Z0G..P.......dc`........}...=2.e..|.Wv..(9..e...w.j..w.......)...55.1.

                        C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:data
                        Category:modified
                        Size (bytes):328
                        Entropy (8bit):3.2418003062782916
                        Encrypted:false
                        SSDEEP:6:kKSa9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:kDImsLNkPlE99SNxAhUe/3
                        MD5:342CA23C27AAF34D8B29E51684F65039
                        SHA1:D9D36E3750E4126EB5B8E204EDFBF9D11CE4EDC7
                        SHA-256:8EA6BB1285725FA17B9BE61A684B7A3509B5B2E8BD6DBB6D8F0B354E1CCDFFF0
                        SHA-512:87294153438A1F94926667C695A8FD9AF40DF2387E5F93997CE2F21030104FF882E39FEFC96C32C9B6134FBC93C8DF19E581C2280D74D39E26D05CD65EACFD69
                        Malicious:false
                        Preview:p...... ...............(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

                        C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):252
                        Entropy (8bit):3.0215269645321685
                        Encrypted:false
                        SSDEEP:3:kkFklWB0tfllXlE/E/KRkzllPlzRkwWBARLNDU+ZMlKlBkvclcMlVHblB8V7lnka:kKBBIxliBAIdQZV7I7kc3
                        MD5:E0855B8711AA54B6367A3B37185AEA1F
                        SHA1:F33FE08742D1E566E6A308FC35D0B793880DF403
                        SHA-256:A2588C53BFC5923B586302FCFC72EF22BC1A60B8FB63CCD9E109C0A2E5C08478
                        SHA-512:2F9475EAA81601B401F088114510E1D0EB8737D3322B9E4B0F7B1BD03F965A754AB99E1B7887AAC5E649F74BBDBC831A17F4191A787C9A78904A52619BC2CBCB
                        Malicious:false
                        Preview:p...... ....`.....d....(....................................................... ........!.M........(...........}...h.t.t.p.:././.a.p.p.s...i.d.e.n.t.r.u.s.t...c.o.m./.r.o.o.t.s./.d.s.t.r.o.o.t.c.a.x.3...p.7.c...".3.7.d.-.6.0.7.9.b.8.c.0.9.2.9.c.0."...

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7804

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:PostScript document text
                        Category:dropped
                        Size (bytes):185099
                        Entropy (8bit):5.182478651346149
                        Encrypted:false
                        SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                        MD5:94185C5850C26B3C6FC24ABC385CDA58
                        SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                        SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                        SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                        Malicious:false
                        Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:PostScript document text
                        Category:dropped
                        Size (bytes):185099
                        Entropy (8bit):5.182478651346149
                        Encrypted:false
                        SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                        MD5:94185C5850C26B3C6FC24ABC385CDA58
                        SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                        SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                        SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                        Malicious:false
                        Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):243196
                        Entropy (8bit):3.3450692389394283
                        Encrypted:false
                        SSDEEP:1536:vKPCPiyzDtrh1cK3XEivK7VK/3AYvYwgqErRo+RQn:yPClJ/3AYvYwghFo+RQn
                        MD5:F5567C4FF4AB049B696D3BE0DD72A793
                        SHA1:EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916
                        SHA-256:D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
                        SHA-512:E769735991E5B1331E259608854D00CDA4F3E92285FDC500158CBD09CBCCEAD8A387F78256A43919B13EBE70C995D19242377C315B0CCBBD4F813251608C1D56
                        Malicious:false
                        Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):295
                        Entropy (8bit):5.353049955310222
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXdWhe+RTnVoZcg1vRcR0YIEeoAvJM3g98kUwPeUkwRe9:YvXKXdAiZc0vgGMbLUkee9
                        MD5:7ED439D64E7249E957B0F0F07AFBB019
                        SHA1:43F71774B164149C33FAD365E1212E4A73864CEA
                        SHA-256:9322CDE3C7ECB9F28E81299261AC3BA933852D9771CD26769F7282B2DEF4433C
                        SHA-512:EA833A39C11F7BB4590F20BA0EA820D233D495FD6AC574B755F8AA0697E8AF727921415062AA50B45CF9593D064A5A68D083C0919965B5E0256B69F5E9A7A64D
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"9cb353c6-ab65-4efb-a3b0-ada19bdaa237","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1725051532644,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):294
                        Entropy (8bit):5.302830053292633
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXdWhe+RTnVoZcg1vRcR0YIEeoAvJfBoTfXpnrPeUkwRe9:YvXKXdAiZc0vgGWTfXcUkee9
                        MD5:9BF912FCB83F4CCD6696B04B1E68D196
                        SHA1:DA0E880BC704A059E4FAB53AA2FBE4568A4D9AB7
                        SHA-256:2D4B8DD9267D49581C0FB7A346C1B200A32C527A8E46626B576D33D543C511A7
                        SHA-512:E008B52C892B45E66E71A7AFC9F396A0202EAECBCC4C0639A2240AA23F2E097B8AF36665A5C1C53DCF50A0C3750C4E197E0D95DD1FCE9087D7E46ECA50D2DF4E
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"9cb353c6-ab65-4efb-a3b0-ada19bdaa237","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1725051532644,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):294
                        Entropy (8bit):5.2810895486504394
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXdWhe+RTnVoZcg1vRcR0YIEeoAvJfBD2G6UpnrPeUkwRe9:YvXKXdAiZc0vgGR22cUkee9
                        MD5:6BD2C0A0447549812ED6B4672FADCCF6
                        SHA1:5803775CAE28B36EBF9230EE55FAF647AAACBF79
                        SHA-256:E717970EB819D60219A0C21AAB34ADB1F5E6EE1F44F87979D72E8E0A366A1A35
                        SHA-512:30DCF21C776A9B6FEAF6C2E1B4A75D4EFE98763E9C500FEC204C2A407656691202C999502E684876670D8F287C5D68D0733174F92DB135A8386DCDD9F77C67DB
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"9cb353c6-ab65-4efb-a3b0-ada19bdaa237","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1725051532644,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):285
                        Entropy (8bit):5.339698586733206
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXdWhe+RTnVoZcg1vRcR0YIEeoAvJfPmwrPeUkwRe9:YvXKXdAiZc0vgGH56Ukee9
                        MD5:FACE588A2E6AA4CE57EC3A6315D6B6BA
                        SHA1:8D4B9BC7228D75ACD270A0D379FC2B0E0D66E73B
                        SHA-256:10E4B0FD27E01D3AB2AF217979CA0EA42300966A3A0DF4FD55C5954164ED4CCD
                        SHA-512:DB361B771AD5FF21B0537FB8E217061B9C0A980D8F377EAF5F34625CBD5BD63A22ABFE2C78E5BFE658B936465ED219C3B144067A15EA2221169CDFB72CE1422E
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"9cb353c6-ab65-4efb-a3b0-ada19bdaa237","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1725051532644,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):1063
                        Entropy (8bit):5.657312479510959
                        Encrypted:false
                        SSDEEP:24:Yv6XWizv9pLgEFqciGennl0RCmK8czOCY4w2/:YvvalhgLtaAh8cvYvw
                        MD5:0CE56827A4BD188FFF78CD0AFACA1F6E
                        SHA1:5A7EFF5679833D4A4D9B06FFDEAFDD0296D67778
                        SHA-256:A1F024B7DC176BE63BE2B8E261AA22C65C91B4054F819212F1E5CF63571A29A3
                        SHA-512:1CEC5C02C01F1F2CED55F3B51FADC7E13D38DE4F68C734A953607DCA8F2CD2867921E403E9E5759AAFCBA82B4DC0DCDCD19975E392049DF1DE2CB4A489681DA9
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"9cb353c6-ab65-4efb-a3b0-ada19bdaa237","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1725051532644,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_2","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"afb9c2a3-eaf4-41f9-9d73-768e72f72282","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQgZmlsZXMgdG8gYW5kIGZyb20gUERGXG53aXRob3V0IGxpbWl0cy4ifSwidGNhdElkIjpudWxsfQ==","dataType":"application\/json","encodingSc

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):1050
                        Entropy (8bit):5.645153325855375
                        Encrypted:false
                        SSDEEP:24:Yv6XWizvhVLgEF0c7sbnl0RCmK8czOCYHflEpwiV/:YvvapFg6sGAh8cvYHWpwW
                        MD5:6CF150C256EADDC5EA7C7F88E04CDFCE
                        SHA1:E923ED3151DD1A912B46CF63CC63EECF544D03A4
                        SHA-256:B97B4287C53A6C732D1BB420481E7BF6451A1078A6A0FC601055932A004F39F9
                        SHA-512:EB0D8FAAAC4759B3BC7A56DE04937B95E0595256B6B9926C6876C533FB9F8A1B2AECADD870D8CFB108EFFD32C0890809033399E6ECFCB64FB0A91FB6723E4A0E
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"9cb353c6-ab65-4efb-a3b0-ada19bdaa237","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1725051532644,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_0","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"0924134e-3c59-4f53-b731-add558c56fec","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuZm9ybXMgJiBhZ3JlZW1lbnRzLiJ9LCJ0Y2F0SWQiOm51bGx9","dataType":"application\/json","encodingScheme":true},"

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):292
                        Entropy (8bit):5.289790412765438
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXdWhe+RTnVoZcg1vRcR0YIEeoAvJfQ1rPeUkwRe9:YvXKXdAiZc0vgGY16Ukee9
                        MD5:649260C1F901933195DC05B929FD2BEB
                        SHA1:1D2E16C30A6D38937B500C11DB85F357017DA48F
                        SHA-256:6636959B2C75691CD0DFB5367F8A90CF9FA4FF3780201DCA986D4DB20E94F57D
                        SHA-512:B9135AA3862BE9C3410023A24442618F1FC333CD59F76BF71B0EE7E1C5E281F4E7222CF639B52DA3F20C89E2431530CD13E59BC50B792F748440355FF4EDD9D2
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"9cb353c6-ab65-4efb-a3b0-ada19bdaa237","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1725051532644,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):1038
                        Entropy (8bit):5.63786249511126
                        Encrypted:false
                        SSDEEP:24:Yv6XWizvQ2LgEF7cciAXs0nl0RCmK8czOCAPtciB/:YvvaYogc8hAh8cvAt
                        MD5:978C25C4DC6E4F01F05B4877627769C8
                        SHA1:21291FBB6F7685F2799AB5AA1CC689DCDB054E6C
                        SHA-256:0219CFBFF900BE66425921051F27AAC5FDBDFF214B2DBCC84FC00F37678C6B86
                        SHA-512:DEDB97075571C3388059107FC807BCA3D54CCFA8730B948CCB4306E3100345DAE3C6E446D89564099D5A4C4561EEF4897A231ADEB889C4C6FA50850CD90C2A75
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"9cb353c6-ab65-4efb-a3b0-ada19bdaa237","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1725051532644,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_1","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"49d2f713-7aa9-44db-aa50-0a7a22add459","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVkaXQgdGV4dCwgaW1hZ2VzLCBwYWdlcywgYW5kIG1vcmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme":true},"endDTS":1744

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):1164
                        Entropy (8bit):5.692551807619
                        Encrypted:false
                        SSDEEP:24:Yv6XWizvYKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK5/:YvvaQEgqprtrS5OZjSlwTmAfSKR
                        MD5:E232432031441B0D10F59D09D35B2726
                        SHA1:CA2FAD15A871660A5368E18844E460E94F7E8CCD
                        SHA-256:3771580A49B0EC12F3291DA6A6012A61B4B8E99D84B17A33B28BF1584CD0B329
                        SHA-512:D712EB8571BF5F4AE04E03734002C4111C4FC025D20D913E35803C0629820CD5B8B492C3862DDA0A761F679264788FB6519E33B147F06AB8B459B1A9E41FA96D
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"9cb353c6-ab65-4efb-a3b0-ada19bdaa237","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1725051532644,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):289
                        Entropy (8bit):5.29095012463114
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXdWhe+RTnVoZcg1vRcR0YIEeoAvJfYdPeUkwRe9:YvXKXdAiZc0vgGg8Ukee9
                        MD5:73254EC98B6FB6B875E694AEC247668B
                        SHA1:44A628AC63CDCCE74AC2FCD6FA0C1E010B44C3A5
                        SHA-256:6CE819B3EA35A21FD80E9DCE77637EA61BB1A6F355689E735968439C45AA8DF4
                        SHA-512:594AEB276D48601EC80B694469D3ABBACEC2DBAE427E544C9A532FDBDDE5DB904FA1AB23D855C30BA3CF5F3515E989F6F74ACDC5EF0BB247B262D5C201B9FA41
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"9cb353c6-ab65-4efb-a3b0-ada19bdaa237","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1725051532644,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):1395
                        Entropy (8bit):5.77159274586781
                        Encrypted:false
                        SSDEEP:24:Yv6XWizv3rLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJN3:YvvafHgDv3W2aYQfgB5OUupHrQ9FJR
                        MD5:B78ABFE1C5B8EE385BE00E791D222952
                        SHA1:1E993A9A75507C76641A18CF64993ACAD5138D99
                        SHA-256:C3C463197D35454B1FA91ACE2CDAC26FE90E9B59EFF0C1091233F6438CFB7191
                        SHA-512:1B52583843ACC6A685E0FCE19B8D01D4F94B15F6522931741A0603D0B1ED455E941A2F358BC2A2139BB94405EAB206EDD2BD3D0B72716C1F8B764D1A7E72035A
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"9cb353c6-ab65-4efb-a3b0-ada19bdaa237","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1725051532644,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):291
                        Entropy (8bit):5.274559420761148
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXdWhe+RTnVoZcg1vRcR0YIEeoAvJfbPtdPeUkwRe9:YvXKXdAiZc0vgGDV8Ukee9
                        MD5:F15BD7653FD335F3521A9C7EDBECE3D0
                        SHA1:409F06530DFC943ADA4C536E4B79D4DED05B44B6
                        SHA-256:73D22647560FF9267EC05D5779F5EFA93DDCF958270B27244563C5541CCA146A
                        SHA-512:37A930539D6759B8D87704BFFED7080A5B69E5471A7CDE5B8CA5C14DF8289705581C0ED37F147158690F977488A09BFB130D5170D862167567AB007B803B860F
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"9cb353c6-ab65-4efb-a3b0-ada19bdaa237","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1725051532644,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):287
                        Entropy (8bit):5.2801770231245495
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXdWhe+RTnVoZcg1vRcR0YIEeoAvJf21rPeUkwRe9:YvXKXdAiZc0vgG+16Ukee9
                        MD5:1D0379978757145AEC9298D78C4FE36A
                        SHA1:C06E5B3904FE3B04A44B93AB66E30A8E77E1A681
                        SHA-256:B75F560416A6168DA1823F32B1F0229BC304AD4690A9A1A3085A496B619E9131
                        SHA-512:76EF1B5AFC7DB4F3717325BE2F420C1177BB0FFB530AD414CB84EB0C32144E6BB4EF0FFE6D07A66D6B7C7D668EE3D347FAB9C7DC2CE09692B950FB8C1C2E2E8E
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"9cb353c6-ab65-4efb-a3b0-ada19bdaa237","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1725051532644,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):1058
                        Entropy (8bit):5.645433908469637
                        Encrypted:false
                        SSDEEP:24:Yv6XWizvFamXayLgEFRcONaqnl0RCmK8czOC+w2E+tg8B/:YvvaRBguOAh8cv+NKY
                        MD5:6D4612FE3CCC101DC0403B953AD0DB0E
                        SHA1:C5B5B70386D9CB9EE0A632652D47E58610806420
                        SHA-256:B8255AB262D977836249456651C224E19A3FBD7C8747984E15EA59A6EE8F9880
                        SHA-512:51E8EDB2D2F438EAD99747EA045B70980DA1C410204A5A628FF074C3A255E70CF0BE01BEA3DDF194F7036EEEC731B16749374387ACA5EECE4A37978737D24366
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"9cb353c6-ab65-4efb-a3b0-ada19bdaa237","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1725051532644,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_3","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"ece07729-7db6-4f20-9f8d-7976ad373049","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IlNlbmQgZG9jdW1lbnRzICYgZm9ybXNcbmZvciBmYXN0IGUtc2lnbmluZyBvbmxpbmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme"

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):286
                        Entropy (8bit):5.25439819207715
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXdWhe+RTnVoZcg1vRcR0YIEeoAvJfshHHrPeUkwRe9:YvXKXdAiZc0vgGUUUkee9
                        MD5:8B0A17431A566329E3BB57ACD8BF6936
                        SHA1:21B4C9F1E9BFF8BFDF67718818AC9AFABC365943
                        SHA-256:11B39646C66BB6B70A668448A4AA8F320DA01162C1442C6E09D5B6BE81B51586
                        SHA-512:CD50E00E4FB37561E9F2992AA314852F36786C3DB381B48E3BE7A038041ADC82C379EC21738A30B589F8358E0FD4F15FC350426EE81FF21D28B75F0AE34FFFB5
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"9cb353c6-ab65-4efb-a3b0-ada19bdaa237","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1725051532644,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):782
                        Entropy (8bit):5.366220979493159
                        Encrypted:false
                        SSDEEP:12:YvXKXdAiZc0vgGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhW1R:Yv6XWizvW168CgEXX5kcIfANhW
                        MD5:7B4F835A35E967A9962E0AE12C6A554D
                        SHA1:88F549D39ACC6B0ABE4BD4149D5EEF078E477D51
                        SHA-256:B10561E9190EAC28310F50C0AF02E969F304DAB9FBD14E40E06A87B5726C6D5F
                        SHA-512:5971529063A18F6E32B62B8CAC39A3BC8D464908D469141D1BC5D5AE5F0EF9CA7E07552140A15E1DA816468FE4F45153A14E7EF4B230FACA46B04FF0A1658A11
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"9cb353c6-ab65-4efb-a3b0-ada19bdaa237","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1725051532644,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1724877352677}}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):4
                        Entropy (8bit):0.8112781244591328
                        Encrypted:false
                        SSDEEP:3:e:e
                        MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                        SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                        SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                        SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                        Malicious:false
                        Preview:....

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):2818
                        Entropy (8bit):5.133354964739527
                        Encrypted:false
                        SSDEEP:24:Y3HKEaOB3maybFVZCQKHP5VD7TK45jG/C8J8j0S3ITFC32V6Qv2LSRjk5G9D7ugj:YrB3MN/KHxVrKKG/vO8wSnjkQ9Db
                        MD5:6747E1AEC7B2756E2560BE032BFCB5D4
                        SHA1:0B46C45A24C7277B02FE2C9365F61A4E9DAB3F90
                        SHA-256:E3B2CEB2FF411C368D9837B7E0F973F456566493B7C43F25AF869FD0AC2CE6D5
                        SHA-512:5524BB82AD835CB4D4DA6F971B0EE7DBF695C5CAD94A7E93059291C17C98E310C3BC54A20BC296BDF1143EB83E17BBC2E6831D320C870592A4A1FDC580F0213A
                        Malicious:false
                        Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"1f8e8b2071d4cf284db2d723d485d6ad","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1050,"ts":1724877352000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"f87e947176a1056237b96b4333bc669b","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1724877352000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"ec0e74435edc1457947fd5dd994b028f","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1058,"ts":1724877352000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"1d25ed0717178d6236bb701f1268e41b","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1063,"ts":1724877352000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"2d7b621638d6c5efd7e0e82851b47ccf","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1038,"ts":1724877352000},{"id":"Edit_InApp_Aug2020","info":{"dg":"788c779531680cddffeae55255360b23","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":17

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
                        Category:dropped
                        Size (bytes):12288
                        Entropy (8bit):1.1887054520664866
                        Encrypted:false
                        SSDEEP:48:TGufl2GL7msEHUUUUUUUUPaTSvR9H9vxFGiDIAEkGVvp7aL:lNVmswUUUUUUUUPaT+FGSItPaL
                        MD5:39FED878D2A66E94DA4A05A7FB61CB32
                        SHA1:70CE0B21B67DBC93D5C683FD71FD308E953E0936
                        SHA-256:C3494803F54249CE3C9DC564F802BB056C4F6442723A87DDEA064F2D22E80FC6
                        SHA-512:0951B7E852E0B4570ED151500D0C652D246D409A5E3CD64DDB274755A7EF23244AF53F49682588DE1EF0BC815EDC0302C743826A7528F4314462E0394C6F5AD2
                        Malicious:false
                        Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:SQLite Rollback Journal
                        Category:dropped
                        Size (bytes):8720
                        Entropy (8bit):1.6081288961426274
                        Encrypted:false
                        SSDEEP:48:7MVKUUUUUUUUUUPaXvR9H9vxFGiDIAEkGVv8qFl2GL7mst:7fUUUUUUUUUUPavFGSIt2KVmst
                        MD5:C328B2DDD05AF379A046A67E62755BFA
                        SHA1:C64B238DE40330A3CE96A036A7DD55956E0A0050
                        SHA-256:5F10CADE7FB2CC9F5BE52DF6056E267006DFDC693DA437E7B773457BFCBE0C73
                        SHA-512:1384C89C307B0244F95F7F75F4B7B7824364B4C10F0DAC74E6ACF7838C7F3591E8661DABDB0AE580C13666EE01EBB5A7BEA1AEF79B4C2B0F183B11BF0E2B418F
                        Malicious:false
                        Preview:.... .c......g.v......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Temp\MSI58496.LOG

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):246
                        Entropy (8bit):3.54720191165387
                        Encrypted:false
                        SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8dArNMZ9:Qw946cPbiOxDlbYnuRKfNMZ9
                        MD5:4AC75547E40ADB250B6BDA46626D947A
                        SHA1:655979D1A8C99B9A8D66AFE1073ECC2A6535F3B9
                        SHA-256:DCEF088974A758FDF112259A2CE7F272345A2DA8C1E00AB689D93CDA27A27267
                        SHA-512:988C55CC55AF968DDA8B2DE5C055B43EA433E1FC32D5F857ECB3AC42D305631D794519E8E4F5459574E61FFC3FA2FA20CA2320B88A4A72A1B2B48D2760AF30F4
                        Malicious:false
                        Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.8./.0.8./.2.0.2.4. . .1.6.:.3.5.:.5.4. .=.=.=.....

                        C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-08-28 16-35-49-185.log

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:ASCII text, with very long lines (393)
                        Category:dropped
                        Size (bytes):16525
                        Entropy (8bit):5.345946398610936
                        Encrypted:false
                        SSDEEP:384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
                        MD5:8947C10F5AB6CFFFAE64BCA79B5A0BE3
                        SHA1:70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
                        SHA-256:4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
                        SHA-512:B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
                        Malicious:false
                        Preview:SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

                        C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:ASCII text, with very long lines (393), with CRLF line terminators
                        Category:dropped
                        Size (bytes):16602
                        Entropy (8bit):5.365150357766922
                        Encrypted:false
                        SSDEEP:384:gUglgwkAKww1orLTTRMHQyvbbkTYg9Z2tYthtfbRNxklrEDuJyr2dtrcPcNIJLoW:mSDSTTn
                        MD5:077DD74665E6CEEF433DE33C83D2CC1A
                        SHA1:6B1C465124347B1DE7ADF9727AE3994CA5EAE9B6
                        SHA-256:F4D993A8DB14BF4CC2DE6EA17262D275A55A4AAAF804C0FC1AE07D994CB8C2D2
                        SHA-512:AC589C51243B0DBC8C2C647D2A2D97D0ECC04CF0B1CC2075F1B7D6CEB5794055ABC32DE8A5ECC8040AE7CA19476DB090B66954ECFBA9B91DD85C5DCE60439D61
                        Malicious:false
                        Preview:SessionID=4b4caf3f-9001-4a50-b0d9-5276ef60ffe9.1724877349196 Timestamp=2024-08-28T16:35:49:196-0400 ThreadID=7644 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=4b4caf3f-9001-4a50-b0d9-5276ef60ffe9.1724877349196 Timestamp=2024-08-28T16:35:49:198-0400 ThreadID=7644 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=4b4caf3f-9001-4a50-b0d9-5276ef60ffe9.1724877349196 Timestamp=2024-08-28T16:35:49:198-0400 ThreadID=7644 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=4b4caf3f-9001-4a50-b0d9-5276ef60ffe9.1724877349196 Timestamp=2024-08-28T16:35:49:198-0400 ThreadID=7644 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=4b4caf3f-9001-4a50-b0d9-5276ef60ffe9.1724877349196 Timestamp=2024-08-28T16:35:49:198-0400 ThreadID=7644 Component=ngl-lib_NglAppLib Description="SetConf

                        C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):29752
                        Entropy (8bit):5.394127496297977
                        Encrypted:false
                        SSDEEP:768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rU:4
                        MD5:EA25D2E7D159D9AAC62DA94F6C3E1348
                        SHA1:FF836A89E67777ED0DE4CE738AB84DE54683E339
                        SHA-256:6B292688DEBDD9DAAFEC3676B3DA4131B1EE0D267B8221A1FADF453EE3F1DB67
                        SHA-512:472C26D2546ABB1CBA4171EEB7BFFFF30D66DDDDA55315A78EF54224E85EE1F4DB1C25A36D802156BC5DB0D4E18FAA53C599EAF833951CBE0C3EFE75166D949A
                        Malicious:false
                        Preview:03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

                        C:\Users\user\AppData\Local\Temp\acrocef_low\2666cbb8-2997-48d2-a7ad-84640efd61f7.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                        Category:dropped
                        Size (bytes):1407294
                        Entropy (8bit):7.97605879016224
                        Encrypted:false
                        SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
                        MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
                        SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
                        SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
                        SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
                        Malicious:false
                        Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                        C:\Users\user\AppData\Local\Temp\acrocef_low\27d2a96c-1530-481a-a430-449a781e7341.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                        Category:dropped
                        Size (bytes):386528
                        Entropy (8bit):7.9736851559892425
                        Encrypted:false
                        SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                        MD5:5C48B0AD2FEF800949466AE872E1F1E2
                        SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                        SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                        SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                        Malicious:false
                        Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                        C:\Users\user\AppData\Local\Temp\acrocef_low\6c6dc23b-08cf-4734-86f5-4f6788304333.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                        Category:dropped
                        Size (bytes):758601
                        Entropy (8bit):7.98639316555857
                        Encrypted:false
                        SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                        MD5:3A49135134665364308390AC398006F1
                        SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                        SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                        SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                        Malicious:false
                        Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                        C:\Users\user\AppData\Local\Temp\acrocef_low\fdbb2410-4359-4532-92c3-e6ae786b71e8.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                        Category:dropped
                        Size (bytes):1419751
                        Entropy (8bit):7.976496077007677
                        Encrypted:false
                        SSDEEP:24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
                        MD5:18E3D04537AF72FDBEB3760B2D10C80E
                        SHA1:B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
                        SHA-256:BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
                        SHA-512:2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
                        Malicious:false
                        Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                        Static File Info

                        General

                        File type:PDF document, version 1.4, 3 pages
                        Entropy (8bit):7.950873001143668
                        TrID:
                        • Adobe Portable Document Format (5005/1) 100.00%
                        File name:SOPO-PDF-83324.pdf
                        File size:58'002 bytes
                        MD5:39aaad18c7d6fbc487e8bb3c71bbeb12
                        SHA1:97b2dddb385f644dccfb2d5ae059e1a18c70be66
                        SHA256:1d39d123dcc22348e7abd5cb61c463ed4d449636d9f4c0083c060898094434d8
                        SHA512:a8de734bb627cba81954a0069267dcb06e7888da395c5af49c33e0401b74bccc06f212757abf402e06a429c2efb24ab834bceccfba9b52c604c7f313c21636e2
                        SSDEEP:1536:+RA3CfgEUadgwuk+Gu3KizK3g7e1QJUCbM0DZR8r:8A47UlT12EedCjDZR8r
                        TLSH:2C43F1B5F99930ECC94E8FD1872B3ED8CE0DF25351C4209268AC415B1C9CFC967A99E1
                        File Content Preview:%PDF-1.4.%.....1 0 obj.<<./Type /Catalog./Version /1.4./Pages 2 0 R.>>.endobj.2 0 obj.<<./Type /Pages./Kids [3 0 R 4 0 R 5 0 R]./Count 3.>>.endobj.3 0 obj.<<./Type /Page./MediaBox [0.0 0.0 612.0 792.0]./Parent 2 0 R./Contents [6 0 R 7 0 R]./Resources 8 0

                        File Icon

                        Icon Hash:62cc8caeb29e8ae0

                        Static PDF Info

                        General

                        Header:%PDF-1.4
                        Total Entropy:7.950873
                        Total Bytes:58002
                        Stream Entropy:7.993811
                        Stream Bytes:52956
                        Entropy outside Streams:5.118722
                        Bytes outside Streams:5046
                        Number of EOF found:1
                        Bytes after EOF:

                        Keywords Statistics

                        NameCount
                        obj35
                        endobj35
                        stream16
                        endstream16
                        xref1
                        trailer1
                        startxref1
                        /Page3
                        /Encrypt0
                        /ObjStm0
                        /URI0
                        /JS0
                        /JavaScript0
                        /AA0
                        /OpenAction0
                        /AcroForm0
                        /JBIG2Decode0
                        /RichMedia0
                        /Launch0
                        /EmbeddedFile0

                        Image Streams

                        IDDHASHMD5Preview
                        16d06470d4051afd605bcfab78f270eff33b07b5679f419230
                        212092802bdae50a80bd9308b8159a6dcc8a870ea3406aeadd

                        Network Behavior

                        Network Port Distribution

                        TCP Packets

                        TimestampSource PortDest PortSource IPDest IP
                        Aug 28, 2024 22:36:00.303122044 CEST49742443192.168.2.423.203.104.175
                        Aug 28, 2024 22:36:00.303173065 CEST4434974223.203.104.175192.168.2.4
                        Aug 28, 2024 22:36:00.303235054 CEST49742443192.168.2.423.203.104.175
                        Aug 28, 2024 22:36:00.303436995 CEST49742443192.168.2.423.203.104.175
                        Aug 28, 2024 22:36:00.303451061 CEST4434974223.203.104.175192.168.2.4
                        Aug 28, 2024 22:36:00.862268925 CEST4434974223.203.104.175192.168.2.4
                        Aug 28, 2024 22:36:00.862561941 CEST49742443192.168.2.423.203.104.175
                        Aug 28, 2024 22:36:00.862612009 CEST4434974223.203.104.175192.168.2.4
                        Aug 28, 2024 22:36:00.863646984 CEST4434974223.203.104.175192.168.2.4
                        Aug 28, 2024 22:36:00.863703966 CEST49742443192.168.2.423.203.104.175
                        Aug 28, 2024 22:36:00.865998983 CEST49742443192.168.2.423.203.104.175
                        Aug 28, 2024 22:36:00.866071939 CEST4434974223.203.104.175192.168.2.4
                        Aug 28, 2024 22:36:00.866209984 CEST49742443192.168.2.423.203.104.175
                        Aug 28, 2024 22:36:00.866216898 CEST4434974223.203.104.175192.168.2.4
                        Aug 28, 2024 22:36:00.908468008 CEST49742443192.168.2.423.203.104.175
                        Aug 28, 2024 22:36:00.963463068 CEST4434974223.203.104.175192.168.2.4
                        Aug 28, 2024 22:36:00.963705063 CEST4434974223.203.104.175192.168.2.4
                        Aug 28, 2024 22:36:00.963753939 CEST49742443192.168.2.423.203.104.175
                        Aug 28, 2024 22:36:00.963973045 CEST49742443192.168.2.423.203.104.175
                        Aug 28, 2024 22:36:00.964000940 CEST4434974223.203.104.175192.168.2.4
                        Aug 28, 2024 22:36:00.964011908 CEST49742443192.168.2.423.203.104.175
                        Aug 28, 2024 22:36:00.964046955 CEST49742443192.168.2.423.203.104.175

                        DNS Answers

                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                        Aug 28, 2024 22:36:00.589550018 CEST1.1.1.1192.168.2.40xe93bNo error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
                        Aug 28, 2024 22:36:00.589550018 CEST1.1.1.1192.168.2.40xe93bNo error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false

                        HTTP Request Dependency Graph

                        • armmf.adobe.com

                        HTTPS Proxied Packets

                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                        0192.168.2.44974223.203.104.1754438084C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        TimestampBytes transferredDirectionData
                        2024-08-28 20:36:00 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
                        Host: armmf.adobe.com
                        Connection: keep-alive
                        Accept-Language: en-US,en;q=0.9
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
                        Sec-Fetch-Site: same-origin
                        Sec-Fetch-Mode: no-cors
                        Sec-Fetch-Dest: empty
                        Accept-Encoding: gzip, deflate, br
                        If-None-Match: "78-5faa31cce96da"
                        If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
                        2024-08-28 20:36:00 UTC198INHTTP/1.1 304 Not Modified
                        Content-Type: text/plain; charset=UTF-8
                        Last-Modified: Mon, 01 May 2023 15:02:33 GMT
                        ETag: "78-5faa31cce96da"
                        Date: Wed, 28 Aug 2024 20:36:00 GMT
                        Connection: close


                        Statistics

                        CPU Usage

                        Click to jump to process

                        Memory Usage

                        Click to jump to process

                        High Level Behavior Distribution

                        Click to dive into process behavior distribution

                        Behavior

                        Click to jump to process

                        System Behavior

                        General

                        Target ID:0
                        Start time:16:35:46
                        Start date:28/08/2024
                        Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        Wow64 process (32bit):false
                        Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\SOPO-PDF-83324.pdf"
                        Imagebase:0x7ff6bc1b0000
                        File size:5'641'176 bytes
                        MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high
                        Has exited:true

                        General

                        Target ID:1
                        Start time:16:35:46
                        Start date:28/08/2024
                        Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        Wow64 process (32bit):false
                        Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                        Imagebase:0x7ff74bb60000
                        File size:3'581'912 bytes
                        MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high
                        Has exited:true

                        General

                        Target ID:3
                        Start time:16:35:46
                        Start date:28/08/2024
                        Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        Wow64 process (32bit):false
                        Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1736,i,6818598665815656412,16629184505958586391,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                        Imagebase:0x7ff74bb60000
                        File size:3'581'912 bytes
                        MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high
                        Has exited:true

                        Disassembly

                        ⊘No disassembly