Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
5BPXX1HIGER9.pdf

Overview

General Information

Sample name:5BPXX1HIGER9.pdf
Analysis ID:1520635
MD5:aa55b36be9bbd1bdb65a4b2741e70f8b
SHA1:3953604d2ebf3bc6d692b2c186a0001c941cab27
SHA256:80d1d9115bd719cec06ec131626f9f8721f8e9259d5aead43b8d20c24f6ce556
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 3712 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\5BPXX1HIGER9.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 7200 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 7424 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1556,i,2454859765742305140,6723875660102114181,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficDNS query: name: x1.i.lencr.org
Source: global trafficDNS query: name: x1.i.lencr.org
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 23.56.162.185:443
Source: Joe Sandbox ViewIP Address: 23.56.162.185 23.56.162.185
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global trafficDNS traffic detected: DNS query: x1.i.lencr.org
Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.drString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.drString found in binary or memory: http://x1.i.lencr.org/
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: classification engineClassification label: clean2.winPDF@14/44@2/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journalJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-09-27 11-36-22-743.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\5BPXX1HIGER9.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1556,i,2454859765742305140,6723875660102114181,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1556,i,2454859765742305140,6723875660102114181,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: 5BPXX1HIGER9.pdfInitial sample: PDF keyword /JS count = 0
Source: 5BPXX1HIGER9.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: A91nc4ata_dakdrj_uk.tmp.0.drInitial sample: PDF keyword /JS count = 0
Source: A91nc4ata_dakdrj_uk.tmp.0.drInitial sample: PDF keyword /JavaScript count = 0
Source: 5BPXX1HIGER9.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts3
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media2
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive13
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1520635 Sample: 5BPXX1HIGER9.pdf Startdate: 27/09/2024 Architecture: WINDOWS Score: 2 14 x1.i.lencr.org 2->14 7 Acrobat.exe 20 61 2->7         started        process3 process4 9 AcroCEF.exe 86 7->9         started        process5 11 AcroCEF.exe 2 9->11         started        dnsIp6 16 23.56.162.185, 443, 49721 AKAMAI-ASUS United States 11->16

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://x1.i.lencr.org/0%URL Reputationsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
x1.i.lencr.org
unknown
unknownfalse
    		unknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://x1.i.lencr.org/2D85F72862B55C4EADD9E66E06947F3D0.2.drfalse
    • URL Reputation: safe
    		unknown

    World Map of Contacted IPs

    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs

    Public IPs

    IPDomainCountryFlagASNASN NameMalicious
    23.56.162.185
    		unknownUnited States
    		16625AKAMAI-ASUSfalse

    General Information

    Joe Sandbox version:41.0.0 Charoite
    Analysis ID:1520635
    Start date and time:2024-09-27 17:35:27 +02:00
    Joe Sandbox product:CloudBasic
    Overall analysis duration:0h 4m 0s
    Hypervisor based Inspection enabled:false
    Report type:full
    Cookbook file name:defaultwindowspdfcookbook.jbs
    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
    Number of analysed new started processes analysed:9
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • EGA enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:Timeout
    Sample name:5BPXX1HIGER9.pdf
    Detection:CLEAN
    Classification:clean2.winPDF@14/44@2/1
    Cookbook Comments:
    • Found application associated with file extension: .pdf
    • Found PDF document
    • Close Viewer

    Warnings

    • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
    • Excluded IPs from analysis (whitelisted): 184.28.88.176, 23.22.254.206, 52.202.204.11, 54.227.187.23, 52.5.13.197, 162.159.61.3, 172.64.41.3, 93.184.221.240, 2.23.197.184, 2.19.126.149, 2.19.126.143
    • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, wu.ec.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, wu.azureedge.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, geo2.adobe.com, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
    • VT rate limit hit for: 5BPXX1HIGER9.pdf

    Simulations

    Behavior and APIs

    TimeTypeDescription
    11:36:33API Interceptor3x Sleep call for process: AcroCEF.exe modified

    LLM Input / Output

    InputOutput
    URL: PDF document Model: jbxai
    {
"brand":["PayPal"],
"contains_trigger_text":false,
"trigger_text":"",
"prominent_button_name":"unknown",
"text_input_field_labels":"unknown",
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":true,
"has_visible_qrcode":false}

    Joe Sandbox View / Context

    IPs

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    23.56.162.185Final_Contract_Copy-532392974.pdfGet hashmaliciousUnknownBrowse
      Cbequipment-Voice Audio Interface.pdfGet hashmaliciousHTMLPhisherBrowse
        Runbook - Carolinas Animal Hospital - 2022-05-25 11.28 UTC -04.00.pdfGet hashmaliciousUnknownBrowse
          Hajj_Advisory pdf lnk.lnkGet hashmaliciousUnknownBrowse
            blockchair_statement.pdf.lnkGet hashmaliciousUnknownBrowse
              Signed_Revised_Contract_See also 19_Lgunning_Carisls_Required_Signature.pdfGet hashmaliciousUnknownBrowse
                Fatura.pdfGet hashmaliciousUnknownBrowse
                  pdf.batGet hashmaliciousUnknownBrowse
                    LrIGsrMRHo.batGet hashmaliciousUnknownBrowse
                      Brownsburg Fire Territory.pdfGet hashmaliciousUnknownBrowse

                        Domains

                        ⊘No context

                        ASNs

                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        AKAMAI-ASUSElectronic Receipt for Carolann Campbell.pdfGet hashmaliciousHTMLPhisherBrowse
                        • 104.78.188.188
                        https://kulodayplastomer-my.sharepoint.com/:f:/g/personal/exim_kpplindia_com/EpT6drgdzgdPk3kwQBUf2ZAB7JXXdY25CyMiKP-z5XBGWQ?e=8byFZYGet hashmaliciousHTMLPhisherBrowse
                        • 23.38.98.68
                        ATT71725.htmlGet hashmaliciousHTMLPhisherBrowse
                        • 173.223.116.167
                        Aisha C. Yetman shared you a document..msgGet hashmaliciousUnknownBrowse
                        • 104.102.55.235
                        file.exeGet hashmaliciousLummaCBrowse
                        • 104.102.49.254
                        https://adclick.g.doubleclick.net/pcs/click?xai=AKAOjsulL2bcqZSGb5TVbFOhW-BzJJtb8_QJJBgbE1zqe78Ie8BMxsNyhIFwdKd0pdA90RMhgTdSzkU9EZ9vbhoKh9hWuvNOpIawTAXoH5R0ak3U5rG_o-sZZz3gEiDRvTxtIDu5LY0qOySZABWrjrj9OfeDXHmC1qe7sBrjM2U90kovZKuuD34ZvXQ_OD2Hq--rkZwnu_VhQVAySwVh2ojndP52NUX9X40zwPfUt6TCc4F2rNspoMzray6vSBsFLXUX7nVDHqqILMYBWJr9fSc6AC0-g4meRNvX0rdEgcGztZ5SXk2Zbb1UlFLMFg&sai=AMfl-YQ851Qqa8i013PHKiB6TgTZ-QzfEpO1vcyiniBLSOaNAv3siIC9L9LV3aRq_nbn81w6wFB7OvNqhOdGvo-t7Q&sig=Cg0ArKJSzNuc_g1R_f21EAE&fbs_aeid=&urlfix=1&adurl=https://t.events.caixabank.com/r/?id=h665ab089,6dc7f7ae,f89fd96&p1=d70r46aqireop.cloudfront.net%23QZ~MamRpYXpAZXZlcnNoZWRzLXN1dGhlcmxhbmQuZXM=Get hashmaliciousHTMLPhisherBrowse
                        • 23.220.112.201
                        kewyIO69TI.exeGet hashmaliciousLummaCBrowse
                        • 104.102.49.254
                        gZzI6gTYn4.exeGet hashmaliciousLummaCBrowse
                        • 104.102.49.254
                        U6b3tLFqN5.exeGet hashmaliciousLummaCBrowse
                        • 104.102.49.254
                        zlsXub68El.exeGet hashmaliciousVidarBrowse
                        • 104.102.49.254

                        JA3 Fingerprints

                        ⊘No context

                        Dropped Files

                        ⊘No context

                        Created / dropped Files

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):294
                        Entropy (8bit):5.1857686257107485
                        Encrypted:false
                        SSDEEP:6:PE6fE5fvIq2P92nKuAl9OmbnIFUt82E6fEyuGzZmw+2E6fEIkwO92nKuAl9Ombjd:PElIv4HAahFUt82EPi/+2Ec5LHAaSJ
                        MD5:C7545697CE8704917D2ED5BC47ADC5FA
                        SHA1:CBA8A973366C99299E41F37A6FF1F9D0F6F01209
                        SHA-256:8C5216515CDB8C7CE4EFAF25D7D2302B0EEF23A69C1D36F673A17F6909EAB77D
                        SHA-512:B2E5042256CE948FB4579B2AB068245FF4AC380A5BCBE71C5C1564EE9CE0E76FBDEBD3E481FD12B43300FAD844FB704818C57BF83582EDBB0337956DDB431895
                        Malicious:false
                        Reputation:low
                        Preview:2024/09/27-11:36:21.181 1c40 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/09/27-11:36:21.209 1c40 Recovering log #3.2024/09/27-11:36:21.210 1c40 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):294
                        Entropy (8bit):5.1857686257107485
                        Encrypted:false
                        SSDEEP:6:PE6fE5fvIq2P92nKuAl9OmbnIFUt82E6fEyuGzZmw+2E6fEIkwO92nKuAl9Ombjd:PElIv4HAahFUt82EPi/+2Ec5LHAaSJ
                        MD5:C7545697CE8704917D2ED5BC47ADC5FA
                        SHA1:CBA8A973366C99299E41F37A6FF1F9D0F6F01209
                        SHA-256:8C5216515CDB8C7CE4EFAF25D7D2302B0EEF23A69C1D36F673A17F6909EAB77D
                        SHA-512:B2E5042256CE948FB4579B2AB068245FF4AC380A5BCBE71C5C1564EE9CE0E76FBDEBD3E481FD12B43300FAD844FB704818C57BF83582EDBB0337956DDB431895
                        Malicious:false
                        Reputation:low
                        Preview:2024/09/27-11:36:21.181 1c40 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/09/27-11:36:21.209 1c40 Recovering log #3.2024/09/27-11:36:21.210 1c40 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):338
                        Entropy (8bit):5.201050767217404
                        Encrypted:false
                        SSDEEP:6:PE6fEg0+q2P92nKuAl9Ombzo2jMGIFUt82E6fEIjZmw+2E6fEsVkwO92nKuAl9OU:PEcJv4HAa8uFUt82EEj/+2Ew5LHAa8RJ
                        MD5:34A4E707E7120F6925D2BE43C0686D88
                        SHA1:F9A50ABBD8C10DA18EBB841E2E56796817FA70BD
                        SHA-256:B3FB4526BF4B33714CC3B74ABF0AAE863B0CDF2749AF860823689FD67C018930
                        SHA-512:16A15AEDA7F34A8AA9A31D7DE4809DE7C6D805342EEE37ECDCFECEFC0E42CCA3C4E07C4C13BA24370FA905CA6C84CE3878094BF6158701D07798878EB248DFD1
                        Malicious:false
                        Reputation:low
                        Preview:2024/09/27-11:36:21.228 1d38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/09/27-11:36:21.229 1d38 Recovering log #3.2024/09/27-11:36:21.230 1d38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):338
                        Entropy (8bit):5.201050767217404
                        Encrypted:false
                        SSDEEP:6:PE6fEg0+q2P92nKuAl9Ombzo2jMGIFUt82E6fEIjZmw+2E6fEsVkwO92nKuAl9OU:PEcJv4HAa8uFUt82EEj/+2Ew5LHAa8RJ
                        MD5:34A4E707E7120F6925D2BE43C0686D88
                        SHA1:F9A50ABBD8C10DA18EBB841E2E56796817FA70BD
                        SHA-256:B3FB4526BF4B33714CC3B74ABF0AAE863B0CDF2749AF860823689FD67C018930
                        SHA-512:16A15AEDA7F34A8AA9A31D7DE4809DE7C6D805342EEE37ECDCFECEFC0E42CCA3C4E07C4C13BA24370FA905CA6C84CE3878094BF6158701D07798878EB248DFD1
                        Malicious:false
                        Reputation:low
                        Preview:2024/09/27-11:36:21.228 1d38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/09/27-11:36:21.229 1d38 Recovering log #3.2024/09/27-11:36:21.230 1d38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):508
                        Entropy (8bit):5.057583481403094
                        Encrypted:false
                        SSDEEP:12:YH/um3RA8squsBdOg2H/caq3QYiubxnP7E4T3OF+:Y2sRdsidMHO3QYhbxP7nbI+
                        MD5:FCFC7929A6DA8D17F8416175B9B0983C
                        SHA1:26E8568A72F46DBD0DB0240766F572B4DAB31A87
                        SHA-256:B68ADA877DC4606E4D3D8B21107149B13FD657C6182F81DFD8E80BBF5BFD31AB
                        SHA-512:94B940C7750FBCD7B5F00364398B8CFAFA07B6B04000781EBDE3AF0CD28571C51B08B5C7164E07FF8B649865E3520DC97544A434E6FE1D5E5B5348E2A7FC8B6E
                        Malicious:false
                        Reputation:low
                        Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372011393207143","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":129265},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\efac3a12-5687-47bf-9ecf-d69b4cd64453.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:JSON data
                        Category:modified
                        Size (bytes):508
                        Entropy (8bit):5.057583481403094
                        Encrypted:false
                        SSDEEP:12:YH/um3RA8squsBdOg2H/caq3QYiubxnP7E4T3OF+:Y2sRdsidMHO3QYhbxP7nbI+
                        MD5:FCFC7929A6DA8D17F8416175B9B0983C
                        SHA1:26E8568A72F46DBD0DB0240766F572B4DAB31A87
                        SHA-256:B68ADA877DC4606E4D3D8B21107149B13FD657C6182F81DFD8E80BBF5BFD31AB
                        SHA-512:94B940C7750FBCD7B5F00364398B8CFAFA07B6B04000781EBDE3AF0CD28571C51B08B5C7164E07FF8B649865E3520DC97544A434E6FE1D5E5B5348E2A7FC8B6E
                        Malicious:false
                        Reputation:low
                        Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372011393207143","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":129265},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):4509
                        Entropy (8bit):5.23503621499676
                        Encrypted:false
                        SSDEEP:96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLU/p6f4gZ:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLl
                        MD5:BF1A42ACC184760757826A5D4D6E6064
                        SHA1:A799C98E4EB77B9ADE6F455C02788C4F59932477
                        SHA-256:1EA61AF4055640AD7659564813B27760BEA8CAA86DCAC54C8109EEAA865BAF5D
                        SHA-512:76ADF642CBECB3FA3C650F1013CDD79DD763F4E74448A4B10E1C22405D4AB895671AAAB8DE5D4C607077E7FE8213CF8E06716F9D294C948537936678485230EA
                        Malicious:false
                        Reputation:low
                        Preview:*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):326
                        Entropy (8bit):5.248568791225709
                        Encrypted:false
                        SSDEEP:6:PE6fEm+q2P92nKuAl9OmbzNMxIFUt82E6fENOXZmw+2E6fE/gtVkwO92nKuAl9Ob:PETv4HAa8jFUt82E5OX/+2EbU5LHAa8E
                        MD5:6AEEA61E6CB92F7569D2F3CF72404FD1
                        SHA1:F91EF624795BC1262B413A262B7B078C5A9CAF49
                        SHA-256:0E427BDC3276D65B355CFEA73C724B487937F40D4404A619CDC70C3C33F4D1AA
                        SHA-512:30D68D9F6204180465C7781DBB3A39E8A2C93545F368C9DAF59EC4CF17D2494934E5523BAEDF77D8B8A2A4899BB75987252E10A2AF584F2A0546691F3450792B
                        Malicious:false
                        Reputation:low
                        Preview:2024/09/27-11:36:21.908 1d38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/09/27-11:36:21.951 1d38 Recovering log #3.2024/09/27-11:36:21.964 1d38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):326
                        Entropy (8bit):5.248568791225709
                        Encrypted:false
                        SSDEEP:6:PE6fEm+q2P92nKuAl9OmbzNMxIFUt82E6fENOXZmw+2E6fE/gtVkwO92nKuAl9Ob:PETv4HAa8jFUt82E5OX/+2EbU5LHAa8E
                        MD5:6AEEA61E6CB92F7569D2F3CF72404FD1
                        SHA1:F91EF624795BC1262B413A262B7B078C5A9CAF49
                        SHA-256:0E427BDC3276D65B355CFEA73C724B487937F40D4404A619CDC70C3C33F4D1AA
                        SHA-512:30D68D9F6204180465C7781DBB3A39E8A2C93545F368C9DAF59EC4CF17D2494934E5523BAEDF77D8B8A2A4899BB75987252E10A2AF584F2A0546691F3450792B
                        Malicious:false
                        Reputation:low
                        Preview:2024/09/27-11:36:21.908 1d38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/09/27-11:36:21.951 1d38 Recovering log #3.2024/09/27-11:36:21.964 1d38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240927153624Z-163.bmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
                        Category:dropped
                        Size (bytes):65110
                        Entropy (8bit):1.7187518082532125
                        Encrypted:false
                        SSDEEP:192:UICYc/RZO36poY9OL0WiHglOoAvgcgWAQv7OvZMvC:gY/OoYWiHglREw
                        MD5:C5D6746889D1C6B83BB5F998FD0E9340
                        SHA1:4F80DC977415A12140DCA98E4AE6A0C10AD03CC2
                        SHA-256:7051068E7F4F95422ECEBC7E793F0BD4512E9C7CA938AD23270BA2E34E0F1A37
                        SHA-512:59C131F1E98E14159F6AB7B8F2AEEF7240501FCAA0AE3D1687B357BA02EEC621B411B5EC65F1B46F63BF7BA0D7E724C4409E2B29D8C06E786B201597CA16C1AE
                        Malicious:false
                        Preview:BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:Certificate, Version=3
                        Category:dropped
                        Size (bytes):1391
                        Entropy (8bit):7.705940075877404
                        Encrypted:false
                        SSDEEP:24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
                        MD5:0CD2F9E0DA1773E9ED864DA5E370E74E
                        SHA1:CABD2A79A1076A31F21D253635CB039D4329A5E8
                        SHA-256:96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
                        SHA-512:3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
                        Malicious:false
                        Preview:0..k0..S............@.YDc.c...0...*.H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0...*.H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I.....*.A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.|C.t..t.....0.[q6....00\H..;..}`...).........A.......|.;F.H*..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..|o..;.....'...}~.."......

                        C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                        Category:dropped
                        Size (bytes):71954
                        Entropy (8bit):7.996617769952133
                        Encrypted:true
                        SSDEEP:1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
                        MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
                        SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
                        SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
                        SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
                        Malicious:false
                        Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

                        C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):192
                        Entropy (8bit):2.750397451508313
                        Encrypted:false
                        SSDEEP:3:kkFklcC+/tfllXlE/HT8kyNNX8RolJuRdxLlGB9lQRYwpDdt:kKFCueT8FNMa8RdWBwRd
                        MD5:AAB31FDBC3A05DCB7B9675FF4A49A398
                        SHA1:48FF1F67B2CB521D485A55578B6ED6288F1F0025
                        SHA-256:3996D34C2A8D081AD5F5E14CD4D018F5938E1053E16A908CE9D056F6FAC43097
                        SHA-512:507C9CF73651624F0DE3CF8ACA2D9FA0DAB7E82EDBB5A4194DE1E479D4932C4B781FC29A7E1180EA389071C4BB1AE655443505AF10A5CBD86EDB98064AE2A05D
                        Malicious:false
                        Preview:p...... ........o.......(....................................................... ..........W....c...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

                        C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:data
                        Category:modified
                        Size (bytes):328
                        Entropy (8bit):3.1440865988908953
                        Encrypted:false
                        SSDEEP:6:kKrdL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:DcDnLNkPlE99SNxAhUe/3
                        MD5:9583506BE77AB5802FAC94A368EB284F
                        SHA1:CBD06EB03CC9D948DBCD2BDDFBB108710A943C99
                        SHA-256:D9756ECBDFAD7D66D057FD97E788F5D8B3A282DA3B1505CADD2B19D376323022
                        SHA-512:BD020A818655FA40E7675200A2D8F3E0B35172BA0BB5A642A521D5142A1510BA6E16BFC40A6F8DABD5CEB2FEC044B4435BB5BBFE382A624866312CCA9C68A1BC
                        Malicious:false
                        Preview:p...... .........5M,....(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):227002
                        Entropy (8bit):3.392780893644728
                        Encrypted:false
                        SSDEEP:1536:WKPC4iyzDtrh1cK3XEivK7VK/3AYvYwgF/rRoL+sn:DPCaJ/3AYvYwglFoL+sn
                        MD5:87EDBEE38F56C20298F25D5D3D4D1B5C
                        SHA1:7F904E9615AC3186A87472EF366DD8202855B0B7
                        SHA-256:A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
                        SHA-512:BBEBC1FCD5BC9AE042DD5782425BA8C47BF3EAC283B2487FC4E3FF6BF8101306DAB081E5135594165D4DC1AC120FF125AADBC5B3FFE7C646183C04DF77865E0D
                        Malicious:false
                        Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):295
                        Entropy (8bit):5.333154241453163
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXDQBAhd7+FIbRI6XVW7+0YMURMqoAvJM3g98kUwPeUkwRe9:YvXKXaAqYpW7ZIsGMbLUkee9
                        MD5:2E457459430E4D6943E26602E22894D5
                        SHA1:61799558AED523245186AEA43217AA8E07FF6291
                        SHA-256:7FA5765EC493633D77518417F39661F41945DCD37F4A7A6794E628F0F48AECD0
                        SHA-512:B576A561DB7893A2D630D37146F463676C6AF8C85CF74950BD262F4BC94BD561A8F5AEE3193C4F2144E6CA1B3C3A2CBEED0C36785B48BA7A93FF0573BC86963C
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"451e0006-bb29-4499-a095-6a26d71ed4cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1727630142683,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):294
                        Entropy (8bit):5.273486575740654
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXDQBAhd7+FIbRI6XVW7+0YMURMqoAvJfBoTfXpnrPeUkwRe9:YvXKXaAqYpW7ZIsGWTfXcUkee9
                        MD5:F26574A9718D52370DA3B31B38894674
                        SHA1:50616EDA4D74E6F451AC1A040612D9339903ED5F
                        SHA-256:AD8B124574AAC76FBABF3FDE5505A1F92CCA056F296CB751F0329329014021FA
                        SHA-512:1F74C90A6967A9372ADD92FFCB51D04670136ECF13357D800614A616C571931693C48128286EE7E929A17BFEEF631DE8DB08FC449C87376D666FD14A5EC4106E
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"451e0006-bb29-4499-a095-6a26d71ed4cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1727630142683,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):294
                        Entropy (8bit):5.25248161113573
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXDQBAhd7+FIbRI6XVW7+0YMURMqoAvJfBD2G6UpnrPeUkwRe9:YvXKXaAqYpW7ZIsGR22cUkee9
                        MD5:BA06E3FEAC3377A65837B7EA6BB84235
                        SHA1:02C8196A06E5EAC4B92B1E99F44565E8FB1D4540
                        SHA-256:29B2CE171A1BDAA8607636A2F4DA1E73C451A9E38881557B499ADB631D3DF6D1
                        SHA-512:CFCF10AE5890B93AE0E610EB67ECF4F948E5E9026D27669F7766B27A0D58AF878C4E1FF0BE1454AD9571C0BA91850B88DD016F755F2D1E61B3B8ABD03CED20B6
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"451e0006-bb29-4499-a095-6a26d71ed4cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1727630142683,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):285
                        Entropy (8bit):5.310987149111869
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXDQBAhd7+FIbRI6XVW7+0YMURMqoAvJfPmwrPeUkwRe9:YvXKXaAqYpW7ZIsGH56Ukee9
                        MD5:D73E7612A1B0933E2664A53A84E889E0
                        SHA1:95B6E2C93A667B51A988300FBC686C87C1C06814
                        SHA-256:6114A978817020AF7AB4E409DD11467AB6215239379AD18C60A6B570832357CD
                        SHA-512:58524687399D8C91E5214BAAC8AC8E8F75C1964532F3545F15E21243B983C8B7115A25C9FC733B21CEFA2735B92B5512282C8C0DB60795BAEE0BF568AF8BC43B
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"451e0006-bb29-4499-a095-6a26d71ed4cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1727630142683,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):1063
                        Entropy (8bit):5.6638003663745184
                        Encrypted:false
                        SSDEEP:24:Yv6XaKiupLgEFqciGennl0RCmK8czOCY4w2Y1:YvHuhgLtaAh8cvYvp
                        MD5:2060779D50501E5F02D706AD79BDCEFC
                        SHA1:E1BD71527E911FD304052C243CA867BC0D4CB471
                        SHA-256:33B55F983C4A12A01C761DC323892DE834C4AD38DBE11FC25B6C8BED286C6727
                        SHA-512:45C531E4FDD8D9249EC8E7AAA18E52C56E6C99F968A886CA19EE5B854A9740FEC345A1D753D2BE0EBC2162C2F30FCA52CA9DE467B9780B6CEB6F3E6DFC548F4E
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"451e0006-bb29-4499-a095-6a26d71ed4cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1727630142683,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_2","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"afb9c2a3-eaf4-41f9-9d73-768e72f72282","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQgZmlsZXMgdG8gYW5kIGZyb20gUERGXG53aXRob3V0IGxpbWl0cy4ifSwidGNhdElkIjpudWxsfQ==","dataType":"application\/json","encodingSc

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):1050
                        Entropy (8bit):5.6481193373696055
                        Encrypted:false
                        SSDEEP:24:Yv6XaKi4VLgEF0c7sbnl0RCmK8czOCYHflEpwiVY1:YvH4Fg6sGAh8cvYHWpwj
                        MD5:7C5317DAE411B55395D9FE6334439B34
                        SHA1:5714A2CC61F63E41C811F39752C589DAF473ED22
                        SHA-256:0D2804EE05B4D101A3EDACF75D4E3C35358D475C17A1BA1BFCA2118AE2F2E643
                        SHA-512:07BB789BCADBE4D35CB584CC04F914EE56EC391E740F1DD9A973118D8F24AD42699688B17FA297D7BDCC0042BAF11F55C6080966EF04FCAB9B1DAF17D7C791E0
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"451e0006-bb29-4499-a095-6a26d71ed4cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1727630142683,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_0","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"0924134e-3c59-4f53-b731-add558c56fec","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuZm9ybXMgJiBhZ3JlZW1lbnRzLiJ9LCJ0Y2F0SWQiOm51bGx9","dataType":"application\/json","encodingScheme":true},"

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):292
                        Entropy (8bit):5.2573333521920755
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXDQBAhd7+FIbRI6XVW7+0YMURMqoAvJfQ1rPeUkwRe9:YvXKXaAqYpW7ZIsGY16Ukee9
                        MD5:F754B36557CC5A647A9171A465B54759
                        SHA1:036B0532E5E896B5BA3A4E707DD20AC022EE64EE
                        SHA-256:25038E7AF691E538F835665EFB75DBACD1F18DECE1295612FB7B042554B550BC
                        SHA-512:3D51F1872CDEAFD26F4F8D43DA87F891E8DFE3611E7427B98C3CF1560A0420DDEC76C0EA1B0745B86C6FB8225C17706B24091A9313340DA934734E99832C90F9
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"451e0006-bb29-4499-a095-6a26d71ed4cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1727630142683,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):1038
                        Entropy (8bit):5.64273703021092
                        Encrypted:false
                        SSDEEP:24:Yv6XaKi92LgEF7cciAXs0nl0RCmK8czOCAPtciBY1:YvH9ogc8hAh8cvAU
                        MD5:936D13C4A10DFFC26898CE1BDB5D5A33
                        SHA1:830AE6E9C94D97B8C3EAC82198672EB9C2B5580C
                        SHA-256:629593DEC914EA00DEE6A2DA7C87C15E2DF1DE769859CE2176FFCD6D5ACE6260
                        SHA-512:B712AB582D857E77173148C1061E613FEEDA50DA2DB343916089A2521ECDA5A135E2C25C24213E5487DD4394158DDB172CFBCAABDE0F3E088752261BD812A218
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"451e0006-bb29-4499-a095-6a26d71ed4cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1727630142683,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_1","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"49d2f713-7aa9-44db-aa50-0a7a22add459","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVkaXQgdGV4dCwgaW1hZ2VzLCBwYWdlcywgYW5kIG1vcmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme":true},"endDTS":1744

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):1164
                        Entropy (8bit):5.69413086104119
                        Encrypted:false
                        SSDEEP:24:Yv6XaKiVKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK5Er:YvHVEgqprtrS5OZjSlwTmAfSKqr
                        MD5:7E119A83E5B80D57D188F8A73907270B
                        SHA1:00BABE474C1012C8A8A89BA4BE1C6FB0ED5ECAD1
                        SHA-256:76B582B30CEBFCD7F70B051E81753C7837C9E21A4D67BB8DC88BE314DE40CBDE
                        SHA-512:C43EC2F3E6D104A739D59A318968D4064CB21E365CA650C9591D82BB4BCA842B83D7A633DB3B25432DAF0934A02DD28F46B3D5CBA44BADC71F63CE1828049F70
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"451e0006-bb29-4499-a095-6a26d71ed4cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1727630142683,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):289
                        Entropy (8bit):5.2633790774148705
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXDQBAhd7+FIbRI6XVW7+0YMURMqoAvJfYdPeUkwRe9:YvXKXaAqYpW7ZIsGg8Ukee9
                        MD5:2CF2A904F73D71292458D31282E6A584
                        SHA1:C073D76CFDEFB39B7D3AB62464CE921FD7869E81
                        SHA-256:69BB8434D232E7226930F6CB7505AF3B091106C720B12F291B83CF75CE625C7A
                        SHA-512:7AB781F1ADD0F3650B2AC93B94A69317817FEAC8E4B89BCD771A4F3B355419D0AF82F56A7D41E9BED69D915293FB23967FFE8BD5A79A9CCC2666138988C9EB9A
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"451e0006-bb29-4499-a095-6a26d71ed4cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1727630142683,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):1395
                        Entropy (8bit):5.770644420554089
                        Encrypted:false
                        SSDEEP:24:Yv6XaKiIrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNA1:YvHIHgDv3W2aYQfgB5OUupHrQ9FJI
                        MD5:F4701E0782D3241AB84520E28802D6C3
                        SHA1:2258FA630E47B9AA6CE784FA8BBB5A76373EE347
                        SHA-256:A1CD6CEF2BBA1EAA5CFA1E0A9FA51A51BB5469025886451E41B1F03B5D09216D
                        SHA-512:74B2167C2FF5D245D34731D7E4D9454D0A5D6980354407FF5C67F9D09D7BA6B476A20A7FC5FF11B0F1FD6BC003EFC3E621F99C4052728DB8592E97A2C767DC80
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"451e0006-bb29-4499-a095-6a26d71ed4cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1727630142683,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):291
                        Entropy (8bit):5.2471778652783225
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXDQBAhd7+FIbRI6XVW7+0YMURMqoAvJfbPtdPeUkwRe9:YvXKXaAqYpW7ZIsGDV8Ukee9
                        MD5:35D65BF7704DE87F5523D0C1B8855BCB
                        SHA1:9EB1982FBDF99C9AC85E7654A97CDE12AD327D2C
                        SHA-256:D6CE5414C615540593C265818CA261E676FF05A3C01509D0443CD783197444DC
                        SHA-512:DEDB9A657FF11F22FA7F69262DB29DC88AC21005B2168DEFAA63BF65C6D816211964FBB9A72AA5C39B1CFAA2CAEB173D73393CB84DF1563D8EC9F652783EE43B
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"451e0006-bb29-4499-a095-6a26d71ed4cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1727630142683,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):287
                        Entropy (8bit):5.248344196305295
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXDQBAhd7+FIbRI6XVW7+0YMURMqoAvJf21rPeUkwRe9:YvXKXaAqYpW7ZIsG+16Ukee9
                        MD5:8E5D6530FDC86036B5E4CF40BE130FBB
                        SHA1:C3CFC50DDAA001891D906740C4F30360E33C895F
                        SHA-256:74B8413220AEC148247545D41B9BE5F24DDD395E3C3A01BFE7450990FC95E5D7
                        SHA-512:B6F5C853E7707AD47B36080F7FBCC8DE40364A413A86D35094901CF56C7CC13966C6B995B5DF844F7814035C82F761825F00E711D3C547FBF630B7253FC62D99
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"451e0006-bb29-4499-a095-6a26d71ed4cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1727630142683,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):1058
                        Entropy (8bit):5.649562790427565
                        Encrypted:false
                        SSDEEP:24:Yv6XaKiyamXayLgEFRcONaqnl0RCmK8czOC+w2E+tg8BY1:YvHMBguOAh8cv+NKh
                        MD5:406F36241E2EDA48372CBDF00CEB0FB8
                        SHA1:1F9C2DD9E372C51E3A8CCBB28AD9C09CAB6EEC71
                        SHA-256:75EA60AE325318EDD50123D4EC8D14CDEB923550622145F2A9A6509B85EBEA5B
                        SHA-512:90FF0DBD059DCF492960EB9C8A8091308AF663983567DF2455BF6688855907D79EA048C859D2735C9AF5B6F9E749A916C96148FD2D628D6552A9FECE898EEF4A
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"451e0006-bb29-4499-a095-6a26d71ed4cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1727630142683,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_3","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"ece07729-7db6-4f20-9f8d-7976ad373049","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IlNlbmQgZG9jdW1lbnRzICYgZm9ybXNcbmZvciBmYXN0IGUtc2lnbmluZyBvbmxpbmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme"

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):286
                        Entropy (8bit):5.2228304779170855
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXDQBAhd7+FIbRI6XVW7+0YMURMqoAvJfshHHrPeUkwRe9:YvXKXaAqYpW7ZIsGUUUkee9
                        MD5:C58553D37F59FE60D6F0953BD8DB0FC3
                        SHA1:7DB0C8DD858C07EA8F9F6B1CD955D0B0F1CBC17C
                        SHA-256:9F643CC8A6828643C93798785853ECA7ED1C4099AE4AADE11926EBD4FCD98A56
                        SHA-512:E520823C92B3B1ABE9380D5EFB1F1046F31AC039F6C41FD228DAE493D5806BA7A941634CF9A3C1ABE7FB550921965109FDA5B8DFFACE249072CE6E9C5548B113
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"451e0006-bb29-4499-a095-6a26d71ed4cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1727630142683,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):782
                        Entropy (8bit):5.359258472004852
                        Encrypted:false
                        SSDEEP:12:YvXKXaAqYpW7ZIsGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhW81:Yv6XaKiF168CgEXX5kcIfANht1
                        MD5:543E5F8DDB334D06A20141ABCEEC63FC
                        SHA1:75835912AEFCDD9D6C65FE2C22C8DB6FF955D17F
                        SHA-256:CC55813299EC644A277B6BDCBE96FEFC9DE03B3CDC9FF2BB6905F4A521ECE691
                        SHA-512:6256CE077CD871ACFC6F3E4B3B8D8400466AC711C48BB936DEA5E5415BA9AC495BE8E9EA60270E4274743C79F293DE86353F476410F6F43F8EE373DF17942232
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"451e0006-bb29-4499-a095-6a26d71ed4cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1727630142683,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1727451387709}}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):4
                        Entropy (8bit):0.8112781244591328
                        Encrypted:false
                        SSDEEP:3:e:e
                        MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                        SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                        SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                        SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                        Malicious:false
                        Preview:....

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):2818
                        Entropy (8bit):5.141097587629666
                        Encrypted:false
                        SSDEEP:48:YQPrlpVL2MKOmzlMAmHgMQ1QmJRv0+pdfzm99/Y9lwUF:Jl2ZmAMp+Nq9AB
                        MD5:B6855D21C1FD750C889796E37B31F80E
                        SHA1:A3D73176C5E29A06D31A1B0DED8479CB7EED4613
                        SHA-256:80F26499FD56776C8866FDBE38877B1EFBD9540F2E59BA5D928039889217ECEE
                        SHA-512:0F9DBBE2ED5052EC748CC6EB475BB2377D852A34586790556A4D7E04514280EAFA789497D018E19145B3795C055C876BE9085AAAB45F657D4908FEE0C33B7387
                        Malicious:false
                        Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"4c7a218988763d9a579e33791925f28b","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1050,"ts":1727451387000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"376f496d25aef6b7bf9713c16320cd86","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1727451387000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"4aadac0b2825294f1922c2f973308f80","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1058,"ts":1727451387000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"e0ab716c83b8f034bee4b3d84e09b65d","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1063,"ts":1727451387000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"8895e640d7bbb4620323e1be9f860947","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1038,"ts":1727451387000},{"id":"Edit_InApp_Aug2020","info":{"dg":"53531500dc526907a12c0b4e77482ff0","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":17

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
                        Category:dropped
                        Size (bytes):12288
                        Entropy (8bit):0.9841183229049072
                        Encrypted:false
                        SSDEEP:24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Spij4zJwtNBwtNbRZ6bRZ4PjF:TVl2GL7ms6ggOVpNzutYtp6PI
                        MD5:91DCF7A1E86A301BA93CE7366B3E5BB9
                        SHA1:2300E84CE03E63EA30FB5FEFAC19B0633F98AC21
                        SHA-256:837D82B74D6D854C24D8B8648ED12047C939668A163559A0C468862953351951
                        SHA-512:1A3EA341B828D5B6FEB8B81FB881D1FC7B6A817B87B33C292B76AF52B086C476AA23A2B73C4833BA45806947EB594E07F68EDBD4EC84E727E324CB2FA1074A4C
                        Malicious:false
                        Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:SQLite Rollback Journal
                        Category:dropped
                        Size (bytes):8720
                        Entropy (8bit):1.3394288537700634
                        Encrypted:false
                        SSDEEP:24:7+tCAD1RZKHs/Ds/SpijPzJwtNBwtNbRZ6bRZWf1RZKuqLBx/XYKQvGJF7ursWl:7MCGgOVpWzutYtp6PM/qll2GL7msWl
                        MD5:A5E413E587264D88EDCD2324C9B2B503
                        SHA1:D2AE4765569E38D9AAC13D8919C6C8E73460889D
                        SHA-256:CB4B8468A5814773513139E5DBFEDC5615157F49EAEDE40691E87C2ECCD53128
                        SHA-512:AD09B7AD05FB5D1AE7EF43C64E2AAF16D286B5143101961B8912C5FB7875DEF578AE2387DE6942AA72A899FB9071F58254D7BDF895C9A4D83A5E7DFE1FC9AC13
                        Malicious:false
                        Preview:.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Temp\MSI6c37e.LOG

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):246
                        Entropy (8bit):3.53559722477471
                        Encrypted:false
                        SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8Ub9:Qw946cPbiOxDlbYnuRKZ9
                        MD5:9EA9816384D13C340E5978028FE5795D
                        SHA1:7EAC3553E05FF7AB233763FA09000543CF606192
                        SHA-256:6893AFF66CA4D67635EC60A596E6095579C0C03D3D87CDDBF279943213C4B8A6
                        SHA-512:8E790D5FFBB32D781C3AC7E9E468FA272BBF4A9BA2922894BFF78453DC7925C0C1CB6B53D7CB85F84B7E887EC7345FA2610FC06C0AF9661B71FB40DA91C8C77C
                        Malicious:false
                        Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.7./.0.9./.2.0.2.4. . .1.1.:.3.6.:.2.8. .=.=.=.....

                        C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91nc4ata_dakdrj_uk.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:PDF document, version 1.6, 0 pages
                        Category:dropped
                        Size (bytes):358
                        Entropy (8bit):5.05841900170208
                        Encrypted:false
                        SSDEEP:6:IngVMrexJzJT0y9VEQIFVmb/eu2g/86S1kxROOAm47umbZbm47umbFCSyAAO:IngVMre9T0HQIDmy9g06JXw97usZb97Z
                        MD5:CC4EF60F8FB300E5A746E8A41C1C4688
                        SHA1:95CED1E4E18C55E3E271D8AEC1298DBC0258FD26
                        SHA-256:1A36F2FED25B25A4A7C5A1C1C43082CC777E64A26525F106529864DA496E3CF4
                        SHA-512:3DBBD240F4665F939E72E7BD3E6DA465F7A95B9F66BFBE620651132295E26B22716E19682C4E9C5E9DB445254300A290A2A5EA1CF9D450041F83E991B9B02B06
                        Malicious:false
                        Preview:%PDF-1.6.%......1 0 obj.<</Pages 2 0 R/Type/Catalog>>.endobj.2 0 obj.<</Count 0/Kids[]/Type/Pages>>.endobj.3 0 obj.<<>>.endobj.xref..0 4..0000000000 65535 f..0000000016 00000 n..0000000061 00000 n..0000000107 00000 n..trailer..<</Size 4/Root 1 0 R/Info 3 0 R/ID[<B284F459238CE04CA6D5841C53F499F0><B284F459238CE04CA6D5841C53F499F0>]>>..startxref..127..%%EOF..

                        C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-09-27 11-36-22-743.log

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:ASCII text, with very long lines (393)
                        Category:dropped
                        Size (bytes):16525
                        Entropy (8bit):5.376360055978702
                        Encrypted:false
                        SSDEEP:384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
                        MD5:1336667A75083BF81E2632FABAA88B67
                        SHA1:46E40800B27D95DAED0DBB830E0D0BA85C031D40
                        SHA-256:F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
                        SHA-512:D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
                        Malicious:false
                        Preview:SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

                        C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:ASCII text, with very long lines (393), with CRLF line terminators
                        Category:dropped
                        Size (bytes):15114
                        Entropy (8bit):5.355806726025244
                        Encrypted:false
                        SSDEEP:384:xkQJaaE8ygp1n7769LFXl0hlwPwMA/HtvsVxnvBejdOq06uMm78Y232lgug2I5ZV:zj9
                        MD5:5EF356983D602C9C87C521AEB6057DC0
                        SHA1:4CB04CA0B7F125936FBEC69BC6ED24BC9D2B7ABA
                        SHA-256:F887C0D45C9BCCA5E879F41DE953ED13AB24C84298FEE0FC575C021F8782047E
                        SHA-512:C5BECD65C2E68F7EDF17E16C6B8225EC1A4EDAAB096E65268604A7351E6A763A2D59FC2744504C512F1C7A4A05D542459AFD39CC9ACD8B413DB9811DA5F26A5A
                        Malicious:false
                        Preview:SessionID=cbdc7e63-d558-40a9-a005-488e9ee73bb6.1727451382778 Timestamp=2024-09-27T11:36:22:778-0400 ThreadID=7176 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=cbdc7e63-d558-40a9-a005-488e9ee73bb6.1727451382778 Timestamp=2024-09-27T11:36:22:791-0400 ThreadID=7176 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=cbdc7e63-d558-40a9-a005-488e9ee73bb6.1727451382778 Timestamp=2024-09-27T11:36:22:791-0400 ThreadID=7176 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=cbdc7e63-d558-40a9-a005-488e9ee73bb6.1727451382778 Timestamp=2024-09-27T11:36:22:791-0400 ThreadID=7176 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=cbdc7e63-d558-40a9-a005-488e9ee73bb6.1727451382778 Timestamp=2024-09-27T11:36:22:793-0400 ThreadID=7176 Component=ngl-lib_NglAppLib Description="SetConf

                        C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):29752
                        Entropy (8bit):5.405206716435118
                        Encrypted:false
                        SSDEEP:768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGb2:a
                        MD5:F86B0A155E992F8A82611D903856A308
                        SHA1:A6A36A8A80EFC4CF4E4E5F5B06D339DBB4C8339C
                        SHA-256:33F3098CADEFC6C0C28A2A6D2E928179724DC1AA6538D1A55A2974C41ED57A3D
                        SHA-512:F188B834DF04B0D21C465F608DF3E9FCAB4B5E0F534DC35D333F306F2C22BE3B34A666C08221C57503CC602D15D767D4C1F7829DC7E1AF0E6B7C209A580987D4
                        Malicious:false
                        Preview:04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

                        C:\Users\user\AppData\Local\Temp\acrocef_low\0c5510d1-db81-4e42-a692-9f9a294c94a9.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                        Category:dropped
                        Size (bytes):758601
                        Entropy (8bit):7.98639316555857
                        Encrypted:false
                        SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                        MD5:3A49135134665364308390AC398006F1
                        SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                        SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                        SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                        Malicious:false
                        Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                        C:\Users\user\AppData\Local\Temp\acrocef_low\2383a919-ce10-4541-a128-843455271905.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                        Category:dropped
                        Size (bytes):386528
                        Entropy (8bit):7.9736851559892425
                        Encrypted:false
                        SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                        MD5:5C48B0AD2FEF800949466AE872E1F1E2
                        SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                        SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                        SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                        Malicious:false
                        Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                        C:\Users\user\AppData\Local\Temp\acrocef_low\8a9cbcb8-262d-4881-8b88-8b74090cc27c.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                        Category:dropped
                        Size (bytes):1407294
                        Entropy (8bit):7.97605879016224
                        Encrypted:false
                        SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
                        MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
                        SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
                        SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
                        SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
                        Malicious:false
                        Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                        C:\Users\user\AppData\Local\Temp\acrocef_low\a2e131c7-8dff-45f8-9130-bb9684ea1ddd.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                        Category:dropped
                        Size (bytes):1419751
                        Entropy (8bit):7.976496077007677
                        Encrypted:false
                        SSDEEP:24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
                        MD5:18E3D04537AF72FDBEB3760B2D10C80E
                        SHA1:B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
                        SHA-256:BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
                        SHA-512:2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
                        Malicious:false
                        Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                        Static File Info

                        General

                        File type:PDF document, version 1.4, 1 pages
                        Entropy (8bit):7.863567354573888
                        TrID:
                        • Adobe Portable Document Format (5005/1) 100.00%
                        File name:5BPXX1HIGER9.pdf
                        File size:50'795 bytes
                        MD5:aa55b36be9bbd1bdb65a4b2741e70f8b
                        SHA1:3953604d2ebf3bc6d692b2c186a0001c941cab27
                        SHA256:80d1d9115bd719cec06ec131626f9f8721f8e9259d5aead43b8d20c24f6ce556
                        SHA512:d71f888b89ef918ee9ffddb205769413bb5a30176f44acefc639d93d409d29731997b20cf423d3d640a278f6d1dc0f5d2bffcd1d9b1cbc3cce5c61eacd0ba36b
                        SSDEEP:768:4zyH2yhB3zXReHqol5+oXi81PUVhi1DHVHWaUNI7/uAtqu+0TxGeU:4zcTlUHhXfi8s6ZHWacI6AMu+0TxGeU
                        TLSH:2933C0B2B7865C4DDDE38772ED64BA4D88B8BD5745C840A3F0320A956D9DC38B6328CD
                        File Content Preview:%PDF-1.4.1 0 obj.<<./Title (..)./Creator (...w.k.h.t.m.l.t.o.p.d.f. .0...1.2...6)./Producer (...Q.t. .4...8...7)./CreationDate (D:20240927145741Z).>>.endobj.3 0 obj.<<./Type /ExtGState./SA true./SM 0.02./ca 1.0./CA 1.0./AIS false./SMask /None>>.endobj.4 0

                        File Icon

                        Icon Hash:62cc8caeb29e8ae0

                        Static PDF Info

                        General

                        Header:%PDF-1.4
                        Total Entropy:7.863567
                        Total Bytes:50795
                        Stream Entropy:7.951490
                        Stream Bytes:45293
                        Entropy outside Streams:5.152872
                        Bytes outside Streams:5502
                        Number of EOF found:1
                        Bytes after EOF:

                        Keywords Statistics

                        NameCount
                        obj36
                        endobj36
                        stream10
                        endstream10
                        xref1
                        trailer1
                        startxref1
                        /Page1
                        /Encrypt0
                        /ObjStm0
                        /URI0
                        /JS0
                        /JavaScript0
                        /AA0
                        /OpenAction0
                        /AcroForm0
                        /JBIG2Decode0
                        /RichMedia0
                        /Launch0
                        /EmbeddedFile0

                        Image Streams

                        IDDHASHMD5Preview
                        969647b6b66e4d054f82a3f5e12732395a25774e01a227be4

                        Network Behavior

                        Network Port Distribution

                        TCP Packets

                        TimestampSource PortDest PortSource IPDest IP
                        Sep 27, 2024 17:36:33.983266115 CEST49721443192.168.2.523.56.162.185
                        Sep 27, 2024 17:36:33.983321905 CEST4434972123.56.162.185192.168.2.5
                        Sep 27, 2024 17:36:33.983393908 CEST49721443192.168.2.523.56.162.185
                        Sep 27, 2024 17:36:33.983740091 CEST49721443192.168.2.523.56.162.185
                        Sep 27, 2024 17:36:33.983757019 CEST4434972123.56.162.185192.168.2.5
                        Sep 27, 2024 17:36:34.684871912 CEST4434972123.56.162.185192.168.2.5
                        Sep 27, 2024 17:36:34.685425997 CEST49721443192.168.2.523.56.162.185
                        Sep 27, 2024 17:36:34.685467958 CEST4434972123.56.162.185192.168.2.5
                        Sep 27, 2024 17:36:34.689131975 CEST4434972123.56.162.185192.168.2.5
                        Sep 27, 2024 17:36:34.689214945 CEST49721443192.168.2.523.56.162.185
                        Sep 27, 2024 17:36:34.714464903 CEST49721443192.168.2.523.56.162.185
                        Sep 27, 2024 17:36:34.714696884 CEST4434972123.56.162.185192.168.2.5
                        Sep 27, 2024 17:36:34.714730978 CEST49721443192.168.2.523.56.162.185
                        Sep 27, 2024 17:36:34.757169962 CEST49721443192.168.2.523.56.162.185
                        Sep 27, 2024 17:36:34.757184029 CEST4434972123.56.162.185192.168.2.5
                        Sep 27, 2024 17:36:34.804008007 CEST49721443192.168.2.523.56.162.185
                        Sep 27, 2024 17:36:34.885026932 CEST4434972123.56.162.185192.168.2.5
                        Sep 27, 2024 17:36:34.885200977 CEST4434972123.56.162.185192.168.2.5
                        Sep 27, 2024 17:36:34.885621071 CEST49721443192.168.2.523.56.162.185
                        Sep 27, 2024 17:36:34.885653973 CEST4434972123.56.162.185192.168.2.5
                        Sep 27, 2024 17:36:34.885667086 CEST49721443192.168.2.523.56.162.185
                        Sep 27, 2024 17:36:34.885696888 CEST49721443192.168.2.523.56.162.185

                        UDP Packets

                        TimestampSource PortDest PortSource IPDest IP
                        Sep 27, 2024 17:36:33.518146992 CEST5270253192.168.2.51.1.1.1
                        Sep 27, 2024 17:36:47.501492977 CEST5574153192.168.2.51.1.1.1

                        DNS Queries

                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                        Sep 27, 2024 17:36:33.518146992 CEST192.168.2.51.1.1.10x6586Standard query (0)x1.i.lencr.orgA (IP address)IN (0x0001)false
                        Sep 27, 2024 17:36:47.501492977 CEST192.168.2.51.1.1.10x6793Standard query (0)x1.i.lencr.orgA (IP address)IN (0x0001)false

                        DNS Answers

                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                        Sep 27, 2024 17:36:33.525928020 CEST1.1.1.1192.168.2.50x6586No error (0)x1.i.lencr.orgcrl.root-x1.letsencrypt.org.edgekey.netCNAME (Canonical name)IN (0x0001)false
                        Sep 27, 2024 17:36:47.511512041 CEST1.1.1.1192.168.2.50x6793No error (0)x1.i.lencr.orgcrl.root-x1.letsencrypt.org.edgekey.netCNAME (Canonical name)IN (0x0001)false

                        HTTP Request Dependency Graph

                        • armmf.adobe.com

                        HTTPS Proxied Packets

                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                        0192.168.2.54972123.56.162.1854437424C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        TimestampBytes transferredDirectionData
                        2024-09-27 15:36:34 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
                        Host: armmf.adobe.com
                        Connection: keep-alive
                        Accept-Language: en-US,en;q=0.9
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
                        Sec-Fetch-Site: same-origin
                        Sec-Fetch-Mode: no-cors
                        Sec-Fetch-Dest: empty
                        Accept-Encoding: gzip, deflate, br
                        If-None-Match: "78-5faa31cce96da"
                        If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
                        2024-09-27 15:36:34 UTC198INHTTP/1.1 304 Not Modified
                        Content-Type: text/plain; charset=UTF-8
                        Last-Modified: Mon, 01 May 2023 15:02:33 GMT
                        ETag: "78-5faa31cce96da"
                        Date: Fri, 27 Sep 2024 15:36:34 GMT
                        Connection: close


                        Statistics

                        CPU Usage

                        Click to jump to process

                        Memory Usage

                        Click to jump to process

                        High Level Behavior Distribution

                        Click to dive into process behavior distribution

                        Behavior

                        Click to jump to process

                        System Behavior

                        General

                        Target ID:0
                        Start time:11:36:19
                        Start date:27/09/2024
                        Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        Wow64 process (32bit):false
                        Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\5BPXX1HIGER9.pdf"
                        Imagebase:0x7ff686a00000
                        File size:5'641'176 bytes
                        MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high
                        Has exited:true

                        General

                        Target ID:2
                        Start time:11:36:20
                        Start date:27/09/2024
                        Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        Wow64 process (32bit):false
                        Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                        Imagebase:0x7ff6413e0000
                        File size:3'581'912 bytes
                        MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high
                        Has exited:true

                        General

                        Target ID:4
                        Start time:11:36:20
                        Start date:27/09/2024
                        Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        Wow64 process (32bit):false
                        Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1556,i,2454859765742305140,6723875660102114181,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                        Imagebase:0x7ff6413e0000
                        File size:3'581'912 bytes
                        MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high
                        Has exited:true

                        Disassembly

                        ⊘No disassembly