Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
RadProCalculatorUpdates.pdf

Overview

General Information

Sample name:RadProCalculatorUpdates.pdf
Analysis ID:1524333
MD5:17c5701f6fec5fc71dc4fe829345f88e
SHA1:56211a667d1e53a6c6e111a6e291b9a36b2c1b4f
SHA256:9d193d86b06a17eceeae4fce87eed0116ff01ad16ac2f05c8c7a4c09338ab78b
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 5148 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\RadProCalculatorUpdates.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 6176 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 3116 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1540,i,16482645188541234527,6887169318165601849,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficDNS query: name: x1.i.lencr.org
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global trafficTCP traffic: 104.126.112.182:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global trafficTCP traffic: 104.126.112.182:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 104.126.112.182:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global trafficTCP traffic: 104.126.112.182:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 104.126.112.182:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global trafficTCP traffic: 104.126.112.182:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global trafficTCP traffic: 104.126.112.182:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global trafficTCP traffic: 104.126.112.182:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 104.126.112.182:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global trafficTCP traffic: 104.126.112.182:443 -> 192.168.2.5:49721
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: global trafficTCP traffic: 192.168.2.5:49721 -> 104.126.112.182:443
Source: Joe Sandbox ViewIP Address: 104.126.112.182 104.126.112.182
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknownTCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknownTCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknownTCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknownTCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknownTCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknownTCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknownTCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknownTCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknownTCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknownTCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknownTCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global trafficDNS traffic detected: DNS query: x1.i.lencr.org
Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.drString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.drString found in binary or memory: http://x1.i.lencr.org/
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: classification engineClassification label: clean2.winPDF@14/48@1/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3924Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-02 11-33-34-473.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\RadProCalculatorUpdates.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1540,i,16482645188541234527,6887169318165601849,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1540,i,16482645188541234527,6887169318165601849,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: RadProCalculatorUpdates.pdfInitial sample: PDF keyword /JS count = 0
Source: RadProCalculatorUpdates.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: A91lqvsya_c9jk18_310.tmp.0.drInitial sample: PDF keyword /JS count = 0
Source: A91lqvsya_c9jk18_310.tmp.0.drInitial sample: PDF keyword /JavaScript count = 0
Source: RadProCalculatorUpdates.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts3
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media2
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive13
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1524333 Sample: RadProCalculatorUpdates.pdf Startdate: 02/10/2024 Architecture: WINDOWS Score: 2 14 x1.i.lencr.org 2->14 7 Acrobat.exe 18 63 2->7         started        process3 process4 9 AcroCEF.exe 97 7->9         started        process5 11 AcroCEF.exe 4 9->11         started        dnsIp6 16 104.126.112.182, 443, 49721 AKAMAI-ASUS United States 11->16

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
RadProCalculatorUpdates.pdf3%ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://x1.i.lencr.org/0%URL Reputationsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
x1.i.lencr.org
unknown
unknownfalse
    		unknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://x1.i.lencr.org/2D85F72862B55C4EADD9E66E06947F3D0.2.drfalse
    • URL Reputation: safe
    		unknown

    World Map of Contacted IPs

    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs

    Public IPs

    IPDomainCountryFlagASNASN NameMalicious
    104.126.112.182
    		unknownUnited States
    		16625AKAMAI-ASUSfalse

    General Information

    Joe Sandbox version:41.0.0 Charoite
    Analysis ID:1524333
    Start date and time:2024-10-02 17:32:32 +02:00
    Joe Sandbox product:CloudBasic
    Overall analysis duration:0h 4m 9s
    Hypervisor based Inspection enabled:false
    Report type:full
    Cookbook file name:defaultwindowspdfcookbook.jbs
    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
    Number of analysed new started processes analysed:9
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • EGA enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:Timeout
    Sample name:RadProCalculatorUpdates.pdf
    Detection:CLEAN
    Classification:clean2.winPDF@14/48@1/1
    Cookbook Comments:
    • Found application associated with file extension: .pdf
    • Found PDF document
    • Close Viewer

    Warnings

    • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
    • Excluded IPs from analysis (whitelisted): 184.28.88.176, 52.202.204.11, 54.227.187.23, 52.5.13.197, 23.22.254.206, 162.159.61.3, 172.64.41.3, 93.184.221.240, 2.23.197.184, 2.19.126.149, 2.19.126.143
    • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, wu.ec.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, wu.azureedge.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, geo2.adobe.com, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
    • VT rate limit hit for: RadProCalculatorUpdates.pdf

    Simulations

    Behavior and APIs

    TimeTypeDescription
    11:33:45API Interceptor3x Sleep call for process: AcroCEF.exe modified

    Joe Sandbox View / Context

    IPs

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    104.126.112.182Biolegend.com_Report_93129.pdfGet hashmaliciousUnknownBrowse
      Quotation-Invitation28252-09yzak_1_cdcon.pdfGet hashmaliciousUnknownBrowse
        Gide#Invoice.pdfGet hashmaliciousUnknownBrowse
          virus total.pdfGet hashmaliciousHTMLPhisherBrowse
            tourmalinellc.com-_DocuSign-.pdfGet hashmaliciousUnknownBrowse
              Oproeg MVTN.pdfGet hashmaliciousUnknownBrowse
                Investec Payment-Copy.pdfGet hashmaliciousHTMLPhisherBrowse
                  https://drive.google.com/file/d/1tRr780hsajeou1KA4eMfCzCm-jeRIblh/view?usp=sharing_eil_m&ts=66aa983cGet hashmaliciousUnknownBrowse
                    Complete_with DocuSign_Monday-July-2024 0738 AM.pdfGet hashmaliciousUnknownBrowse
                      Building Made Easy Proposal .pdfGet hashmaliciousUnknownBrowse

                        Domains

                        ⊘No context

                        ASNs

                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        AKAMAI-ASUS66fb252fe232b_Patksl.exeGet hashmaliciousLummaC, PrivateLoader, Stealc, VidarBrowse
                        • 104.102.49.254
                        http://view.flodesk.com/emails/66fd2053af85c99dd55d1461Get hashmaliciousUnknownBrowse
                        • 2.19.126.198
                        file.exeGet hashmaliciousLummaC, Stealc, VidarBrowse
                        • 104.102.49.254
                        test.exeGet hashmaliciousBabadedaBrowse
                        • 23.223.209.207
                        kuly.exeGet hashmaliciousLummaCBrowse
                        • 104.102.49.254
                        webNY0O9Sr.exeGet hashmaliciousLummaCBrowse
                        • 104.102.49.254
                        klFMCT64RF.exeGet hashmaliciousLummaCBrowse
                        • 104.102.49.254
                        EKAHephXb2.exeGet hashmaliciousLummaC, Go Injector, LummaC StealerBrowse
                        • 104.102.49.254
                        webNY0O9Sr.exeGet hashmaliciousLummaCBrowse
                        • 104.102.49.254
                        klFMCT64RF.exeGet hashmaliciousLummaCBrowse
                        • 104.102.49.254

                        JA3 Fingerprints

                        ⊘No context

                        Dropped Files

                        ⊘No context

                        Created / dropped Files

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):291
                        Entropy (8bit):5.114127738267403
                        Encrypted:false
                        SSDEEP:6:W6C3+q2P92nKuAl9OmbnIFUt8B6eAZZmw+B6eANVkwO92nKuAl9OmbjLJ:E+v4HAahFUt8iZ/+iNV5LHAaSJ
                        MD5:D8FD6DA1D01D08939EA863EE03D2401D
                        SHA1:58A49F70D8C7555C3850B53D2CE6EE7FA671DC51
                        SHA-256:01EF428FE30DE3DC4AB6D5E7DCD8F4A692C747419EF78B1D66E572448037A355
                        SHA-512:687A57D60CE00CD8FFDF2A9600D6CCFEE6BFACB33B6A2CF96779A21511D1916A30C3513D7E23F7CBAA4E892E5936B3C5E4AEDEEDB0A20CEFF48CFACDE5D554C1
                        Malicious:false
                        Reputation:low
                        Preview:2024/10/02-11:33:32.400 94c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/02-11:33:32.403 94c Recovering log #3.2024/10/02-11:33:32.403 94c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):291
                        Entropy (8bit):5.114127738267403
                        Encrypted:false
                        SSDEEP:6:W6C3+q2P92nKuAl9OmbnIFUt8B6eAZZmw+B6eANVkwO92nKuAl9OmbjLJ:E+v4HAahFUt8iZ/+iNV5LHAaSJ
                        MD5:D8FD6DA1D01D08939EA863EE03D2401D
                        SHA1:58A49F70D8C7555C3850B53D2CE6EE7FA671DC51
                        SHA-256:01EF428FE30DE3DC4AB6D5E7DCD8F4A692C747419EF78B1D66E572448037A355
                        SHA-512:687A57D60CE00CD8FFDF2A9600D6CCFEE6BFACB33B6A2CF96779A21511D1916A30C3513D7E23F7CBAA4E892E5936B3C5E4AEDEEDB0A20CEFF48CFACDE5D554C1
                        Malicious:false
                        Reputation:low
                        Preview:2024/10/02-11:33:32.400 94c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/02-11:33:32.403 94c Recovering log #3.2024/10/02-11:33:32.403 94c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):338
                        Entropy (8bit):5.126835753036727
                        Encrypted:false
                        SSDEEP:6:W6zIq2P92nKuAl9Ombzo2jMGIFUt8B6/vZZmw+B6AFkwO92nKuAl9Ombzo2jMmLJ:BIv4HAa8uFUt8k/+r5LHAa8RJ
                        MD5:689E75E9832B342AB1E3FFC56A3E6820
                        SHA1:DBE97310982387967D3279501509742D2799218D
                        SHA-256:B0C6BB2494D6E7408A51FA79C6E9E0CB43DC7B1CBAB37AD0707665C93AE99F2E
                        SHA-512:470FFFC1030F6AADAD8A457A54BCA57EB6F7E090D7C8A799EACCC9F6394C122367471899C1E2F5C1C03BEDEA92257884FA9021FCC738C949688FCFA3F8F4E34C
                        Malicious:false
                        Reputation:low
                        Preview:2024/10/02-11:33:32.458 1c40 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/02-11:33:32.461 1c40 Recovering log #3.2024/10/02-11:33:32.462 1c40 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):338
                        Entropy (8bit):5.126835753036727
                        Encrypted:false
                        SSDEEP:6:W6zIq2P92nKuAl9Ombzo2jMGIFUt8B6/vZZmw+B6AFkwO92nKuAl9Ombzo2jMmLJ:BIv4HAa8uFUt8k/+r5LHAa8RJ
                        MD5:689E75E9832B342AB1E3FFC56A3E6820
                        SHA1:DBE97310982387967D3279501509742D2799218D
                        SHA-256:B0C6BB2494D6E7408A51FA79C6E9E0CB43DC7B1CBAB37AD0707665C93AE99F2E
                        SHA-512:470FFFC1030F6AADAD8A457A54BCA57EB6F7E090D7C8A799EACCC9F6394C122367471899C1E2F5C1C03BEDEA92257884FA9021FCC738C949688FCFA3F8F4E34C
                        Malicious:false
                        Reputation:low
                        Preview:2024/10/02-11:33:32.458 1c40 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/02-11:33:32.461 1c40 Recovering log #3.2024/10/02-11:33:32.462 1c40 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1ded9e02-845e-4d3f-be2b-db1aa5314bfd.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:JSON data
                        Category:modified
                        Size (bytes):508
                        Entropy (8bit):5.0593484360334875
                        Encrypted:false
                        SSDEEP:12:YH/um3RA8sq/sBdOg2Hj2caq3QYiubxnP7E4TfF+:Y2sRdsldMH13QYhbxP7np+
                        MD5:55D63ABA9062B03570C6709A9C012392
                        SHA1:F0D88CDB182C1CB86CB2E35505E627592990A848
                        SHA-256:AD1FAD4F63AE32D4A0535ABD5D0241EE6F6D9B0FA241D0D683EF1FCFA2AFBC15
                        SHA-512:BE5BCC03F8DCBBBC553BA75C9ED8B51C7CD983E399154538CADAD43FED5C4E88EF5F8B49DF71FEF6140E8B50A2C7DCB1F4AA23B8B4563811019C494C05EE2E85
                        Malicious:false
                        Reputation:low
                        Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372443224902768","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":127604},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):508
                        Entropy (8bit):5.047195090775108
                        Encrypted:false
                        SSDEEP:12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4TfF+:Y2sRdsgTAdMHW3QYhbxP7np+
                        MD5:70321A46A77A3C2465E2F031754B3E06
                        SHA1:5E7E713285D36F12ACFC68A34D8A34FD33C96B34
                        SHA-256:344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
                        SHA-512:E885342B270FE3D538F17F8F80B9ED061B30EE55624177BD81F5C65C033160D71559D60872BC0F99C0C93FAE29F9D09FD5042B68D83CD538154D1335BAC8205D
                        Malicious:false
                        Reputation:moderate, very likely benign file
                        Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF61a3ba.TMP (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):508
                        Entropy (8bit):5.047195090775108
                        Encrypted:false
                        SSDEEP:12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4TfF+:Y2sRdsgTAdMHW3QYhbxP7np+
                        MD5:70321A46A77A3C2465E2F031754B3E06
                        SHA1:5E7E713285D36F12ACFC68A34D8A34FD33C96B34
                        SHA-256:344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
                        SHA-512:E885342B270FE3D538F17F8F80B9ED061B30EE55624177BD81F5C65C033160D71559D60872BC0F99C0C93FAE29F9D09FD5042B68D83CD538154D1335BAC8205D
                        Malicious:false
                        Reputation:moderate, very likely benign file
                        Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cab57eb1-b1f4-4918-895a-8f128a86844e.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):508
                        Entropy (8bit):5.047195090775108
                        Encrypted:false
                        SSDEEP:12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4TfF+:Y2sRdsgTAdMHW3QYhbxP7np+
                        MD5:70321A46A77A3C2465E2F031754B3E06
                        SHA1:5E7E713285D36F12ACFC68A34D8A34FD33C96B34
                        SHA-256:344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
                        SHA-512:E885342B270FE3D538F17F8F80B9ED061B30EE55624177BD81F5C65C033160D71559D60872BC0F99C0C93FAE29F9D09FD5042B68D83CD538154D1335BAC8205D
                        Malicious:false
                        Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):4509
                        Entropy (8bit):5.2334214679829305
                        Encrypted:false
                        SSDEEP:96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLU423l3tb28jZ:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLi
                        MD5:E9DBC33297689064330A90EEBE0DF5C6
                        SHA1:C126FCE080647A9C6631C6E8C7491B30A4164CCD
                        SHA-256:AC89C86F7F2E5B86A946C761BB54E23E21CCB82A25F5A67891E0F367C5745F2E
                        SHA-512:BFF902DD283B1AE886BEF740D6C929D5A30DF8B34ACA61C5B1A0EC560EF92CE04EF07C6A4699FA763A079E249DEC6CD3AEB13F7AACC22133F069911226EC3126
                        Malicious:false
                        Preview:*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):326
                        Entropy (8bit):5.0845380684105645
                        Encrypted:false
                        SSDEEP:6:W6EL6q2P92nKuAl9OmbzNMxIFUt8B6EahZmw+B6EjxzkwO92nKuAl9OmbzNMFLJ:uWv4HAa8jFUt8bah/+bjx5LHAa84J
                        MD5:C89AA092ECFB2591DACA3A4EE600EBCE
                        SHA1:341F1A8B07E99F86CD7E35F1A92842B793C0D5F7
                        SHA-256:14F283403768F0541EB7C39FD228EF64A9E9E04FA080DC66D15D6BF43AB6CDC2
                        SHA-512:7710EFFC08BAFEA3C508D60C87A9457CF4D78F9281CD090F4CE118CF7A5540B28A90442C2804C693CFF06B41D7C53999A2A057FA3FD3618DF8FA06F20D4A7D61
                        Malicious:false
                        Preview:2024/10/02-11:33:33.124 1c40 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/02-11:33:33.127 1c40 Recovering log #3.2024/10/02-11:33:33.133 1c40 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):326
                        Entropy (8bit):5.0845380684105645
                        Encrypted:false
                        SSDEEP:6:W6EL6q2P92nKuAl9OmbzNMxIFUt8B6EahZmw+B6EjxzkwO92nKuAl9OmbzNMFLJ:uWv4HAa8jFUt8bah/+bjx5LHAa84J
                        MD5:C89AA092ECFB2591DACA3A4EE600EBCE
                        SHA1:341F1A8B07E99F86CD7E35F1A92842B793C0D5F7
                        SHA-256:14F283403768F0541EB7C39FD228EF64A9E9E04FA080DC66D15D6BF43AB6CDC2
                        SHA-512:7710EFFC08BAFEA3C508D60C87A9457CF4D78F9281CD090F4CE118CF7A5540B28A90442C2804C693CFF06B41D7C53999A2A057FA3FD3618DF8FA06F20D4A7D61
                        Malicious:false
                        Preview:2024/10/02-11:33:33.124 1c40 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/02-11:33:33.127 1c40 Recovering log #3.2024/10/02-11:33:33.133 1c40 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241002153336Z-161.bmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
                        Category:dropped
                        Size (bytes):71190
                        Entropy (8bit):1.6810282003340726
                        Encrypted:false
                        SSDEEP:192:EKTFiEiqbVLwIgc0F5xxejLepVOb7+cQH:VLWJBpc/9QH
                        MD5:347D88AEB7B5324FA50C5784E6A8B4F2
                        SHA1:0CCE3B42760A7D5321EE93D4EB55A73CD18AB647
                        SHA-256:D09AEE97D356B1C6A5FBA75855BB3110D9F4985575C9251B852C386B7CA1FCA0
                        SHA-512:C7114D14DF51AF81CE1273B23C265C97BBF17DB94DE51FB99680035EB661079267ABCB2DE4DED97DB95338A367B4902AC3C4E3AB11ECB3E824F1EEF3FC0027AB
                        Malicious:false
                        Preview:BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:Certificate, Version=3
                        Category:dropped
                        Size (bytes):1391
                        Entropy (8bit):7.705940075877404
                        Encrypted:false
                        SSDEEP:24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
                        MD5:0CD2F9E0DA1773E9ED864DA5E370E74E
                        SHA1:CABD2A79A1076A31F21D253635CB039D4329A5E8
                        SHA-256:96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
                        SHA-512:3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
                        Malicious:false
                        Preview:0..k0..S............@.YDc.c...0...*.H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0...*.H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I.....*.A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.|C.t..t.....0.[q6....00\H..;..}`...).........A.......|.;F.H*..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..|o..;.....'...}~.."......

                        C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                        Category:dropped
                        Size (bytes):71954
                        Entropy (8bit):7.996617769952133
                        Encrypted:true
                        SSDEEP:1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
                        MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
                        SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
                        SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
                        SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
                        Malicious:false
                        Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

                        C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):192
                        Entropy (8bit):2.7569015731729736
                        Encrypted:false
                        SSDEEP:3:kkFkl5FSFjllXfllXlE/HT8kmfh1NNX8RolJuRdxLlGB9lQRYwpDdt:kK9lIT8R7NMa8RdWBwRd
                        MD5:640CE885567FFC4F3C7F5E3922EA9669
                        SHA1:206E21039C051BA88C1C037F7CB8E4698F97CE6B
                        SHA-256:EF515BEFA7B4BD81E218E5DF27405EB83C0CF4455FFF69E7D8D0FA372860DD71
                        SHA-512:CC44A87881AEB9E3ACDC569C398F5803A7A15421EBB80893AD6B1DDCD206580A302348857670686CA5E8ECA5F9AF9F43390F65ECA12C1FF878B5ED9C10F98DEC
                        Malicious:false
                        Preview:p...... ...........w....(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

                        C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:data
                        Category:modified
                        Size (bytes):328
                        Entropy (8bit):3.150184159866505
                        Encrypted:false
                        SSDEEP:6:kKth/99UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:MDnLNkPlE99SNxAhUe/3
                        MD5:0480E19D2238A104889E8B496AEEC314
                        SHA1:E8A134FB78E4926D0679830416ACB265F74A0174
                        SHA-256:AB1F895AE6DE83F66C123EA82A674477A13C9C28EB51AC0A8B9F4ABF1DF5838B
                        SHA-512:17232B07557BEB4D51EB9E318C4D8D6D640E81CF3CBBED07F4FC81E73831B08AAFE34799CF49BFB8385AA6B09C7501C6E9DE0BFD86D0079C5F3B11E3394BD5D2
                        Malicious:false
                        Preview:p...... ........6.`.....(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3924

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:PostScript document text
                        Category:dropped
                        Size (bytes):185099
                        Entropy (8bit):5.182478651346149
                        Encrypted:false
                        SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                        MD5:94185C5850C26B3C6FC24ABC385CDA58
                        SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                        SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                        SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                        Malicious:false
                        Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:PostScript document text
                        Category:dropped
                        Size (bytes):185099
                        Entropy (8bit):5.182478651346149
                        Encrypted:false
                        SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                        MD5:94185C5850C26B3C6FC24ABC385CDA58
                        SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                        SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                        SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                        Malicious:false
                        Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):227002
                        Entropy (8bit):3.392780893644728
                        Encrypted:false
                        SSDEEP:1536:WKPC4iyzDtrh1cK3XEivK7VK/3AYvYwgF/rRoL+sn:DPCaJ/3AYvYwglFoL+sn
                        MD5:87EDBEE38F56C20298F25D5D3D4D1B5C
                        SHA1:7F904E9615AC3186A87472EF366DD8202855B0B7
                        SHA-256:A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
                        SHA-512:BBEBC1FCD5BC9AE042DD5782425BA8C47BF3EAC283B2487FC4E3FF6BF8101306DAB081E5135594165D4DC1AC120FF125AADBC5B3FFE7C646183C04DF77865E0D
                        Malicious:false
                        Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):295
                        Entropy (8bit):5.329956283260954
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXrSEH6DJQ+x+FIbRI6XVW7+0YGVVKoAvJM3g98kUwPeUkwRe9:YvXKXrSEaDJQpYpW7F5GMbLUkee9
                        MD5:4793335010F86F9B14C70CA999F38664
                        SHA1:3659CC60D532A70F3A65BE0917BFFA773F212A9F
                        SHA-256:25AC5C016D79322C855B4B5D640B03E51705F63E035C384CF1081F9CD810D6BF
                        SHA-512:F032EB623186AB40D1264074DA86FA2C9426E7063166988B3B7162DC2D31F48DAE1DB80CB0F58EE72FC2037D5D0E4433E332E810C9EA2E75078A1077193ADF66
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"1d870511-7109-4ddb-be82-c6f10aa05319","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1728058809220,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):294
                        Entropy (8bit):5.270311757742123
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXrSEH6DJQ+x+FIbRI6XVW7+0YGVVKoAvJfBoTfXpnrPeUkwRe9:YvXKXrSEaDJQpYpW7F5GWTfXcUkee9
                        MD5:C929DDBFC4FB2A2150390F6FA0ECAAEA
                        SHA1:55A9D836728FF45CE10A507D30765282BC6695F6
                        SHA-256:719E461A49971AF38334CA5D4A4E3511C1B69CC46DCB5DCB1AA00B87312F0ABB
                        SHA-512:41F49E278BFD32E068EF4CF9E3A7E308227CA6768235ABC2C8CF60E1EB50DD5869DCDCF0F56BB2F79565BB3F4611C14BBF058962AD517583A488CC6C92AC75BC
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"1d870511-7109-4ddb-be82-c6f10aa05319","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1728058809220,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):294
                        Entropy (8bit):5.2490179719690016
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXrSEH6DJQ+x+FIbRI6XVW7+0YGVVKoAvJfBD2G6UpnrPeUkwRe9:YvXKXrSEaDJQpYpW7F5GR22cUkee9
                        MD5:0D86D0734722734EA0796C2B1EB2EA0D
                        SHA1:03118B871E969D7982A029D13A79327D6B8624C8
                        SHA-256:C3B9A9B17A148E168D6C1C0BD409B8727B081E58C383779599B32854C84707FC
                        SHA-512:D13749B871D4ED58ACC4367FF258F192DBD7E869FB64030009709D6E5778DA25ACFB614F9D7A8D89C4A737F832272BEF7334FCEFE5ECAE47127AED49A412370B
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"1d870511-7109-4ddb-be82-c6f10aa05319","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1728058809220,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):285
                        Entropy (8bit):5.307676981860286
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXrSEH6DJQ+x+FIbRI6XVW7+0YGVVKoAvJfPmwrPeUkwRe9:YvXKXrSEaDJQpYpW7F5GH56Ukee9
                        MD5:3212252CBECE179C255E7977355E9069
                        SHA1:06B3B987AD33456BF70EBB34B24528F024861FBD
                        SHA-256:D5E1DB66EE493FF529B4A6D3A8A31EF4FF63F7F4C5EDB23CA6EF6991F5215385
                        SHA-512:28BBCB0B980AD835B0F930C3502238EA05D9E762D911551E3CD84D96ABA16EF44458D97C8E2824E68EF08151F3543A0439664F55CDD0BDFB6D130E7AFC26E50C
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"1d870511-7109-4ddb-be82-c6f10aa05319","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1728058809220,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):1063
                        Entropy (8bit):5.663894704110167
                        Encrypted:false
                        SSDEEP:24:Yv6XhWJQKiApLgEFqciGennl0RCmK8czOCY4w2oE:YvoWJkAhgLtaAh8cvYvW
                        MD5:60EDA5A97D0031DC093486FBD64F82E4
                        SHA1:F15DE37BC46B49796A65C906B9D8E1BC7A81F30D
                        SHA-256:E19F84A7CD64B1CD9E75F15AC5E4A9FF5279A6EC705049CD8AF756E05D944897
                        SHA-512:29E73CF8523ED6E3AA7BD7A4B19EDD95C4D616A6A6162988E1C655EECF09B599560BE4902208717DFFAE78B8F2715BB2589E96C7D06D7C818BA9AB09D5017D63
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"1d870511-7109-4ddb-be82-c6f10aa05319","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1728058809220,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_2","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"afb9c2a3-eaf4-41f9-9d73-768e72f72282","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQgZmlsZXMgdG8gYW5kIGZyb20gUERGXG53aXRob3V0IGxpbWl0cy4ifSwidGNhdElkIjpudWxsfQ==","dataType":"application\/json","encodingSc

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):1050
                        Entropy (8bit):5.648853878952549
                        Encrypted:false
                        SSDEEP:24:Yv6XhWJQKiSVLgEF0c7sbnl0RCmK8czOCYHflEpwiVoE:YvoWJkSFg6sGAh8cvYHWpwY
                        MD5:F9029B8C608503B940E79225D9486DDB
                        SHA1:BC794ADDD2AFD3A3753C4D106ED1E2729A243450
                        SHA-256:D579E4A5E4A7F9B41ABFF5937B9189F0EF8D3819B83DEEEA69640FE2C14F5423
                        SHA-512:18A0D41B71DE62C8E1EF2BEA3DC35B490090A5F13716E05F3AD9D9FEE5AAF8A5D555936AD981FFB2AA81EB971F1E6C052431A37BB593E1B8DC32863881B4435B
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"1d870511-7109-4ddb-be82-c6f10aa05319","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1728058809220,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_0","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"0924134e-3c59-4f53-b731-add558c56fec","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuZm9ybXMgJiBhZ3JlZW1lbnRzLiJ9LCJ0Y2F0SWQiOm51bGx9","dataType":"application\/json","encodingScheme":true},"

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):292
                        Entropy (8bit):5.254390329690633
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXrSEH6DJQ+x+FIbRI6XVW7+0YGVVKoAvJfQ1rPeUkwRe9:YvXKXrSEaDJQpYpW7F5GY16Ukee9
                        MD5:A4A1398695EDBCE7C4B34E6655E304B2
                        SHA1:798F1EA9EC18E4445E7146469364382B203A7F70
                        SHA-256:2815D37882970A4395CAE27823D2ED63246EDB875D9BCB3E29DD396742CC6478
                        SHA-512:E1D2CE1AA6B7337DB23481AC9EAFC8F774351B487157E7110AFA5691BC318B6BAAAF429391EE403B0111791B033F235DFFEA869E6A626BBA077881CB673EF4D9
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"1d870511-7109-4ddb-be82-c6f10aa05319","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1728058809220,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):1038
                        Entropy (8bit):5.644697229868642
                        Encrypted:false
                        SSDEEP:24:Yv6XhWJQKi/2LgEF7cciAXs0nl0RCmK8czOCAPtciBoE:YvoWJk/ogc8hAh8cvA7
                        MD5:E94A83DE76EFC3236576AD6C35549F47
                        SHA1:5982F8DFF278F2BF9AE63344C21B7BC4FDB58126
                        SHA-256:CE3AEDAB3295FCBF506651B9A1B83A7A7AFD777763903C706B233F6A1218D8C3
                        SHA-512:BE6900158CE70962BEC3D5ADCC980BCDB53BCDA159238D5522AB6796B4688D154A3EDEC44E2D309717CF9EEB8D37DA3E600251D8AA96FD163E02CFB7B97B7318
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"1d870511-7109-4ddb-be82-c6f10aa05319","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1728058809220,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_1","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"49d2f713-7aa9-44db-aa50-0a7a22add459","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVkaXQgdGV4dCwgaW1hZ2VzLCBwYWdlcywgYW5kIG1vcmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme":true},"endDTS":1744

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):1164
                        Entropy (8bit):5.694520197486624
                        Encrypted:false
                        SSDEEP:24:Yv6XhWJQKiTKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK5oE:YvoWJkTEgqprtrS5OZjSlwTmAfSKP
                        MD5:AA9C73398E61A436CF0DF64C1B8A2AA1
                        SHA1:41058D0E298EB2916BD2674A2B8B8796BD302D5E
                        SHA-256:3E86A36E8E662796381D8DD32563607ACBE1504F11B9FE8E8D7869B422DC1709
                        SHA-512:ED69FBA38FA751BCC86305E89076C9EDA69D3541015AC7D260506517E9AA8AAB468FBFD9DEC76ED393799A3F0587E697DCF8166DDB411B52C5E5C4D762E682AB
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"1d870511-7109-4ddb-be82-c6f10aa05319","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1728058809220,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):289
                        Entropy (8bit):5.260405504506839
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXrSEH6DJQ+x+FIbRI6XVW7+0YGVVKoAvJfYdPeUkwRe9:YvXKXrSEaDJQpYpW7F5Gg8Ukee9
                        MD5:78B3855736D467FD88802F100A5C554E
                        SHA1:63E99BC80EF138ED69F78562F5606CAC5CD0F99F
                        SHA-256:51DFCB9EE00AEBA11AE0893A94A7120CABC35D8E27FF857014BDAC0EB34C0154
                        SHA-512:83C34D443525D3D706440339177048C16E20E75D84348A0251D10BEA8B07B5FA4C97837F46661DCB201B095E5CD15C03E0044633144D2AE415002DA532DCED34
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"1d870511-7109-4ddb-be82-c6f10aa05319","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1728058809220,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):1395
                        Entropy (8bit):5.769317172490375
                        Encrypted:false
                        SSDEEP:24:Yv6XhWJQKiurLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNQE:YvoWJkuHgDv3W2aYQfgB5OUupHrQ9FJP
                        MD5:E579CFDD0ECBE6D0E51C97E36B852593
                        SHA1:5610120E531D9299A57A648ACBDCB0FFC9C1DF8E
                        SHA-256:21EB30A04C01C22082837307A60830277B7D2AF33B1CABAE5A8D7C14DC02AD37
                        SHA-512:4625C26C46F0D0678BDE58933089374F7A3B6D5EFA53D95EB09ECA4092727817E720F79DDAB9DD1EC9D6854DD4578FBC564E03438A93529741E82EE3765AE811
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"1d870511-7109-4ddb-be82-c6f10aa05319","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1728058809220,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):291
                        Entropy (8bit):5.244224729297494
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXrSEH6DJQ+x+FIbRI6XVW7+0YGVVKoAvJfbPtdPeUkwRe9:YvXKXrSEaDJQpYpW7F5GDV8Ukee9
                        MD5:AFAB2A96C6B5F8A27AFC11E5A9977A5B
                        SHA1:6B1729D013478ED95ECA9F21A1657F4E40C90759
                        SHA-256:04A57EDA61041591E7EFC1413FB9FDBE3F636B2B717E99E62813DA8FF703EAD2
                        SHA-512:BD5DFDC1916A8115044F17D7D92DFF28332B6FF928CB1E0515E4CE6121DC72987864F8C0F14920091CE9516703FD9EAD9072F8F4F98874561192A47798A583E5
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"1d870511-7109-4ddb-be82-c6f10aa05319","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1728058809220,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):287
                        Entropy (8bit):5.245349901634839
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXrSEH6DJQ+x+FIbRI6XVW7+0YGVVKoAvJf21rPeUkwRe9:YvXKXrSEaDJQpYpW7F5G+16Ukee9
                        MD5:DD108361BAE6F7899BAE1185BDF59BB1
                        SHA1:17ABE48DFFE0322D2A83723FAFB38A4FE65324A6
                        SHA-256:A017BCC87EACE7306A95FE1C4D9E28F29CC134C77EEFA03035C775E46F58BDB4
                        SHA-512:851E8083FE1BCB93D9CAC9DC9EABDC2AC4A8F8F8A77007F11EDC0E8E3FD425CAC312788CA7F625168D719D61EB7A2F980E8A93ED9CEF5EFEF578C5F0B2CE13B8
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"1d870511-7109-4ddb-be82-c6f10aa05319","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1728058809220,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):1058
                        Entropy (8bit):5.653324423211665
                        Encrypted:false
                        SSDEEP:24:Yv6XhWJQKikamXayLgEFRcONaqnl0RCmK8czOC+w2E+tg8BoE:YvoWJkiBguOAh8cv+NK+
                        MD5:39421B1A24E96A26F0DF16C98FA1C70A
                        SHA1:130AF4D5332714A292340CDC06A5365FE0EF317C
                        SHA-256:A171A985F95FE294B7877A68E1B3D8864CB4B8582D41B3FF44C66DC298C75C46
                        SHA-512:01B96D7EB9425B264546BE8E779A470024B648A18E79A6BE66E7E72A24388FA110A717074A9724D2B669E4A9B530D4E82BCF179F8B15048962D5A397E1DF17A7
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"1d870511-7109-4ddb-be82-c6f10aa05319","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1728058809220,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_3","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"ece07729-7db6-4f20-9f8d-7976ad373049","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IlNlbmQgZG9jdW1lbnRzICYgZm9ybXNcbmZvciBmYXN0IGUtc2lnbmluZyBvbmxpbmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme"

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):286
                        Entropy (8bit):5.218684146049753
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXrSEH6DJQ+x+FIbRI6XVW7+0YGVVKoAvJfshHHrPeUkwRe9:YvXKXrSEaDJQpYpW7F5GUUUkee9
                        MD5:4D3343A6F5805235DCC83E42849210F0
                        SHA1:4DF20B6B4F8247CDAE81E698CAA223A842BD6627
                        SHA-256:770603F26ADF2F07A624891FAF8A13BEE1BD1AA64CA1477595CF133B7D5650DD
                        SHA-512:B491E360A2DB83F524F042FBCE3E4EB34974DC0642A12C9CA30DBA81F991CBD0FE8BE9DA59F0988DD140ABD3A8A1159E505E110955399C95BA007B876E0491EC
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"1d870511-7109-4ddb-be82-c6f10aa05319","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1728058809220,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):782
                        Entropy (8bit):5.355297603122185
                        Encrypted:false
                        SSDEEP:12:YvXKXrSEaDJQpYpW7F5GTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWME:Yv6XhWJQKir168CgEXX5kcIfANhLE
                        MD5:58FFA1580B67D802D1D0B22E1532E85C
                        SHA1:DA1F6E5022B32440A9A0516B3B4E33D5C81C22EE
                        SHA-256:23C6611C96262EF51FB56B92DF38D2EFBBB15CF578F0CE4361DAF14B78449A5B
                        SHA-512:F20A81FD5A29FCAF66CA052CAA2315C716B1705BEF0A13E19943C4E9218DA3834F435147449B33923DE4E7B447B0612CCE82B3D80A6A15A7BAA3EB6EA9E80EFB
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"1d870511-7109-4ddb-be82-c6f10aa05319","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1728058809220,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1727883219255}}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):4
                        Entropy (8bit):0.8112781244591328
                        Encrypted:false
                        SSDEEP:3:e:e
                        MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                        SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                        SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                        SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                        Malicious:false
                        Preview:....

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):2818
                        Entropy (8bit):5.118981348132025
                        Encrypted:false
                        SSDEEP:24:YhZQOMKQDaXayA8PZ4CC6j8c7LEEK72NX0Qjmj0SI84AI2N12LSiwy75/pdP9pug:Y33hVNYc7wX7CZ42hU1Mwy7tpdP9F
                        MD5:CCAD07A7DD942BFCF90FA57ADF54F277
                        SHA1:1771CF9B624B4CED8B2DE11BC66DD02BFC3160EF
                        SHA-256:7CB5E2EB132C06178002B04EAE929F1B1271448CC245DBB98DEEFF490A356309
                        SHA-512:B4E0E7C73F775E141FB565828E04370CF241327257FB5177ABA3A5F9D582F3A4DB1EA919D557034D6AA056D38DF402A68EF58A27B2CDA26EBCE2435C41F29BAC
                        Malicious:false
                        Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"5b9cd140da48c6d8aa1199eb25f8dee9","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1050,"ts":1727883218000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d5dc82da4ae793896d65d9ab22854f70","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1727883218000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"808feac761694f4f04ecdea67bccbe7a","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1058,"ts":1727883218000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"8e3dd17bc78e5367477521b11fb500ec","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1063,"ts":1727883218000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"c415fdbac84f109ff07d110c12cbf748","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1038,"ts":1727883218000},{"id":"Edit_InApp_Aug2020","info":{"dg":"a750a119c6de5739c28aea8d0dda158e","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":17

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
                        Category:dropped
                        Size (bytes):12288
                        Entropy (8bit):0.9846441653305193
                        Encrypted:false
                        SSDEEP:24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpQ+Mf4zJwtNBwtNbRZ6bRZ4/+MfF:TVl2GL7ms6ggOVptzutYtp6Pg
                        MD5:962C378E3360CBDB89EBF9DE55C8EBAF
                        SHA1:2765E8F3C8C6899654C63544179DBA4AD7475A5D
                        SHA-256:AECE846B1BACDC1282EDB79143783FD2A59615EBA6C6E3FB596F5A99609C54AE
                        SHA-512:44CA762F379E03ACBA7E4F1405C5DC73876367C401329451272F38ED6EA4ED7008B64FAF93F86DFB73CC9C4004D23FA75C7AD10E8D5B4B01567B1C0303202BC3
                        Malicious:false
                        Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:SQLite Rollback Journal
                        Category:dropped
                        Size (bytes):8720
                        Entropy (8bit):1.3393163265041301
                        Encrypted:false
                        SSDEEP:24:7+ttAD1RZKHs/Ds/SpQ+MfPzJwtNBwtNbRZ6bRZWf1RZKlqLBx/XYKQvGJF7ursX:7MtGgOVp2zutYtp6PMcqll2GL7msX
                        MD5:B8EED175FD82241BB509759E63CEEDD7
                        SHA1:8300B8CB4738CE538A62CCE81F5CA60FB064EC7A
                        SHA-256:B3184B096ACA4A0CF4080A1712EE530537F02653B6212FEF22D78FA9DA52C6B0
                        SHA-512:77872B0EC9E7051FD6C0A4E52A9DCBDAF4500B1F4B27CDAB58173B0DE3B174B7BA816350217A75197800C402B16B640024B70A552087E417EA3AFDCFFD827582
                        Malicious:false
                        Preview:.... .c.....^.|.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Temp\MSI17121.LOG

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):246
                        Entropy (8bit):3.501595078528367
                        Encrypted:false
                        SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8gjqceCH:Qw946cPbiOxDlbYnuRKL9zH
                        MD5:164B809EC4735C0B015F3CC9515889DB
                        SHA1:620344A305390E1BDF066722DAF97A4EBE0F5885
                        SHA-256:5C86EACED917456F8D218A2556845211DDC663214AB42978159FA4473D22504B
                        SHA-512:EFDEFEA0878BEBB087711AFBAEED24C93A6F417E7342E985ABCBBFB364B33FDA5B95951941A48EACA8E763995A1B70B0E93DE95431AD090913AEA78C19FE5571
                        Malicious:false
                        Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .0.2./.1.0./.2.0.2.4. . .1.1.:.3.3.:.4.2. .=.=.=.....

                        C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91lqvsya_c9jk18_310.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:PDF document, version 1.6, 0 pages
                        Category:dropped
                        Size (bytes):358
                        Entropy (8bit):5.081139654149842
                        Encrypted:false
                        SSDEEP:6:IngVMrexJzJT0y9VEQIFVmb/eu2g/86S1kxROOtiXI5fXIjCSyAAO:IngVMre9T0HQIDmy9g06JXoI5PIjlX
                        MD5:04BF659A1D0AB26A23B7733C8153DEF2
                        SHA1:49C91CCEA355FC2857E5F81E1B84808072C0FA16
                        SHA-256:FE542B914D74A3BAA9FC8DBE9E4E5D03A7528267708D0D52A113D5DDCE505D78
                        SHA-512:46A4B6873DF4E569AC32EADDF72BED8B7888A08F87D24EACB2185594D3E6B8C220B1726F2046BCA1509C39A32C5978166B793A4D593B857618967C622106EC9D
                        Malicious:false
                        Preview:%PDF-1.6.%......1 0 obj.<</Pages 2 0 R/Type/Catalog>>.endobj.2 0 obj.<</Count 0/Kids[]/Type/Pages>>.endobj.3 0 obj.<<>>.endobj.xref..0 4..0000000000 65535 f..0000000016 00000 n..0000000061 00000 n..0000000107 00000 n..trailer..<</Size 4/Root 1 0 R/Info 3 0 R/ID[<EEEB85415A57B64783E68F7A7812C63C><EEEB85415A57B64783E68F7A7812C63C>]>>..startxref..127..%%EOF..

                        C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-02 11-33-34-473.log

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:ASCII text, with very long lines (393)
                        Category:dropped
                        Size (bytes):16525
                        Entropy (8bit):5.376360055978702
                        Encrypted:false
                        SSDEEP:384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
                        MD5:1336667A75083BF81E2632FABAA88B67
                        SHA1:46E40800B27D95DAED0DBB830E0D0BA85C031D40
                        SHA-256:F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
                        SHA-512:D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
                        Malicious:false
                        Preview:SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

                        C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:ASCII text, with very long lines (393), with CRLF line terminators
                        Category:dropped
                        Size (bytes):15114
                        Entropy (8bit):5.310672142749323
                        Encrypted:false
                        SSDEEP:384:xdnIPVzVq7iAjxurf1u/TMdZn7au1Cmz1+HpzXm5ZFAvXFmA6T6aififX1fUFiCY:QLZ
                        MD5:77C225ECDE080C3B0E59E17C0CF6837E
                        SHA1:0BCAD5FA8BC860CD935DF502D8A91D11A329F98D
                        SHA-256:070EC8FEC734A5271C55BD5126F49ECA7302AB003CEFAF136EB53B94DEB1FF0A
                        SHA-512:A1838500CD3D336C834C9C316E772F44BBE122518ECCFB6EE8195E7992FC1CBA3201C4EACB4CEA931D1ED29BF80BE1FBA16DA5F64429191A4B8B137F829178B1
                        Malicious:false
                        Preview:SessionID=049efee3-9ae2-4aec-9187-bcee3cd8099f.1727883214511 Timestamp=2024-10-02T11:33:34:511-0400 ThreadID=1892 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=049efee3-9ae2-4aec-9187-bcee3cd8099f.1727883214511 Timestamp=2024-10-02T11:33:34:512-0400 ThreadID=1892 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=049efee3-9ae2-4aec-9187-bcee3cd8099f.1727883214511 Timestamp=2024-10-02T11:33:34:512-0400 ThreadID=1892 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=049efee3-9ae2-4aec-9187-bcee3cd8099f.1727883214511 Timestamp=2024-10-02T11:33:34:512-0400 ThreadID=1892 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=049efee3-9ae2-4aec-9187-bcee3cd8099f.1727883214511 Timestamp=2024-10-02T11:33:34:512-0400 ThreadID=1892 Component=ngl-lib_NglAppLib Description="SetConf

                        C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):29752
                        Entropy (8bit):5.393240620211457
                        Encrypted:false
                        SSDEEP:768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbf:b
                        MD5:B5EE236F2C9E2938A3E9814CE9DF31F5
                        SHA1:2B89CEC87A46F94918CF3133361EC46C69B6A3B4
                        SHA-256:D8FEAFFF5F7498AC7871790985587C6EECA7B72E34ED85E358FBB59D35E896D4
                        SHA-512:10BA2133037B14209C6F86BD8DD2B7CD2FD91FF6C38A32BA77B7F2F28C21D35D3BB9B7408EDC7DACCE7E9E0C67F4FF173054B1F793FB9A866D07027ECC2557BE
                        Malicious:false
                        Preview:04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

                        C:\Users\user\AppData\Local\Temp\acrocef_low\192b4b42-1dd6-4d80-a354-b4fc7c72dab8.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                        Category:dropped
                        Size (bytes):758601
                        Entropy (8bit):7.98639316555857
                        Encrypted:false
                        SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                        MD5:3A49135134665364308390AC398006F1
                        SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                        SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                        SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                        Malicious:false
                        Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                        C:\Users\user\AppData\Local\Temp\acrocef_low\2859a1c4-cb5b-4614-beb4-289634e77214.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                        Category:dropped
                        Size (bytes):386528
                        Entropy (8bit):7.9736851559892425
                        Encrypted:false
                        SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                        MD5:5C48B0AD2FEF800949466AE872E1F1E2
                        SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                        SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                        SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                        Malicious:false
                        Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                        C:\Users\user\AppData\Local\Temp\acrocef_low\7fecc860-051a-478c-aafa-b97c29776605.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                        Category:dropped
                        Size (bytes):1407294
                        Entropy (8bit):7.97605879016224
                        Encrypted:false
                        SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
                        MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
                        SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
                        SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
                        SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
                        Malicious:false
                        Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                        C:\Users\user\AppData\Local\Temp\acrocef_low\cf97a0f5-13f6-4b11-ab0b-b8b907dfc1fe.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
                        Category:dropped
                        Size (bytes):1419751
                        Entropy (8bit):7.976496077007677
                        Encrypted:false
                        SSDEEP:24576:/xA7owWLaGZDwYIGNPJxdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07c:JVwWLaGZDwZGV3mlind9i4ufFXpAXkrj
                        MD5:96E2EE6506759519A5E3E5E550F28388
                        SHA1:477522A699526F3EC2270AD0B3D3B8D6609F8BBB
                        SHA-256:D135FEF8231B87D1F758B3D31FC5467BC933321F7E8EACB316F933DBA36474D5
                        SHA-512:C84E93CB72ABC0742C44BF13608472EDD30BE64358C0DA350D9D54C0A88EC45931D48CE1DA823FC527E5134E7277B16AFE0521F2716C067A519FDD390DB315CC
                        Malicious:false
                        Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                        Static File Info

                        General

                        File type:PDF document, version 1.4, 8 pages
                        Entropy (8bit):7.440025788299381
                        TrID:
                        • Adobe Portable Document Format (5005/1) 100.00%
                        File name:RadProCalculatorUpdates.pdf
                        File size:36'080 bytes
                        MD5:17c5701f6fec5fc71dc4fe829345f88e
                        SHA1:56211a667d1e53a6c6e111a6e291b9a36b2c1b4f
                        SHA256:9d193d86b06a17eceeae4fce87eed0116ff01ad16ac2f05c8c7a4c09338ab78b
                        SHA512:365ec80685e5d30db073e757600ed1bc3bf883e3ec84cac86be0427f66306ee751d50b7897d7bca6cbedf9d0f1de3ff37e223c4a77e9a82ae26095d667171988
                        SSDEEP:768:20dtL64cdXSnYWjMRKMbRWNeJGTM6Cgn/1RaNB+O7:VF4b4wJGTM6j/1RkB+O7
                        TLSH:BDF28D14DAC6BC5CE0565787232A3102871EF37975C898823C7D0B974B81FB9EABBD94
                        File Content Preview:%PDF-1.4.%......37 0 obj.<</Linearized 1/L 36080/O 39/E 5887/N 8/T 35293/H [ 556 233]>>.endobj. ..xref..37 13..0000000016 00000 n..0000000789 00000 n..0000000870 00000 n..0000001000 00000 n..0000001107 00000 n..0000001486 00000 n..000000

                        File Icon

                        Icon Hash:62cc8caeb29e8ae0

                        Static PDF Info

                        General

                        Header:%PDF-1.4
                        Total Entropy:7.440026
                        Total Bytes:36080
                        Stream Entropy:7.700604
                        Stream Bytes:27449
                        Entropy outside Streams:5.112800
                        Bytes outside Streams:8631
                        Number of EOF found:2
                        Bytes after EOF:

                        Keywords Statistics

                        NameCount
                        obj49
                        endobj49
                        stream11
                        endstream11
                        xref2
                        trailer2
                        startxref2
                        /Page8
                        /Encrypt0
                        /ObjStm0
                        /URI0
                        /JS0
                        /JavaScript0
                        /AA0
                        /OpenAction0
                        /AcroForm0
                        /JBIG2Decode0
                        /RichMedia0
                        /Launch0
                        /EmbeddedFile0

                        Network Behavior

                        Network Port Distribution

                        TCP Packets

                        TimestampSource PortDest PortSource IPDest IP
                        Oct 2, 2024 17:33:45.758083105 CEST49721443192.168.2.5104.126.112.182
                        Oct 2, 2024 17:33:45.758120060 CEST44349721104.126.112.182192.168.2.5
                        Oct 2, 2024 17:33:45.758220911 CEST49721443192.168.2.5104.126.112.182
                        Oct 2, 2024 17:33:45.758387089 CEST49721443192.168.2.5104.126.112.182
                        Oct 2, 2024 17:33:45.758398056 CEST44349721104.126.112.182192.168.2.5
                        Oct 2, 2024 17:33:46.335241079 CEST44349721104.126.112.182192.168.2.5
                        Oct 2, 2024 17:33:46.335565090 CEST49721443192.168.2.5104.126.112.182
                        Oct 2, 2024 17:33:46.335593939 CEST44349721104.126.112.182192.168.2.5
                        Oct 2, 2024 17:33:46.337038994 CEST44349721104.126.112.182192.168.2.5
                        Oct 2, 2024 17:33:46.337091923 CEST49721443192.168.2.5104.126.112.182
                        Oct 2, 2024 17:33:46.363827944 CEST49721443192.168.2.5104.126.112.182
                        Oct 2, 2024 17:33:46.364026070 CEST44349721104.126.112.182192.168.2.5
                        Oct 2, 2024 17:33:46.364643097 CEST49721443192.168.2.5104.126.112.182
                        Oct 2, 2024 17:33:46.364654064 CEST44349721104.126.112.182192.168.2.5
                        Oct 2, 2024 17:33:46.411748886 CEST49721443192.168.2.5104.126.112.182
                        Oct 2, 2024 17:33:46.461494923 CEST44349721104.126.112.182192.168.2.5
                        Oct 2, 2024 17:33:46.461647987 CEST44349721104.126.112.182192.168.2.5
                        Oct 2, 2024 17:33:46.461714983 CEST49721443192.168.2.5104.126.112.182
                        Oct 2, 2024 17:33:46.462049961 CEST49721443192.168.2.5104.126.112.182
                        Oct 2, 2024 17:33:46.462073088 CEST44349721104.126.112.182192.168.2.5
                        Oct 2, 2024 17:33:46.462095976 CEST49721443192.168.2.5104.126.112.182
                        Oct 2, 2024 17:33:46.462116957 CEST49721443192.168.2.5104.126.112.182

                        UDP Packets

                        TimestampSource PortDest PortSource IPDest IP
                        Oct 2, 2024 17:33:45.319076061 CEST5733453192.168.2.51.1.1.1

                        DNS Queries

                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                        Oct 2, 2024 17:33:45.319076061 CEST192.168.2.51.1.1.10x55a5Standard query (0)x1.i.lencr.orgA (IP address)IN (0x0001)false

                        DNS Answers

                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                        Oct 2, 2024 17:33:45.326416969 CEST1.1.1.1192.168.2.50x55a5No error (0)x1.i.lencr.orgcrl.root-x1.letsencrypt.org.edgekey.netCNAME (Canonical name)IN (0x0001)false

                        HTTP Request Dependency Graph

                        • armmf.adobe.com

                        HTTPS Proxied Packets

                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                        0192.168.2.549721104.126.112.1824433116C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        TimestampBytes transferredDirectionData
                        2024-10-02 15:33:46 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
                        Host: armmf.adobe.com
                        Connection: keep-alive
                        Accept-Language: en-US,en;q=0.9
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
                        Sec-Fetch-Site: same-origin
                        Sec-Fetch-Mode: no-cors
                        Sec-Fetch-Dest: empty
                        Accept-Encoding: gzip, deflate, br
                        If-None-Match: "78-5faa31cce96da"
                        If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
                        2024-10-02 15:33:46 UTC198INHTTP/1.1 304 Not Modified
                        Content-Type: text/plain; charset=UTF-8
                        Last-Modified: Mon, 01 May 2023 15:02:33 GMT
                        ETag: "78-5faa31cce96da"
                        Date: Wed, 02 Oct 2024 15:33:46 GMT
                        Connection: close


                        Statistics

                        CPU Usage

                        Click to jump to process

                        Memory Usage

                        Click to jump to process

                        High Level Behavior Distribution

                        Click to dive into process behavior distribution

                        Behavior

                        Click to jump to process

                        System Behavior

                        General

                        Target ID:0
                        Start time:11:33:31
                        Start date:02/10/2024
                        Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        Wow64 process (32bit):false
                        Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\RadProCalculatorUpdates.pdf"
                        Imagebase:0x7ff686a00000
                        File size:5'641'176 bytes
                        MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high
                        Has exited:true

                        General

                        Target ID:2
                        Start time:11:33:31
                        Start date:02/10/2024
                        Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        Wow64 process (32bit):false
                        Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                        Imagebase:0x7ff6413e0000
                        File size:3'581'912 bytes
                        MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high
                        Has exited:true

                        General

                        Target ID:4
                        Start time:11:33:32
                        Start date:02/10/2024
                        Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        Wow64 process (32bit):false
                        Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1540,i,16482645188541234527,6887169318165601849,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                        Imagebase:0x7ff6413e0000
                        File size:3'581'912 bytes
                        MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high
                        Has exited:true

                        Disassembly

                        ⊘No disassembly