Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
00b9978f-ff57-4ab4-9bf8-ae8853d3346f.pdf

Overview

General Information

Sample name:00b9978f-ff57-4ab4-9bf8-ae8853d3346f.pdf
(renamed file extension from none to pdf)
Original sample name:00b9978f-ff57-4ab4-9bf8-ae8853d3346f
Analysis ID:1523630
MD5:e7a4e4a027a5fdfc75a6e33716f2a365
SHA1:ca62581ed80eed4d05d72993fab0b0d47643d934
SHA256:0dd0e3e2412f594d5d3e2af9389b9489fff5cba60ac4ce66d7c802580f17455d
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 6476 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\00b9978f-ff57-4ab4-9bf8-ae8853d3346f.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 7016 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 5288 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1708,i,4304674134217149286,5362066792861887805,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficDNS query: name: x1.i.lencr.org
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.41.168.139:443
Source: global trafficTCP traffic: 23.41.168.139:443 -> 192.168.2.4:49743
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.41.168.139:443
Source: global trafficTCP traffic: 23.41.168.139:443 -> 192.168.2.4:49743
Source: global trafficTCP traffic: 23.41.168.139:443 -> 192.168.2.4:49743
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.41.168.139:443
Source: global trafficTCP traffic: 23.41.168.139:443 -> 192.168.2.4:49743
Source: global trafficTCP traffic: 23.41.168.139:443 -> 192.168.2.4:49743
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.41.168.139:443
Source: global trafficTCP traffic: 23.41.168.139:443 -> 192.168.2.4:49743
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.41.168.139:443
Source: global trafficTCP traffic: 23.41.168.139:443 -> 192.168.2.4:49743
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.41.168.139:443
Source: global trafficTCP traffic: 23.41.168.139:443 -> 192.168.2.4:49743
Source: global trafficTCP traffic: 23.41.168.139:443 -> 192.168.2.4:49743
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.41.168.139:443
Source: global trafficTCP traffic: 23.41.168.139:443 -> 192.168.2.4:49743
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.41.168.139:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.41.168.139:443
Source: Joe Sandbox ViewIP Address: 23.41.168.139 23.41.168.139
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknownTCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknownTCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknownTCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknownTCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknownTCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknownTCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknownTCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknownTCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknownTCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknownTCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknownTCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global trafficDNS traffic detected: DNS query: x1.i.lencr.org
Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.drString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.drString found in binary or memory: http://x1.i.lencr.org/
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: classification engineClassification label: clean2.winPDF@14/47@1/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journalJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 15-33-42-144.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\00b9978f-ff57-4ab4-9bf8-ae8853d3346f.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1708,i,4304674134217149286,5362066792861887805,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1708,i,4304674134217149286,5362066792861887805,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: 00b9978f-ff57-4ab4-9bf8-ae8853d3346f.pdfInitial sample: PDF keyword /JS count = 0
Source: 00b9978f-ff57-4ab4-9bf8-ae8853d3346f.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: 00b9978f-ff57-4ab4-9bf8-ae8853d3346f.pdfInitial sample: PDF keyword /JBIG2Decode count = 6
Source: 00b9978f-ff57-4ab4-9bf8-ae8853d3346f.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts3
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media2
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive13
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1523630 Sample: 00b9978f-ff57-4ab4-9bf8-ae8... Startdate: 01/10/2024 Architecture: WINDOWS Score: 2 14 x1.i.lencr.org 2->14 16 bg.microsoft.map.fastly.net 2->16 7 Acrobat.exe 17 72 2->7         started        process3 process4 9 AcroCEF.exe 91 7->9         started        process5 11 AcroCEF.exe 2 9->11         started        dnsIp6 18 23.41.168.139, 443, 49743 ZAYO-6461US United States 11->18

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
00b9978f-ff57-4ab4-9bf8-ae8853d3346f.pdf0%ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://x1.i.lencr.org/0%URL Reputationsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
bg.microsoft.map.fastly.net
199.232.214.172
truefalse
    		unknown
    x1.i.lencr.org
    		unknown
    		unknownfalse
      		unknown

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      http://x1.i.lencr.org/2D85F72862B55C4EADD9E66E06947F3D0.1.drfalse
      • URL Reputation: safe
      		unknown

      World Map of Contacted IPs

      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs

      Public IPs

      IPDomainCountryFlagASNASN NameMalicious
      23.41.168.139
      		unknownUnited States
      		6461ZAYO-6461USfalse

      General Information

      Joe Sandbox version:41.0.0 Charoite
      Analysis ID:1523630
      Start date and time:2024-10-01 21:32:46 +02:00
      Joe Sandbox product:CloudBasic
      Overall analysis duration:0h 4m 6s
      Hypervisor based Inspection enabled:false
      Report type:full
      Cookbook file name:defaultwindowspdfcookbook.jbs
      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
      Number of analysed new started processes analysed:10
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • HCA enabled
      • EGA enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Sample name:00b9978f-ff57-4ab4-9bf8-ae8853d3346f.pdf
      (renamed file extension from none to pdf)
      Original Sample Name:00b9978f-ff57-4ab4-9bf8-ae8853d3346f
      Detection:CLEAN
      Classification:clean2.winPDF@14/47@1/1
      EGA Information:Failed
      HCA Information:
      • Successful, ratio: 100%
      • Number of executed functions: 0
      • Number of non-executed functions: 0
      Cookbook Comments:
      • Found PDF document
      • Close Viewer

      Warnings

      • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
      • Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.19.126.149, 2.19.126.143, 162.159.61.3, 172.64.41.3, 54.227.187.23, 52.202.204.11, 52.5.13.197, 23.22.254.206, 2.23.197.184, 199.232.214.172
      • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
      • Not all processes where analyzed, report is missing behavior information
      • VT rate limit hit for: 00b9978f-ff57-4ab4-9bf8-ae8853d3346f.pdf

      Simulations

      Behavior and APIs

      TimeTypeDescription
      15:33:47API Interceptor2x Sleep call for process: AcroCEF.exe modified

      LLM Input / Output

      InputOutput
      URL: PDF document Model: jbxai
      {
"brand":[],
"contains_trigger_text":false,
"trigger_text":"",
"prominent_button_name":"unknown",
"text_input_field_labels":"unknown",
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"has_visible_qrcode":false}

      Joe Sandbox View / Context

      IPs

      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      23.41.168.139Sales_Contract_Main_417053608_09.2024.pdfGet hashmaliciousUnknownBrowse
        Sales_Contract_Main_417053608_09.2024.pdfGet hashmaliciousUnknownBrowse
          140AEcuVy7.lnkGet hashmaliciousLonePageBrowse
            XnQmVRj5g0.lnkGet hashmaliciousLonePageBrowse
              Advisory23-UCDMS04-11-01.pdf.lnkGet hashmaliciousUnknownBrowse
                Callus+1(814)-310-9943.pdfGet hashmaliciousPayPal PhisherBrowse
                  Steel Dynamics.pdfGet hashmaliciousUnknownBrowse
                    https://seedsmarket.org/Get hashmaliciousHTMLPhisherBrowse
                      1445321243TK.pdfGet hashmaliciousUnknownBrowse
                        cho6043ijz.000Get hashmaliciousUnknownBrowse

                          Domains

                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                          bg.microsoft.map.fastly.netTranslink_rishi.vasandani_Advice81108.pdfGet hashmaliciousUnknownBrowse
                          • 199.232.210.172
                          bWrRSlOThY.exeGet hashmaliciousAsyncRAT, NeshtaBrowse
                          • 199.232.210.172
                          https://www.dropbox.com/l/scl/AADL_v5DzsoHwkyegIhk6J0bQm3A7UWklCAGet hashmaliciousUnknownBrowse
                          • 199.232.214.172
                          https://k7qo.sarnerholz.cam/APRjVfmkGet hashmaliciousUnknownBrowse
                          • 199.232.214.172
                          https://0.pwsinc.shop/?MKPT=IncGet hashmaliciousCaptcha PhishBrowse
                          • 199.232.210.172
                          https://swissquotech.com/swissquote-2024.zipGet hashmaliciousPhisherBrowse
                          • 199.232.214.172
                          He6pI1bhcA.exeGet hashmaliciousScreenConnect ToolBrowse
                          • 199.232.214.172
                          5eRyCYRR9y.exeGet hashmaliciousScreenConnect ToolBrowse
                          • 199.232.210.172
                          VD01NDHM8u.exeGet hashmaliciousScreenConnect ToolBrowse
                          • 199.232.210.172
                          vovE92JSzK.exeGet hashmaliciousScreenConnect ToolBrowse
                          • 199.232.214.172

                          ASNs

                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                          ZAYO-6461USSales_Contract_Main_417053608_09.2024.pdfGet hashmaliciousUnknownBrowse
                          • 23.41.168.139
                          Sales_Contract_Main_417053608_09.2024.pdfGet hashmaliciousUnknownBrowse
                          • 23.41.168.139
                          140AEcuVy7.lnkGet hashmaliciousLonePageBrowse
                          • 23.41.168.139
                          XnQmVRj5g0.lnkGet hashmaliciousLonePageBrowse
                          • 23.41.168.139
                          Advisory23-UCDMS04-11-01.pdf.lnkGet hashmaliciousUnknownBrowse
                          • 23.41.168.139
                          Callus+1(814)-310-9943.pdfGet hashmaliciousPayPal PhisherBrowse
                          • 23.41.168.139
                          Steel Dynamics.pdfGet hashmaliciousUnknownBrowse
                          • 23.41.168.139
                          https://seedsmarket.org/Get hashmaliciousHTMLPhisherBrowse
                          • 23.41.168.139
                          1445321243TK.pdfGet hashmaliciousUnknownBrowse
                          • 23.41.168.139
                          cho6043ijz.000Get hashmaliciousUnknownBrowse
                          • 23.41.168.139

                          JA3 Fingerprints

                          ⊘No context

                          Dropped Files

                          ⊘No context

                          Created / dropped Files

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:ASCII text
                          Category:dropped
                          Size (bytes):292
                          Entropy (8bit):5.238346974070727
                          Encrypted:false
                          SSDEEP:6:dYeQ+q2Pwkn2nKuAl9OmbnIFUt8cYggZmw+cYhMSQVkwOwkn2nKuAl9OmbjLJ:dVVvYfHAahFUt8crg/+cyMSI5JfHAaSJ
                          MD5:ED89F263AC0E22271632D69878EB4EF0
                          SHA1:6E952DD9AB11AF6B87BDD4CB6CE4D1D616F6ED9A
                          SHA-256:1EF148712B0652D30E434BA2293233C5E5BD09F5D06FB110E71AC635492757D2
                          SHA-512:E0A15422E63C3AC76E70075396184EBC61C134AD3EE3069DC40F48C09EA5F4662A7B013C19F48C7CE6D8764EF44D2A6762BC66108D99DA294E3EB9AD7714894F
                          Malicious:false
                          Reputation:low
                          Preview:2024/10/01-15:33:39.886 1b98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/01-15:33:39.888 1b98 Recovering log #3.2024/10/01-15:33:39.889 1b98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:ASCII text
                          Category:dropped
                          Size (bytes):292
                          Entropy (8bit):5.238346974070727
                          Encrypted:false
                          SSDEEP:6:dYeQ+q2Pwkn2nKuAl9OmbnIFUt8cYggZmw+cYhMSQVkwOwkn2nKuAl9OmbjLJ:dVVvYfHAahFUt8crg/+cyMSI5JfHAaSJ
                          MD5:ED89F263AC0E22271632D69878EB4EF0
                          SHA1:6E952DD9AB11AF6B87BDD4CB6CE4D1D616F6ED9A
                          SHA-256:1EF148712B0652D30E434BA2293233C5E5BD09F5D06FB110E71AC635492757D2
                          SHA-512:E0A15422E63C3AC76E70075396184EBC61C134AD3EE3069DC40F48C09EA5F4662A7B013C19F48C7CE6D8764EF44D2A6762BC66108D99DA294E3EB9AD7714894F
                          Malicious:false
                          Reputation:low
                          Preview:2024/10/01-15:33:39.886 1b98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/01-15:33:39.888 1b98 Recovering log #3.2024/10/01-15:33:39.889 1b98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:ASCII text
                          Category:dropped
                          Size (bytes):336
                          Entropy (8bit):5.13457065751251
                          Encrypted:false
                          SSDEEP:6:d2qM+q2Pwkn2nKuAl9Ombzo2jMGIFUt8cetZZmw+cetMMVkwOwkn2nKuAl9Ombzz:dy+vYfHAa8uFUt8cetZ/+cetNV5JfHAv
                          MD5:718AC2C8B1D3F2E6C502C2AE6CF5DD10
                          SHA1:56F752D7534E281019EF48064D823794DB8C859A
                          SHA-256:ECC0F3C721EA8169B6D256DBD490704A0B95CCB6DB2EDF26DC2A0777AA6AABFE
                          SHA-512:5AF5F307F609927A38D3E6416C304122B110DE32EA1D79399D61012BA0FA3407AD676EBA745D6B17F917A816B715DDBDBE89691C1A48A7EB011742222EFD90C4
                          Malicious:false
                          Reputation:low
                          Preview:2024/10/01-15:33:40.034 181c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/01-15:33:40.038 181c Recovering log #3.2024/10/01-15:33:40.038 181c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:ASCII text
                          Category:dropped
                          Size (bytes):336
                          Entropy (8bit):5.13457065751251
                          Encrypted:false
                          SSDEEP:6:d2qM+q2Pwkn2nKuAl9Ombzo2jMGIFUt8cetZZmw+cetMMVkwOwkn2nKuAl9Ombzz:dy+vYfHAa8uFUt8cetZ/+cetNV5JfHAv
                          MD5:718AC2C8B1D3F2E6C502C2AE6CF5DD10
                          SHA1:56F752D7534E281019EF48064D823794DB8C859A
                          SHA-256:ECC0F3C721EA8169B6D256DBD490704A0B95CCB6DB2EDF26DC2A0777AA6AABFE
                          SHA-512:5AF5F307F609927A38D3E6416C304122B110DE32EA1D79399D61012BA0FA3407AD676EBA745D6B17F917A816B715DDBDBE89691C1A48A7EB011742222EFD90C4
                          Malicious:false
                          Reputation:low
                          Preview:2024/10/01-15:33:40.034 181c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/01-15:33:40.038 181c Recovering log #3.2024/10/01-15:33:40.038 181c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\037fc4a7-a959-4efb-837a-36bd03dadccb.tmp

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:JSON data
                          Category:modified
                          Size (bytes):475
                          Entropy (8bit):4.9578626600426565
                          Encrypted:false
                          SSDEEP:12:YH/um3RA8sqMAXhsBdOg2HCcaq3QYiubInP7E4T3y:Y2sRdsjpdMHN3QYhbG7nby
                          MD5:99F306FAEB3E46B23C5FEEF7D5D2A4B3
                          SHA1:6AF35EBD48C285BE4F68B8F28E3EC1B1616E905B
                          SHA-256:76796E2742EFBDA33668062E73125EF6DB5EDE51078C0A3E760E4EAA4CEBF124
                          SHA-512:0DC876D2B5F0C4765476FEA1E1C41710F77EA11DE27F5C46B68EDD7C4C82C62AB12584CE6C18F010ACAC5CDCC1CBAB2C59FBF59045885D47AA0ED7376FFC07AA
                          Malicious:false
                          Reputation:low
                          Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372371231623344","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125105},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):475
                          Entropy (8bit):4.9578626600426565
                          Encrypted:false
                          SSDEEP:12:YH/um3RA8sqMAXhsBdOg2HCcaq3QYiubInP7E4T3y:Y2sRdsjpdMHN3QYhbG7nby
                          MD5:99F306FAEB3E46B23C5FEEF7D5D2A4B3
                          SHA1:6AF35EBD48C285BE4F68B8F28E3EC1B1616E905B
                          SHA-256:76796E2742EFBDA33668062E73125EF6DB5EDE51078C0A3E760E4EAA4CEBF124
                          SHA-512:0DC876D2B5F0C4765476FEA1E1C41710F77EA11DE27F5C46B68EDD7C4C82C62AB12584CE6C18F010ACAC5CDCC1CBAB2C59FBF59045885D47AA0ED7376FFC07AA
                          Malicious:false
                          Reputation:low
                          Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372371231623344","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125105},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:data
                          Category:dropped
                          Size (bytes):4730
                          Entropy (8bit):5.25351868599199
                          Encrypted:false
                          SSDEEP:96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7XyyA9FZ:etJCV4FiN/jTN/2r8Mta02fEhgO73gow
                          MD5:66BC684953E17411901A9998FF7C3F80
                          SHA1:BC3D7F7DC35DE99518CA1106B81D4F70BFE62B36
                          SHA-256:AD14873D1EF39EF64D3ACE133CB24E0B53EE863881F5969CB5649792ABF19B52
                          SHA-512:0DFF1DD195501102481E8BF1F4623B85EB931623C7F8D683FB7CFABE06320B15FF94383181B310B50D4112BA5F1769FB089990AEAC8829772B77CE30C6BC4691
                          Malicious:false
                          Reputation:low
                          Preview:*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:ASCII text
                          Category:dropped
                          Size (bytes):324
                          Entropy (8bit):5.131935764518419
                          Encrypted:false
                          SSDEEP:6:dhldtMM+q2Pwkn2nKuAl9OmbzNMxIFUt8chVUWGXZmw+chGSMMVkwOwkn2nKuAlG:dhH/+vYfHAa8jFUt8chVUN/+chBV5Jfv
                          MD5:B08A73161FBEF4F8EB4FFEFFB85FE339
                          SHA1:9FBD79CD6A846C894FF9ED4F052D7B6C0F8C6AE5
                          SHA-256:EB34673BA829EBAFA8B126856BFA65BC1C11B78D32E4E8B3C9004E73644F12CC
                          SHA-512:41FC36F5DA98757077AB7291F41995E7D1A1FADC8F5224D78E1A1C766F9BB21C55E38FE9382597691DBC198314E585929C5099F0C3716A199BE88B07755E827F
                          Malicious:false
                          Reputation:low
                          Preview:2024/10/01-15:33:40.141 181c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/01-15:33:40.142 181c Recovering log #3.2024/10/01-15:33:40.143 181c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:ASCII text
                          Category:dropped
                          Size (bytes):324
                          Entropy (8bit):5.131935764518419
                          Encrypted:false
                          SSDEEP:6:dhldtMM+q2Pwkn2nKuAl9OmbzNMxIFUt8chVUWGXZmw+chGSMMVkwOwkn2nKuAlG:dhH/+vYfHAa8jFUt8chVUN/+chBV5Jfv
                          MD5:B08A73161FBEF4F8EB4FFEFFB85FE339
                          SHA1:9FBD79CD6A846C894FF9ED4F052D7B6C0F8C6AE5
                          SHA-256:EB34673BA829EBAFA8B126856BFA65BC1C11B78D32E4E8B3C9004E73644F12CC
                          SHA-512:41FC36F5DA98757077AB7291F41995E7D1A1FADC8F5224D78E1A1C766F9BB21C55E38FE9382597691DBC198314E585929C5099F0C3716A199BE88B07755E827F
                          Malicious:false
                          Reputation:low
                          Preview:2024/10/01-15:33:40.141 181c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/01-15:33:40.142 181c Recovering log #3.2024/10/01-15:33:40.143 181c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                          C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241001193344Z-160.bmp

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
                          Category:dropped
                          Size (bytes):71190
                          Entropy (8bit):2.2164020692562554
                          Encrypted:false
                          SSDEEP:1536:DxfFCZkZD7Zhqa3hOLOpnL7Z3ZfekZvhyhXmZYRL+OWvRLEnWvRLmaRi/iVabbAB:mzM0i
                          MD5:D7E713320DB45CE8F036956930609166
                          SHA1:D050DABDB4AAD5BAED21A150A6AEA5756DBD6654
                          SHA-256:1D0C457E180C5F24E766C8CC599263FCD0791B2D0ACEBE19DE515929B24DCC38
                          SHA-512:0C94201057E26E6BF0CA394A7BD9AC69ADB977037025F0F2737E111A56AB81ED77AD8299C25D49D435488B7A8069F16AAA3AF55019FB3E0E8B837B96DDB53CF4
                          Malicious:false
                          Preview:BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                          C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
                          Category:dropped
                          Size (bytes):86016
                          Entropy (8bit):4.4449987562095545
                          Encrypted:false
                          SSDEEP:384:yezci5tAiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rXs3OazzU89UTTgUL
                          MD5:209ADAB87BB8328D10F5BA26891B437D
                          SHA1:04CAEEBFBDE463FDF924D9B292F11F5A1696E25E
                          SHA-256:FD7C84AD24AEA35116ADF3E635F9F5227C248B6C00D58B1CAA38C58DB124E5A9
                          SHA-512:96F9CBFF286E243C25FA51D09FE61090D58CA2481DE222DF7AA8285050DD505DA846CCECA989101E9ED77C57B54D1CC0744F64A95C07A3F7EE0F59FB146059C8
                          Malicious:false
                          Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                          C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:SQLite Rollback Journal
                          Category:dropped
                          Size (bytes):8720
                          Entropy (8bit):3.773489469658045
                          Encrypted:false
                          SSDEEP:48:7M1p/E2ioyViioy9oWoy1Cwoy1KKOioy1noy1AYoy1Wioy1hioybioygoy1noy13:7WpjuiFZXKQ91b9IVXEBodRBkN
                          MD5:9564554C9FC6311EF8355BE4B2B07D60
                          SHA1:3F21C05A35D0E5F1E1C8BBAF797DCEBE7B628754
                          SHA-256:481ED50406AE0677F174853C128C9359DC0B9463CB03A0104F174D20BF11A580
                          SHA-512:65617CA670A9BF0FDD872E61CC076AFF58CAAD65C5C654812497742DE5C78D77C8F422A1B4C2D4C4AD93819C5A1751C890555618BB0D07BB9AD9C2A65EF4F111
                          Malicious:false
                          Preview:.... .c......!e................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

                          C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:Certificate, Version=3
                          Category:dropped
                          Size (bytes):1391
                          Entropy (8bit):7.705940075877404
                          Encrypted:false
                          SSDEEP:24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
                          MD5:0CD2F9E0DA1773E9ED864DA5E370E74E
                          SHA1:CABD2A79A1076A31F21D253635CB039D4329A5E8
                          SHA-256:96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
                          SHA-512:3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
                          Malicious:false
                          Preview:0..k0..S............@.YDc.c...0...*.H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0...*.H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I.....*.A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.|C.t..t.....0.[q6....00\H..;..}`...).........A.......|.;F.H*..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..|o..;.....'...}~.."......

                          C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                          Category:dropped
                          Size (bytes):71954
                          Entropy (8bit):7.996617769952133
                          Encrypted:true
                          SSDEEP:1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
                          MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
                          SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
                          SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
                          SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
                          Malicious:false
                          Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

                          C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:data
                          Category:dropped
                          Size (bytes):192
                          Entropy (8bit):2.7673182398396405
                          Encrypted:false
                          SSDEEP:3:kkFklW06sXfllXlE/HT8kjNNX8RolJuRdxLlGB9lQRYwpDdt:kKPIIT8WNMa8RdWBwRd
                          MD5:91DBADFCAA1F331173815D37E21983B3
                          SHA1:79F25A27540A19DE2931E57FF73E3E688AB6C4FD
                          SHA-256:AC1B9BAD9231134D4E822901D770F4880F73E0F6641AEDB1B274F32B394A5BE5
                          SHA-512:4E609FDCA21A4FBC29DF75F1330B546BAA7B926A5B7DABB5E8D960F105758DB69DC73BAB2BC70D96B98CF592366276D0866878E34A178BA9AF105A91C7167E40
                          Malicious:false
                          Preview:p...... ........%Q..8...(....................................................... ..........W....s...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

                          C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:data
                          Category:dropped
                          Size (bytes):328
                          Entropy (8bit):3.2357027453026816
                          Encrypted:false
                          SSDEEP:6:kKrl99UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:GDImsLNkPlE99SNxAhUe/3
                          MD5:16F777D7BB79E2E035C25716DF311525
                          SHA1:D0FA1CFAF694CBCF69477B147623E9B81CFA6EAF
                          SHA-256:693480BDE5E2C3D4BA25C5553BDBF4B4B1F709AC613669039C5AC67CCD2F1C72
                          SHA-512:D4EBEF6AF60A88A00D1D67A47DD3651E3A0C1A430205018CBF9036F289E74FB0D81812400549C63B7DC8AF3A328CAE3C0C0E1622C5A880E6E1DB1E7BBAF7DF99
                          Malicious:false
                          Preview:p...... ............8...(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6644

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:PostScript document text
                          Category:dropped
                          Size (bytes):185099
                          Entropy (8bit):5.182478651346149
                          Encrypted:false
                          SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                          MD5:94185C5850C26B3C6FC24ABC385CDA58
                          SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                          SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                          SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                          Malicious:false
                          Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:PostScript document text
                          Category:dropped
                          Size (bytes):185099
                          Entropy (8bit):5.182478651346149
                          Encrypted:false
                          SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                          MD5:94185C5850C26B3C6FC24ABC385CDA58
                          SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                          SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                          SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                          Malicious:false
                          Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:data
                          Category:dropped
                          Size (bytes):243196
                          Entropy (8bit):3.3450692389394283
                          Encrypted:false
                          SSDEEP:1536:vKPCPiyzDtrh1cK3XEivK7VK/3AYvYwgqErRo+RQn:yPClJ/3AYvYwghFo+RQn
                          MD5:F5567C4FF4AB049B696D3BE0DD72A793
                          SHA1:EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916
                          SHA-256:D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
                          SHA-512:E769735991E5B1331E259608854D00CDA4F3E92285FDC500158CBD09CBCCEAD8A387F78256A43919B13EBE70C995D19242377C315B0CCBBD4F813251608C1D56
                          Malicious:false
                          Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):295
                          Entropy (8bit):5.364631018883706
                          Encrypted:false
                          SSDEEP:6:YEQXJ2HXHAFd7oe9VoZcg1vRcR0YZKoAvJM3g98kUwPeUkwRe9:YvXKX4oeEZc0vwGMbLUkee9
                          MD5:C1D6D5052D468386BF369AEA001A3592
                          SHA1:CFAE2B2B5684AA4A69B60A35FABC502240B25D38
                          SHA-256:C7F6918ADDF2280011DD86B1862ECDA3A469A5D469C15F5DCF54FBDC5272D6BB
                          SHA-512:6DC3A50F7D6E0220E04269A954C03CB1D3A0F75E41E80F8DEEC653C6ABC4967F129B4E094E2A4DF1D43318459E33C5CD7616FAE69D0413594162F4C22F02C7FF
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"0ee66ab1-6f88-4af7-8bd4-1475869020c4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1727986563289,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):294
                          Entropy (8bit):5.31380692248883
                          Encrypted:false
                          SSDEEP:6:YEQXJ2HXHAFd7oe9VoZcg1vRcR0YZKoAvJfBoTfXpnrPeUkwRe9:YvXKX4oeEZc0vwGWTfXcUkee9
                          MD5:1781D202E5A366E0D2FA80D103358241
                          SHA1:4C4BED0C89C0CD6E909790CE92269AF9AE46C56C
                          SHA-256:A0DC56416646B017D035B8686E231890A898BEC5E767D5D6D28A1481016C2202
                          SHA-512:C5801DED77C12834AB594A0E2DA9424F016BB68AE881AD3167EE6662761B49111402F73AFF6305DCBA56EE07A425E52F488B63565F08F04AE92D28FD4A284D51
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"0ee66ab1-6f88-4af7-8bd4-1475869020c4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1727986563289,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):294
                          Entropy (8bit):5.292801957883906
                          Encrypted:false
                          SSDEEP:6:YEQXJ2HXHAFd7oe9VoZcg1vRcR0YZKoAvJfBD2G6UpnrPeUkwRe9:YvXKX4oeEZc0vwGR22cUkee9
                          MD5:610D91132834063612A32A61E0FB9542
                          SHA1:B61ED30902D062B51CC99D4043FBA4F574E0CA39
                          SHA-256:0E930C6AF024FB7EB6096529E3D65C4CD02709669AF2AD8A7F0779A60117A9BB
                          SHA-512:F6C8F531C7ABA9A3B926D3FD4EF19C8488472894336F0D4BBD32DED93349CCE6DF0CA814439650F1F1763077B77C27D3495FBEDAA4F7894B7F75B235BF3866C4
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"0ee66ab1-6f88-4af7-8bd4-1475869020c4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1727986563289,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):285
                          Entropy (8bit):5.3516860034145335
                          Encrypted:false
                          SSDEEP:6:YEQXJ2HXHAFd7oe9VoZcg1vRcR0YZKoAvJfPmwrPeUkwRe9:YvXKX4oeEZc0vwGH56Ukee9
                          MD5:FA9919C8ACFBFA8EB829A088FC4CAEC2
                          SHA1:C89069D76302A1BF107F2EDA254BB3DECDC446B4
                          SHA-256:14D524CA29F3382C1827A7189F4E85BB946F73000205B81AED40F1A14C550ED9
                          SHA-512:DFC7123DE98C67D94A20B342C6F1AB391BCFC053634B135F02073543A0D8F0C8874554185D2C8678313D6B55CFAD920E58E933CA9DAE99E38E8F46710C1AAFE8
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"0ee66ab1-6f88-4af7-8bd4-1475869020c4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1727986563289,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):1063
                          Entropy (8bit):5.669608541347478
                          Encrypted:false
                          SSDEEP:24:Yv6XbzvtpLgEFqciGennl0RCmK8czOCY4w2On:YvMVhgLtaAh8cvYv9
                          MD5:720555AE060FB4B7E6555929DE2CC45A
                          SHA1:E19180EA307AE431567CE9EEB73DC7FA250488E3
                          SHA-256:F0DD65606DEFB03D473C1322AD98A2923FEDCF2B3DA5548116C96F6420B029F9
                          SHA-512:4D79131205FE5DC9FE70C969B006E2A2889DAE9802327AB6945EC404B62AA287862F01955D08113287613A603D12E92ADF3602BEF642BD83D7840442B063E98B
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"0ee66ab1-6f88-4af7-8bd4-1475869020c4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1727986563289,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_2","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"afb9c2a3-eaf4-41f9-9d73-768e72f72282","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQgZmlsZXMgdG8gYW5kIGZyb20gUERGXG53aXRob3V0IGxpbWl0cy4ifSwidGNhdElkIjpudWxsfQ==","dataType":"application\/json","encodingSc

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):1050
                          Entropy (8bit):5.660555610440477
                          Encrypted:false
                          SSDEEP:24:Yv6XbzvxVLgEF0c7sbnl0RCmK8czOCYHflEpwiVOn:YvM5Fg6sGAh8cvYHWpwv
                          MD5:26FB0FED4A92759AED18BC7E658F8490
                          SHA1:0594EB458EFBEF4D713701CA4E532833B2A74569
                          SHA-256:278281CD96CF5DC0B61DCB6122747FE3C3D78A54128EE4482441906B3996E077
                          SHA-512:FF5B273B29828A591FE3FD9BC42D8D225F87E16ED9930DCDFAE26A8FAFE96835A518B5F676C19A492E85CCC787CC618F36A47ECABA50D4A1562D6898A9C445A1
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"0ee66ab1-6f88-4af7-8bd4-1475869020c4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1727986563289,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_0","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"0924134e-3c59-4f53-b731-add558c56fec","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuZm9ybXMgJiBhZ3JlZW1lbnRzLiJ9LCJ0Y2F0SWQiOm51bGx9","dataType":"application\/json","encodingScheme":true},"

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):292
                          Entropy (8bit):5.303085692134397
                          Encrypted:false
                          SSDEEP:6:YEQXJ2HXHAFd7oe9VoZcg1vRcR0YZKoAvJfQ1rPeUkwRe9:YvXKX4oeEZc0vwGY16Ukee9
                          MD5:9AABF23B04457D9E1173742D3C3EC520
                          SHA1:DEB8F1D5B808DAAA19F98A0E0F19E3513BBE7B68
                          SHA-256:FEDFDCE2D767A34957BA24D6995BE338179895C13D603832AD982D42C0EA7BC7
                          SHA-512:2E5767BF99774C33E82DE5488BF43C9804DA401C36030ADF392050890D3FB5F4437632F98E4EB32C964F41F764B73B9A6C627937C24158549FC0989A2142D327
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"0ee66ab1-6f88-4af7-8bd4-1475869020c4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1727986563289,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):1038
                          Entropy (8bit):5.652998681240662
                          Encrypted:false
                          SSDEEP:24:Yv6Xbzvg2LgEF7cciAXs0nl0RCmK8czOCAPtciBOn:YvMoogc8hAh8cvAI
                          MD5:F6514492266EF8B046C8DCD9C482B6DF
                          SHA1:01B8E293530FC885C2E03DEF10DC3ABAF686763E
                          SHA-256:B05EA9DD4C64ED9DFC417C2111EB0D03DDDDB271EC1BDAE253B7699762E7F03F
                          SHA-512:E04AF358F6F7D4E20D0EA1FF2AB5281DA8DACA795C7981A201B4956A0171FB17D240A94DB02CC71F840638189170B788FD1A3E2C377E8113D8F1F1A7099B6E68
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"0ee66ab1-6f88-4af7-8bd4-1475869020c4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1727986563289,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_1","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"49d2f713-7aa9-44db-aa50-0a7a22add459","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVkaXQgdGV4dCwgaW1hZ2VzLCBwYWdlcywgYW5kIG1vcmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme":true},"endDTS":1744

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):1164
                          Entropy (8bit):5.703827900100015
                          Encrypted:false
                          SSDEEP:24:Yv6XbzvoKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK5On:YvMgEgqprtrS5OZjSlwTmAfSKs
                          MD5:B2067C6F7328B3FF33FE1A7C4D307AAE
                          SHA1:2FD6734BD719D0FE9C24EA9B237FE799E3266A9C
                          SHA-256:DFB7C2AB1906ACBD9A3E453145FD66FE40DA1D7BE90FD523F83882DF09EBF018
                          SHA-512:32E6FDA39B2088210B3CF7E9DFA8E9AFB76E050D818DA886FEBE5780C1E7C62D0B8FE800C0D6755F9862B7BB198DFB9603BA28D0CF096C847F963596428C5066
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"0ee66ab1-6f88-4af7-8bd4-1475869020c4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1727986563289,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):289
                          Entropy (8bit):5.304967239976617
                          Encrypted:false
                          SSDEEP:6:YEQXJ2HXHAFd7oe9VoZcg1vRcR0YZKoAvJfYdPeUkwRe9:YvXKX4oeEZc0vwGg8Ukee9
                          MD5:F9BE2DA085A1B8502694A388E8E6F026
                          SHA1:84C569381D4610E7DBBA8E67B551F5C8A2A8D664
                          SHA-256:4CD1DB7BFA74FB556AF424493B25B36F7231274BFBF88D78CE32FBC7564D20D5
                          SHA-512:F3114C9641BD5884A0B3CB12458172419EECC05C3DE29CCC15282E95818FF36D69FBEDB377F7A1063B55BA8F111D7B6F1E7F3F98687B58309A196C78B609BFAB
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"0ee66ab1-6f88-4af7-8bd4-1475869020c4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1727986563289,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):1395
                          Entropy (8bit):5.783188679322687
                          Encrypted:false
                          SSDEEP:24:Yv6XbzvHrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJN2n:YvMvHgDv3W2aYQfgB5OUupHrQ9FJs
                          MD5:B6AD3E2B4CB4DCC00116B3DD5D115362
                          SHA1:7528CA356C15605820C8EB66E8EFABB5C52AFEB8
                          SHA-256:15F86CC8078BDA70CF9F061F6C4458377CC7D989EEF9C11FAEBB01B85FE51E32
                          SHA-512:85C957CAFE08D5E90A6DDEF0A3CA3CA35600E83954E78027553BB9082D3F920329C033404FA0EDF93134A300DBFC2234D4BD127385693B81A3659FA5F7755699
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"0ee66ab1-6f88-4af7-8bd4-1475869020c4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1727986563289,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):291
                          Entropy (8bit):5.288480198544112
                          Encrypted:false
                          SSDEEP:6:YEQXJ2HXHAFd7oe9VoZcg1vRcR0YZKoAvJfbPtdPeUkwRe9:YvXKX4oeEZc0vwGDV8Ukee9
                          MD5:CB95F3FEB03BBD3EA72C8EF890A8DF08
                          SHA1:3330DAF8BEC7A53045C754742B3AD49B04F41BFE
                          SHA-256:4C5FF20AAB0F942EB369FD46AE704DFA8D1A3C0B13B509D6FACAE75C5560AABC
                          SHA-512:6B840908C4DA5B5DAD06480E49CB56357F189EFAB7B7EA9ED7C48692E910126FF83128BBC46ACDB2CB86C9CDBFF3D15CAE606C824EE766917EC7668CAB69108D
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"0ee66ab1-6f88-4af7-8bd4-1475869020c4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1727986563289,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):287
                          Entropy (8bit):5.293200405199434
                          Encrypted:false
                          SSDEEP:6:YEQXJ2HXHAFd7oe9VoZcg1vRcR0YZKoAvJf21rPeUkwRe9:YvXKX4oeEZc0vwG+16Ukee9
                          MD5:96D352732AC338354214AE04AEE31D1B
                          SHA1:9C71B6EDB13236914B6D68F2B26A8412BFB1248F
                          SHA-256:C1A037951E55EB1C05C2AA1CC1A59B0B2C07ED18D04B57434F5FB7EA0DD8102F
                          SHA-512:0DFA8B70B04C153B09294062C7FF192FFE7B8A1DBF9FC5327BC437BCAFBA161371D4CAD31E1F23504F5F6C4DCE4DDCD98A192AA6A5ABDC0706F8A98D2B0ECE7B
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"0ee66ab1-6f88-4af7-8bd4-1475869020c4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1727986563289,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):1058
                          Entropy (8bit):5.659869865048997
                          Encrypted:false
                          SSDEEP:24:Yv6XbzvVamXayLgEFRcONaqnl0RCmK8czOC+w2E+tg8BOn:YvMhBguOAh8cv+NKV
                          MD5:5F702B3A20E2757E49478493DD5E5F06
                          SHA1:4CCFFF7C33A834B4E691FAAD69974CC502697AD4
                          SHA-256:99F724DC5C09BF9CFC03BF46C0C0F8367F69FB75D4744ADCA0D2FE688EDF9505
                          SHA-512:45C5C9D69EADF327004CA497D864BA81E70B9897170F261DD24A7F5C2A51EA9B0FF96B394CC6326DD2633115DEDFF62698FD63E55AD0753A018121A452F887CF
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"0ee66ab1-6f88-4af7-8bd4-1475869020c4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1727986563289,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_3","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"ece07729-7db6-4f20-9f8d-7976ad373049","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IlNlbmQgZG9jdW1lbnRzICYgZm9ybXNcbmZvciBmYXN0IGUtc2lnbmluZyBvbmxpbmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme"

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):286
                          Entropy (8bit):5.269874953663676
                          Encrypted:false
                          SSDEEP:6:YEQXJ2HXHAFd7oe9VoZcg1vRcR0YZKoAvJfshHHrPeUkwRe9:YvXKX4oeEZc0vwGUUUkee9
                          MD5:2B4093CD59CAC6240D3A9E0ACB111B00
                          SHA1:467A33F2A553925AFE6E0FEA6AFE52F525C3E066
                          SHA-256:4E577625E6B3812BA9E519DA548AEE86F9926DD346463A25F8232B3A00CDA96E
                          SHA-512:023F3BF9956DF8566C12CD597C171C9E9B8DDD1B9F35551081AE5010EEF773BAB2D8D5DAA2EE88D1651D4AA5C1FAD71DDF5170E67DDA191F14E115AD282965A8
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"0ee66ab1-6f88-4af7-8bd4-1475869020c4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1727986563289,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):782
                          Entropy (8bit):5.374677489861222
                          Encrypted:false
                          SSDEEP:12:YvXKX4oeEZc0vwGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWSn:Yv6Xbzvm168CgEXX5kcIfANhvn
                          MD5:F927387EF6F7970E39E62E359FCD674B
                          SHA1:155ACD77CF857C6C424F41D8CC849A3CF54EE417
                          SHA-256:99E811B038233E4850D4D11E16047E7788807AEC73B8DB74F49A90543863A2CB
                          SHA-512:7B95CF991E52427B8ED149E4937B9D0C7C19E962DEA38CEB7B6EE0A6EA236E84A786C944C705C29370230C4846A852D8F8BDBF115CD8072B4AE7A69CE5FBA107
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"0ee66ab1-6f88-4af7-8bd4-1475869020c4","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1727986563289,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1727811228323}}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:data
                          Category:dropped
                          Size (bytes):4
                          Entropy (8bit):0.8112781244591328
                          Encrypted:false
                          SSDEEP:3:e:e
                          MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                          SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                          SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                          SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                          Malicious:false
                          Preview:....

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):2818
                          Entropy (8bit):5.127710174122899
                          Encrypted:false
                          SSDEEP:24:Yby1nNGa2w83ayNb37nCNzHM0Ae7xbEbXsfXjfVj0SdS5Z2pcTx2LSPoW529o73E:Y2P8v3SrMet+ofZCLVoW49o70
                          MD5:014898CFC2C1C47388E2CE200561A68F
                          SHA1:81A1BD2368D6A20FD89A8A57BC20DFB7AFFB3F3A
                          SHA-256:4B08BBE295E6323A1815211F4A4350D990E72596699D207730151A85517D5E8D
                          SHA-512:2036AD9A4693E84295928D0499FADDFED7A38D11FE051E32A5657260D09F697CF97050E2665D9E1C6E357CA98740CB9F75538C097B6EA7EF4E594A351CFFBCF3
                          Malicious:false
                          Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"7fec004a9fad3c468461920327f034b5","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1050,"ts":1727811227000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"7480110fd9057e4f1a417600e57b73f4","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1727811227000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"402f5fe1e2387503d88b3f1b9f639a6e","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1058,"ts":1727811227000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"0074978fc94fd6e2cae8f0ef4ddb7c37","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1063,"ts":1727811227000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"bdcf6a36c2fffecc74d3626535ce0f91","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1038,"ts":1727811227000},{"id":"Edit_InApp_Aug2020","info":{"dg":"cba7819ba5521604b4e365a55df40ac2","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":17

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
                          Category:dropped
                          Size (bytes):12288
                          Entropy (8bit):1.1882793273014114
                          Encrypted:false
                          SSDEEP:48:TGufl2GL7msEHUUUUUUUUdASvR9H9vxFGiDIAEkGVvpxe:lNVmswUUUUUUUUdA+FGSItde
                          MD5:0337CA390971696A3A9DF66320FF3773
                          SHA1:BAE58A7C0AF014EAF5B5C7F4F2830A91358ED1E7
                          SHA-256:66BC9C3F249D0E380203DF1F705C854ABBACC34A263226BCCC6DA343283F6D40
                          SHA-512:DC4CB6AD382F510486EDF68145A6BBA868D004A93C7BFA94610E64DB257F8FC156409792600CBF4D8DA8B59E8CD79F02201B490B52D3EE4D10D6F1B67299C1A8
                          Malicious:false
                          Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:SQLite Rollback Journal
                          Category:dropped
                          Size (bytes):8720
                          Entropy (8bit):1.6084421885249205
                          Encrypted:false
                          SSDEEP:48:7M6KUUUUUUUUUUdyvR9H9vxFGiDIAEkGVvLqFl2GL7msW:76UUUUUUUUUUdeFGSItBKVmsW
                          MD5:910E2527A2AF17E8A1A006C308C89A6C
                          SHA1:B952DA22AD8E3036B79FDE19F7113CCFD6AEE533
                          SHA-256:A6F56980C270CD62770F940B2E7BB8D0100150C619EA7821D260E7880C4C3E7A
                          SHA-512:C8D7CA7C14B37AE1FEA52655475A4E7CC6066B5728CA6786B3D9A22BE9333470750589F687D859DCC6D674BDF501F0FF1CB2820DCBA10450D55FA260AEB16722
                          Malicious:false
                          Preview:.... .c........E......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                          C:\Users\user\AppData\Local\Temp\MSI59196.LOG

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                          Category:dropped
                          Size (bytes):246
                          Entropy (8bit):3.5213298467083405
                          Encrypted:false
                          SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K80QRqT9:Qw946cPbiOxDlbYnuRKf
                          MD5:86ED78D16B9DD8A69A40063745C44BD0
                          SHA1:2B5EF5B769FBC41902D68641E03FD2E6ADBF4150
                          SHA-256:6787A8D2304F1E61A38906E65FD4BECFC52EAB9CED27C0B5F2CED21D1EC65FAC
                          SHA-512:F48E0E2C7F12DCDC5F191188E4D54ACF46BFEEA485B5517840FB2FD17345A88B7A6E07AD67EE7F467AD0DB7C8229F33D245AA696E1FE1F11594D5E49DB0671F8
                          Malicious:false
                          Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .0.1./.1.0./.2.0.2.4. . .1.5.:.3.3.:.4.7. .=.=.=.....

                          C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 15-33-42-144.log

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:ASCII text, with very long lines (393)
                          Category:dropped
                          Size (bytes):16525
                          Entropy (8bit):5.345946398610936
                          Encrypted:false
                          SSDEEP:384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
                          MD5:8947C10F5AB6CFFFAE64BCA79B5A0BE3
                          SHA1:70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
                          SHA-256:4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
                          SHA-512:B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
                          Malicious:false
                          Preview:SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

                          C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:ASCII text, with very long lines (393), with CRLF line terminators
                          Category:dropped
                          Size (bytes):16603
                          Entropy (8bit):5.3508913252558425
                          Encrypted:false
                          SSDEEP:384:HPx6JL43vghvo55YMBEJ1ubDA3JGQkA6rwtHB93F0srvsZVe8ZCk7K76j5bktCiO:36ap
                          MD5:0FCB821B91155B2E30C4940BFD73D610
                          SHA1:FDB2A546690ECA3607665E75C88267EFBA236241
                          SHA-256:766E867327BA760A801D903B645EE7F859FDA1C05559A6BA1427585520565BC1
                          SHA-512:820EE570897720C5CFCAD1BB2FC5D88B2751432E438C64AF8B36CEBD6879360893932F9913D94AEC57619F64E45A21F003A1CBC39DF231E45EA7014F170C2F74
                          Malicious:false
                          Preview:SessionID=7ef33280-0690-4df9-b50a-f8b2db47c43d.1727811222170 Timestamp=2024-10-01T15:33:42:170-0400 ThreadID=7544 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=7ef33280-0690-4df9-b50a-f8b2db47c43d.1727811222170 Timestamp=2024-10-01T15:33:42:171-0400 ThreadID=7544 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=7ef33280-0690-4df9-b50a-f8b2db47c43d.1727811222170 Timestamp=2024-10-01T15:33:42:171-0400 ThreadID=7544 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=7ef33280-0690-4df9-b50a-f8b2db47c43d.1727811222170 Timestamp=2024-10-01T15:33:42:171-0400 ThreadID=7544 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=7ef33280-0690-4df9-b50a-f8b2db47c43d.1727811222170 Timestamp=2024-10-01T15:33:42:171-0400 ThreadID=7544 Component=ngl-lib_NglAppLib Description="SetConf

                          C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:ASCII text, with CRLF line terminators
                          Category:dropped
                          Size (bytes):29752
                          Entropy (8bit):5.384327659248067
                          Encrypted:false
                          SSDEEP:768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2r4:M
                          MD5:F8F0E1A6088FB6D24B757BD14A95A64A
                          SHA1:BE1878443DBFDFEA0F88051A940E004EB5C938D5
                          SHA-256:E1CE52035F138443F9EAE6B4D78F34D1BE79BA412E20BA410BABBFAD8F580A73
                          SHA-512:F61791DFDD845FA6E337CEA4B0B9C22CCE2B3FD94A90DF1BFFE29374ACC580FE98D9CF06BCB2E68098465B4B46E387C3F0F172638494D8744A07BD4380723BBA
                          Malicious:false
                          Preview:03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

                          C:\Users\user\AppData\Local\Temp\acrocef_low\0d13e89e-24fb-42d5-8a48-28a1e18badb3.tmp

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                          Category:dropped
                          Size (bytes):386528
                          Entropy (8bit):7.9736851559892425
                          Encrypted:false
                          SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                          MD5:5C48B0AD2FEF800949466AE872E1F1E2
                          SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                          SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                          SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                          Malicious:false
                          Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                          C:\Users\user\AppData\Local\Temp\acrocef_low\510ea7c7-0e3f-4c9b-ab71-2e92c34658e7.tmp

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                          Category:dropped
                          Size (bytes):1419751
                          Entropy (8bit):7.976496077007677
                          Encrypted:false
                          SSDEEP:24576:/nZXYIGNPpeWL07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:fZXZGeWLxYGZN3mlind9i4ufFXpAXkru
                          MD5:8B9A388440CFE3BFA95587E34B7BE149
                          SHA1:64B74497856A696252797E130D819CB147870A77
                          SHA-256:63DE1DC0683CEFDE940AE3FD2970C7BB91A507B13EC28F75F9C51039831CB82D
                          SHA-512:6B21038A24D4AAFCBB371D84CF0B76019ACD6A9F70E5D30E9FD491989DF2999C884E0C49273B66C1D6D6E2C369FF28A04F9805079B025B0D77CD857DCA61457B
                          Malicious:false
                          Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                          C:\Users\user\AppData\Local\Temp\acrocef_low\acafbf32-8d4b-4083-b69d-f6156c8cbf5c.tmp

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                          Category:dropped
                          Size (bytes):1407294
                          Entropy (8bit):7.97605879016224
                          Encrypted:false
                          SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
                          MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
                          SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
                          SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
                          SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
                          Malicious:false
                          Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                          C:\Users\user\AppData\Local\Temp\acrocef_low\e2473995-4dc6-4f0d-8ebd-e87eca4969cf.tmp

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                          Category:dropped
                          Size (bytes):758601
                          Entropy (8bit):7.98639316555857
                          Encrypted:false
                          SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                          MD5:3A49135134665364308390AC398006F1
                          SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                          SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                          SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                          Malicious:false
                          Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                          Static File Info

                          General

                          File type:PDF document, version 1.4, 2 pages
                          Entropy (8bit):7.927736670993783
                          TrID:
                          • Adobe Portable Document Format (5005/1) 100.00%
                          File name:00b9978f-ff57-4ab4-9bf8-ae8853d3346f.pdf
                          File size:34'418 bytes
                          MD5:e7a4e4a027a5fdfc75a6e33716f2a365
                          SHA1:ca62581ed80eed4d05d72993fab0b0d47643d934
                          SHA256:0dd0e3e2412f594d5d3e2af9389b9489fff5cba60ac4ce66d7c802580f17455d
                          SHA512:5a345f69469e75638de0018b8e248c9997d8bee223fc1d84c72bda13ed6cc7f7cf49ca8e9c568ef1a22153f74ddb90340cb08dcffb1f5dd596d6b377a53edcfe
                          SSDEEP:768:hEreR3waX1KgEIF9Dj7iXCgl9kcHOTOlvOxaXj/xiD:x5KFuySWpHOTOlmUj/xM
                          TLSH:9BF2E17046282EDCD80625349EB3398BD6BFF50005DA39511624EB5F381EFD8AB716DE
                          File Content Preview:%PDF-1.4.%......1 0 obj.<< /Type /Catalog./Pages 2 0 R.>>.endobj..2 0 obj.<< /Type /Pages./Kids [4 0 R 11 0 R]./Count 2.>>.endobj..3 0 obj.<< /ProcSet [/PDF /Text /ImageB /ImageC /ImageI]./XObject << /XIPLAYER0 6 0 R./XIPLAYER_CM1 8 0 R.>>..>>.endobj..4 0

                          File Icon

                          Icon Hash:62cc8caeb29e8ae0

                          Static PDF Info

                          General

                          Header:%PDF-1.4
                          Total Entropy:7.927737
                          Total Bytes:34418
                          Stream Entropy:7.971377
                          Stream Bytes:31123
                          Entropy outside Streams:5.169891
                          Bytes outside Streams:3295
                          Number of EOF found:1
                          Bytes after EOF:

                          Keywords Statistics

                          NameCount
                          obj20
                          endobj20
                          stream11
                          endstream11
                          xref1
                          trailer1
                          startxref1
                          /Page2
                          /Encrypt0
                          /ObjStm0
                          /URI0
                          /JS0
                          /JavaScript0
                          /AA0
                          /OpenAction0
                          /AcroForm0
                          /JBIG2Decode6
                          /RichMedia0
                          /Launch0
                          /EmbeddedFile0

                          Network Behavior

                          Network Port Distribution

                          TCP Packets

                          TimestampSource PortDest PortSource IPDest IP
                          Oct 1, 2024 21:33:52.259677887 CEST49743443192.168.2.423.41.168.139
                          Oct 1, 2024 21:33:52.259710073 CEST4434974323.41.168.139192.168.2.4
                          Oct 1, 2024 21:33:52.259776115 CEST49743443192.168.2.423.41.168.139
                          Oct 1, 2024 21:33:52.259977102 CEST49743443192.168.2.423.41.168.139
                          Oct 1, 2024 21:33:52.259991884 CEST4434974323.41.168.139192.168.2.4
                          Oct 1, 2024 21:33:52.834717035 CEST4434974323.41.168.139192.168.2.4
                          Oct 1, 2024 21:33:52.835053921 CEST49743443192.168.2.423.41.168.139
                          Oct 1, 2024 21:33:52.835081100 CEST4434974323.41.168.139192.168.2.4
                          Oct 1, 2024 21:33:52.835956097 CEST4434974323.41.168.139192.168.2.4
                          Oct 1, 2024 21:33:52.836153984 CEST49743443192.168.2.423.41.168.139
                          Oct 1, 2024 21:33:52.879579067 CEST49743443192.168.2.423.41.168.139
                          Oct 1, 2024 21:33:52.879664898 CEST4434974323.41.168.139192.168.2.4
                          Oct 1, 2024 21:33:52.879933119 CEST49743443192.168.2.423.41.168.139
                          Oct 1, 2024 21:33:52.926959991 CEST49743443192.168.2.423.41.168.139
                          Oct 1, 2024 21:33:52.926969051 CEST4434974323.41.168.139192.168.2.4
                          Oct 1, 2024 21:33:52.973356962 CEST49743443192.168.2.423.41.168.139
                          Oct 1, 2024 21:33:52.976217031 CEST4434974323.41.168.139192.168.2.4
                          Oct 1, 2024 21:33:52.976643085 CEST4434974323.41.168.139192.168.2.4
                          Oct 1, 2024 21:33:52.979352951 CEST49743443192.168.2.423.41.168.139
                          Oct 1, 2024 21:33:52.979372025 CEST4434974323.41.168.139192.168.2.4
                          Oct 1, 2024 21:33:52.979445934 CEST49743443192.168.2.423.41.168.139
                          Oct 1, 2024 21:33:52.979445934 CEST49743443192.168.2.423.41.168.139

                          UDP Packets

                          TimestampSource PortDest PortSource IPDest IP
                          Oct 1, 2024 21:33:47.160933018 CEST5540953192.168.2.41.1.1.1

                          DNS Queries

                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                          Oct 1, 2024 21:33:47.160933018 CEST192.168.2.41.1.1.10x2c9fStandard query (0)x1.i.lencr.orgA (IP address)IN (0x0001)false

                          DNS Answers

                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                          Oct 1, 2024 21:33:47.169823885 CEST1.1.1.1192.168.2.40x2c9fNo error (0)x1.i.lencr.orgcrl.root-x1.letsencrypt.org.edgekey.netCNAME (Canonical name)IN (0x0001)false
                          Oct 1, 2024 21:33:47.899944067 CEST1.1.1.1192.168.2.40x3d4cNo error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
                          Oct 1, 2024 21:33:47.899944067 CEST1.1.1.1192.168.2.40x3d4cNo error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false

                          HTTP Request Dependency Graph

                          • armmf.adobe.com

                          HTTPS Proxied Packets

                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                          0192.168.2.44974323.41.168.1394435288C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          TimestampBytes transferredDirectionData
                          2024-10-01 19:33:52 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
                          Host: armmf.adobe.com
                          Connection: keep-alive
                          Accept-Language: en-US,en;q=0.9
                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
                          Sec-Fetch-Site: same-origin
                          Sec-Fetch-Mode: no-cors
                          Sec-Fetch-Dest: empty
                          Accept-Encoding: gzip, deflate, br
                          If-None-Match: "78-5faa31cce96da"
                          If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
                          2024-10-01 19:33:52 UTC198INHTTP/1.1 304 Not Modified
                          Content-Type: text/plain; charset=UTF-8
                          Last-Modified: Mon, 01 May 2023 15:02:33 GMT
                          ETag: "78-5faa31cce96da"
                          Date: Tue, 01 Oct 2024 19:33:52 GMT
                          Connection: close


                          Statistics

                          CPU Usage

                          Click to jump to process

                          Memory Usage

                          Click to jump to process

                          High Level Behavior Distribution

                          Click to dive into process behavior distribution

                          Behavior

                          Click to jump to process

                          System Behavior

                          General

                          Target ID:0
                          Start time:15:33:38
                          Start date:01/10/2024
                          Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          Wow64 process (32bit):false
                          Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\00b9978f-ff57-4ab4-9bf8-ae8853d3346f.pdf"
                          Imagebase:0x7ff6bc1b0000
                          File size:5'641'176 bytes
                          MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Reputation:high
                          Has exited:true

                          General

                          Target ID:1
                          Start time:15:33:39
                          Start date:01/10/2024
                          Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          Wow64 process (32bit):false
                          Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                          Imagebase:0x7ff74bb60000
                          File size:3'581'912 bytes
                          MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Reputation:high
                          Has exited:true

                          General

                          Target ID:3
                          Start time:15:33:39
                          Start date:01/10/2024
                          Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          Wow64 process (32bit):false
                          Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1708,i,4304674134217149286,5362066792861887805,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                          Imagebase:0x7ff74bb60000
                          File size:3'581'912 bytes
                          MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Reputation:high
                          Has exited:true

                          Disassembly

                          ⊘No disassembly