Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Paychex Direct Deposit Form (02 2024)..pdf

Overview

General Information

Sample name:Paychex Direct Deposit Form (02 2024)..pdf
Analysis ID:1523645
MD5:08eadc77f3722a16ef5fd1b74f1836ba
SHA1:aa5b360b614821872f0aecc3dda6d3f40ccf1ffb
SHA256:3e8b33ffbd977c14bca8e21f80cc46ab0820da8209a529fd95ab7eeaf2d5235e
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64_ra
  • Acrobat.exe (PID: 5772 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Paychex Direct Deposit Form (02 2024)..pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 6956 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 7100 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1548,i,771568016486475644,2400619360177338759,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficDNS query: name: x1.i.lencr.org
Source: global trafficDNS query: name: x1.i.lencr.org
Source: global trafficDNS query: name: x1.i.lencr.org
Source: global trafficTCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global trafficTCP traffic: 23.195.76.153:443 -> 192.168.2.16:49712
Source: global trafficTCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global trafficTCP traffic: 23.195.76.153:443 -> 192.168.2.16:49712
Source: global trafficTCP traffic: 23.195.76.153:443 -> 192.168.2.16:49712
Source: global trafficTCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global trafficTCP traffic: 23.195.76.153:443 -> 192.168.2.16:49712
Source: global trafficTCP traffic: 23.195.76.153:443 -> 192.168.2.16:49712
Source: global trafficTCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global trafficTCP traffic: 23.195.76.153:443 -> 192.168.2.16:49712
Source: global trafficTCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global trafficTCP traffic: 23.195.76.153:443 -> 192.168.2.16:49712
Source: global trafficTCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global trafficTCP traffic: 23.195.76.153:443 -> 192.168.2.16:49712
Source: global trafficTCP traffic: 23.195.76.153:443 -> 192.168.2.16:49712
Source: global trafficTCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global trafficTCP traffic: 23.195.76.153:443 -> 192.168.2.16:49712
Source: Joe Sandbox ViewIP Address: 23.195.76.153 23.195.76.153
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br
Source: unknownTCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknownTCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknownTCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknownTCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknownTCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknownTCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknownTCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknownTCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknownTCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknownTCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknownTCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br
Source: global trafficDNS traffic detected: DNS query: x1.i.lencr.org
Source: 77EC63BDA74BD0D0E0426DC8F80085060.3.drString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.3.drString found in binary or memory: http://x1.i.lencr.org/
Source: a94c4a4e-cc78-4f50-a0fa-53ed2510b9b5.tmp.4.dr, 103f993c-462e-4330-9d03-98934c66b985.tmp.4.drString found in binary or memory: https://chrome.cloudflare-dns.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: classification engineClassification label: clean2.winPDF@15/48@3/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6744Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 15-54-07-077.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Paychex Direct Deposit Form (02 2024)..pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1548,i,771568016486475644,2400619360177338759,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1548,i,771568016486475644,2400619360177338759,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: Paychex Direct Deposit Form (02 2024)..pdfInitial sample: PDF keyword /JS count = 0
Source: Paychex Direct Deposit Form (02 2024)..pdfInitial sample: PDF keyword /JavaScript count = 0
Source: Paychex Direct Deposit Form (02 2024)..pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information queried: ProcessInformationJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts3
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS Memory1
System Information Discovery		Remote Desktop ProtocolData from Removable Media2
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive13
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1523645 Sample: Paychex Direct Deposit Form... Startdate: 01/10/2024 Architecture: WINDOWS Score: 2 14 x1.i.lencr.org 2->14 7 Acrobat.exe 20 66 2->7         started        process3 process4 9 AcroCEF.exe 108 7->9         started        process5 11 AcroCEF.exe 6 9->11         started        dnsIp6 16 23.195.76.153, 443, 49712 NTT-COMMUNICATIONS-2914US United States 11->16

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://x1.i.lencr.org/0%URL Reputationsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
bg.microsoft.map.fastly.net
199.232.214.172
truefalse
    		unknown
    x1.i.lencr.org
    		unknown
    		unknownfalse
      		unknown

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      https://chrome.cloudflare-dns.coma94c4a4e-cc78-4f50-a0fa-53ed2510b9b5.tmp.4.dr, 103f993c-462e-4330-9d03-98934c66b985.tmp.4.drfalse
        		unknown
        http://x1.i.lencr.org/2D85F72862B55C4EADD9E66E06947F3D0.3.drfalse
        • URL Reputation: safe
        		unknown

        World Map of Contacted IPs

        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs

        Public IPs

        IPDomainCountryFlagASNASN NameMalicious
        23.195.76.153
        		unknownUnited States
        		2914NTT-COMMUNICATIONS-2914USfalse

        General Information

        Joe Sandbox version:41.0.0 Charoite
        Analysis ID:1523645
        Start date and time:2024-10-01 21:53:31 +02:00
        Joe Sandbox product:CloudBasic
        Overall analysis duration:0h 3m 46s
        Hypervisor based Inspection enabled:false
        Report type:full
        Cookbook file name:defaultwindowsinteractivecookbook.jbs
        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
        Number of analysed new started processes analysed:15
        Number of new started drivers analysed:0
        Number of existing processes analysed:0
        Number of existing drivers analysed:0
        Number of injected processes analysed:0
        Technologies:
        • HCA enabled
        • EGA enabled
        • AMSI enabled
        Analysis Mode:default
        Analysis stop reason:Timeout
        Sample name:Paychex Direct Deposit Form (02 2024)..pdf
        Detection:CLEAN
        Classification:clean2.winPDF@15/48@3/1
        EGA Information:Failed
        HCA Information:
        • Successful, ratio: 100%
        • Number of executed functions: 0
        • Number of non-executed functions: 0
        Cookbook Comments:
        • Found application associated with file extension: .pdf

        Warnings

        • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
        • Excluded IPs from analysis (whitelisted): 199.232.214.172, 184.28.88.176, 52.202.204.11, 54.227.187.23, 23.22.254.206, 52.5.13.197, 162.159.61.3, 172.64.41.3, 2.23.197.184, 2.19.126.149, 2.19.126.143
        • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
        • Not all processes where analyzed, report is missing behavior information
        • VT rate limit hit for: Paychex Direct Deposit Form (02 2024)..pdf

        Simulations

        Behavior and APIs

        TimeTypeDescription
        15:54:17API Interceptor2x Sleep call for process: AcroCEF.exe modified

        Joe Sandbox View / Context

        IPs

        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        23.195.76.153Open 99 Restaurants Benefits Enrollment.pdfGet hashmaliciousHTMLPhisherBrowse
          DOC-72212087.pdfGet hashmaliciousHTMLPhisherBrowse
            [EXTERNAL] Complete with AdobeSignPDF_ Approve and Sign TRCOT.emlGet hashmaliciousUnknownBrowse
              Secured Doc-[uiC-22723].pdfGet hashmaliciousHTMLPhisherBrowse
                Secured Doc-[qnz-33059].pdfGet hashmaliciousHTMLPhisherBrowse

                  Domains

                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                  bg.microsoft.map.fastly.netTranslink_rishi.vasandani_Advice81108.pdfGet hashmaliciousUnknownBrowse
                  • 199.232.210.172
                  bWrRSlOThY.exeGet hashmaliciousAsyncRAT, NeshtaBrowse
                  • 199.232.210.172
                  https://www.dropbox.com/l/scl/AADL_v5DzsoHwkyegIhk6J0bQm3A7UWklCAGet hashmaliciousUnknownBrowse
                  • 199.232.214.172
                  https://k7qo.sarnerholz.cam/APRjVfmkGet hashmaliciousUnknownBrowse
                  • 199.232.214.172
                  https://0.pwsinc.shop/?MKPT=IncGet hashmaliciousCaptcha PhishBrowse
                  • 199.232.210.172
                  https://swissquotech.com/swissquote-2024.zipGet hashmaliciousPhisherBrowse
                  • 199.232.214.172
                  He6pI1bhcA.exeGet hashmaliciousScreenConnect ToolBrowse
                  • 199.232.214.172
                  5eRyCYRR9y.exeGet hashmaliciousScreenConnect ToolBrowse
                  • 199.232.210.172
                  VD01NDHM8u.exeGet hashmaliciousScreenConnect ToolBrowse
                  • 199.232.210.172
                  vovE92JSzK.exeGet hashmaliciousScreenConnect ToolBrowse
                  • 199.232.214.172

                  ASNs

                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                  NTT-COMMUNICATIONS-2914USSecuriteInfo.com.Linux.Siggen.9999.28931.8128.elfGet hashmaliciousMiraiBrowse
                  • 161.59.241.27
                  SecuriteInfo.com.Linux.Siggen.9999.13221.8731.elfGet hashmaliciousUnknownBrowse
                  • 192.217.230.219
                  SecuriteInfo.com.Linux.Siggen.9999.32167.12194.elfGet hashmaliciousUnknownBrowse
                  • 128.241.223.25
                  SecuriteInfo.com.Linux.Siggen.9999.18891.22819.elfGet hashmaliciousUnknownBrowse
                  • 207.57.33.248
                  jade.mpsl.elfGet hashmaliciousMiraiBrowse
                  • 207.71.80.132
                  ZgBCG135hk.elfGet hashmaliciousMirai, MoobotBrowse
                  • 198.90.243.234
                  XPK8NKw7Jv.elfGet hashmaliciousMirai, MoobotBrowse
                  • 209.70.9.123
                  c0m5xRfolz.elfGet hashmaliciousGafgyt, Mirai, OkiruBrowse
                  • 205.38.130.58
                  jNGMZWmt23.elfGet hashmaliciousMiraiBrowse
                  • 211.130.102.4
                  SecuriteInfo.com.Linux.Siggen.9999.6095.9527.elfGet hashmaliciousMiraiBrowse
                  • 129.251.163.64

                  JA3 Fingerprints

                  ⊘No context

                  Dropped Files

                  ⊘No context

                  Created / dropped Files

                  C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                  File Type:ASCII text
                  Category:dropped
                  Size (bytes):290
                  Entropy (8bit):5.248494198680827
                  Encrypted:false
                  SSDEEP:6:buSQ+q2PRN2nKuAl9OmbnIFUt8aXcQgZmw+aXcQQVkwORN2nKuAl9OmbjLJ:tVvaHAahFUt8E/g/+E/I5JHAaSJ
                  MD5:50E8BA2520DEC8F0223FC48CB7A90806
                  SHA1:1C883FA5BD270E7567E5EF1C0F424596F3F4B708
                  SHA-256:F469A04C6C9D96B7BB0F3CD52E4615608CC4654CAEAEA9E404592CB79A15731E
                  SHA-512:200D49D4CF2C57265248FA6D31AE4B56D73421D96A4F519C5C28AD04E91205BACCE2DA7B1A1DC8F011384C8157C982E45008003F063CD14B5B97A76DE59348E3
                  Malicious:false
                  Reputation:low
                  Preview:2024/10/01-15:54:05.767 1b98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/01-15:54:05.769 1b98 Recovering log #3.2024/10/01-15:54:05.769 1b98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                  C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                  File Type:ASCII text
                  Category:dropped
                  Size (bytes):290
                  Entropy (8bit):5.248494198680827
                  Encrypted:false
                  SSDEEP:6:buSQ+q2PRN2nKuAl9OmbnIFUt8aXcQgZmw+aXcQQVkwORN2nKuAl9OmbjLJ:tVvaHAahFUt8E/g/+E/I5JHAaSJ
                  MD5:50E8BA2520DEC8F0223FC48CB7A90806
                  SHA1:1C883FA5BD270E7567E5EF1C0F424596F3F4B708
                  SHA-256:F469A04C6C9D96B7BB0F3CD52E4615608CC4654CAEAEA9E404592CB79A15731E
                  SHA-512:200D49D4CF2C57265248FA6D31AE4B56D73421D96A4F519C5C28AD04E91205BACCE2DA7B1A1DC8F011384C8157C982E45008003F063CD14B5B97A76DE59348E3
                  Malicious:false
                  Reputation:low
                  Preview:2024/10/01-15:54:05.767 1b98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/01-15:54:05.769 1b98 Recovering log #3.2024/10/01-15:54:05.769 1b98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                  C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                  File Type:ASCII text
                  Category:dropped
                  Size (bytes):334
                  Entropy (8bit):5.162567411765347
                  Encrypted:false
                  SSDEEP:6:bB4q2PRN2nKuAl9Ombzo2jMGIFUt8asUS3JZmw+ajpDkwORN2nKuAl9Ombzo2jM4:mvaHAa8uFUt8rUSZ/+MZ5JHAa8RJ
                  MD5:B6EEB2BBED329E12F13ECCFFF9B04D5E
                  SHA1:02586123E0318E8B972AEFAA92FF13AF17E8E851
                  SHA-256:12754C1F9DDB45CF2E830494DE9F4626119D1536892BCB035B0AB77EBC0C8DB6
                  SHA-512:425C753456A9FA09E0E43FE8EF1B6DE5027C1BAD781DEE96FDEF1CD45159951CEC10C29C0D29735991B85EABAA019800C1BC101F78FF405FEC0539C4973CC585
                  Malicious:false
                  Reputation:low
                  Preview:2024/10/01-15:54:05.663 17d0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/01-15:54:05.666 17d0 Recovering log #3.2024/10/01-15:54:05.667 17d0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                  C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                  File Type:ASCII text
                  Category:dropped
                  Size (bytes):334
                  Entropy (8bit):5.162567411765347
                  Encrypted:false
                  SSDEEP:6:bB4q2PRN2nKuAl9Ombzo2jMGIFUt8asUS3JZmw+ajpDkwORN2nKuAl9Ombzo2jM4:mvaHAa8uFUt8rUSZ/+MZ5JHAa8RJ
                  MD5:B6EEB2BBED329E12F13ECCFFF9B04D5E
                  SHA1:02586123E0318E8B972AEFAA92FF13AF17E8E851
                  SHA-256:12754C1F9DDB45CF2E830494DE9F4626119D1536892BCB035B0AB77EBC0C8DB6
                  SHA-512:425C753456A9FA09E0E43FE8EF1B6DE5027C1BAD781DEE96FDEF1CD45159951CEC10C29C0D29735991B85EABAA019800C1BC101F78FF405FEC0539C4973CC585
                  Malicious:false
                  Reputation:low
                  Preview:2024/10/01-15:54:05.663 17d0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/01-15:54:05.666 17d0 Recovering log #3.2024/10/01-15:54:05.667 17d0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                  C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\103f993c-462e-4330-9d03-98934c66b985.tmp

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                  File Type:JSON data
                  Category:dropped
                  Size (bytes):403
                  Entropy (8bit):4.953858338552356
                  Encrypted:false
                  SSDEEP:12:YHO8sq/WLksBdOg2H9caq3QYiubrP7E4T3y:YXsRJdMHM3QYhbz7nby
                  MD5:4C313FE514B5F4E7E89329630909F8DC
                  SHA1:916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
                  SHA-256:1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
                  SHA-512:1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
                  Malicious:false
                  Reputation:moderate, very likely benign file
                  Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                  C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                  File Type:JSON data
                  Category:dropped
                  Size (bytes):403
                  Entropy (8bit):4.953858338552356
                  Encrypted:false
                  SSDEEP:12:YHO8sq/WLksBdOg2H9caq3QYiubrP7E4T3y:YXsRJdMHM3QYhbz7nby
                  MD5:4C313FE514B5F4E7E89329630909F8DC
                  SHA1:916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
                  SHA-256:1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
                  SHA-512:1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
                  Malicious:false
                  Reputation:moderate, very likely benign file
                  Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                  C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF551196.TMP (copy)

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                  File Type:JSON data
                  Category:dropped
                  Size (bytes):403
                  Entropy (8bit):4.953858338552356
                  Encrypted:false
                  SSDEEP:12:YHO8sq/WLksBdOg2H9caq3QYiubrP7E4T3y:YXsRJdMHM3QYhbz7nby
                  MD5:4C313FE514B5F4E7E89329630909F8DC
                  SHA1:916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
                  SHA-256:1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
                  SHA-512:1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
                  Malicious:false
                  Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                  C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a94c4a4e-cc78-4f50-a0fa-53ed2510b9b5.tmp

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                  File Type:JSON data
                  Category:modified
                  Size (bytes):403
                  Entropy (8bit):4.982730477568236
                  Encrypted:false
                  SSDEEP:12:YHO8sq7sBdOg2Hctcaq3QYiubrP7E4T3y:YXsBdMHP3QYhbz7nby
                  MD5:FD135EE5000A9D160BFCA73E94FD533B
                  SHA1:6CB192B81D8CCA13EBDDD42BCD8B6671219CEFCC
                  SHA-256:630B76834F66A06D3ADB4DB3BFD5478EA503063A29BAD539B7EE987F0BFBD616
                  SHA-512:7E8A0BCF181E36B19B8C2E71CE43DB622BBEE3457841CB1C331B2510DF913ECFFD0E5C31E1750A5A82AC38D8E111710B6D8CF178A9010F2901EBE821A875D75A
                  Malicious:false
                  Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372372457506277","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":134174},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                  C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):4099
                  Entropy (8bit):5.228721159610316
                  Encrypted:false
                  SSDEEP:96:OLSw0bSwIAnrRqLX2rSq1OUxu/0OZ0xRBTxekN8xe0NvN:OLT0bTIeYa51Ogu/0OZARBT8kN880NvN
                  MD5:2129732290B1AFA7EDDAF6811630BEB9
                  SHA1:0F7A66DC35F66F39B8665DE3D8FDAF8C28B1DB7D
                  SHA-256:2BF787A81F9939FB013518507B112F0E7B6E435338F5D11DFB752E644F2E25A7
                  SHA-512:8B35F26741EE1FDDD96A8620A20851F919CBF3D31A7AC121EF624F740E30FEDA4E13DB1D5DF13B8B9BED206674222BCDE585C92DECB853117BC6E46915FCC2D1
                  Malicious:false
                  Preview:*...#................version.1..namespace-e...o................next-map-id.1.Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/.0y.S_r................next-map-id.2.Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/.16.X:r................next-map-id.3.Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/.2.P.@o................next-map-id.4.Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/.346.+^...............Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/....^...............Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/..?&a...............Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/_...a...............Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/...o................next-map-id.5.Pnamespace-07af9ee9_2076_4f12_94b5_

                  C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                  File Type:ASCII text
                  Category:dropped
                  Size (bytes):322
                  Entropy (8bit):5.160234598013847
                  Encrypted:false
                  SSDEEP:6:b9534q2PRN2nKuAl9OmbzNMxIFUt8ahDJZmw+ajDDkwORN2nKuAl9OmbzNMFLJ:ZKvaHAa8jFUt8A/+WX5JHAa84J
                  MD5:4FF77E6200D86700DAD1479DBAEEF34B
                  SHA1:8A08AE8F10D1173D5070BA6AF1F4395465564E65
                  SHA-256:B0F19562DEB25B9A388B0642EDCD01D4DAC4481A2FD3F2BEA17F2B284E9C8A0F
                  SHA-512:D902B18A12D6109190BC5A04706F04335BF9E8C585B95907269A7F14AA030A7892DFA188C2D380F56224E61065FD3832CC1CE1FD8982C854FEDFF66D137D976E
                  Malicious:false
                  Preview:2024/10/01-15:54:05.809 17d0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/01-15:54:05.810 17d0 Recovering log #3.2024/10/01-15:54:05.812 17d0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                  C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                  File Type:ASCII text
                  Category:dropped
                  Size (bytes):322
                  Entropy (8bit):5.160234598013847
                  Encrypted:false
                  SSDEEP:6:b9534q2PRN2nKuAl9OmbzNMxIFUt8ahDJZmw+ajDDkwORN2nKuAl9OmbzNMFLJ:ZKvaHAa8jFUt8A/+WX5JHAa84J
                  MD5:4FF77E6200D86700DAD1479DBAEEF34B
                  SHA1:8A08AE8F10D1173D5070BA6AF1F4395465564E65
                  SHA-256:B0F19562DEB25B9A388B0642EDCD01D4DAC4481A2FD3F2BEA17F2B284E9C8A0F
                  SHA-512:D902B18A12D6109190BC5A04706F04335BF9E8C585B95907269A7F14AA030A7892DFA188C2D380F56224E61065FD3832CC1CE1FD8982C854FEDFF66D137D976E
                  Malicious:false
                  Preview:2024/10/01-15:54:05.809 17d0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/01-15:54:05.810 17d0 Recovering log #3.2024/10/01-15:54:05.812 17d0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                  C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241001195409Z-161.bmp

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
                  Category:dropped
                  Size (bytes):71190
                  Entropy (8bit):4.011493886219743
                  Encrypted:false
                  SSDEEP:1536:BxW9WVjbAJ3qTYqLfnAkCdibYUcVfq8VCFgv/z:JI/z
                  MD5:25E433DF39140B90CE3568B83D27B082
                  SHA1:59FA52FD981E700EAC1043D9B8151F146DFD5351
                  SHA-256:561C71CEF9ED5F70158D76D7C53840CA2E0A682B2DED9216289CFA8B4BBAB698
                  SHA-512:51557A568F687E79640BB01CA5135BDE377AF547501E94423FEDD352846055386C4B7E8509177D23B206C765CCD85386ACCFF20440804AFAA6218E444E48DBC2
                  Malicious:false
                  Preview:BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2
                  Category:dropped
                  Size (bytes):57344
                  Entropy (8bit):3.291927920232006
                  Encrypted:false
                  SSDEEP:192:vedRBvVui5V4R4dcQ5V4R4RtYWtEV2UUTTchqGp8F/7/z+FP:veBci5H5FY+EUUUTTcHqFzqFP
                  MD5:A4D5FECEFE05F21D6F81ACF4D9A788CF
                  SHA1:1A9AC236C80F2A2809F7DE374072E2FCCA5A775C
                  SHA-256:83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
                  SHA-512:FF106C6B9E1EA4B1F3E3AB01FAEA21BA24A885E63DDF0C36EB0A8C3C89A9430FE676039C076C50D7C46DC4E809F6A7E35A4BFED64D9033FEBD6121AC547AA5E9
                  Malicious:false
                  Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:SQLite Rollback Journal
                  Category:dropped
                  Size (bytes):16928
                  Entropy (8bit):1.2151299752804894
                  Encrypted:false
                  SSDEEP:24:7+tzMqLi+zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zw:7MQqLmFTIF3XmHjBoGGR+jMz+Lh9
                  MD5:BD7FF890485AA07CB4FBC63E6846E9F5
                  SHA1:BC8B13176E7EA75D7988EE12347B0C32725EB597
                  SHA-256:12637FF55BB14942F01BAB466E3B0055D9FB6E47425E4AF17C582B7D3933449E
                  SHA-512:01C513531A9F302FE37F3AF7F776BB0669E611FF29B39F89D7B0C34F8E1648487FA41DF7145865D7C72A0BE8DA851CC47B28D7355B29D0B487C04C3C20574845
                  Malicious:false
                  Preview:.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                  File Type:Certificate, Version=3
                  Category:dropped
                  Size (bytes):1391
                  Entropy (8bit):7.705940075877404
                  Encrypted:false
                  SSDEEP:24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
                  MD5:0CD2F9E0DA1773E9ED864DA5E370E74E
                  SHA1:CABD2A79A1076A31F21D253635CB039D4329A5E8
                  SHA-256:96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
                  SHA-512:3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
                  Malicious:false
                  Preview:0..k0..S............@.YDc.c...0...*.H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0...*.H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I.....*.A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.|C.t..t.....0.[q6....00\H..;..}`...).........A.......|.;F.H*..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..|o..;.....'...}~.."......

                  C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                  File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                  Category:dropped
                  Size (bytes):71954
                  Entropy (8bit):7.996617769952133
                  Encrypted:true
                  SSDEEP:1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
                  MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
                  SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
                  SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
                  SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
                  Malicious:false
                  Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

                  C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):192
                  Entropy (8bit):2.7673182398396405
                  Encrypted:false
                  SSDEEP:3:kkFklc7ej/XfllXlE/HT8k1lltNNX8RolJuRdxLlGB9lQRYwpDdt:kKFabIT8GNMa8RdWBwRd
                  MD5:2506CFF79027CA4978975E251A058E9D
                  SHA1:FAB640DAB2F83DAE09C7095F60A40863C93887A2
                  SHA-256:476F9C067F3780EDF79D754A131837D703E76B34A671862A2A39E175AE6CD930
                  SHA-512:F2529FB1458333E4BCE2F1D8D9CD5BB2380842F2225956AFEA0C9E250DF4BAC2B36B64E883A3EA13928531A5436402C88FF2EDCDDE3AD23E75EE5B9F39F6B18F
                  Malicious:false
                  Preview:p...... .........+..;...(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

                  C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                  File Type:data
                  Category:modified
                  Size (bytes):328
                  Entropy (8bit):3.2539954282295116
                  Encrypted:false
                  SSDEEP:6:kK3W99UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:fWkDImsLNkPlE99SNxAhUe/3
                  MD5:0A693CA99DAF036912FBB716248DA01B
                  SHA1:E438442E1E6458E573ACA3E650255C330C996A95
                  SHA-256:221330490CC23522A82CF4D5CEA5E63B95F1AA5C105EDDD62875D0046149150D
                  SHA-512:35F5EA98EE3C1D23193F1F69AFF934BD11C02AE8A0D11D3709461A7CABD75235350763363073879D89EBDBDEE3E8107BD73A533788CB64365C499250A5C86CC7
                  Malicious:false
                  Preview:p...... .........B[.;...(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

                  C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6744

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:PostScript document text
                  Category:dropped
                  Size (bytes):185099
                  Entropy (8bit):5.182478651346149
                  Encrypted:false
                  SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                  MD5:94185C5850C26B3C6FC24ABC385CDA58
                  SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                  SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                  SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                  Malicious:false
                  Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                  C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:PostScript document text
                  Category:dropped
                  Size (bytes):185099
                  Entropy (8bit):5.182478651346149
                  Encrypted:false
                  SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                  MD5:94185C5850C26B3C6FC24ABC385CDA58
                  SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                  SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                  SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                  Malicious:false
                  Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                  C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:JSON data
                  Category:dropped
                  Size (bytes):295
                  Entropy (8bit):5.3849460183572635
                  Encrypted:false
                  SSDEEP:6:YEQXJ2HXH+Dmgune5IRR4UhUR0YxT2xoAvJM3g98kUwPeUkwRe9:YvXKXeNueWRuUhUUOGMbLUkee9
                  MD5:A0332CE325B5FDC31AF94F8098186672
                  SHA1:4E4DD1DDFE3519B9376EC343E540064C2FCDAF0C
                  SHA-256:81905CA0D61AB1EF1BCF6F2F47F48244B6FFF9A469C3C0410B95278DFED572A4
                  SHA-512:2C612240D89622D9E3BEDFF108165A717C3B3CAB72E556C79BD493A5B5A10C79106E7B26B1A1697474AAA9471DC95A3D4CDB5F7BB1B431B9A47F2AD633E3EB48
                  Malicious:false
                  Preview:{"analyticsData":{"responseGUID":"0d91cd3e-152e-4558-b51f-f659824327ea","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727985731373,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                  C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:JSON data
                  Category:dropped
                  Size (bytes):294
                  Entropy (8bit):5.332082654476942
                  Encrypted:false
                  SSDEEP:6:YEQXJ2HXH+Dmgune5IRR4UhUR0YxT2xoAvJfBoTfXpnrPeUkwRe9:YvXKXeNueWRuUhUUOGWTfXcUkee9
                  MD5:5D3E924D42894EAA9CFFB796A5F75FF3
                  SHA1:C56D5AD63AEC3B9210D31C7A14A832BAA114FA42
                  SHA-256:303467434923E3F628DFE427168A2C08430AAF534D70700432D6AB5F1AA73DD9
                  SHA-512:6D65D5AE31BD1CDB26C338F9546F9BC95366626428698201D92B3DAF292D7562647C36EBB82452AF0FFA38BAC4E0EB4E37961B2589C1B8CDDA9E3D87CC8AE968
                  Malicious:false
                  Preview:{"analyticsData":{"responseGUID":"0d91cd3e-152e-4558-b51f-f659824327ea","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727985731373,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                  C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:JSON data
                  Category:dropped
                  Size (bytes):294
                  Entropy (8bit):5.311350448391612
                  Encrypted:false
                  SSDEEP:6:YEQXJ2HXH+Dmgune5IRR4UhUR0YxT2xoAvJfBD2G6UpnrPeUkwRe9:YvXKXeNueWRuUhUUOGR22cUkee9
                  MD5:5ECD346D168A92F9D44D7AE6C2746C38
                  SHA1:A9A4D11FB376F0C5AFE4214FC4095A698ECE526B
                  SHA-256:3ADD90BD4FAD459BBA7558EFB3BEE116C313C3F39A73B5957B4D222E70084993
                  SHA-512:73DF74D9FCAF96B86BC8351176E546958C2319D2B1F5AFBFC732AD4F9E3D09D3827EBDA73D65D642ED0AEDA5767E8ACE218F82B36E953667CFCDD1830E009398
                  Malicious:false
                  Preview:{"analyticsData":{"responseGUID":"0d91cd3e-152e-4558-b51f-f659824327ea","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727985731373,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                  C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:JSON data
                  Category:dropped
                  Size (bytes):285
                  Entropy (8bit):5.374083492432998
                  Encrypted:false
                  SSDEEP:6:YEQXJ2HXH+Dmgune5IRR4UhUR0YxT2xoAvJfPmwrPeUkwRe9:YvXKXeNueWRuUhUUOGH56Ukee9
                  MD5:36589E1938185CE36D0292AC351782B1
                  SHA1:BD8392907ADC2F4BEDE729F46C9063ADDD8B0293
                  SHA-256:E7FF45AC33E79FA419357FC2F41DD61776E19F55187B459C77BFA2EBD044AC2F
                  SHA-512:E92BDD72FCD4A87A556EDB02D0DFC2CEDAA57173A8CB0772F6D153D585D2FB7CF5B60D586CD1D0911F2B907E6731A649D5ABF6D5E88A660786322356C0FC777C
                  Malicious:false
                  Preview:{"analyticsData":{"responseGUID":"0d91cd3e-152e-4558-b51f-f659824327ea","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727985731373,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                  C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:JSON data
                  Category:dropped
                  Size (bytes):1063
                  Entropy (8bit):5.66854896886274
                  Encrypted:false
                  SSDEEP:24:Yv6XeN0UU7pLgEFqciGennl0RCmK8czOCY4w2d:Yvp0UIhgLtaAh8cvYvW
                  MD5:75AF59E3AF009C3A4AA138A1E281D8C0
                  SHA1:C0090FB4D1657DE06AC8664469199514A745EDB3
                  SHA-256:95DC6185987378D1B3F16212A664CF622B7753B2E3876921E8B9EF9F31D50699
                  SHA-512:56508A7197C71C12C1FF44AFDEC920C0A04F7E93CA7B37C97EA99F59A09F21B0685760DA4911B79BFDF80302B7197EC88D1F11222589AEEAEB8EEB659C9DE624
                  Malicious:false
                  Preview:{"analyticsData":{"responseGUID":"0d91cd3e-152e-4558-b51f-f659824327ea","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727985731373,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_2","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"afb9c2a3-eaf4-41f9-9d73-768e72f72282","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQgZmlsZXMgdG8gYW5kIGZyb20gUERGXG53aXRob3V0IGxpbWl0cy4ifSwidGNhdElkIjpudWxsfQ==","dataType":"application\/json","encodingSc

                  C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:JSON data
                  Category:dropped
                  Size (bytes):1050
                  Entropy (8bit):5.654877471493323
                  Encrypted:false
                  SSDEEP:24:Yv6XeN0UU3VLgEF0c7sbnl0RCmK8czOCYHflEpwiVd:Yvp0UaFg6sGAh8cvYHWpw4
                  MD5:9ABE4D44B1BED86ECD4FC04596DDF93B
                  SHA1:5B74520E79351773216237B50BA349A3E1CE6110
                  SHA-256:F6D960CA2976FDF2EAF855FD0EBBE9BA246C035EAF662861FFD389199C313F31
                  SHA-512:4A855FC2904CF3AEC82BA7D584DC790B4F4FC022DD1BF97FBB008D17EF05485A31A022FB0E8F8B4CA852338A1E53E3E1326FE43813F8E501BE5194F830254C41
                  Malicious:false
                  Preview:{"analyticsData":{"responseGUID":"0d91cd3e-152e-4558-b51f-f659824327ea","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727985731373,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_0","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"0924134e-3c59-4f53-b731-add558c56fec","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuZm9ybXMgJiBhZ3JlZW1lbnRzLiJ9LCJ0Y2F0SWQiOm51bGx9","dataType":"application\/json","encodingScheme":true},"

                  C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:JSON data
                  Category:dropped
                  Size (bytes):292
                  Entropy (8bit):5.322823448059287
                  Encrypted:false
                  SSDEEP:6:YEQXJ2HXH+Dmgune5IRR4UhUR0YxT2xoAvJfQ1rPeUkwRe9:YvXKXeNueWRuUhUUOGY16Ukee9
                  MD5:12F171F2B758A40888DBAF9CF3FDDF27
                  SHA1:122CE12D66375703043CF61F3435972E1ED171B6
                  SHA-256:87AB153600E93213C14C3F672D645B8AA12AFD350E2EC2C94ADDD8847B57DD20
                  SHA-512:723D40C7C431FB501BB105570635A76B683E22DCB7363BE77C3F7F129F1B95BBA950728545700E1FC58C6F7DB576D168C2592EB55756638677A0625C12E45FB1
                  Malicious:false
                  Preview:{"analyticsData":{"responseGUID":"0d91cd3e-152e-4558-b51f-f659824327ea","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727985731373,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                  C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:JSON data
                  Category:dropped
                  Size (bytes):1038
                  Entropy (8bit):5.64938199132539
                  Encrypted:false
                  SSDEEP:24:Yv6XeN0UUm2LgEF7cciAXs0nl0RCmK8czOCAPtciBd:Yvp0UHogc8hAh8cvAv
                  MD5:3B6F405C1E01ED806E0CB88DD8FCF0CE
                  SHA1:0CC88672312C7E6DF4299673E3A24593ECFB27FC
                  SHA-256:006E5CF179898EB4DE0DD67C8441FF5B3F795F9D84B5A06EF53CE6B4255474BA
                  SHA-512:0A23A3C2262322E3953F7856AE985527646A040C706F10522957D57A5DADF32670490302F4B59CEDBC289F86B648A8A0D5D3D5DFA034CF60B6F0CB6086DB0F75
                  Malicious:false
                  Preview:{"analyticsData":{"responseGUID":"0d91cd3e-152e-4558-b51f-f659824327ea","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727985731373,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_1","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"49d2f713-7aa9-44db-aa50-0a7a22add459","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVkaXQgdGV4dCwgaW1hZ2VzLCBwYWdlcywgYW5kIG1vcmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme":true},"endDTS":1744

                  C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:JSON data
                  Category:dropped
                  Size (bytes):1164
                  Entropy (8bit):5.699675885010651
                  Encrypted:false
                  SSDEEP:24:Yv6XeN0UUKKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK5d:Yvp0UrEgqprtrS5OZjSlwTmAfSKz
                  MD5:A20C55B1FC7DE7AE0009A037146746FA
                  SHA1:6D5B475AA710F3A96436CBA2BDD5C7992CCDCBC3
                  SHA-256:77379C1DC93C7B95826BC88399A264C2BF1EBDF3AC4E9EF66B67014663FD4A80
                  SHA-512:237776C8031711433B573C79392ECAE90413E4D7E76AE306EC4A921EA2DB101E14EF87BDD4621A415DBA768E213D29A5A71829D62EFC3CD2689D6CB8A5DB091D
                  Malicious:false
                  Preview:{"analyticsData":{"responseGUID":"0d91cd3e-152e-4558-b51f-f659824327ea","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727985731373,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

                  C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:JSON data
                  Category:dropped
                  Size (bytes):289
                  Entropy (8bit):5.326483433547731
                  Encrypted:false
                  SSDEEP:6:YEQXJ2HXH+Dmgune5IRR4UhUR0YxT2xoAvJfYdPeUkwRe9:YvXKXeNueWRuUhUUOGg8Ukee9
                  MD5:4E5A1EC9CFE9F2037245074FCEA0A1DD
                  SHA1:6FA998E577E8B3E7BDE7C856F213C3B75BA2289A
                  SHA-256:372501A2E78B8DC5DCF7217C37F97021016D26B67CAE789D63A64406269385D9
                  SHA-512:C614C5E0FC06A6A1322D78AB0CE2B93AA175F715358443C570A803848146E4533E6436879C7C2902D34E3BC1EE864BE3DA72CE98C3796D0C3E118F4428057624
                  Malicious:false
                  Preview:{"analyticsData":{"responseGUID":"0d91cd3e-152e-4558-b51f-f659824327ea","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727985731373,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                  C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:JSON data
                  Category:dropped
                  Size (bytes):1395
                  Entropy (8bit):5.776771254717294
                  Encrypted:false
                  SSDEEP:24:Yv6XeN0UU5rLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJN1:Yvp0UWHgDv3W2aYQfgB5OUupHrQ9FJz
                  MD5:0FDD3313BFA57E03D24609D323B0F860
                  SHA1:F87D5E7199316DA37C3A43B868AC1CD9C1347580
                  SHA-256:FD8CB98FB9F9B77AF9281A328A860C3DCDE12711664533280685E88D4158605C
                  SHA-512:7C6C74E103D44F8322042FDA1DC2BB0869C057630B802F887C5C9C7E8DC97D9EE67B47CFA016DE1127F5960D3A0EDA33228B8B4C814258FBDEA0D3A88C3A2154
                  Malicious:false
                  Preview:{"analyticsData":{"responseGUID":"0d91cd3e-152e-4558-b51f-f659824327ea","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727985731373,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

                  C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:JSON data
                  Category:dropped
                  Size (bytes):291
                  Entropy (8bit):5.309848514496179
                  Encrypted:false
                  SSDEEP:6:YEQXJ2HXH+Dmgune5IRR4UhUR0YxT2xoAvJfbPtdPeUkwRe9:YvXKXeNueWRuUhUUOGDV8Ukee9
                  MD5:0FC32163CF409EC9ECDBD2B7A802556A
                  SHA1:C8BC28341A7D04C693EA70A84210BF008F9C417C
                  SHA-256:5DFAAC8DA26682EF9CA3F5BC8DD8491191351129AB7FB230C26E4A5F89A50120
                  SHA-512:ACE85D362C910EA86DDA1B5A2BA587CAD6D478986300471E129E99C1CF02FAD943EE3CD5471A7101747E20397180BA61DE1E98E97BC2BFF4FE01E32CDEE98D74
                  Malicious:false
                  Preview:{"analyticsData":{"responseGUID":"0d91cd3e-152e-4558-b51f-f659824327ea","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727985731373,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                  C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:JSON data
                  Category:dropped
                  Size (bytes):287
                  Entropy (8bit):5.313282024467963
                  Encrypted:false
                  SSDEEP:6:YEQXJ2HXH+Dmgune5IRR4UhUR0YxT2xoAvJf21rPeUkwRe9:YvXKXeNueWRuUhUUOG+16Ukee9
                  MD5:11C603D17D9D599C151E06BBA755519D
                  SHA1:4AFB8A12791265B67A7671FB68C6AFBA6A0C89AC
                  SHA-256:5869B9EA5C4560A4B0AA232C2ADA00CEA0F63F0ED7F268CBB43520BF69226DED
                  SHA-512:128D794A7F73F5D20BD79B04A7B9C1A4E7B903D10A71AB9E5019A8D363A9CD538ED0FF3D214452B832A609B6AC83900C8D3AD8DC16EA89977655971C18246DB6
                  Malicious:false
                  Preview:{"analyticsData":{"responseGUID":"0d91cd3e-152e-4558-b51f-f659824327ea","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727985731373,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                  C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:JSON data
                  Category:dropped
                  Size (bytes):1058
                  Entropy (8bit):5.659602973762547
                  Encrypted:false
                  SSDEEP:24:Yv6XeN0UU7amXayLgEFRcONaqnl0RCmK8czOC+w2E+tg8Bd:Yvp0UaBguOAh8cv+NK+
                  MD5:0A9B9FBF0F4B7C81FECC353DD779F608
                  SHA1:09B5E47C280218375AE2D6CE65B41C52C330B70F
                  SHA-256:EF170092BF589CF4122256B055B7C18A729C63FCE852DA2142DB641C05C4ACC7
                  SHA-512:D6385BCA7962F7C766C754C0377E2E6843B3536B91A874208B22B0665DC3F3A9B4A481FEF824D9922C0934B6303AD382DB4172AAAB37063DFE44DB82D295E0C9
                  Malicious:false
                  Preview:{"analyticsData":{"responseGUID":"0d91cd3e-152e-4558-b51f-f659824327ea","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727985731373,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_3","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"ece07729-7db6-4f20-9f8d-7976ad373049","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IlNlbmQgZG9jdW1lbnRzICYgZm9ybXNcbmZvciBmYXN0IGUtc2lnbmluZyBvbmxpbmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme"

                  C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:JSON data
                  Category:dropped
                  Size (bytes):286
                  Entropy (8bit):5.289606942876119
                  Encrypted:false
                  SSDEEP:6:YEQXJ2HXH+Dmgune5IRR4UhUR0YxT2xoAvJfshHHrPeUkwRe9:YvXKXeNueWRuUhUUOGUUUkee9
                  MD5:C907EB43FFA1BF737D5231FD8DF95074
                  SHA1:C32E16FFDE8130E627F57CC2F63CEF6A8C3257B1
                  SHA-256:7B469287179421D4EBB05C43CDE074F860EAB0D22398FCBE764F8AD0F64BEFED
                  SHA-512:CF6E4CF0C0254CC5D1CFF0BE4303B4FC542688C55ACCC37769D86AB45E960B9852896183BF08A781373421200F66C7388303EB7A8C20168B430CB0C64A13DCB4
                  Malicious:false
                  Preview:{"analyticsData":{"responseGUID":"0d91cd3e-152e-4558-b51f-f659824327ea","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727985731373,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                  C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:JSON data
                  Category:dropped
                  Size (bytes):782
                  Entropy (8bit):5.37319178629858
                  Encrypted:false
                  SSDEEP:12:YvXKXeNueWRuUhUUOGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWh:Yv6XeN0UUY168CgEXX5kcIfANh4
                  MD5:809F7028F684DD3362A11C5B214727A1
                  SHA1:8040202644411F67A6397746F146E93FD06A5502
                  SHA-256:015A6E33887C7A97FD5267A591635E2A10095E01C08ED3703F3C0257553666CA
                  SHA-512:E14EFEC8A68D8921CAE32D750C822FC09B99C4D28CE69B33F92E0719A08F0B5C6B66F2C1A67ED8A0F1C9337CBE5BF8BCB81AF870DD26810889315C6B9CDD19CA
                  Malicious:false
                  Preview:{"analyticsData":{"responseGUID":"0d91cd3e-152e-4558-b51f-f659824327ea","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727985731373,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1727812451404}}}}

                  C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):4
                  Entropy (8bit):0.8112781244591328
                  Encrypted:false
                  SSDEEP:3:e:e
                  MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                  SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                  SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                  SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                  Malicious:false
                  Preview:....

                  C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:JSON data
                  Category:dropped
                  Size (bytes):2818
                  Entropy (8bit):5.124759071876488
                  Encrypted:false
                  SSDEEP:24:Y5SQSa0GfayZrsLZ/wTGDC559KPqNTk8WKjjJN2j0SJjSN2yZ2LSLQEja5f9tzun:YUXG7Dsm5YPqNTkb+JCITZpQEjaB9to
                  MD5:9EB1C32CBC5D51BC63E0DEB275352A71
                  SHA1:0A58CB618AC1A59B5E76B9F9647E25A007DB803B
                  SHA-256:A5EA28BBDB376B2D72E42030130407B3F632B4E351B2D42E23A3D1156EE9945A
                  SHA-512:95BDC0E07273D46436674208E3A2FE59C72DF9766A36EBDA703D2E95C6C915886D0417C23F6358989FD663AFDA860732A77FB255503E4025AF8098E8D80A40E7
                  Malicious:false
                  Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"2cf955554136923778e69ae4351605a0","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1050,"ts":1727812451000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"118f23088d310a0a2b0e2e535059c236","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1727812451000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"959aeee245124ba76d4f8e8bdabe4e63","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1058,"ts":1727812451000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"1ca4c9ef849b4a8d989b6fc3d422292f","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1063,"ts":1727812451000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"105def30eca02a6ee41467de5863f85c","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1038,"ts":1727812451000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"ddee3ace32e26ee0bd6d1268b61e5cf2","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"t

                  C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
                  Category:dropped
                  Size (bytes):12288
                  Entropy (8bit):0.987219109758488
                  Encrypted:false
                  SSDEEP:24:TLHRx/XYKQvGJF7urs67Y9QmQ6Qe1IcLESiAie9F:TVl2GL7ms67YXtrGcI87
                  MD5:6F53FFAE7A009D965BA9FDA7FC8C4205
                  SHA1:48D0C2AF73CDFE7AE1049796DC9064BB31646E20
                  SHA-256:7EF3605A6E92D218EE97453EFFEC5EE0900845CBF80130A900D55152F6083BB4
                  SHA-512:1F0BDB43750EBFDD07A8D937509B8AA2D7D7FA374BDE530B09343FB0992D5E13B4FC074FF676310F82D4BA3EABEE51E1F07CB362B642FFA607D6D8058A91EC14
                  Malicious:false
                  Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:SQLite Rollback Journal
                  Category:dropped
                  Size (bytes):8720
                  Entropy (8bit):1.3440611694572315
                  Encrypted:false
                  SSDEEP:24:7+tvASY9QmQ6Qe17cLESiAi0mY9Q+qLBx/XYKQvGJF7ursi:7MvlYXtrhcI8KYrqll2GL7msi
                  MD5:135C49851614F1EAE07D5D59136F2845
                  SHA1:6C06FBF4BAEBFD0A5F5ECB7422F152AC008100B2
                  SHA-256:5B400F409177C655E5C1CE798CFEACDCECF58A7AF96A2D8F867983650031D1CA
                  SHA-512:C96FB3679339D6C28DBF8B215EAB0B30160274CFE90A1F842FF9ADAFC6B5AD1776835602808B36F6B4B283BB4613941F4A8519FFD14234F0BD68C765B9737234
                  Malicious:false
                  Preview:.... .c......(.S......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Temp\MSI40391.LOG

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):246
                  Entropy (8bit):3.5004142083842487
                  Encrypted:false
                  SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K80QRqV7U9H:Qw946cPbiOxDlbYnuRK7Q9H
                  MD5:AB08AB719D3227A62B9C28F91E355C23
                  SHA1:F38978398453CD3D6B1E815C38C8D725817E8B22
                  SHA-256:05419B2E7303CE1B17C831085C8F80533C7625D4CDDCFAD37BC00719C24AAC33
                  SHA-512:0800422481224CB7F08A806B694469D5A3C5B1E3CC4BFA370EFA450834C1BD13A3EF4CF4F6F99FE6E3BB1FCD5C73432D3F9C473C48A76B026FD5BFD274B48D1A
                  Malicious:false
                  Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .0.1./.1.0./.2.0.2.4. . .1.5.:.5.4.:.1.2. .=.=.=.....

                  C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 15-54-07-077.log

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:ASCII text, with very long lines (393)
                  Category:dropped
                  Size (bytes):16525
                  Entropy (8bit):5.353642815103214
                  Encrypted:false
                  SSDEEP:384:tbxtsuP+XEWJJQbnR8L31M7HeltV+KYm3wsa2KjF4ODkr/O8r2IUHUHMWwEyZRN2:aPL
                  MD5:91F06491552FC977E9E8AF47786EE7C1
                  SHA1:8FEB27904897FFCC2BE1A985D479D7F75F11CEFC
                  SHA-256:06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
                  SHA-512:A63E6E0D25B88EBB6602885AB8E91167D37267B24516A11F7492F48876D3DDCAE44FFC386E146F3CF6EB4FA6AF251602143F254687B17FCFE6F00783095C5082
                  Malicious:false
                  Preview:SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig:

                  C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:ASCII text, with very long lines (393), with CRLF line terminators
                  Category:dropped
                  Size (bytes):15111
                  Entropy (8bit):5.323591341541535
                  Encrypted:false
                  SSDEEP:384:ItZEssNULBeh6PQUuX4jcGn2eBeEm5BfHApl7zjCc+8wvQUpRGvKHwHyf2suhk0x:4BL
                  MD5:64EA4F074305A2FB396424D3D47CA81B
                  SHA1:AB0A559BAF44768B916B8B5C940A3B8971BB387C
                  SHA-256:720D1556D59F0E8D28A3D2DECDBE1B5EAF3C4843BA096E414C100905B344C562
                  SHA-512:D168A430E682306643EEAEFD14731D49FF444D3B7EDDF8A98243534EF2EB73AE488194AF7CD0C5EB9AA064816E3F91BC37E703EF2E218A0996B27846722DD61A
                  Malicious:false
                  Preview:SessionID=1d871d14-8985-4845-83f8-92f66812e2a0.1727812447088 Timestamp=2024-10-01T15:54:07:088-0400 ThreadID=4212 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=1d871d14-8985-4845-83f8-92f66812e2a0.1727812447088 Timestamp=2024-10-01T15:54:07:090-0400 ThreadID=4212 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=1d871d14-8985-4845-83f8-92f66812e2a0.1727812447088 Timestamp=2024-10-01T15:54:07:090-0400 ThreadID=4212 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=1d871d14-8985-4845-83f8-92f66812e2a0.1727812447088 Timestamp=2024-10-01T15:54:07:090-0400 ThreadID=4212 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=1d871d14-8985-4845-83f8-92f66812e2a0.1727812447088 Timestamp=2024-10-01T15:54:07:091-0400 ThreadID=4212 Component=ngl-lib_NglAppLib Description="SetConf

                  C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  File Type:ASCII text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):29752
                  Entropy (8bit):5.416813577035107
                  Encrypted:false
                  SSDEEP:192:0cbgIhPcbocbAIlncb2cbwI/RcbNcbQIVvcbvBCcbxqIN3cbFqs:fhWlA/TVSB5TNwqs
                  MD5:B57C5AA6C4CCEE458874A0724209F7C6
                  SHA1:571E2F2B9E87B4D9CDD252E4B61324DD3DED3391
                  SHA-256:3B151B49281E10EBB1881635E0FBC5A2D9DD73B151B35A27433695F567F0A668
                  SHA-512:3C6E4E0072F7E6FAA2A97B67A07071FF20F60D3338ECE19864FAC86A81731E379881C9EB60B61C6A088B44641387E4E621942E6A7B3B5E129D33E24B7BB2A857
                  Malicious:false
                  Preview:06-10-2023 10:08:42:.---2---..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 10:08:42:.Closing File..06-10-

                  C:\Users\user\AppData\Local\Temp\acrocef_low\229d12c8-8a5c-4973-b6c7-5e87b0b7d77d.tmp

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                  File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                  Category:dropped
                  Size (bytes):386528
                  Entropy (8bit):7.9736851559892425
                  Encrypted:false
                  SSDEEP:6144:rBgI81ReWQ53+sQ3POSTJJJJEQ6T9UkRm1XX/FLYVbxrr/IxktOQZ1mau4yBwsOo:r+Tegs6lTJJJJv+9UZd1ybxrr/IxkB1m
                  MD5:774036904FF86EB19FCE18B796528E1E
                  SHA1:2BA0EBF3FC7BEF9EF5BFAD32070BD3C785904E16
                  SHA-256:D2FC8EA3DDD3F095F7A469927179B408102471627C91275EDB4D7356F8E453AD
                  SHA-512:9E9662EA15AE3345166C1E51235CDCE3123B27848E4A4651CC4D2173BDD973E4AD2F8994EFF34A221A9F07AA676F52BEB6D90FF374F6CCB0D06FA39C3EFE6B31
                  Malicious:false
                  Preview:...........[l\[.......p.a$..$.K...&%J.J...Wuo..dI.vk4.E..P.u..(.....1.I....A...............0.....$ctg.H.'....@.Zk...~.s.A]M.A..:g?.^{...cjL...X..#.Q{......z...m...K.U]-..^V.........@..P...U.R..z.......?......]nG..O{..n........y...v7...~C#..O.z...:...H&..6M;........c..#.y4u.~6.?...V?.%?SW.....K...[..`N.i.1..:..@?i.Q..O...`.....m.!y.{...?=.. .....Zk......%.6......o<.....yA}......no......u,.....U...a.......[S.n..`.....:...1......X..u.u...`..B=.&M.y..s.....}.i..l.'u]. ...6.s`....zdN.F.>;.d%D..}3..b..~..k.......,hl.j..._...F..p.z..o...C..,.Ss.u.Xd..a.Y.{.p...?.k..t,&..'...........^.f.hg....y..Y...i..m....<..^......yK.......;.5...E...K..Q.;k..|;..B.{m..eS..>b..>...6...wmC.i.....wv..k..{..X...RB.P..?w......1l.H..{{.`g.P.8.Z..v_.G.....f.%+z.....p.P..u}.T.....~r]..W7..._..c.k.....@....y.K...uOSj........^....B..]..~{..;...c....r.J.m.S.}.....k....u*^...5./...{......3.I.p.t...V..........W-..|.K.N.....n.........Bl...#)..;..4.x.....'....A....x..

                  C:\Users\user\AppData\Local\Temp\acrocef_low\354f08e1-cb1e-4ceb-8290-4c779fc66921.tmp

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                  File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                  Category:dropped
                  Size (bytes):758601
                  Entropy (8bit):7.98639316555857
                  Encrypted:false
                  SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9Uq:O3Pjegf121YS8lkipdjMMNB1DofjgJJ2
                  MD5:10CA6FDFFE6BC68FFF791D3E7104C4CA
                  SHA1:53C1BAD96D37D31D37A3302EFB838059E2BC8063
                  SHA-256:F317D901F863D154C87299A0DF6F0BE7699F00CC66CD76F14B7CE1387B7B71DE
                  SHA-512:653166A4D56BCDFA1CBE1097A4CC0FEA277593B2E554D9FDF5F10A954E8E1260E0CF3185DEAA68E930A5EB74C2FFDDB7066B54CAE4F7F98A79C250115686C8CE
                  Malicious:false
                  Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                  C:\Users\user\AppData\Local\Temp\acrocef_low\82ff17b1-728d-4e83-815b-100efc1f34ef.tmp

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                  File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                  Category:dropped
                  Size (bytes):1419751
                  Entropy (8bit):7.976496077007677
                  Encrypted:false
                  SSDEEP:24576:/xaWL07oXGZGwYIGNPJwdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JaWLxXGZGwZGM3mlind9i4ufFXpAXkru
                  MD5:0A347312E361322436D1AF1D5145D2AB
                  SHA1:1D6C06A274705F8A295F62AD90CF8CA27555C226
                  SHA-256:094501B3CA4E93F626ABFCAE800645C533B61409DC3D1D233F4D053CE6A124D7
                  SHA-512:9856C231513B47DD996488DF19EEE44DBB320E55432984C0C041EF568B6EC5C05F5340831132890D1D162E0505CA243D579582EDB9157CF722A86EC8CE2FEAFE
                  Malicious:false
                  Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                  C:\Users\user\AppData\Local\Temp\acrocef_low\c6ea7a53-6a38-4b45-8ab6-6f451286c793.tmp

                  Download File
                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                  File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                  Category:dropped
                  Size (bytes):1407294
                  Entropy (8bit):7.97605879016224
                  Encrypted:false
                  SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
                  MD5:8B9FA2EC5118087D19CFDB20DA7C4C26
                  SHA1:E32D6A1829B18717EF1455B73E88D36E0410EF93
                  SHA-256:4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
                  SHA-512:662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
                  Malicious:false
                  Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                  Static File Info

                  General

                  File type:PDF document, version 1.7 (zip deflate encoded)
                  Entropy (8bit):7.95901389237863
                  TrID:
                  • Adobe Portable Document Format (5005/1) 100.00%
                  File name:Paychex Direct Deposit Form (02 2024)..pdf
                  File size:223'383 bytes
                  MD5:08eadc77f3722a16ef5fd1b74f1836ba
                  SHA1:aa5b360b614821872f0aecc3dda6d3f40ccf1ffb
                  SHA256:3e8b33ffbd977c14bca8e21f80cc46ab0820da8209a529fd95ab7eeaf2d5235e
                  SHA512:bb0daf43adc85eec92d026244007e3a37db12c917a2225a380c9b8716b712243e00a61b0260cba77e12d20457fe1b10fa542f8aaf69cf221d2559765708ad78f
                  SSDEEP:3072:q6OEkcPcELj3QDv6CRTBBBBBBBZrEA2f+d31o2FXhfXFL90P2NUi0nJwT3r0:HTjtZCRTBBBBBBBZF2mzNxfFWP2qp270
                  TLSH:B124023DB91B0D7CCB6B417911360BCAD8A23414EF29A97F26D52BD2274C6533A3B817
                  File Content Preview:%PDF-1.7.%......4 0 obj.<</E 222737/H [ 783 147 ]/L 223383/Linearized 1/N 1/O 6/T 222955>>.endobj. .26 0 obj.<</DecodeParms<</Columns 5/Predictor 12>>/Filter/FlateDecode/ID[(

                  File Icon

                  Icon Hash:62cc8caeb29e8ae0

                  Static PDF Info

                  General

                  Header:%PDF-1.7
                  Total Entropy:7.959014
                  Total Bytes:223383
                  Stream Entropy:7.959739
                  Stream Bytes:220913
                  Entropy outside Streams:5.204942
                  Bytes outside Streams:2470
                  Number of EOF found:2
                  Bytes after EOF:

                  Keywords Statistics

                  NameCount
                  obj17
                  endobj17
                  stream14
                  endstream14
                  xref0
                  trailer1
                  startxref2
                  /Page1
                  /Encrypt0
                  /ObjStm2
                  /URI0
                  /JS0
                  /JavaScript0
                  /AA0
                  /OpenAction0
                  /AcroForm0
                  /JBIG2Decode0
                  /RichMedia0
                  /Launch0
                  /EmbeddedFile0

                  Image Streams

                  IDDHASHMD5Preview
                  120c5f7d4f6f697177fd0fb10e8771b862138903271ba4514d
                  140000000000000000b86e81b9dc937f998b0e51e928a4bcf3
                  150000000000000000f7b4157772c43fe223075c5f0d3d8dfc

                  Network Behavior

                  Network Port Distribution

                  TCP Packets

                  TimestampSource PortDest PortSource IPDest IP
                  Oct 1, 2024 21:54:17.981360912 CEST49712443192.168.2.1623.195.76.153
                  Oct 1, 2024 21:54:17.981405973 CEST4434971223.195.76.153192.168.2.16
                  Oct 1, 2024 21:54:17.981551886 CEST49712443192.168.2.1623.195.76.153
                  Oct 1, 2024 21:54:17.981791019 CEST49712443192.168.2.1623.195.76.153
                  Oct 1, 2024 21:54:17.981806993 CEST4434971223.195.76.153192.168.2.16
                  Oct 1, 2024 21:54:18.534353018 CEST4434971223.195.76.153192.168.2.16
                  Oct 1, 2024 21:54:18.534694910 CEST49712443192.168.2.1623.195.76.153
                  Oct 1, 2024 21:54:18.534713984 CEST4434971223.195.76.153192.168.2.16
                  Oct 1, 2024 21:54:18.535810947 CEST4434971223.195.76.153192.168.2.16
                  Oct 1, 2024 21:54:18.535890102 CEST49712443192.168.2.1623.195.76.153
                  Oct 1, 2024 21:54:18.537950039 CEST49712443192.168.2.1623.195.76.153
                  Oct 1, 2024 21:54:18.538024902 CEST4434971223.195.76.153192.168.2.16
                  Oct 1, 2024 21:54:18.538113117 CEST49712443192.168.2.1623.195.76.153
                  Oct 1, 2024 21:54:18.578800917 CEST49712443192.168.2.1623.195.76.153
                  Oct 1, 2024 21:54:18.578820944 CEST4434971223.195.76.153192.168.2.16
                  Oct 1, 2024 21:54:18.626555920 CEST49712443192.168.2.1623.195.76.153
                  Oct 1, 2024 21:54:18.633812904 CEST4434971223.195.76.153192.168.2.16
                  Oct 1, 2024 21:54:18.634121895 CEST4434971223.195.76.153192.168.2.16
                  Oct 1, 2024 21:54:18.634182930 CEST49712443192.168.2.1623.195.76.153
                  Oct 1, 2024 21:54:18.635121107 CEST49712443192.168.2.1623.195.76.153
                  Oct 1, 2024 21:54:18.635149956 CEST4434971223.195.76.153192.168.2.16

                  UDP Packets

                  TimestampSource PortDest PortSource IPDest IP
                  Oct 1, 2024 21:54:17.526437044 CEST5555653192.168.2.161.1.1.1
                  Oct 1, 2024 21:54:31.486303091 CEST5315453192.168.2.161.1.1.1
                  Oct 1, 2024 21:54:43.941246033 CEST6340453192.168.2.161.1.1.1

                  DNS Queries

                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                  Oct 1, 2024 21:54:17.526437044 CEST192.168.2.161.1.1.10x3230Standard query (0)x1.i.lencr.orgA (IP address)IN (0x0001)false
                  Oct 1, 2024 21:54:31.486303091 CEST192.168.2.161.1.1.10xb589Standard query (0)x1.i.lencr.orgA (IP address)IN (0x0001)false
                  Oct 1, 2024 21:54:43.941246033 CEST192.168.2.161.1.1.10x54d9Standard query (0)x1.i.lencr.orgA (IP address)IN (0x0001)false

                  DNS Answers

                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                  Oct 1, 2024 21:54:05.931972980 CEST1.1.1.1192.168.2.160xc668No error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
                  Oct 1, 2024 21:54:05.931972980 CEST1.1.1.1192.168.2.160xc668No error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
                  Oct 1, 2024 21:54:17.534065008 CEST1.1.1.1192.168.2.160x3230No error (0)x1.i.lencr.orgcrl.root-x1.letsencrypt.org.edgekey.netCNAME (Canonical name)IN (0x0001)false
                  Oct 1, 2024 21:54:31.494169950 CEST1.1.1.1192.168.2.160xb589No error (0)x1.i.lencr.orgcrl.root-x1.letsencrypt.org.edgekey.netCNAME (Canonical name)IN (0x0001)false
                  Oct 1, 2024 21:54:44.051389933 CEST1.1.1.1192.168.2.160x54d9No error (0)x1.i.lencr.orgcrl.root-x1.letsencrypt.org.edgekey.netCNAME (Canonical name)IN (0x0001)false

                  HTTP Request Dependency Graph

                  • armmf.adobe.com

                  HTTPS Proxied Packets

                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                  0192.168.2.164971223.195.76.1534437100C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                  TimestampBytes transferredDirectionData
                  2024-10-01 19:54:18 UTC390OUTGET /onboarding/smskillreader.txt HTTP/1.1
                  Host: armmf.adobe.com
                  Connection: keep-alive
                  Accept-Language: en-US,en;q=0.9
                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
                  Sec-Fetch-Site: same-origin
                  Sec-Fetch-Mode: no-cors
                  Sec-Fetch-Dest: empty
                  Accept-Encoding: gzip, deflate, br
                  2024-10-01 19:54:18 UTC247INHTTP/1.1 200 OK
                  Server: Apache
                  Last-Modified: Mon, 01 May 2023 15:02:33 GMT
                  ETag: "78-5faa31cce96da"
                  Accept-Ranges: bytes
                  Content-Length: 120
                  Content-Type: text/plain; charset=UTF-8
                  Date: Tue, 01 Oct 2024 19:54:18 GMT
                  Connection: close
                  2024-10-01 19:54:18 UTC120INData Raw: 46 69 6c 65 20 74 68 61 74 20 61 63 74 73 20 6c 69 6b 65 20 61 20 4b 69 6c 6c 20 73 77 69 74 63 68 20 66 6f 72 20 53 4d 53 20 66 75 6e 63 74 69 6f 6e 61 6c 69 74 79 20 69 6e 20 52 65 61 64 65 72 2e 20 44 65 6c 65 74 65 20 74 68 69 73 20 66 69 6c 65 20 74 6f 20 65 6e 61 62 6c 65 20 74 68 65 20 6b 69 6c 6c 20 73 77 69 74 63 68 20 69 6e 20 52 65 61 64 65 72 2e
                  Data Ascii: File that acts like a Kill switch for SMS functionality in Reader. Delete this file to enable the kill switch in Reader.


                  Statistics

                  CPU Usage

                  Click to jump to process

                  Memory Usage

                  Click to jump to process

                  High Level Behavior Distribution

                  Click to dive into process behavior distribution

                  Behavior

                  Click to jump to process

                  System Behavior

                  General

                  Target ID:0
                  Start time:15:54:03
                  Start date:01/10/2024
                  Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                  Wow64 process (32bit):false
                  Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Paychex Direct Deposit Form (02 2024)..pdf"
                  Imagebase:0x7ff76a5c0000
                  File size:5'641'176 bytes
                  MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:high
                  Has exited:false

                  General

                  Target ID:3
                  Start time:15:54:04
                  Start date:01/10/2024
                  Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                  Wow64 process (32bit):false
                  Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                  Imagebase:0x7ff784740000
                  File size:3'581'912 bytes
                  MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:high
                  Has exited:false

                  General

                  Target ID:4
                  Start time:15:54:05
                  Start date:01/10/2024
                  Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                  Wow64 process (32bit):false
                  Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1548,i,771568016486475644,2400619360177338759,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                  Imagebase:0x7ff784740000
                  File size:3'581'912 bytes
                  MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:high
                  Has exited:false

                  Disassembly

                  ⊘No disassembly