Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
INV114721.pdf

Overview

General Information

Sample name:INV114721.pdf
Analysis ID:1500786
MD5:d58320c091ec675e2c61e3ef86b03c3c
SHA1:cca2339754b1e8069e3fa6def3385e83d6b34585
SHA256:e0a63d3fe13447097706ab3cad1df47308f05b6b546b799ba0ffcbf13963bc93
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64_ra
  • Acrobat.exe (PID: 3020 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\INV114721.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 6920 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 6408 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2252 --field-trial-handle=1572,i,13373086223109293454,2570682305473997975,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficTCP traffic: 192.168.2.16:49720 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.16:49720 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.16:49720 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.16:49720 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.16:49720 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.16:49720 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.16:49720 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.16:49720 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.16:49720 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.16:49720 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.16:49720 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.16:49720 -> 23.56.162.185:443
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.16:49720
Source: global trafficTCP traffic: 192.168.2.16:49720 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.16:49720 -> 23.56.162.185:443
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.16:49720
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.16:49720
Source: global trafficTCP traffic: 192.168.2.16:49720 -> 23.56.162.185:443
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.16:49720
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.16:49720
Source: global trafficTCP traffic: 192.168.2.16:49720 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.16:49720 -> 23.56.162.185:443
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.16:49720
Source: global trafficTCP traffic: 192.168.2.16:49720 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.16:49720 -> 23.56.162.185:443
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.16:49720
Source: global trafficTCP traffic: 192.168.2.16:49720 -> 23.56.162.185:443
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.16:49720
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.16:49720
Source: global trafficTCP traffic: 192.168.2.16:49720 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.16:49720 -> 23.56.162.185:443
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.16:49720
Source: Joe Sandbox ViewIP Address: 23.56.162.185 23.56.162.185
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br
Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.2.drString found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.drString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 7b56304f-82fb-4290-a659-90d714338861.tmp.4.dr, d9794878-8f2c-4eda-94bc-ab6f714d7055.tmp.4.drString found in binary or memory: https://chrome.cloudflare-dns.com
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: classification engineClassification label: clean2.winPDF@15/46@0/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journalJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-08-28 16-52-28-704.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\INV114721.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2252 --field-trial-handle=1572,i,13373086223109293454,2570682305473997975,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2252 --field-trial-handle=1572,i,13373086223109293454,2570682305473997975,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: INV114721.pdfInitial sample: PDF keyword /JS count = 0
Source: INV114721.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: INV114721.pdfInitial sample: PDF keyword /Page count = 41
Source: INV114721.pdfInitial sample: PDF keyword startxref count = 26
Source: INV114721.pdfInitial sample: PDF keyword stream count = 460
Source: INV114721.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: INV114721.pdfInitial sample: PDF keyword endobj count = 992
Source: INV114721.pdfInitial sample: PDF keyword endstream count = 460
Source: INV114721.pdfInitial sample: PDF eof value = 26
Source: INV114721.pdfInitial sample: PDF keyword obj count = 992
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information queried: ProcessInformationJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS Memory1
System Information Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive12
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1500786 Sample: INV114721.pdf Startdate: 28/08/2024 Architecture: WINDOWS Score: 2 6 Acrobat.exe 20 64 2->6         started        process3 8 AcroCEF.exe 108 6->8         started        process4 10 AcroCEF.exe 6 8->10         started        dnsIp5 13 23.56.162.185, 443, 49720 AKAMAI-ASUS United States 10->13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
INV114721.pdf3%ReversingLabsDocument-PDF.Trojan.Heuristic

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://chrome.cloudflare-dns.com0%URL Reputationsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://chrome.cloudflare-dns.com7b56304f-82fb-4290-a659-90d714338861.tmp.4.dr, d9794878-8f2c-4eda-94bc-ab6f714d7055.tmp.4.drfalse
  • URL Reputation: safe
unknown

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
23.56.162.185
unknownUnited States
16625AKAMAI-ASUSfalse

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1500786
Start date and time:2024-08-28 22:51:52 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 0s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultwindowsinteractivecookbook.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:17
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:INV114721.pdf
Detection:CLEAN
Classification:clean2.winPDF@15/46@0/1
Cookbook Comments:
  • Found application associated with file extension: .pdf

Warnings

  • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 184.28.88.176, 107.22.247.231, 18.207.85.246, 54.144.73.197, 34.193.227.236, 162.159.61.3, 172.64.41.3, 2.16.241.13, 2.16.241.15, 93.184.221.240, 2.16.238.143, 2.16.238.147, 2.19.126.209, 2.19.126.205
  • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, identrust.edgesuite.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, wu.ec.azureedge.net, settings-win.data.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, wu.azureedge.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, a1952.dscq.akamai.net, login.live.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, geo2.adobe.com, apps.identrust.com, wu-b-net.trafficmanager.net
  • Not all processes where analyzed, report is missing behavior information
  • Report size exceeded maximum capacity and may have missing behavior information.
  • VT rate limit hit for: INV114721.pdf

Simulations

Behavior and APIs

TimeTypeDescription
16:52:39API Interceptor2x Sleep call for process: AcroCEF.exe modified

LLM Input / Output

InputOutput
URL: PDF document Model: jbxai
{
"brand":["Erma Foster"],
"contains_trigger_text":false,
"prominent_button_name":"unknown",
"text_input_field_labels":["unknown"],
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"has_visible_qrcode":false}

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
23.56.162.185eicar-adobe-acrobat-attachment.pdfGet hashmaliciousEICARBrowse
    Madisonwellsmedia546.pdfGet hashmaliciousUnknownBrowse
      signature.pdfGet hashmaliciousUnknownBrowse
        AG Uncorked IRMI Wine Mixer Invite.pdfGet hashmaliciousHTMLPhisherBrowse
          Gov Annual Salary + Employer - Provided Benefits2.pdfGet hashmaliciousPhisherBrowse
            Remittance 728 Norriselectric0032xslx.pdfGet hashmaliciousHTMLPhisherBrowse
              Secured Doc-[Rmz-67847].pdfGet hashmaliciousUnknownBrowse
                GONZALES, ALFREDO 0012104586, 0010640472 b .pdfGet hashmaliciousUnknownBrowse
                  Corp.AcctPayable Payment Update.pdfGet hashmaliciousUnknownBrowse
                    2024AdoptionConference-WhovaDirections-Desktop.pdfGet hashmaliciousUnknownBrowse

                      Domains

                      ⊘No context

                      ASNs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      AKAMAI-ASUShttps://ca.docusign.net/Signing/EmailStart.aspx?a=1cdabf46-ff5a-4450-ae28-4b5293077687&etti=24&acct=938a1226-4cc2-4b96-95f9-d33be464ae6b&er=5b95ae4e-7414-40c0-b9fc-e2de228fcc1bGet hashmaliciousUnknownBrowse
                      • 2.19.126.227
                      phish_alert_iocp_v1.4.48 (43).emlGet hashmaliciousHTMLPhisherBrowse
                      • 2.19.126.147
                      file.exeGet hashmaliciousLummaC, VidarBrowse
                      • 23.199.218.33
                      file.exeGet hashmaliciousLummaC, VidarBrowse
                      • 23.192.247.89
                      https://oh3y.ulvantiro.su/82xG/Get hashmaliciousHTMLPhisherBrowse
                      • 184.30.24.22
                      file.exeGet hashmaliciousLummaC, VidarBrowse
                      • 23.192.247.89
                      https://d4g6kw04.na1.hubspotlinks.com/Ctc/I9+113/d4G6KW04/VVDXvw2129f7W9lgpSl3-BQgwW4125np5kh8PvN1n_9Xx5kBl-W50kH_H6lZ3lBW5xCLbK6c416cW6G0HMx6QhV7VVrZqSG3HBKSjV6wDNg4ZyZn6W7_FTpm1dqZm4W723tVM4rftccW3vWlSp1wGvTJW2zXXwV1X740xN1t2gyvnMRlqW7JdFVP1Ty-FHN3Fp_ww3m7TdW66_q2r1Q3VwtW7Dpks077Qf8bM1V49whQ40NW6RphCp8kpt1HV_HZcV84HKmBW5lF7ZC61FD66W73XZV57GJ9ZkVDMN0b9hXGx2W8dysfm3qm-8VMZTWKPM6VCVW6l8ws98dhwKqW4Z2gzl8fZ601N7pH1zqJ5vZ5N90-353vPlZ7VD24xR8Rht6PVyTztF65g6ScN24XQrJRlvxMW20qlrM4TTNP7W6Lc5vQ43Pq7NW32bHwR84HFLgVgWx3d5S85nlf8gcVNq04Get hashmaliciousUnknownBrowse
                      • 2.19.126.135
                      https://securemsgdesk.cam/yte67Get hashmaliciousUnknownBrowse
                      • 23.220.132.219
                      file.exeGet hashmaliciousLummaC, VidarBrowse
                      • 23.199.218.33
                      mbda-us.comAudiowav012.htmlGet hashmaliciousHTMLPhisherBrowse
                      • 2.19.224.184

                      JA3 Fingerprints

                      ⊘No context

                      Dropped Files

                      ⊘No context

                      Created / dropped Files

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):290
                      Entropy (8bit):5.211542627470606
                      Encrypted:false
                      SSDEEP:6:NLmcyq2PRN2nKuAl9OmbnIFUt88Lh1Zmw+8L3RkwORN2nKuAl9OmbjLJ:NLmcyvaHAahFUt88Lr/+8L3R5JHAaSJ
                      MD5:5777BBC16D5094E5FD63FBB4F66580E5
                      SHA1:8C5B021E322689701211DCC47705E3E66D36E677
                      SHA-256:302963031B9083C1A413B361AA5772F00300DB79A59CE836029CC0381614D636
                      SHA-512:8F769A63A989682117C54090ECF571838AD9164AF6F6624279DF7869130F169AEFDBEE560B7D651B9C6C31230045C808BEEF511929955D4FCEA3375A5B0BAC0B
                      Malicious:false
                      Reputation:low
                      Preview:2024/08/28-16:52:27.246 1850 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/08/28-16:52:27.248 1850 Recovering log #3.2024/08/28-16:52:27.248 1850 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):290
                      Entropy (8bit):5.211542627470606
                      Encrypted:false
                      SSDEEP:6:NLmcyq2PRN2nKuAl9OmbnIFUt88Lh1Zmw+8L3RkwORN2nKuAl9OmbjLJ:NLmcyvaHAahFUt88Lr/+8L3R5JHAaSJ
                      MD5:5777BBC16D5094E5FD63FBB4F66580E5
                      SHA1:8C5B021E322689701211DCC47705E3E66D36E677
                      SHA-256:302963031B9083C1A413B361AA5772F00300DB79A59CE836029CC0381614D636
                      SHA-512:8F769A63A989682117C54090ECF571838AD9164AF6F6624279DF7869130F169AEFDBEE560B7D651B9C6C31230045C808BEEF511929955D4FCEA3375A5B0BAC0B
                      Malicious:false
                      Reputation:low
                      Preview:2024/08/28-16:52:27.246 1850 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/08/28-16:52:27.248 1850 Recovering log #3.2024/08/28-16:52:27.248 1850 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):334
                      Entropy (8bit):5.209684837235404
                      Encrypted:false
                      SSDEEP:6:NLHcM+q2PRN2nKuAl9Ombzo2jMGIFUt88LqEDGNJZmw+8Lz3cMVkwORN2nKuAl97:NL8M+vaHAa8uFUt88LU/+8LoMV5JHAaU
                      MD5:A8636B09EBF41942155362488953EC01
                      SHA1:C818D0E241A909DA2994335156C463FC2AE88669
                      SHA-256:92DC2D6EFF3C3DACABEE1DE448545AFD9DA09D5ACBB04CB4292C586B428274A5
                      SHA-512:AED8EAF41C3DA89CABB3C304CC07C3A894AC44D5F399994877C5D1DC466B9396FA3F03820102BAB2CCBF4B5BDEE7F2888CF2F7911DC4990C78B9D799C79A8B29
                      Malicious:false
                      Reputation:low
                      Preview:2024/08/28-16:52:27.154 18fc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/08/28-16:52:27.157 18fc Recovering log #3.2024/08/28-16:52:27.158 18fc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):334
                      Entropy (8bit):5.209684837235404
                      Encrypted:false
                      SSDEEP:6:NLHcM+q2PRN2nKuAl9Ombzo2jMGIFUt88LqEDGNJZmw+8Lz3cMVkwORN2nKuAl97:NL8M+vaHAa8uFUt88LU/+8LoMV5JHAaU
                      MD5:A8636B09EBF41942155362488953EC01
                      SHA1:C818D0E241A909DA2994335156C463FC2AE88669
                      SHA-256:92DC2D6EFF3C3DACABEE1DE448545AFD9DA09D5ACBB04CB4292C586B428274A5
                      SHA-512:AED8EAF41C3DA89CABB3C304CC07C3A894AC44D5F399994877C5D1DC466B9396FA3F03820102BAB2CCBF4B5BDEE7F2888CF2F7911DC4990C78B9D799C79A8B29
                      Malicious:false
                      Reputation:low
                      Preview:2024/08/28-16:52:27.154 18fc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/08/28-16:52:27.157 18fc Recovering log #3.2024/08/28-16:52:27.158 18fc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7b56304f-82fb-4290-a659-90d714338861.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:modified
                      Size (bytes):403
                      Entropy (8bit):4.974222621667791
                      Encrypted:false
                      SSDEEP:12:YHO8sqOTsBdOg2Hncaq3QYiubrP7E4T3y:YXs10dMHG3QYhbz7nby
                      MD5:D25E5DE1516A2F66C0630662F17C1FC1
                      SHA1:C5118E6F7832487F4B262ACD93A330FF4B489247
                      SHA-256:DB5F14C77FFFC69F3A7888976E58DAF006946C8E6FDDDE71C2A32549BBD5F2E2
                      SHA-512:A8D24BE986BB45A0926D40617CEF683CE42DBAAE5F0DE6B0936196B7D06D8F3D9F23FE882967BFAE8E39E9599841520C8A59E6D3117EC2D59B5038D0EBE0A102
                      Malicious:false
                      Reputation:low
                      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13369438359232427","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":147221},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):403
                      Entropy (8bit):4.953858338552356
                      Encrypted:false
                      SSDEEP:12:YHO8sq/WLksBdOg2H9caq3QYiubrP7E4T3y:YXsRJdMHM3QYhbz7nby
                      MD5:4C313FE514B5F4E7E89329630909F8DC
                      SHA1:916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
                      SHA-256:1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
                      SHA-512:1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
                      Malicious:false
                      Reputation:moderate, very likely benign file
                      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF501577.TMP (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):403
                      Entropy (8bit):4.953858338552356
                      Encrypted:false
                      SSDEEP:12:YHO8sq/WLksBdOg2H9caq3QYiubrP7E4T3y:YXsRJdMHM3QYhbz7nby
                      MD5:4C313FE514B5F4E7E89329630909F8DC
                      SHA1:916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
                      SHA-256:1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
                      SHA-512:1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
                      Malicious:false
                      Reputation:moderate, very likely benign file
                      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d9794878-8f2c-4eda-94bc-ab6f714d7055.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):403
                      Entropy (8bit):4.953858338552356
                      Encrypted:false
                      SSDEEP:12:YHO8sq/WLksBdOg2H9caq3QYiubrP7E4T3y:YXsRJdMHM3QYhbz7nby
                      MD5:4C313FE514B5F4E7E89329630909F8DC
                      SHA1:916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
                      SHA-256:1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
                      SHA-512:1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
                      Malicious:false
                      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):4099
                      Entropy (8bit):5.234811901155984
                      Encrypted:false
                      SSDEEP:96:OLSw0bSwIAnrRqLX2rSq1OUxu/0OZ0xRBTxekN8xeReEc6U:OLT0bTIeYa51Ogu/0OZARBT8kN889c6U
                      MD5:E6CBDF22F768B4E143073D1AD3137151
                      SHA1:74158EB9C228A6253749F51FA2F7DB4FDF301574
                      SHA-256:A6B52861965089BB2D1F99CD9ACBDD7A2773FBBFE435BB05949689DCD610D08D
                      SHA-512:C6CC86EBB90E2B4BCB4FD88527C538B5FC0CC6488552336BCDDCE9C669B4C94D2D33B10E7115EFD06CEFFD20C2817967AFE8A26A4B235F72313C611473082C8C
                      Malicious:false
                      Preview:*...#................version.1..namespace-e...o................next-map-id.1.Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/.0y.S_r................next-map-id.2.Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/.16.X:r................next-map-id.3.Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/.2.P.@o................next-map-id.4.Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/.346.+^...............Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/....^...............Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/..?&a...............Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/_...a...............Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/...o................next-map-id.5.Pnamespace-07af9ee9_2076_4f12_94b5_

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):322
                      Entropy (8bit):5.211407077949657
                      Encrypted:false
                      SSDEEP:6:NLLEcM+q2PRN2nKuAl9OmbzNMxIFUt88L6GF3JZmw+8Lh3cMVkwORN2nKuAl9Omk:NLdM+vaHAa8jFUt88LtFZ/+8LhMMV5Jv
                      MD5:F9837CAC023B954445ECB82E7A17871F
                      SHA1:7C1460893C60628B7075C530E17026FE04BFAB42
                      SHA-256:F62BF6413707F9880DBCCAE943FC93A9B156BAFF61DB5C0D55AFB56D1D189B7B
                      SHA-512:98B7A43BE60F459E125AD0DB73EB341D343A5A7687D57BD8055C944FDC6BC7D907A259ADDD324305D6FAA6FDF82DDC36320B365BE7C4E39DDAC1B63A2757A443
                      Malicious:false
                      Preview:2024/08/28-16:52:27.270 18fc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/08/28-16:52:27.271 18fc Recovering log #3.2024/08/28-16:52:27.273 18fc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):322
                      Entropy (8bit):5.211407077949657
                      Encrypted:false
                      SSDEEP:6:NLLEcM+q2PRN2nKuAl9OmbzNMxIFUt88L6GF3JZmw+8Lh3cMVkwORN2nKuAl9Omk:NLdM+vaHAa8jFUt88LtFZ/+8LhMMV5Jv
                      MD5:F9837CAC023B954445ECB82E7A17871F
                      SHA1:7C1460893C60628B7075C530E17026FE04BFAB42
                      SHA-256:F62BF6413707F9880DBCCAE943FC93A9B156BAFF61DB5C0D55AFB56D1D189B7B
                      SHA-512:98B7A43BE60F459E125AD0DB73EB341D343A5A7687D57BD8055C944FDC6BC7D907A259ADDD324305D6FAA6FDF82DDC36320B365BE7C4E39DDAC1B63A2757A443
                      Malicious:false
                      Preview:2024/08/28-16:52:27.270 18fc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/08/28-16:52:27.271 18fc Recovering log #3.2024/08/28-16:52:27.273 18fc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240828205230Z-162.bmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
                      Category:dropped
                      Size (bytes):65110
                      Entropy (8bit):1.362083954420442
                      Encrypted:false
                      SSDEEP:192:lRzrPX1AmDI1WWe13D4fBkk1UzZSXn92h1um6iRl1S14awpV1hP1yL1L51BO1k1v:Pzxwk3D45JUzZZp6WM0VhdILq+WAl
                      MD5:ED4C408D4EF163DFE60ED5DBF060E5F4
                      SHA1:CD423EECBD5AC2542E5150D0E7D542FF685F36D2
                      SHA-256:2001999823E9F5D7F3E282EC32AE68B59A94A201A03081D7800292D78EB24B9B
                      SHA-512:EE377F391C6B137051F7FBE4BB21F9CDDD56C05E77661BE2E2B357429106224CABFA5E27C23AFF3E9134F3CA22C27B0FE60B859C7E86C1A1AC2D1216B7322B57
                      Malicious:false
                      Preview:BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2
                      Category:dropped
                      Size (bytes):57344
                      Entropy (8bit):3.291927920232006
                      Encrypted:false
                      SSDEEP:192:vedRBvVui5V4R4dcQ5V4R4RtYWtEV2UUTTchqGp8F/7/z+FP:veBci5H5FY+EUUUTTcHqFzqFP
                      MD5:A4D5FECEFE05F21D6F81ACF4D9A788CF
                      SHA1:1A9AC236C80F2A2809F7DE374072E2FCCA5A775C
                      SHA-256:83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
                      SHA-512:FF106C6B9E1EA4B1F3E3AB01FAEA21BA24A885E63DDF0C36EB0A8C3C89A9430FE676039C076C50D7C46DC4E809F6A7E35A4BFED64D9033FEBD6121AC547AA5E9
                      Malicious:false
                      Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite Rollback Journal
                      Category:dropped
                      Size (bytes):16928
                      Entropy (8bit):1.215383195776262
                      Encrypted:false
                      SSDEEP:24:7+tx9MqLi+zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+i:7MYqLmFTIF3XmHjBoGGR+jMz+LhF
                      MD5:6F24251B85EED34B3A9668C97B8AA83E
                      SHA1:BD4FB1D43D99D611F84ACC7A24F5509EDA28FB05
                      SHA-256:5BC50C01EDCC28F09F25DD198B9937C0871A86420B73DE0287F5D8B0F9A51C4E
                      SHA-512:45E6918E7B1B5E91E942A6E38B4600DF486DF1C969C5F015CAF6B6D5BC7D27B6678E58BBB38AA666FCCF2C6853353DEB26D8027B351EFC38F329F89B01AE0084
                      Malicious:false
                      Preview:.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                      Category:dropped
                      Size (bytes):71954
                      Entropy (8bit):7.996617769952133
                      Encrypted:true
                      SSDEEP:1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
                      MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
                      SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
                      SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
                      SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
                      Malicious:false
                      Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):893
                      Entropy (8bit):7.366016576663508
                      Encrypted:false
                      SSDEEP:24:hBntmDvKUQQDvKUr7C5fpqp8gPvXHmXvponXux:3ntmD5QQD5XC5RqHHXmXvp++x
                      MD5:D4AE187B4574036C2D76B6DF8A8C1A30
                      SHA1:B06F409FA14BAB33CBAF4A37811B8740B624D9E5
                      SHA-256:A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
                      SHA-512:1F44A360E8BB8ADA22BC5BFE001F1BABB4E72005A46BC2A94C33C4BD149FF256CCE6F35D65CA4F7FC2A5B9E15494155449830D2809C8CF218D0B9196EC646B0C
                      Malicious:false
                      Preview:0..y..*.H.........j0..f...1.0...*.H.........N0..J0..2.......D....'..09...@k0...*.H........0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30...000930211219Z..210930140115Z0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30.."0...*.H.............0..........P..W..be......,k0.[...}.@......3vI*.?!I..N..>H.e...!.e.*.2....w..{........s.z..2..~..0....*8.y.1.P..e.Qc...a.Ka..Rk...K.(.H......>.... .[.*....p....%.tr.{j.4.0...h.{T....Z...=d.....Ap..r.&.8U9C....\@........%.......:..n.>..\..<.i....*.)W..=....]......B0@0...U.......0....0...U...........0...U.........{,q...K.u...`...0...*.H...............,...\...(f7:...?K.... ]..YD.>.>..K.t.....t..~.....K. D....}..j.....N..:.pI...........:^H...X._..Z.....Y..n......f3.Y[...sG.+..7H..VK....r2...D.SrmC.&H.Rg.X..gvqx...V..9$1....Z0G..P.......dc`........}...=2.e..|.Wv..(9..e...w.j..w.......)...55.1.

                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:data
                      Category:modified
                      Size (bytes):328
                      Entropy (8bit):3.144086598890895
                      Encrypted:false
                      SSDEEP:6:kKj19UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:7cDnLNkPlE99SNxAhUe/3
                      MD5:8E4A9C08357719031F9288DEE8F8F0C8
                      SHA1:F5EB46C4013093C9D8FA6C0E05762DE1B5307487
                      SHA-256:DF9DF961F90CD64C287AC08BAB8ABB1D5AC6F1BFA16D3BB5CA443FB12F0FAB38
                      SHA-512:1835E35163915446E2D41FD40236C1E44CE208C8FD03E71304AA6956960EE873BA7919714F9DD0DC3B555EFEB3C44E902A4C96CA73C5C670A32400F9AA48E010
                      Malicious:false
                      Preview:p...... ........<..J....(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):252
                      Entropy (8bit):3.0056539486591523
                      Encrypted:false
                      SSDEEP:3:kkFkl3TrLVltfllXlE/E/KRkzllPlzRkwWBARLNDU+ZMlKlBkvclcMlVHblB8V7F:kKyrLlxliBAIdQZV7I7kc3
                      MD5:523C9F7108952D8492711120367225C2
                      SHA1:BA707CEE4931FC2B66B634E655A7B727FFA4C0F8
                      SHA-256:632C31C8E664AE7DE31CD4034413693A4DF3435F12938030C00FA67E091392F1
                      SHA-512:E37A45DED45CAA4341958CB3700687EAE4DD8B32E843F3BCA335CBF7B7C383B41A33AE45A208186E90AAD20050C6CD43E3FB5C408F3F8D47C14EFBF7812B96CF
                      Malicious:false
                      Preview:p...... ....`....768....(....................................................... ........!.M........(...........}...h.t.t.p.:././.a.p.p.s...i.d.e.n.t.r.u.s.t...c.o.m./.r.o.o.t.s./.d.s.t.r.o.o.t.c.a.x.3...p.7.c...".3.7.d.-.6.0.7.9.b.8.c.0.9.2.9.c.0."...

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):295
                      Entropy (8bit):5.374823581747444
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXH8M1aHNVQ5IRR4UhUR0YBRWxoAvJM3g98kUwPeUkwRe9:YvXKXz1aQWRuUhU2OGMbLUkee9
                      MD5:73A13C637F3DD56A79DFCA3E53A2989D
                      SHA1:D33CBB62649AEABE2C1CD78A40514062C9AB93AC
                      SHA-256:2D84DBB7B3F6E8331DB616DDFB6FA43B30B744372FE1FBFCE39BF0056D12C359
                      SHA-512:0B75415CE0AD09BE630DB9F7D1786F8B333916B55CA00BCA4E51CEF4B24BAF737551972E6AC481F1CA41708C2DCA3A42D4304622729F5961B8C34090B2202CBA
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"02594a2a-09ba-4d74-8bd7-a87cc7b6ff99","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1725051812917,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.324343853151872
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXH8M1aHNVQ5IRR4UhUR0YBRWxoAvJfBoTfXpnrPeUkwRe9:YvXKXz1aQWRuUhU2OGWTfXcUkee9
                      MD5:3B824387DAF92ABB47FC0E47C38C0F56
                      SHA1:CC87916A03D93CE4FD0E69059122BA432C586E08
                      SHA-256:C1A8415CC0D71D116EEBFF39A68B3F781257EC44FAC39C4306262823BED70EBD
                      SHA-512:2565EE913DFE961DB9A6220D7B62AA3888D91964DE82E5258895446F5299D7C6C35CEC01CC4E631DA9BD5E7FC71346F25F85984C8737C8769AE69BEF8B7AD330
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"02594a2a-09ba-4d74-8bd7-a87cc7b6ff99","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1725051812917,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.302296453151231
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXH8M1aHNVQ5IRR4UhUR0YBRWxoAvJfBD2G6UpnrPeUkwRe9:YvXKXz1aQWRuUhU2OGR22cUkee9
                      MD5:4504C7A6A126E71AED5B8CEEB1D8B400
                      SHA1:45E1B4C36347AE27CEB7CCA56D53BE1C84A95ED5
                      SHA-256:74460812C9CDFF5D1547BF5733EA8D40ADF39F10D05C0F4A401A370009CB9E05
                      SHA-512:D41584890D96AC80CB3E0BD5FACD103C6AE1B3FEBA867B6E1502873D352C962717416D85992D7A4554F6E6F7B3F742EFD74B27823321AA76BE1251DCD6199390
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"02594a2a-09ba-4d74-8bd7-a87cc7b6ff99","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1725051812917,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):285
                      Entropy (8bit):5.363605882608799
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXH8M1aHNVQ5IRR4UhUR0YBRWxoAvJfPmwrPeUkwRe9:YvXKXz1aQWRuUhU2OGH56Ukee9
                      MD5:188225AE0FCF9D676209773F4DBC639E
                      SHA1:68999971CB3FCCAC20D52880D2C7EAEB34CA2739
                      SHA-256:445C025E8583596A01CFB77C6CD9CE82AE94455243B7785C7583D50301383C3A
                      SHA-512:9D313025D190CB382974CB9A55FD9E7D8B8BAF95E383E83838A35E5DEDC889CB56059FA0F12B80F880D687DE7C430A2D1E8335A892E2D3B79C92083C1962A37F
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"02594a2a-09ba-4d74-8bd7-a87cc7b6ff99","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1725051812917,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1063
                      Entropy (8bit):5.669719844495914
                      Encrypted:false
                      SSDEEP:24:Yv6Xz6U27pLgEFqciGennl0RCmK8czOCY4w2aS:YvZU+hgLtaAh8cvYvfS
                      MD5:F6FED228B53D855B0E9CD81FAC05814B
                      SHA1:CA44FCF0037451B1B74420DB69F08D66F37BEF7A
                      SHA-256:21D86CF469A64D4C82296531FE35F7EE8B2D9FD140BF3866E830F614C7558EF0
                      SHA-512:3E6166F12DDBD8B0BAFD479C6C01E72C7B0B7D8A2A5893B7B98CCD2E2334454C4F1ECC1EC0B401F0D07EAF251F551632B1B4F0BC8BD4307EE32D985DFC5FD381
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"02594a2a-09ba-4d74-8bd7-a87cc7b6ff99","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1725051812917,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_2","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"afb9c2a3-eaf4-41f9-9d73-768e72f72282","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQgZmlsZXMgdG8gYW5kIGZyb20gUERGXG53aXRob3V0IGxpbWl0cy4ifSwidGNhdElkIjpudWxsfQ==","dataType":"application\/json","encodingSc

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1050
                      Entropy (8bit):5.657635593844822
                      Encrypted:false
                      SSDEEP:24:Yv6Xz6U23VLgEF0c7sbnl0RCmK8czOCYHflEpwiVaS:YvZUoFg6sGAh8cvYHWpwRS
                      MD5:3E970BBE3334089E67F7E7AAAEAAA87A
                      SHA1:A9E30BECDD1AF2C35C32474767E7D56E5DE1E975
                      SHA-256:B5E371C4CE4BF0C24B014E800D0759838E0168A7D37A067F9A9C76B28B2F4900
                      SHA-512:F2DA5D44D0246DCEA9C057A3D45CC70819CB190E1DF32D476797B6CD30215AE830FD5C6353C50B547700C0D491783F84E18CBE9A2B3ACF7CC3C05DED9A05EED8
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"02594a2a-09ba-4d74-8bd7-a87cc7b6ff99","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1725051812917,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_0","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"0924134e-3c59-4f53-b731-add558c56fec","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuZm9ybXMgJiBhZ3JlZW1lbnRzLiJ9LCJ0Y2F0SWQiOm51bGx9","dataType":"application\/json","encodingScheme":true},"

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.315031641245687
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXH8M1aHNVQ5IRR4UhUR0YBRWxoAvJfQ1rPeUkwRe9:YvXKXz1aQWRuUhU2OGY16Ukee9
                      MD5:EBD2A10FBFBF2F4BC190F74880A49FAD
                      SHA1:4C16F34BF09394892748DC70516FD72524B86DE3
                      SHA-256:6D32484A2890BAF50EB2BD623CA38FEAB3735C869E218271451C81130A118E89
                      SHA-512:BB55174C11EA5903535AA3FABC7F203FAEC2CE275A6105FC25A066EEB74B6406DA16A59734E2FAB8FACAC50A15C40643C04AA9940E92412F3282298273031B8A
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"02594a2a-09ba-4d74-8bd7-a87cc7b6ff99","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1725051812917,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1038
                      Entropy (8bit):5.650657164909142
                      Encrypted:false
                      SSDEEP:24:Yv6Xz6U2m2LgEF7cciAXs0nl0RCmK8czOCAPtciBaS:YvZUtogc8hAh8cvA0S
                      MD5:CABDEEE8B89F862A0FAB2A102F070D41
                      SHA1:FACE2424180ABBB8462D27ACB9720D6EA6507FE7
                      SHA-256:439B5A2A60ED042B4678636F667B7E2E97DC9814A816452AFC98F8209B551128
                      SHA-512:24E87842E6052AA5E96751424558636FD43A51A06038C732D787C2185AF32CBD2EA72B451763912E7A6E5F8146EB39316DF2803BBE1672F45D93A9FE77FD6B8E
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"02594a2a-09ba-4d74-8bd7-a87cc7b6ff99","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1725051812917,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_1","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"49d2f713-7aa9-44db-aa50-0a7a22add459","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVkaXQgdGV4dCwgaW1hZ2VzLCBwYWdlcywgYW5kIG1vcmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme":true},"endDTS":1744

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1164
                      Entropy (8bit):5.700514799554353
                      Encrypted:false
                      SSDEEP:24:Yv6Xz6U2KKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK5aS:YvZUFEgqprtrS5OZjSlwTmAfSKgS
                      MD5:3154723F45D633EA688AF7DA2B53808C
                      SHA1:0D371E17F0A4A791AE61E33B613D60CBB9C765B8
                      SHA-256:69B73443A2F03C6A831AF70CC209D3265605FBEDD00B47C6D8037E00A4B47314
                      SHA-512:3D0EFE67BE7CAB25235FBF0C7E231EE211676CB31D37B81567C73B9F07E8D647FF83BDAF8A168D2DF0B03DB2AD61692ED2AF8900AC82DBD997BAED096121E856
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"02594a2a-09ba-4d74-8bd7-a87cc7b6ff99","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1725051812917,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.31822728014662
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXH8M1aHNVQ5IRR4UhUR0YBRWxoAvJfYdPeUkwRe9:YvXKXz1aQWRuUhU2OGg8Ukee9
                      MD5:F18C4A8C6CB1D6E7EAF3611D1043E4AB
                      SHA1:B50730AB773FFEDD62DD4103F10F9A9251A7C400
                      SHA-256:E7CDE0958541C50147527AF85F62CB3B8551AB6F6B0DB013AAD692A229CE2FD5
                      SHA-512:4D2D91CCD0BBA7A5FEF5F8FA205222FB7894A740A689F83A6341A08779F3A00C594D8D497587641FA14670E7126B86E2F475BEB3C6BCD50C3AEEA39651C022B1
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"02594a2a-09ba-4d74-8bd7-a87cc7b6ff99","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1725051812917,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1395
                      Entropy (8bit):5.775790238918671
                      Encrypted:false
                      SSDEEP:24:Yv6Xz6U25rLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNiS:YvZU4HgDv3W2aYQfgB5OUupHrQ9FJgS
                      MD5:B6AA005232063C6C2D28B1EE21087BEB
                      SHA1:6140311FC950958716BEB4DD85A5D50CBE8B52C8
                      SHA-256:54B261A52BECB3E3EB14D014DE47D7B245F6E4527F0FA9957263E0A998BA4D1F
                      SHA-512:0E59DE168E10670A8791D39D1A76A767FEA4BBF4B25C4DD2E995F704534C1E59169C76347F74CBF693B626FC37DBD7EB9753D33E6AC10D426F7F7CA835541E7B
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"02594a2a-09ba-4d74-8bd7-a87cc7b6ff99","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1725051812917,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):291
                      Entropy (8bit):5.301649104417412
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXH8M1aHNVQ5IRR4UhUR0YBRWxoAvJfbPtdPeUkwRe9:YvXKXz1aQWRuUhU2OGDV8Ukee9
                      MD5:BE1952CE6A726436716915A03D6F4B32
                      SHA1:99BC29D3815FC01C734860C448A55A8F2A3C9B6E
                      SHA-256:1565E9200A525712246F5A3ACA4893F8D0B656DC47E29093FFC62DD6C16B12E5
                      SHA-512:C8CF6693BD3687E74E05DEB5FC6E620946BD0C52A69E66AC0B7AD3D51CC509589511805F62CE148056036FBD06904D8AC71A3F4C24DC79DEFCC2C9CEDFEBBC92
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"02594a2a-09ba-4d74-8bd7-a87cc7b6ff99","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1725051812917,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):287
                      Entropy (8bit):5.30585799426125
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXH8M1aHNVQ5IRR4UhUR0YBRWxoAvJf21rPeUkwRe9:YvXKXz1aQWRuUhU2OG+16Ukee9
                      MD5:DF11BF18A612079860D26C55A2C6F6FF
                      SHA1:90BDF2F078CE6541D040119D4A89580DEF9DF566
                      SHA-256:491143AB6E7F6DC17DFF68DCC919C715EF6499398AE3CAED4B6F9A42F52E7503
                      SHA-512:CAFE35CCA1D41099E1C5C5194F2701D45BBE394B700AD6F71076006D3B4D6B33091363139EB0A244B29A37BD4E9F2642B933B5AB31C385F2F370F7444A0124B2
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"02594a2a-09ba-4d74-8bd7-a87cc7b6ff99","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1725051812917,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1058
                      Entropy (8bit):5.6586074181113215
                      Encrypted:false
                      SSDEEP:24:Yv6Xz6U27amXayLgEFRcONaqnl0RCmK8czOC+w2E+tg8BaS:YvZU8BguOAh8cv+NKXS
                      MD5:7C2E1EAB74BFE49737337534883698E9
                      SHA1:7C50863B9FEA1B8EF601AE0FD2CAA62E11F8C368
                      SHA-256:EC35B71C45898C089B32C8FD5413F0EB81020E550BF094D2E1AF7F9C8A043D5E
                      SHA-512:84859035526F59670FD29E051344E4378A438A906CEE71D06AA14FC2590B8D3E6B164662E9EC0BE13902C1227EC81C02B1B08A31383F33E7AD799AC9F4BCFC09
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"02594a2a-09ba-4d74-8bd7-a87cc7b6ff99","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1725051812917,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_3","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"ece07729-7db6-4f20-9f8d-7976ad373049","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IlNlbmQgZG9jdW1lbnRzICYgZm9ybXNcbmZvciBmYXN0IGUtc2lnbmluZyBvbmxpbmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme"

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):286
                      Entropy (8bit):5.280371418412778
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXH8M1aHNVQ5IRR4UhUR0YBRWxoAvJfshHHrPeUkwRe9:YvXKXz1aQWRuUhU2OGUUUkee9
                      MD5:201D8ECF85A4C1A3B87AB1CD772774D1
                      SHA1:B36C876FB50A604E5C4EC9424107946BC269726C
                      SHA-256:814BF237A33BAD9B300D2B4B04CD6827BD68FED459EE4141A8E8A0D90E2B0E2F
                      SHA-512:0A437E134D3BE8C1E53501F1234197B95386223C807BF3F89991900191A6D6DCFCE026FF6188207D03897E9892B829BBA60B791728D41298A80BB45B69169A2E
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"02594a2a-09ba-4d74-8bd7-a87cc7b6ff99","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1725051812917,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):782
                      Entropy (8bit):5.37178103754273
                      Encrypted:false
                      SSDEEP:12:YvXKXz1aQWRuUhU2OGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWE1S:Yv6Xz6U2Y168CgEXX5kcIfANhRS
                      MD5:4D20F1324CAE4A2CD35A5577E776ED68
                      SHA1:7BD4DC9B8121A42CB73A5898A3FA49A15DFCF0F0
                      SHA-256:7B8E4161EF2A169D89916B27EE9C1F1664ABB42EC9214ED2ED8F61E7D0F2BD9E
                      SHA-512:154BB4AA41D8136E7A3BBCF7D474416C7F627D2626A7983F28359B83DD9CEE638C7E3C0DCA73E59B922E411003F1CE24CC4FCC73F8DE95C88FE30053CB8110E8
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"02594a2a-09ba-4d74-8bd7-a87cc7b6ff99","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1725051812917,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1724878352948}}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):4
                      Entropy (8bit):0.8112781244591328
                      Encrypted:false
                      SSDEEP:3:e:e
                      MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                      SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                      SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                      SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                      Malicious:false
                      Preview:....

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):2818
                      Entropy (8bit):5.139064501156319
                      Encrypted:false
                      SSDEEP:24:Y4hfKWk6agawaySIQwElC/oft0QPC29KbYbFMfKo6KNSTStjjqDj0S4VNRw2tzq5:Y4X7OtdobWFMfIJ8jqPRQGq1Ng9B
                      MD5:C8794B89344A2C2AE05756CAF1450620
                      SHA1:2BC63CD66493F4B800CDE0FCF82674377915C54E
                      SHA-256:66DCC0AA9FA82C4C8A3481C17E15644E6AC703470550E75B08EEAAA1974029C1
                      SHA-512:0DB54BDA569CF97D810734620697E2695BF870D6B1626A8DFCA58180864785D6686EE6E19E5276620D1D65A120CB57FE718F847FA057E547181A0E67CCE7E0DE
                      Malicious:false
                      Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"a3603e278b5833de66940d5cd9a33543","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1050,"ts":1724878352000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"9069b38514f975240ba12401a74df1a2","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1724878352000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"9c1ead652ff9749e4aa6acfc0af495cb","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1058,"ts":1724878352000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"b77ac6a45a51e7d0e57970dcb3f15cda","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1063,"ts":1724878352000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"f1efee913da1657763dd6ed193e0a3e7","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1038,"ts":1724878352000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"a06731c309760c9a2095618894504d89","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"t

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
                      Category:dropped
                      Size (bytes):12288
                      Entropy (8bit):0.9879570545601732
                      Encrypted:false
                      SSDEEP:24:TLHRx/XYKQvGJF7urs67Y9QmQ6Qel6IcLESiAiet6F:TVl2GL7ms67YXtrDcI88
                      MD5:A77EDDE09AEF077E7A64C4F4F0B2AADC
                      SHA1:C7543BA3005F1E5620CB84A918049DEB9BDBFF56
                      SHA-256:69A697DBAA58ECE193EC3257625CC71F7A1A8A89748E20934B60F647316BF406
                      SHA-512:3EFECD656015228B65D517BE9A26E3C584EABC3B79E48A4EEB1BF444167DAEE092FA70A6FD2E229482DDD7BE989B610D105DE35488BF0C78D3D33DF20A69FA1B
                      Malicious:false
                      Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite Rollback Journal
                      Category:dropped
                      Size (bytes):8720
                      Entropy (8bit):1.3414063682729054
                      Encrypted:false
                      SSDEEP:24:7+tZASY9QmQ6Qel67cLESiAi0mY9QWWqLBx/XYKQvGJF7urs3:7MZlYXtrgcI8KY1Wqll2GL7ms3
                      MD5:95F82BDAF92657E4499DD6284827A780
                      SHA1:7DC79115910210BB0CC885D3B82676DF12F40387
                      SHA-256:3E8B8CC5130E869A4AC73FA9AD1AC699FB687D0EE4C16C7643E3489AFAE1288E
                      SHA-512:6903FB9EB5811FFBC727C81DA8B2773828BDC561432358B24FAB68DA1936D01B789ADF288EB9BE8A7BD1A38D1CB0DEB91C8ED7991E740CAED62352D8AC77353C
                      Malicious:false
                      Preview:.... .c.....udM.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Temp\MSIf0946.LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):246
                      Entropy (8bit):3.5406586576927443
                      Encrypted:false
                      SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8dArNhDl:Qw946cPbiOxDlbYnuRKfNn
                      MD5:E7A7147834D79DCE8A924856E87904F7
                      SHA1:CB51F62F1118FBC93EFDBB924FFB8B2A8C37B30C
                      SHA-256:FDB16B27AA3D21CE000819519BFDA4409D0E18E44058ED36AD33DF7ACBF1EEF9
                      SHA-512:35B0BE5A08FC6F425165BDEE5B4985002051139189849D64542C4332A24B20C926C3459E8DA08BF46462964C98C13D1BF2EA71D3CC39F8D59A2DC36214360D05
                      Malicious:false
                      Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.8./.0.8./.2.0.2.4. . .1.6.:.5.2.:.3.4. .=.=.=.....

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-08-28 16-52-28-704.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393)
                      Category:dropped
                      Size (bytes):16525
                      Entropy (8bit):5.353642815103214
                      Encrypted:false
                      SSDEEP:384:tbxtsuP+XEWJJQbnR8L31M7HeltV+KYm3wsa2KjF4ODkr/O8r2IUHUHMWwEyZRN2:aPL
                      MD5:91F06491552FC977E9E8AF47786EE7C1
                      SHA1:8FEB27904897FFCC2BE1A985D479D7F75F11CEFC
                      SHA-256:06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
                      SHA-512:A63E6E0D25B88EBB6602885AB8E91167D37267B24516A11F7492F48876D3DDCAE44FFC386E146F3CF6EB4FA6AF251602143F254687B17FCFE6F00783095C5082
                      Malicious:false
                      Preview:SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig:

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393), with CRLF line terminators
                      Category:dropped
                      Size (bytes):15114
                      Entropy (8bit):5.34309915717823
                      Encrypted:false
                      SSDEEP:384:lRrgcKBPWJEeU9EBjWxgpUINJKP7o3PQg//LNVF9030UaUUUsbK6Fj3qtG/O4iX4:CJNpXI
                      MD5:ED38772A9D0B39C76C28FC588327C5E2
                      SHA1:7915B5E8C61E9CC147F89608A9503E17B8464F3C
                      SHA-256:FD2B2E36A0D7F900033153AD81899D5450A48E96D481878157F2DC50E8B56A06
                      SHA-512:CBFF21347DF87677F4BE415F31258CDD73BAEBB435A07442A6DBDA6A8A252B0553C5154B44B498769CCD53426633D69A094828BCC3F7AB73C279C2D0AF1FDF61
                      Malicious:false
                      Preview:SessionID=7b57c62a-18cb-4b6d-b05c-432e632d787b.1724878348724 Timestamp=2024-08-28T16:52:28:724-0400 ThreadID=7096 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=7b57c62a-18cb-4b6d-b05c-432e632d787b.1724878348724 Timestamp=2024-08-28T16:52:28:725-0400 ThreadID=7096 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=7b57c62a-18cb-4b6d-b05c-432e632d787b.1724878348724 Timestamp=2024-08-28T16:52:28:725-0400 ThreadID=7096 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=7b57c62a-18cb-4b6d-b05c-432e632d787b.1724878348724 Timestamp=2024-08-28T16:52:28:725-0400 ThreadID=7096 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=7b57c62a-18cb-4b6d-b05c-432e632d787b.1724878348724 Timestamp=2024-08-28T16:52:28:726-0400 ThreadID=7096 Component=ngl-lib_NglAppLib Description="SetConf

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):29752
                      Entropy (8bit):5.419503698466664
                      Encrypted:false
                      SSDEEP:192:0cbgIhPcbocbAIlncb2cbwI/RcbNcbQIVvcbmcbIIXhcbt:fhWlA/TVgXS
                      MD5:36E9CC862909BDB5D6D276F5B4792833
                      SHA1:B3E41F2838B1EB120F633DDC3E02859DBB966154
                      SHA-256:391B11A578BDFB7E47AD33FC83ECABA8AF9BC30C4A59A92888F2F6A06E437BE1
                      SHA-512:792D86388B96F1713B3D1ABC0375D4FD107395E9F263369E4DAC1993457E95561BBF4769E2BFF2680342D1EA9DFE8FC042AD1AC95A1211BBB1CC776A8FEED053
                      Malicious:false
                      Preview:06-10-2023 10:08:42:.---2---..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 10:08:42:.Closing File..06-10-

                      C:\Users\user\AppData\Local\Temp\acrocef_low\2555b970-3d97-41ec-9e22-b39768fcf98b.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                      Category:dropped
                      Size (bytes):1407294
                      Entropy (8bit):7.97605879016224
                      Encrypted:false
                      SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
                      MD5:8B9FA2EC5118087D19CFDB20DA7C4C26
                      SHA1:E32D6A1829B18717EF1455B73E88D36E0410EF93
                      SHA-256:4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
                      SHA-512:662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
                      Malicious:false
                      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                      C:\Users\user\AppData\Local\Temp\acrocef_low\3feeee5d-a4ba-44ba-a4fa-708d524c7d6f.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                      Category:dropped
                      Size (bytes):386528
                      Entropy (8bit):7.9736851559892425
                      Encrypted:false
                      SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                      MD5:5C48B0AD2FEF800949466AE872E1F1E2
                      SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                      SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                      SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                      Malicious:false
                      Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                      C:\Users\user\AppData\Local\Temp\acrocef_low\6c631323-c377-4d79-b850-5f23b986c419.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                      Category:dropped
                      Size (bytes):1419751
                      Entropy (8bit):7.976496077007677
                      Encrypted:false
                      SSDEEP:24576:/xA7ouWLgGZtwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVuWLgGZtwZGk3mlind9i4ufFXpAXkru
                      MD5:A8E5C37206C98D1B655FF994A420FFB6
                      SHA1:827237782AB5971EC205C3BCECCC7950BE9F84C3
                      SHA-256:F1F755059AF7C2CBC36920337941AEFB18FBDB3CD14D3239CBBBCF0CB8F208EA
                      SHA-512:12DE33EB7624458AEC44D83D4E2C09E626F8E54E177FC0C26EEBA232935F34FAAAEB71FBB025EB7C53BEA9933C46ADCE759C32516D1B80C03B6734C61D61CEB2
                      Malicious:false
                      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                      C:\Users\user\AppData\Local\Temp\acrocef_low\e4bd25f5-14b4-412a-a867-ba233996399c.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                      Category:dropped
                      Size (bytes):758601
                      Entropy (8bit):7.98639316555857
                      Encrypted:false
                      SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                      MD5:3A49135134665364308390AC398006F1
                      SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                      SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                      SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                      Malicious:false
                      Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                      Static File Info

                      General

                      File type:PDF document, version 1.7, 2 pages
                      Entropy (8bit):7.043833511544227
                      TrID:
                      • Adobe Portable Document Format (5005/1) 100.00%
                      File name:INV114721.pdf
                      File size:2'556'708 bytes
                      MD5:d58320c091ec675e2c61e3ef86b03c3c
                      SHA1:cca2339754b1e8069e3fa6def3385e83d6b34585
                      SHA256:e0a63d3fe13447097706ab3cad1df47308f05b6b546b799ba0ffcbf13963bc93
                      SHA512:35db14655a3feee22d75e7b8f75cfa5bf621e082091ac0301551bcd58027ae2553f2ddc9e3b9721d1105161b4e819118a81a7c1f5074aca6070e9cfc03e64914
                      SSDEEP:24576:r1yziomUj1b7i6vwxXHW4WhtEvUK34xdjDeCooB5QmL9SGOeaIPqofX0h1oW2KSN:KVh2X24WcMK6a7oP2ebSoWVGZ
                      TLSH:F2C56B9C9488E48C5477ABC1A747D9E6E24E676B46880C77B16F4FC20B03D9EFD4B806
                      File Content Preview:%PDF-1.7.%......9 0 obj.<</AcroForm 59 0 R/Metadata 60 0 R/Pages 2 0 R/Type/Catalog>>.endobj.59 0 obj.<</DA(/Helv 0 Tf 0 g )/DR<</Encoding<</PDFDocEncoding 61 0 R>>/Font<</Helv 62 0 R/ZaDb 63 0 R>>>>/Fields[]>>.endobj.60 0 obj.<</Length 3279/Subtype/XML/T

                      File Icon

                      Icon Hash:62cc8caeb29e8ae0

                      Static PDF Info

                      General

                      Header:%PDF-1.7
                      Total Entropy:7.043834
                      Total Bytes:2556708
                      Stream Entropy:7.908809
                      Stream Bytes:1544915
                      Entropy outside Streams:4.112955
                      Bytes outside Streams:1011793
                      Number of EOF found:26
                      Bytes after EOF:

                      Keywords Statistics

                      NameCount
                      obj992
                      endobj992
                      stream460
                      endstream460
                      xref26
                      trailer26
                      startxref26
                      /Page41
                      /Encrypt0
                      /ObjStm0
                      /URI0
                      /JS0
                      /JavaScript0
                      /AA0
                      /OpenAction0
                      /AcroForm1
                      /JBIG2Decode0
                      /RichMedia0
                      /Launch0
                      /EmbeddedFile0

                      Image Streams

                      IDDHASHMD5Preview
                      700010143d772034002d131cec9a4c3836b93c3c31521b013a
                      87006068c088404000b2c1725cc3d8cf004308b7172db368f0
                      6060010143d772034002d131cec9a4c3836b93c3c31521b013a
                      607006068c088404000b2c1725cc3d8cf004308b7172db368f0

                      Network Behavior

                      Network Port Distribution

                      TCP Packets

                      TimestampSource PortDest PortSource IPDest IP
                      Aug 28, 2024 22:52:39.891935110 CEST49720443192.168.2.1623.56.162.185
                      Aug 28, 2024 22:52:39.891971111 CEST4434972023.56.162.185192.168.2.16
                      Aug 28, 2024 22:52:39.892041922 CEST49720443192.168.2.1623.56.162.185
                      Aug 28, 2024 22:52:39.892205954 CEST49720443192.168.2.1623.56.162.185
                      Aug 28, 2024 22:52:39.892218113 CEST4434972023.56.162.185192.168.2.16
                      Aug 28, 2024 22:52:40.506865025 CEST4434972023.56.162.185192.168.2.16
                      Aug 28, 2024 22:52:40.507175922 CEST49720443192.168.2.1623.56.162.185
                      Aug 28, 2024 22:52:40.507194042 CEST4434972023.56.162.185192.168.2.16
                      Aug 28, 2024 22:52:40.508102894 CEST4434972023.56.162.185192.168.2.16
                      Aug 28, 2024 22:52:40.508177042 CEST49720443192.168.2.1623.56.162.185
                      Aug 28, 2024 22:52:40.510174990 CEST49720443192.168.2.1623.56.162.185
                      Aug 28, 2024 22:52:40.510230064 CEST4434972023.56.162.185192.168.2.16
                      Aug 28, 2024 22:52:40.510365963 CEST49720443192.168.2.1623.56.162.185
                      Aug 28, 2024 22:52:40.550302029 CEST49720443192.168.2.1623.56.162.185
                      Aug 28, 2024 22:52:40.550313950 CEST4434972023.56.162.185192.168.2.16
                      Aug 28, 2024 22:52:40.597268105 CEST49720443192.168.2.1623.56.162.185
                      Aug 28, 2024 22:52:40.607423067 CEST4434972023.56.162.185192.168.2.16
                      Aug 28, 2024 22:52:40.607815027 CEST4434972023.56.162.185192.168.2.16
                      Aug 28, 2024 22:52:40.607857943 CEST49720443192.168.2.1623.56.162.185
                      Aug 28, 2024 22:52:40.608484030 CEST49720443192.168.2.1623.56.162.185
                      Aug 28, 2024 22:52:40.608499050 CEST4434972023.56.162.185192.168.2.16

                      HTTP Request Dependency Graph

                      • armmf.adobe.com

                      HTTPS Proxied Packets

                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      0192.168.2.164972023.56.162.1854436408C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      TimestampBytes transferredDirectionData
                      2024-08-28 20:52:40 UTC390OUTGET /onboarding/smskillreader.txt HTTP/1.1
                      Host: armmf.adobe.com
                      Connection: keep-alive
                      Accept-Language: en-US,en;q=0.9
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
                      Sec-Fetch-Site: same-origin
                      Sec-Fetch-Mode: no-cors
                      Sec-Fetch-Dest: empty
                      Accept-Encoding: gzip, deflate, br
                      2024-08-28 20:52:40 UTC247INHTTP/1.1 200 OK
                      Server: Apache
                      Last-Modified: Mon, 01 May 2023 15:02:33 GMT
                      ETag: "78-5faa31cce96da"
                      Accept-Ranges: bytes
                      Content-Length: 120
                      Content-Type: text/plain; charset=UTF-8
                      Date: Wed, 28 Aug 2024 20:52:40 GMT
                      Connection: close
                      2024-08-28 20:52:40 UTC120INData Raw: 46 69 6c 65 20 74 68 61 74 20 61 63 74 73 20 6c 69 6b 65 20 61 20 4b 69 6c 6c 20 73 77 69 74 63 68 20 66 6f 72 20 53 4d 53 20 66 75 6e 63 74 69 6f 6e 61 6c 69 74 79 20 69 6e 20 52 65 61 64 65 72 2e 20 44 65 6c 65 74 65 20 74 68 69 73 20 66 69 6c 65 20 74 6f 20 65 6e 61 62 6c 65 20 74 68 65 20 6b 69 6c 6c 20 73 77 69 74 63 68 20 69 6e 20 52 65 61 64 65 72 2e
                      Data Ascii: File that acts like a Kill switch for SMS functionality in Reader. Delete this file to enable the kill switch in Reader.


                      Statistics

                      CPU Usage

                      Click to jump to process

                      Memory Usage

                      Click to jump to process

                      High Level Behavior Distribution

                      Click to dive into process behavior distribution

                      Behavior

                      Click to jump to process

                      System Behavior

                      General

                      Target ID:0
                      Start time:16:52:25
                      Start date:28/08/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\INV114721.pdf"
                      Imagebase:0x7ff7cd680000
                      File size:5'641'176 bytes
                      MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:high
                      Has exited:false

                      General

                      Target ID:2
                      Start time:16:52:26
                      Start date:28/08/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                      Imagebase:0x7ff6480c0000
                      File size:3'581'912 bytes
                      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:high
                      Has exited:false

                      General

                      Target ID:4
                      Start time:16:52:27
                      Start date:28/08/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2252 --field-trial-handle=1572,i,13373086223109293454,2570682305473997975,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                      Imagebase:0x7ff6480c0000
                      File size:3'581'912 bytes
                      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:high
                      Has exited:false

                      Disassembly

                      ⊘No disassembly