Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
W9po7Vc6bl.pdf

Overview

General Information

Sample name:W9po7Vc6bl.pdf
renamed because original name is a hash value
Original sample name:c4aa1f5bdaeb179eec2ee31af7d8308414fd79925b381e0618498bcc39520b3c.pdf
Analysis ID:1561659
MD5:9a9a5b518fde106213bc5c187eda6a7d
SHA1:b5d35a4c3aa2fdb10d893e154ad8a810d7c3f6fe
SHA256:c4aa1f5bdaeb179eec2ee31af7d8308414fd79925b381e0618498bcc39520b3c
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
IP address seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 7548 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\W9po7Vc6bl.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 7736 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 7912 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1672,i,12757576538781070382,9876864705769082499,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: W9po7Vc6bl.pdfReversingLabs: Detection: 15%
Source: W9po7Vc6bl.pdfVirustotal: Detection: 29%Perma Link
Source: global trafficDNS query: name: x1.i.lencr.org
Source: global trafficTCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global trafficTCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global trafficTCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global trafficTCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global trafficTCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global trafficTCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global trafficTCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global trafficTCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global trafficTCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global trafficTCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global trafficTCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global trafficTCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global trafficTCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global trafficTCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global trafficTCP traffic: 23.200.196.138:443 -> 192.168.2.4:49748
Source: global trafficTCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global trafficTCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global trafficTCP traffic: 23.200.196.138:443 -> 192.168.2.4:49748
Source: global trafficTCP traffic: 23.200.196.138:443 -> 192.168.2.4:49748
Source: global trafficTCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global trafficTCP traffic: 23.200.196.138:443 -> 192.168.2.4:49748
Source: global trafficTCP traffic: 23.200.196.138:443 -> 192.168.2.4:49748
Source: global trafficTCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global trafficTCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global trafficTCP traffic: 23.200.196.138:443 -> 192.168.2.4:49748
Source: global trafficTCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global trafficTCP traffic: 23.200.196.138:443 -> 192.168.2.4:49748
Source: global trafficTCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global trafficTCP traffic: 23.200.196.138:443 -> 192.168.2.4:49748
Source: global trafficTCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global trafficTCP traffic: 23.200.196.138:443 -> 192.168.2.4:49748
Source: global trafficTCP traffic: 23.200.196.138:443 -> 192.168.2.4:49748
Source: global trafficTCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global trafficTCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global trafficTCP traffic: 23.200.196.138:443 -> 192.168.2.4:49748
Source: global trafficTCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global trafficTCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: Joe Sandbox ViewIP Address: 23.200.196.138 23.200.196.138
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknownTCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknownTCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknownTCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknownTCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknownTCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknownTCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknownTCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknownTCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknownTCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknownTCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknownTCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknownTCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global trafficDNS traffic detected: DNS query: x1.i.lencr.org
Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.drString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.drString found in binary or memory: http://x1.i.lencr.org/
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: classification engineClassification label: mal48.winPDF@14/53@1/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journalJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-23 21-40-55-345.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: W9po7Vc6bl.pdfReversingLabs: Detection: 15%
Source: W9po7Vc6bl.pdfVirustotal: Detection: 29%
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\W9po7Vc6bl.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1672,i,12757576538781070382,9876864705769082499,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1672,i,12757576538781070382,9876864705769082499,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: W9po7Vc6bl.pdfInitial sample: PDF keyword /JS count = 0
Source: W9po7Vc6bl.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: W9po7Vc6bl.pdfInitial sample: PDF keyword stream count = 22
Source: W9po7Vc6bl.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts3
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media2
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive13
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1561659 Sample: W9po7Vc6bl.pdf Startdate: 24/11/2024 Architecture: WINDOWS Score: 48 15 x1.i.lencr.org 2->15 19 Multi AV Scanner detection for submitted file 2->19 8 Acrobat.exe 20 77 2->8         started        signatures3 process4 process5 10 AcroCEF.exe 107 8->10         started        process6 12 AcroCEF.exe 4 10->12         started        dnsIp7 17 23.200.196.138, 443, 49748 NOS_COMUNICACOESPT United States 12->17

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
W9po7Vc6bl.pdf16%ReversingLabsDocument-PDF.Trojan.Heuristic
W9po7Vc6bl.pdf30%VirustotalBrowse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
x1.i.lencr.org
unknown
unknownfalse
    		high

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://x1.i.lencr.org/2D85F72862B55C4EADD9E66E06947F3D0.1.drfalse
      		high

      World Map of Contacted IPs

      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs

      Public IPs

      IPDomainCountryFlagASNASN NameMalicious
      23.200.196.138
      		unknownUnited States
      		2860NOS_COMUNICACOESPTfalse

      General Information

      Joe Sandbox version:41.0.0 Charoite
      Analysis ID:1561659
      Start date and time:2024-11-24 03:39:52 +01:00
      Joe Sandbox product:CloudBasic
      Overall analysis duration:0h 4m 12s
      Hypervisor based Inspection enabled:false
      Report type:full
      Cookbook file name:defaultwindowspdfcookbook.jbs
      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
      Number of analysed new started processes analysed:10
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • EGA enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Sample name:W9po7Vc6bl.pdf
      renamed because original name is a hash value
      Original Sample Name:c4aa1f5bdaeb179eec2ee31af7d8308414fd79925b381e0618498bcc39520b3c.pdf
      Detection:MAL
      Classification:mal48.winPDF@14/53@1/1
      Cookbook Comments:
      • Found application associated with file extension: .pdf
      • Found PDF document
      • Close Viewer

      Warnings

      • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
      • Excluded IPs from analysis (whitelisted): 184.30.16.138, 23.32.238.130, 2.19.198.75, 52.5.13.197, 23.22.254.206, 54.227.187.23, 52.202.204.11, 172.64.41.3, 162.159.61.3, 23.195.39.65, 2.16.149.141, 2.16.149.153
      • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, a767.dspw65.akamai.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
      • Not all processes where analyzed, report is missing behavior information
      • Report size getting too big, too many NtCreateFile calls found.

      Simulations

      Behavior and APIs

      TimeTypeDescription
      21:41:03API Interceptor2x Sleep call for process: AcroCEF.exe modified

      Joe Sandbox View / Context

      IPs

      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      23.200.196.138Sampension-file-846845087.pdfGet hashmaliciousCaptcha PhishBrowse
        https://docsend.com/view/yw8rtf7gp9v6uesgGet hashmaliciousUnknownBrowse
          N-Access New e-Fax Court Notice...pdfGet hashmaliciousUnknownBrowse
            report_209.pdfGet hashmaliciousUnknownBrowse
              Statement 2024-14.pdfGet hashmaliciousUnknownBrowse
                uenic.msiGet hashmaliciousUnknownBrowse
                  https://img1.wsimg.com/blobby/go/672d0f54-9add-420a-a58c-ef66bcb1ba03/downloads/sijapej.pdfGet hashmaliciousUnknownBrowse
                    c.cmdGet hashmaliciousCarnavalHeistBrowse
                      Voice_Message.pdfGet hashmaliciousHTMLPhisherBrowse
                        ADJUSTMENT ON PAY RISE FOR ALL FACULTY AND STAFF.pdfGet hashmaliciousHTMLPhisherBrowse

                          Domains

                          ⊘No context

                          ASNs

                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                          NOS_COMUNICACOESPTsh4.nn.elfGet hashmaliciousMirai, OkiruBrowse
                          • 89.180.114.13
                          http://elizgallery.com/js.phpGet hashmaliciousUnknownBrowse
                          • 23.200.197.152
                          owari.spc.elfGet hashmaliciousUnknownBrowse
                          • 94.133.118.147
                          yakuza.ppc.elfGet hashmaliciousMiraiBrowse
                          • 95.94.72.211
                          sora.mips.elfGet hashmaliciousMiraiBrowse
                          • 109.49.130.92
                          Sampension-file-846845087.pdfGet hashmaliciousCaptcha PhishBrowse
                          • 23.200.196.138
                          bin.sh.elfGet hashmaliciousMiraiBrowse
                          • 109.48.20.69
                          sora.m68k.elfGet hashmaliciousMiraiBrowse
                          • 213.22.198.228
                          botnet.sh4.elfGet hashmaliciousMirai, MoobotBrowse
                          • 109.48.123.26
                          wrgmhT3TP7.elfGet hashmaliciousMiraiBrowse
                          • 87.196.249.110

                          JA3 Fingerprints

                          ⊘No context

                          Dropped Files

                          ⊘No context

                          Created / dropped Files

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:ASCII text
                          Category:dropped
                          Size (bytes):292
                          Entropy (8bit):5.162670130062614
                          Encrypted:false
                          SSDEEP:6:HGvyFIq2Pwkn2nKuAl9OmbnIFUt8YGvpZmw+YGvjkwOwkn2nKuAl9OmbjLJ:8yOvYfHAahFUt81p/+1j5JfHAaSJ
                          MD5:72023DDC7732A92D1EF5368A8A252025
                          SHA1:7344A02FC42D5850DAFA8CBDC23B7D4F9ADB0F40
                          SHA-256:3CC16C2D401DE77922804C4DB191C8A08EFB622DAC226AABE03C04FE7DD1BCF7
                          SHA-512:13562A86CEBF53FF78D2D30ED61FFE1006CF06E95BED03BD9ECC5A66BE0ECD921CD9C126D2EA380E438E8F2975E402B7DD466EE6EE235457A08CBC61AC90F306
                          Malicious:false
                          Reputation:low
                          Preview:2024/11/23-21:40:53.058 1eb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/23-21:40:53.060 1eb0 Recovering log #3.2024/11/23-21:40:53.060 1eb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:ASCII text
                          Category:dropped
                          Size (bytes):292
                          Entropy (8bit):5.162670130062614
                          Encrypted:false
                          SSDEEP:6:HGvyFIq2Pwkn2nKuAl9OmbnIFUt8YGvpZmw+YGvjkwOwkn2nKuAl9OmbjLJ:8yOvYfHAahFUt81p/+1j5JfHAaSJ
                          MD5:72023DDC7732A92D1EF5368A8A252025
                          SHA1:7344A02FC42D5850DAFA8CBDC23B7D4F9ADB0F40
                          SHA-256:3CC16C2D401DE77922804C4DB191C8A08EFB622DAC226AABE03C04FE7DD1BCF7
                          SHA-512:13562A86CEBF53FF78D2D30ED61FFE1006CF06E95BED03BD9ECC5A66BE0ECD921CD9C126D2EA380E438E8F2975E402B7DD466EE6EE235457A08CBC61AC90F306
                          Malicious:false
                          Reputation:low
                          Preview:2024/11/23-21:40:53.058 1eb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/23-21:40:53.060 1eb0 Recovering log #3.2024/11/23-21:40:53.060 1eb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:ASCII text
                          Category:dropped
                          Size (bytes):336
                          Entropy (8bit):5.183085251399778
                          Encrypted:false
                          SSDEEP:6:HGvtrVq2Pwkn2nKuAl9Ombzo2jMGIFUt8YGvUgZmw+YGvUIkwOwkn2nKuAl9OmbX:8trVvYfHAa8uFUt81Ug/+1UI5JfHAa8z
                          MD5:953D21362CC5CA251B00CB261F243219
                          SHA1:DC7EDE5760DD8C7CEC531825407A1435E40EC039
                          SHA-256:E368D5EFE7F5196B4F3AA0626710A359F8B8181AD033C6FF5D473FF844D8EF9E
                          SHA-512:945763C4BEB09A33EEC345B80833D39D2C197FCC9B2682C708C40E2A6A8BA0A396B828EE4235D1F37CC6FFD9BC66004DCAF5D453E4F3EE557A1C6934360C4185
                          Malicious:false
                          Reputation:low
                          Preview:2024/11/23-21:40:53.079 1f04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/11/23-21:40:53.081 1f04 Recovering log #3.2024/11/23-21:40:53.081 1f04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:ASCII text
                          Category:dropped
                          Size (bytes):336
                          Entropy (8bit):5.183085251399778
                          Encrypted:false
                          SSDEEP:6:HGvtrVq2Pwkn2nKuAl9Ombzo2jMGIFUt8YGvUgZmw+YGvUIkwOwkn2nKuAl9OmbX:8trVvYfHAa8uFUt81Ug/+1UI5JfHAa8z
                          MD5:953D21362CC5CA251B00CB261F243219
                          SHA1:DC7EDE5760DD8C7CEC531825407A1435E40EC039
                          SHA-256:E368D5EFE7F5196B4F3AA0626710A359F8B8181AD033C6FF5D473FF844D8EF9E
                          SHA-512:945763C4BEB09A33EEC345B80833D39D2C197FCC9B2682C708C40E2A6A8BA0A396B828EE4235D1F37CC6FFD9BC66004DCAF5D453E4F3EE557A1C6934360C4185
                          Malicious:false
                          Reputation:low
                          Preview:2024/11/23-21:40:53.079 1f04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/11/23-21:40:53.081 1f04 Recovering log #3.2024/11/23-21:40:53.081 1f04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):475
                          Entropy (8bit):4.967403857886107
                          Encrypted:false
                          SSDEEP:12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
                          MD5:B7761633048D74E3C02F61AD04E00147
                          SHA1:72A2D446DF757BAEA2C7A58C050925976E4C9372
                          SHA-256:1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
                          SHA-512:397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
                          Malicious:false
                          Reputation:moderate, very likely benign file
                          Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5ded88.TMP (copy)

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):475
                          Entropy (8bit):4.967403857886107
                          Encrypted:false
                          SSDEEP:12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
                          MD5:B7761633048D74E3C02F61AD04E00147
                          SHA1:72A2D446DF757BAEA2C7A58C050925976E4C9372
                          SHA-256:1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
                          SHA-512:397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
                          Malicious:false
                          Reputation:moderate, very likely benign file
                          Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b55de4c9-dab2-451c-b457-76a92480ac78.tmp

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):475
                          Entropy (8bit):4.967403857886107
                          Encrypted:false
                          SSDEEP:12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
                          MD5:B7761633048D74E3C02F61AD04E00147
                          SHA1:72A2D446DF757BAEA2C7A58C050925976E4C9372
                          SHA-256:1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
                          SHA-512:397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
                          Malicious:false
                          Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b7e3d768-9bef-4ab5-b8e7-e6141934011f.tmp

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:JSON data
                          Category:modified
                          Size (bytes):475
                          Entropy (8bit):4.972381811521054
                          Encrypted:false
                          SSDEEP:12:YH/um3RA8sqF2sBdOg2H5caq3QYiubInP7E4TX:Y2sRdsKbdMHA3QYhbG7n7
                          MD5:19901AC3E296A2C84F7289F7B1083F05
                          SHA1:CC2B416D31BD2C615F6AF604E56ED3083DE5D64A
                          SHA-256:761B9E0EDECF0BF9EC56AD60E6A35D7234C0A6CACC607BFCE80E3B0457B3D1D1
                          SHA-512:4E0AFD541A239FB2DD8DD9981177EA7452AA257551C81F5232A0B8964ED559F5090E118EC64463F4DE1B4D03A1B52CD992DBB44EE9F7716EF982C790F2E55DB4
                          Malicious:false
                          Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376976065758313","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":686302},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:data
                          Category:dropped
                          Size (bytes):4730
                          Entropy (8bit):5.257866806380368
                          Encrypted:false
                          SSDEEP:96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7Uw3ynSZ:etJCV4FiN/jTN/2r8Mta02fEhgO73god
                          MD5:10145236D51E17759FE53BB013102F37
                          SHA1:561DD81787322D6D0E14F44211A9FB0BD16783C6
                          SHA-256:67EA662B67EA18BBEC49A035EA44C9C87E88B38F9352B218026EB82CD559AD51
                          SHA-512:43C9D4FC8D4459A379EE1F8050EFD69480C214381B8574305EDD8A1E4157FF0766BE348371701DB7BF097315192D0AC50A12BE4D14322DA361E52DC695DEAF27
                          Malicious:false
                          Preview:*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:ASCII text
                          Category:dropped
                          Size (bytes):324
                          Entropy (8bit):5.173207679691358
                          Encrypted:false
                          SSDEEP:6:HGvjVq2Pwkn2nKuAl9OmbzNMxIFUt8YGv2M2gZmw+YGvK6IkwOwkn2nKuAl9Ombg:8jVvYfHAa8jFUt812rg/+1vI5JfHAa8E
                          MD5:562699AD5848801A0B557EBFB38EF8DD
                          SHA1:3B6FFC8BD2210951E5DF35A870A6EC8B9978F22A
                          SHA-256:0D0C6EDA2DDF4DD9558636776D72D35FA854D4EC92B8BE844EC4256F78C48DCB
                          SHA-512:D7A9049272ACE1CACDD10F39D1194EAAED7FC9CCD7F2F077E4AF484A853BA9ED835490A89888BAD45B13BF510B0125BFEDB1E57930EFFE3A89DE752915AAE87A
                          Malicious:false
                          Preview:2024/11/23-21:40:53.433 1f04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/11/23-21:40:53.555 1f04 Recovering log #3.2024/11/23-21:40:53.565 1f04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:ASCII text
                          Category:dropped
                          Size (bytes):324
                          Entropy (8bit):5.173207679691358
                          Encrypted:false
                          SSDEEP:6:HGvjVq2Pwkn2nKuAl9OmbzNMxIFUt8YGv2M2gZmw+YGvK6IkwOwkn2nKuAl9Ombg:8jVvYfHAa8jFUt812rg/+1vI5JfHAa8E
                          MD5:562699AD5848801A0B557EBFB38EF8DD
                          SHA1:3B6FFC8BD2210951E5DF35A870A6EC8B9978F22A
                          SHA-256:0D0C6EDA2DDF4DD9558636776D72D35FA854D4EC92B8BE844EC4256F78C48DCB
                          SHA-512:D7A9049272ACE1CACDD10F39D1194EAAED7FC9CCD7F2F077E4AF484A853BA9ED835490A89888BAD45B13BF510B0125BFEDB1E57930EFFE3A89DE752915AAE87A
                          Malicious:false
                          Preview:2024/11/23-21:40:53.433 1f04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/11/23-21:40:53.555 1f04 Recovering log #3.2024/11/23-21:40:53.565 1f04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                          C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241124024057Z-170.bmp

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
                          Category:dropped
                          Size (bytes):71190
                          Entropy (8bit):1.314632864808987
                          Encrypted:false
                          SSDEEP:96:y6byNMMMq/hXzhef3GtsrMMQq+XMX4McTMVPMfMMzMyrHMzEF54LnNHMr+cMMJMz:HG7/P8WiHJ
                          MD5:42EE8C5B73836444E8D7E4045A26AE06
                          SHA1:097EDA88A911571A86555764BA52B8CBCE794E8A
                          SHA-256:40CDB441F63D6DD929F4E0A551BECC2FC9AA3D48C39092448F87AD38B4E7D73C
                          SHA-512:146C3E3A79B6F864E780AF0BAAA7EA89FB6EA8E9C2BBC520F5B00E4B865BA713FF0DD021885DC9CF95AB60690BCD00A208BD8350519EDBCA8EB78F1B485B0540
                          Malicious:false
                          Preview:BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                          C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
                          Category:dropped
                          Size (bytes):86016
                          Entropy (8bit):4.445024892645668
                          Encrypted:false
                          SSDEEP:384:yezci5tTiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rgs3OazzU89UTTgUL
                          MD5:B03B429FEA3E4F99B0E7B6B87FFD9459
                          SHA1:55DB31B88B5BBC05DC9D71E4988B283AA1E6EB06
                          SHA-256:6F3E75F292524ED3C60C4269996F9F107D6DF0A74617CC6277F47679C5FCDCA3
                          SHA-512:6C9B7F753BD611C0D86E7C5A9F045FA84778271A3406BFBB2C1A1F23CE227783CA4A75D9C5E71B82897FC7C6B37847B3FC5AB706027FE7182A3EA791A865AA80
                          Malicious:false
                          Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                          C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:SQLite Rollback Journal
                          Category:dropped
                          Size (bytes):8720
                          Entropy (8bit):3.775464458258171
                          Encrypted:false
                          SSDEEP:48:7MOp/E2ioyV6Wioy9oWoy1Cwoy1jlKOioy1noy1AYoy1Wioy1hioybioyt0/oy1N:79pju6WFknXKQ20tSb9IVXEBodRBkA
                          MD5:F5C3C495777865A0A86599BAC1E42270
                          SHA1:32C88B8E46F6EA835C865D1ABAAD6BDE0DAAA40C
                          SHA-256:54B385AF8DC14BA0A852630BD6396E3C13568C47DACB9B6B2E7B1ED34A063AA4
                          SHA-512:A949D5718686F76B023D23A51AD7BCAC3B15F83DABD14B6DB076C05678D3AF0DE556AC39A0E267BBB0DBEAC35186023C7E338EDF953BD5D0686329341F6834A8
                          Malicious:false
                          Preview:.... .c......>v................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

                          C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:Certificate, Version=3
                          Category:dropped
                          Size (bytes):1391
                          Entropy (8bit):7.705940075877404
                          Encrypted:false
                          SSDEEP:24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
                          MD5:0CD2F9E0DA1773E9ED864DA5E370E74E
                          SHA1:CABD2A79A1076A31F21D253635CB039D4329A5E8
                          SHA-256:96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
                          SHA-512:3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
                          Malicious:false
                          Preview:0..k0..S............@.YDc.c...0...*.H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0...*.H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I.....*.A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.|C.t..t.....0.[q6....00\H..;..}`...).........A.......|.;F.H*..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..|o..;.....'...}~.."......

                          C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                          Category:dropped
                          Size (bytes):71954
                          Entropy (8bit):7.996617769952133
                          Encrypted:true
                          SSDEEP:1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
                          MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
                          SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
                          SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
                          SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
                          Malicious:false
                          Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

                          C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:data
                          Category:dropped
                          Size (bytes):192
                          Entropy (8bit):2.7673182398396405
                          Encrypted:false
                          SSDEEP:3:kkFklDJz+kVltfllXlE/HT8krUljNNX8RolJuRdxLlGB9lQRYwpDdt:kKCbVleT8iUlRNMa8RdWBwRd
                          MD5:E488191B3F4050F6365A127A95803192
                          SHA1:21F8CCE8F042A77A22D9F1BC05099185187DC6DC
                          SHA-256:00F9FDF87A05A0B375DD8E3CB9C1529B728C90EF2CF6075BF4B3BFE31EDE3A94
                          SHA-512:3FE686ED591817400E7F082B533D3B861EEAC0289291CBB30C64DABA9C44385691505108E1776A2811A31231DA62D88F55645523D4EC325A0EE1CE88328D07BF
                          Malicious:false
                          Preview:p...... .........,.M.>..(....................................................... ..........W.....y..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

                          C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:data
                          Category:modified
                          Size (bytes):328
                          Entropy (8bit):3.1220765959979877
                          Encrypted:false
                          SSDEEP:6:kKgc+klL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:ocRkDnLNkPlE99SNxAhUe/3
                          MD5:8B306164749143C79131BC59F6A4952C
                          SHA1:ED66F8803845331B518F2ABD8E327948A904559F
                          SHA-256:4ACBCB1871C8E4118E2F6A9850861F97E0C682DCF169E0465CBBB098A1A87593
                          SHA-512:0FC24B2D9CC827A37D4CC2D6E0F0B4693EE3FCD41E087611C07D2BFD717485286FA089FC2DD0A3BF4F97460B84D12D9A9C345242E41278C2577A7FA6B32FD01A
                          Malicious:false
                          Preview:p...... ........./.a.>..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:PostScript document text
                          Category:dropped
                          Size (bytes):1233
                          Entropy (8bit):5.233980037532449
                          Encrypted:false
                          SSDEEP:24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
                          MD5:8BA9D8BEBA42C23A5DB405994B54903F
                          SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
                          SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
                          SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
                          Malicious:false
                          Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7608

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:PostScript document text
                          Category:dropped
                          Size (bytes):1233
                          Entropy (8bit):5.233980037532449
                          Encrypted:false
                          SSDEEP:24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
                          MD5:8BA9D8BEBA42C23A5DB405994B54903F
                          SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
                          SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
                          SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
                          Malicious:false
                          Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:PostScript document text
                          Category:dropped
                          Size (bytes):1233
                          Entropy (8bit):5.233980037532449
                          Encrypted:false
                          SSDEEP:24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
                          MD5:8BA9D8BEBA42C23A5DB405994B54903F
                          SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
                          SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
                          SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
                          Malicious:false
                          Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:PostScript document text
                          Category:dropped
                          Size (bytes):10880
                          Entropy (8bit):5.214360287289079
                          Encrypted:false
                          SSDEEP:192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
                          MD5:B60EE534029885BD6DECA42D1263BDC0
                          SHA1:4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
                          SHA-256:B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
                          SHA-512:52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
                          Malicious:false
                          Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7608

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:PostScript document text
                          Category:dropped
                          Size (bytes):10880
                          Entropy (8bit):5.214360287289079
                          Encrypted:false
                          SSDEEP:192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
                          MD5:B60EE534029885BD6DECA42D1263BDC0
                          SHA1:4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
                          SHA-256:B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
                          SHA-512:52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
                          Malicious:false
                          Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:data
                          Category:dropped
                          Size (bytes):244540
                          Entropy (8bit):3.3415042960460593
                          Encrypted:false
                          SSDEEP:1536:vKPCPiyzDtrh1cK3XEivK7VK/3AYvYwggErRo+RQn:yPClJ/3AYvYwgrFo+RQn
                          MD5:758B42992DDFC41CB5E57069C621B54A
                          SHA1:D0C28AF6CF1BD2208DA97DEDE57F6C78CEC98DCD
                          SHA-256:55DF75758DD6CA825ED2DC9380EDC8469351191308C34CACFC44205197ABD25D
                          SHA-512:437918372167A402005A728DCBBEF7B3A9580B794AD6A948A435C9D57C1672ACC1B7376E2A09113B66600EF5049D23625174256565BC639125A2F2BD07928926
                          Malicious:false
                          Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):295
                          Entropy (8bit):5.367102394996251
                          Encrypted:false
                          SSDEEP:6:YEQXJ2HXA1PAdLjHVoZcg1vRcR0YJqoAvJM3g98kUwPeUkwRe9:YvXKXAQqZc0vQZGMbLUkee9
                          MD5:65E25FA7B321933E48CE60985CDE32E6
                          SHA1:2CFE2A1B37D8551FC1D63B756F67DE3997D1AD08
                          SHA-256:BE75A4CF03E48FFC82BAAFC06A70A37FF8B91BD4FCA3F0EC1D1D34E25641E63A
                          SHA-512:A721661D68AAABD5C7F7AAF4E586F5685CB62E829780191968C75FA118AEC4D05B0E1EEE3AF69A7DAC1F0FD347A9C05F0053155A437A5C36ED592CFE031BEC55
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"db63b7cc-bd4a-46c1-8869-9ece4a119851","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732595163643,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):294
                          Entropy (8bit):5.31716701634586
                          Encrypted:false
                          SSDEEP:6:YEQXJ2HXA1PAdLjHVoZcg1vRcR0YJqoAvJfBoTfXpnrPeUkwRe9:YvXKXAQqZc0vQZGWTfXcUkee9
                          MD5:0B1FE1E1C888FF40EC50F2A8A6C6A9D3
                          SHA1:B4D2BAA0F4194768D178B7AB98F8F4D5C48BA573
                          SHA-256:025AD5B1887A6EDA70DF1A19490435A80B07E2C925CEC607DDD4BEEB6B2F7C0B
                          SHA-512:82C49E0CA12D77C32D92E64A48C6ECD92F9E4B62FB4F173BA42093B9AFECDB12D690E84DDDA674D856B4C91ACF7297E78E0A8AF5D62701EA02DDAE5FEAC1032A
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"db63b7cc-bd4a-46c1-8869-9ece4a119851","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732595163643,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):294
                          Entropy (8bit):5.294928086717686
                          Encrypted:false
                          SSDEEP:6:YEQXJ2HXA1PAdLjHVoZcg1vRcR0YJqoAvJfBD2G6UpnrPeUkwRe9:YvXKXAQqZc0vQZGR22cUkee9
                          MD5:59FD0427EB4184E95CC7678E87AD1F4A
                          SHA1:C8D8C5CB3E2FD67358A1CF7A0FE338E372C3B437
                          SHA-256:963EF82599D10AC550E6291C1F5292BAB5CE7972C71CA4F5439B95E32C338B21
                          SHA-512:6243B4DA10AA48796110C9CE8BE6C84086D12B867D041935F99E40E76B2CB7DF6D9DBBFFB2B2829C1636EA262E674810598555EFC83D09AC7BE254660BFBCA09
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"db63b7cc-bd4a-46c1-8869-9ece4a119851","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732595163643,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):285
                          Entropy (8bit):5.354244094478395
                          Encrypted:false
                          SSDEEP:6:YEQXJ2HXA1PAdLjHVoZcg1vRcR0YJqoAvJfPmwrPeUkwRe9:YvXKXAQqZc0vQZGH56Ukee9
                          MD5:0A33B417399D83989460FE5EEED6E313
                          SHA1:A20931D7989EABCC0BDE85E2DCEC756B3306D079
                          SHA-256:BF6572FDDEF4A6CE71E9E6B8D2F84E6D08E089440052EBA3CC94A5B18486D687
                          SHA-512:FE3E6D5A7900DFD8A6A8844BE44A094A2581FA3C46EEEDA19213C001C6CB56FDC6CC22189368AB1EDA7EE5C622D9C64EA8FD84EF8A125A608CDF4D987888430B
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"db63b7cc-bd4a-46c1-8869-9ece4a119851","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732595163643,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):1123
                          Entropy (8bit):5.683435961736721
                          Encrypted:false
                          SSDEEP:24:Yv6XAQqzvQ+pLgE9cQx8LennAvzBvkn0RCmK8czOCCSBi:YvBQiFhgy6SAFv5Ah8cv/g
                          MD5:68B2327D7BB3CFD9BD4758B2527C6080
                          SHA1:E5EB2A05133D0B23955C44CB80339244DC418209
                          SHA-256:0AC3457364DE4A91155DE2C3D22E50C5B9730B7220F522F0FC06A3EDD67917FB
                          SHA-512:0D08E89DF8690E4711C296489DA22CC1D5FD3ED1A7E74DF94A789B375566A5C86FCEA75DED95A1357D3AEE63A2D5DF6E9BF0C5E49D3129E1AFBD201785FD6E61
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"db63b7cc-bd4a-46c1-8869-9ece4a119851","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732595163643,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):1122
                          Entropy (8bit):5.6786314104170135
                          Encrypted:false
                          SSDEEP:24:Yv6XAQqzvQoVLgEwcp06ybnAvz7xHn0RCmK8czOCYHfl8zdByi:YvBQiJFgSNycJUAh8cvYHu
                          MD5:D5197D2FC14FCFC7E81639FA6B95C028
                          SHA1:A3700F19AA57BFF222E01CBECB5EFA48B4E8A6A8
                          SHA-256:B4DA09067F6490F10DB1C2E6F753784E71328E1E1FBAB4EE4717C6A9EB2EB887
                          SHA-512:8366723C3C0C525D98CE2EBB8D557C0DB85FA4D5B59EC631A45BDC76BCF41D7134434165F7A60DD31339DEA03DE8406E4AB4F8ECB4D4BE1C7F4B80584B2744AC
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"db63b7cc-bd4a-46c1-8869-9ece4a119851","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732595163643,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93181_288855ActionBlock_0","campaignId":93181,"containerId":"1","controlGroupId":"","treatmentId":"1aad653c-ef44-43f7-be1c-3a2ba2cf2cfc","variationId":"288855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuIFBERiBmb3JtcyAmIGFncmVlbWVudHMuIn0sInRjY

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):292
                          Entropy (8bit):5.302977190714234
                          Encrypted:false
                          SSDEEP:6:YEQXJ2HXA1PAdLjHVoZcg1vRcR0YJqoAvJfQ1rPeUkwRe9:YvXKXAQqZc0vQZGY16Ukee9
                          MD5:ED4E3E3800A7F18049165E8847869846
                          SHA1:009A6D20489E0E4D85F2049437D9708C0D8391D2
                          SHA-256:BC0E908FC0611A9F8263F1CA2DE2CC18A949BDD48C289C7ABEF084EB76C524B0
                          SHA-512:8EF80E5805402EB91FD649EE7489A64B1AF94CB6565FA05E3C469B3482A9A38246DBE46C4D5CC0B7D70EA33424926FE3393C59FC79D7811325984E032EABE1DB
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"db63b7cc-bd4a-46c1-8869-9ece4a119851","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732595163643,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):1102
                          Entropy (8bit):5.671237290827254
                          Encrypted:false
                          SSDEEP:24:Yv6XAQqzvQt2LgErcXWl7y0nAvzIBcSJCBViVyi:YvBQi4ogH47yfkB5kVg
                          MD5:8678A89684448D2DA02F560167D8C933
                          SHA1:A3A197916F18038993D67DA2A53CE0F5175C15AF
                          SHA-256:84BEFD9007060BBF38A7004554B3431770CFD8EE29B00A64684FFFC0394D8881
                          SHA-512:F340F2E8F28BF3B359D13516D4C2DF83BB0741BDBA8529EA78A7C173B6AB75DDBB67C4209DB05ADCE75DDA0552147E5FD174A4F81CA6947647523A0A9E6ACE99
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"db63b7cc-bd4a-46c1-8869-9ece4a119851","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732595163643,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93181_288855ActionBlock_1","campaignId":93181,"containerId":"1","controlGroupId":"","treatmentId":"533ab5eb-b236-4889-89a5-ac002261d71e","variationId":"288855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkVkaXRQREZSZHJBcHBGdWxsIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTRweCIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTJweCIsImZvbnRfc3R5bGUiOiItMSJ9LCJ0aXRsZSI6bnVsbCwiZGVzY3JpcHRpb24iOiJFZGl0IHRleHQsIGltYWdlcywgcGFnZXMsIGFuZCBtb3JlLiJ9LCJ0Y2F0SWQiOm51bGx9","da

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):1164
                          Entropy (8bit):5.696069923876824
                          Encrypted:false
                          SSDEEP:24:Yv6XAQqzvQFKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK5yT:YvBQiwEgqprtrS5OZjSlwTmAfSKS
                          MD5:3BFED4E8744BBB4BC90B60ADD2FF7C22
                          SHA1:8B3A82DF9A28B70F8A34901EA139EAB923FBF340
                          SHA-256:D2B101120F163FB813331A6477DCE9C01322D1FE9120D0F583BAA5ACCA8652A2
                          SHA-512:A032DBE1A253CC7E4474B66C86E541C392710205C94C732305662FCAB278B28646B793D841F406C842A92480BCFB01C86DE35FF5A77B206181E8BC00226E28A1
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"db63b7cc-bd4a-46c1-8869-9ece4a119851","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732595163643,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):289
                          Entropy (8bit):5.306228582456202
                          Encrypted:false
                          SSDEEP:6:YEQXJ2HXA1PAdLjHVoZcg1vRcR0YJqoAvJfYdPeUkwRe9:YvXKXAQqZc0vQZGg8Ukee9
                          MD5:2CB76FC8B097E8B78F92B1D50D454053
                          SHA1:9FC1C223EFE33ACEA502018D2ED3BC9BD0EBE325
                          SHA-256:FBE38C8D22E12EDE7B3C3213A5ABDDD515F56350AAB5D9F654CCE7D7A3090E59
                          SHA-512:E373313442CC478AD42061523DC98AFB138E8C63F498A25F228A2A87F227ADAD0B1B1DBEABC1B96266E121B8DDEB02431F4921B05F423425BD36479B2FF7DDA0
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"db63b7cc-bd4a-46c1-8869-9ece4a119851","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732595163643,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):284
                          Entropy (8bit):5.292687604348552
                          Encrypted:false
                          SSDEEP:6:YEQXJ2HXA1PAdLjHVoZcg1vRcR0YJqoAvJf+dPeUkwRe9:YvXKXAQqZc0vQZG28Ukee9
                          MD5:70934D026C5C58BFE21014BD7E9E504B
                          SHA1:188FAFDB561081A961E10E574209A2A908926507
                          SHA-256:A36B462C5798D4F59B79670BC2DFE5BBF5C1CEB4F6BBEE29E65DE58AE9476C96
                          SHA-512:125924175BADB746785D21A3CC03E4F5AE232E6742C897FE9570FB15A46438E09BFC086C2DE9B02FD18E734E438E5131567F6F2A4ED90809135AD782F00CBBEE
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"db63b7cc-bd4a-46c1-8869-9ece4a119851","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732595163643,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):291
                          Entropy (8bit):5.289732872003219
                          Encrypted:false
                          SSDEEP:6:YEQXJ2HXA1PAdLjHVoZcg1vRcR0YJqoAvJfbPtdPeUkwRe9:YvXKXAQqZc0vQZGDV8Ukee9
                          MD5:FA027DDE9C2BCFC414F3FC7A17E4A0A7
                          SHA1:07C4FE514C178243564B39B5DFDB3122DE16C46D
                          SHA-256:E1723C701ABA4053D3DA78ED03AEFF62942F00BF02E6709997BA23E02AAE1328
                          SHA-512:2644C41DD0C329485B452573BA1B59C6D3F5C0762AF35EE42B6792522C562BE4ACC773B82149578A5359AC12F6A428FD5BCD770C559461837C8FA72A31DDFF61
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"db63b7cc-bd4a-46c1-8869-9ece4a119851","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732595163643,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):287
                          Entropy (8bit):5.294470537522083
                          Encrypted:false
                          SSDEEP:6:YEQXJ2HXA1PAdLjHVoZcg1vRcR0YJqoAvJf21rPeUkwRe9:YvXKXAQqZc0vQZG+16Ukee9
                          MD5:5121992910F993742E20EB4824A1F8CF
                          SHA1:4B4DC9D0FAB33F74A2BB0E32885208D3AA87AFDC
                          SHA-256:62799F529E908AE20817AD71489D2AF8A3A90863284FBFD82C89895F9ADFBCA8
                          SHA-512:F132FECDB9BB4CD3AE84537CAFAF82C9B0EB77DEB8B059B889D3D424042FA90043D84A8201E25F93CC88E3DDD4E892B02931358A9CDCABD3C14A0C2CFB14FC4A
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"db63b7cc-bd4a-46c1-8869-9ece4a119851","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732595163643,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):1090
                          Entropy (8bit):5.659579836491704
                          Encrypted:false
                          SSDEEP:24:Yv6XAQqzvQiamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSBi:YvBQixBgkDMUJUAh8cvMg
                          MD5:566ECF3E343FF5D3D4E6B61015C1A7DA
                          SHA1:8B88948D7DF500E179D691978602E6466470949D
                          SHA-256:380C86B34013A277CDC6836E6A21039360F50E25EA987137CE9F6201A22AD35A
                          SHA-512:F32BF43FA804DEA56CCD8B2B1FEA9CD1236023520BB2A3C5304198CF1B1E2642CCA73DE723E5C04BDC0EE48AD59E38515E8E93EFE12B801B5A9AED5C165477A6
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"db63b7cc-bd4a-46c1-8869-9ece4a119851","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732595163643,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):286
                          Entropy (8bit):5.270133813527826
                          Encrypted:false
                          SSDEEP:6:YEQXJ2HXA1PAdLjHVoZcg1vRcR0YJqoAvJfshHHrPeUkwRe9:YvXKXAQqZc0vQZGUUUkee9
                          MD5:F6C1D2628FD5F95950E31AC33061B275
                          SHA1:F2EE37686BC96537391F925A7B105AF26A36E7E4
                          SHA-256:CA7C8B50CED83B89E4D592D72CE83D041808532ABB881CBEC9BFC64539A9A665
                          SHA-512:5BA1AA950B7DA2CFE989B060B43CE8704D563735FF0B02B316406C044DA64693F3043C78D2C7ABE56B5361969B6B91AF82D66CBD480A5EEACC5E78F7661A4A3C
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"db63b7cc-bd4a-46c1-8869-9ece4a119851","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732595163643,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):782
                          Entropy (8bit):5.369156097795365
                          Encrypted:false
                          SSDEEP:12:YvXKXAQqZc0vQZGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWui:Yv6XAQqzvQ1168CgEXX5kcIfANhBi
                          MD5:A949FE5AD1FB8CA47381F60AADF8EC6D
                          SHA1:346527D7897BC99EDE99273B6E121C1C9EC4F4CC
                          SHA-256:C3152FE3EFD1225213F08662034F1CC85A4C9014495A08AEA7FE45297541BE64
                          SHA-512:75420A5F228D94F5C7DD886ACF7D610E9FC649C98F11E9CF067F92168E5108AFE40ABF48FBDBED80BDE9366E134084F962CC21F3BB6025B8B6BBCCA1E15F9007
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"db63b7cc-bd4a-46c1-8869-9ece4a119851","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732595163643,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1732416063674}}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:data
                          Category:dropped
                          Size (bytes):4
                          Entropy (8bit):0.8112781244591328
                          Encrypted:false
                          SSDEEP:3:e:e
                          MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                          SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                          SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                          SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                          Malicious:false
                          Preview:....

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):2817
                          Entropy (8bit):5.13160348314611
                          Encrypted:false
                          SSDEEP:24:YUzviNHheEwIaymBay8CuzYxCXCeYiDrx7dWguDBBHCiQIlju/cVj0SC99nLo2xh:YKKWWGoruzdLTw8kD0LXAkF9i
                          MD5:DC658A9BDD34E2A1CC17B1121471E58B
                          SHA1:765FFA56116F948C1510EC7B8A2E975DE9FE21C8
                          SHA-256:38C911E540B7ADAC3D3145961B0E9316FC752B4FDB1667DE628167D2624F5157
                          SHA-512:5E772895948D119D02C69CF6BA7F22DE40BD78C462A86E26D01B1979092F1E5D2527FED926E478FB08DC142C19AB54F58016934C5EE64388D45F957D5A177D33
                          Malicious:false
                          Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"f9276b2facd52afc250e36e9cb55689d","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1122,"ts":1732416063000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"681d15b21f5c7a733fa619112c18a5b2","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1732416063000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"52a0d7f34d1f7f359f3998d98eabbea7","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1732416063000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"e5572c31e045467ba5304c5631641561","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1732416063000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"f4362cc8202daacc61ff68becf2f52d6","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1102,"ts":1732416063000},{"id":"Edit_InApp_Aug2020","info":{"dg":"6702b86a95baf6322399d62d794dbc3c","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":17

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
                          Category:dropped
                          Size (bytes):12288
                          Entropy (8bit):1.18743877790494
                          Encrypted:false
                          SSDEEP:48:TGufl2GL7msEHUUUUUUUUReSvR9H9vxFGiDIAEkGVvpF4:lNVmswUUUUUUUURe+FGSItR4
                          MD5:62187BCA5D05E1D3F097FA7D92023040
                          SHA1:86B1496C014F59E9415982F780DABBB2AC492C93
                          SHA-256:16E7488FFF486589C6F4E8684BC34826692C279009EC99DCCDDA9936D564451C
                          SHA-512:985112E40933231E7C3258928D6D8D308ADC3BBEF09E830BEB7AB348C3E5890AC7E65105CCDA4F683F08D2E800591868DEDE5A2DF0C66285E7C58267BC4CFB6B
                          Malicious:false
                          Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:SQLite Rollback Journal
                          Category:dropped
                          Size (bytes):8720
                          Entropy (8bit):1.6061866986866904
                          Encrypted:false
                          SSDEEP:48:7MpKUUUUUUUUUURMvR9H9vxFGiDIAEkGVvxqFl2GL7msB:7DUUUUUUUUUUR8FGSIt/KVmsB
                          MD5:F65EBCB846A9105510CB0B8B2EA7CB71
                          SHA1:C8F9DB8C82715FA9839AF93DE3763FF26B8E2C32
                          SHA-256:26D2ECE6CE957E69DC434F52028F6BB7F61830774879F082C43C0B2F49382FCF
                          SHA-512:2CA42FF5DC136300F6D46820742114D6302AD38928FBC53376EB1912E4339891460D5EA853F8F83F43239908CEE7277A3D4F10966273612494437721F681DEE6
                          Malicious:false
                          Preview:.... .c.......1.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:data
                          Category:dropped
                          Size (bytes):66726
                          Entropy (8bit):5.392739213842091
                          Encrypted:false
                          SSDEEP:768:RNOpblrU6TBH44ADKZEgvJtmP21m/v1KVeUDPCFj451DYyu:6a6TZ44ADERtmP21C1K17DK
                          MD5:972195BBEB12DE78B676114BE414C28F
                          SHA1:540049ACCBB1031F81BF145AB8788B1EDB2DA711
                          SHA-256:79F0338ABD9E7411C62104E688E25EABEBDAB016665BA2C9E36E71F6FCC03290
                          SHA-512:1F20887E16F96680F5222AEC2EDF472940B5C5E76D7FC90275D9B65E2F98F4DBE0A00A534A3FB73362E52B77DE95452D164ECBBE6267B23F0A1D477819BA96CA
                          Malicious:false
                          Preview:4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

                          C:\Users\user\AppData\Local\Temp\MSId3ad2.LOG

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                          Category:dropped
                          Size (bytes):246
                          Entropy (8bit):3.493870954423123
                          Encrypted:false
                          SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8rOlUltPlYH:Qw946cPbiOxDlbYnuRKDlkYH
                          MD5:1230F3C95BAA325BE7A475ECBF2C0577
                          SHA1:4945F66938A0A10BE957F46E5C86539BFC63DB1B
                          SHA-256:980DB4FED15577847FFB8907C04F3804FC4AE8ED8BE26B768290E88F5460CF10
                          SHA-512:BCACDF7EA2D336A3A79ADC54C998B952433FC2151D01B4F6E4A647766534CFD89E319600983698F80916A08E4889126226265B88ACBF24F3A3E80C38C1A89E1E
                          Malicious:false
                          Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.3./.1.1./.2.0.2.4. . .2.1.:.4.1.:.0.0. .=.=.=.....

                          C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-23 21-40-55-345.log

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:ASCII text, with very long lines (393)
                          Category:dropped
                          Size (bytes):16525
                          Entropy (8bit):5.345946398610936
                          Encrypted:false
                          SSDEEP:384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
                          MD5:8947C10F5AB6CFFFAE64BCA79B5A0BE3
                          SHA1:70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
                          SHA-256:4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
                          SHA-512:B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
                          Malicious:false
                          Preview:SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

                          C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:ASCII text, with very long lines (393), with CRLF line terminators
                          Category:dropped
                          Size (bytes):15114
                          Entropy (8bit):5.383592762296452
                          Encrypted:false
                          SSDEEP:384:o5gw8wFwkw4wxwSJRtRaRbKR+RPRCRTRFRITjTdTLTNsQs4s7sUsiXVJVJVXkTk/:oeDAb1m/JnINKMFgt363JHRnDgB3/D5v
                          MD5:408D574087B8B7412BD628EA4BF792FC
                          SHA1:9DC72F07CBF16E4A6A28B98E8FCA88408BDF1C26
                          SHA-256:684FAF38FBB62C1A0A52E78F0AB823F9D1134C174A2ECDAD765FAD0C86DFE766
                          SHA-512:75DAC0F42DA315EFD064103DA03004B62EB4C1F31192B95B2CB5D653DE63F7F757338E3A3E041A6E0C5DCCB06CFF3F32FDCF882F103692E2A7240FD1DD3725C8
                          Malicious:false
                          Preview:SessionID=d1b6dfcd-d038-429c-afb0-b7c9bff08d58.1732416055356 Timestamp=2024-11-23T21:40:55:356-0500 ThreadID=7228 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=d1b6dfcd-d038-429c-afb0-b7c9bff08d58.1732416055356 Timestamp=2024-11-23T21:40:55:362-0500 ThreadID=7228 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=d1b6dfcd-d038-429c-afb0-b7c9bff08d58.1732416055356 Timestamp=2024-11-23T21:40:55:362-0500 ThreadID=7228 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=d1b6dfcd-d038-429c-afb0-b7c9bff08d58.1732416055356 Timestamp=2024-11-23T21:40:55:362-0500 ThreadID=7228 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=d1b6dfcd-d038-429c-afb0-b7c9bff08d58.1732416055356 Timestamp=2024-11-23T21:40:55:362-0500 ThreadID=7228 Component=ngl-lib_NglAppLib Description="SetConf

                          C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:ASCII text, with CRLF line terminators
                          Category:dropped
                          Size (bytes):29752
                          Entropy (8bit):5.3906996039977235
                          Encrypted:false
                          SSDEEP:768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2r9:B
                          MD5:383E5AC1F53BC110C92797237690C338
                          SHA1:3DED58A504DAF6E72B534A3CC09E04B92487BC59
                          SHA-256:AA7AA44B6FB13650FB435D0B7210D0B1117B5E77CBB63B39B17DA6CE0BD1AE27
                          SHA-512:69A5E06160F4FE3588C40E97D5B96BC656BAD627A84FB58DC621EC91C9744CF10F4E10D9808B7EBA31EDC11CCD40A3CE15864EC774EF42ADFE0D0AE1AEE2850C
                          Malicious:false
                          Preview:03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

                          C:\Users\user\AppData\Local\Temp\acrocef_low\13ec3b08-cdeb-4547-ae7e-98147e2cd11b.tmp

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                          Category:dropped
                          Size (bytes):386528
                          Entropy (8bit):7.9736851559892425
                          Encrypted:false
                          SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                          MD5:5C48B0AD2FEF800949466AE872E1F1E2
                          SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                          SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                          SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                          Malicious:false
                          Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                          C:\Users\user\AppData\Local\Temp\acrocef_low\8bac7c5f-e68d-42a9-b8b1-edd76cc64df8.tmp

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                          Category:dropped
                          Size (bytes):1419751
                          Entropy (8bit):7.976496077007677
                          Encrypted:false
                          SSDEEP:24576:/xA7ouWLaGZ7wYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVuWLaGZ7wZGk3mlind9i4ufFXpAXkru
                          MD5:13F55292D0735B9ABD4259B225D210FC
                          SHA1:810CC5D545BFA11D2825F6E1DFA69176794DA7EC
                          SHA-256:8C3FFEA68963D108599E8C5AE20DE6E9C473BF33197A03A9A7DDCD0F25A6C7F6
                          SHA-512:4F54EDA9EB61172A5243DAA718CFF42A0BF079CC0FA7BE3553CC8B79772763B49F530DD6B54A9D595C4F46B8416ADF7D5C8DAD58FC43A5C651258E669DC375DA
                          Malicious:false
                          Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                          C:\Users\user\AppData\Local\Temp\acrocef_low\ab42e746-ea0b-4de2-9733-eec2374a1218.tmp

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                          Category:dropped
                          Size (bytes):758601
                          Entropy (8bit):7.98639316555857
                          Encrypted:false
                          SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                          MD5:3A49135134665364308390AC398006F1
                          SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                          SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                          SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                          Malicious:false
                          Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                          C:\Users\user\AppData\Local\Temp\acrocef_low\c9c6def6-ebc8-41ac-b829-8de5a93e876a.tmp

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                          Category:dropped
                          Size (bytes):1407294
                          Entropy (8bit):7.97605879016224
                          Encrypted:false
                          SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
                          MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
                          SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
                          SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
                          SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
                          Malicious:false
                          Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                          Static File Info

                          General

                          File type:PDF document, version 1.7
                          Entropy (8bit):5.457853186153733
                          TrID:
                          • Adobe Portable Document Format (5005/1) 100.00%
                          File name:W9po7Vc6bl.pdf
                          File size:2'791'500 bytes
                          MD5:9a9a5b518fde106213bc5c187eda6a7d
                          SHA1:b5d35a4c3aa2fdb10d893e154ad8a810d7c3f6fe
                          SHA256:c4aa1f5bdaeb179eec2ee31af7d8308414fd79925b381e0618498bcc39520b3c
                          SHA512:9a9360cc992c2df5b2ea79b7924bc7a2e9492737744f8f33c6d4bd04aff99d1a23e81c4d1ec4ee00ad941e998374a9ebc230fb6721ada0fa65e2af8da335dcb5
                          SSDEEP:12288:pwGeLi2QoVN4d/ST/clgyzBPXNvrxsRd9E2MJ3tacWve4OwSLgLd:8YoVNuSjc7LzadC243tGebLgLd
                          TLSH:73D518A19870BF06BE250C0453A16FAA514C696F4BF8520CA86ECF8F3197DDE70DF856
                          File Content Preview:%PDF-1.7.%.....2 0 obj.<<./Type /Catalog./PageLayout /SinglePage./PageMode /UseNone./ViewerPreferences 4 0 R./Version /1#2E7./MarkInfo 5 0 R./Pages 6 0 R./AcroForm 7 0 R.>>.endobj.12 0 obj.<<./Filter /FlateDecode./Length 10.>>.stream..x.+......|..endstrea

                          File Icon

                          Icon Hash:62cc8caeb29e8ae0

                          Static PDF Info

                          General

                          Header:%PDF-1.7
                          Total Entropy:5.457853
                          Total Bytes:2791500
                          Stream Entropy:5.454101
                          Stream Bytes:2789382
                          Entropy outside Streams:4.996532
                          Bytes outside Streams:2118
                          Number of EOF found:1
                          Bytes after EOF:

                          Keywords Statistics

                          NameCount
                          obj24
                          endobj24
                          stream22
                          endstream22
                          xref0
                          trailer0
                          startxref1
                          /Page0
                          /Encrypt0
                          /ObjStm1
                          /URI0
                          /JS0
                          /JavaScript0
                          /AA0
                          /OpenAction0
                          /AcroForm1
                          /JBIG2Decode0
                          /RichMedia0
                          /Launch0
                          /EmbeddedFile0

                          Image Streams

                          IDDHASHMD5Preview
                          353835232b2b0b434d99acd6aa86a7523f8ea790aa6510ffe2

                          Network Behavior

                          Network Port Distribution

                          TCP Packets

                          TimestampSource PortDest PortSource IPDest IP
                          Nov 24, 2024 03:41:06.426111937 CET49748443192.168.2.423.200.196.138
                          Nov 24, 2024 03:41:06.426135063 CET4434974823.200.196.138192.168.2.4
                          Nov 24, 2024 03:41:06.426207066 CET49748443192.168.2.423.200.196.138
                          Nov 24, 2024 03:41:06.426619053 CET49748443192.168.2.423.200.196.138
                          Nov 24, 2024 03:41:06.426630974 CET4434974823.200.196.138192.168.2.4
                          Nov 24, 2024 03:41:08.114742994 CET4434974823.200.196.138192.168.2.4
                          Nov 24, 2024 03:41:08.115082026 CET49748443192.168.2.423.200.196.138
                          Nov 24, 2024 03:41:08.115099907 CET4434974823.200.196.138192.168.2.4
                          Nov 24, 2024 03:41:08.116673946 CET4434974823.200.196.138192.168.2.4
                          Nov 24, 2024 03:41:08.116750002 CET49748443192.168.2.423.200.196.138
                          Nov 24, 2024 03:41:08.162378073 CET49748443192.168.2.423.200.196.138
                          Nov 24, 2024 03:41:08.162499905 CET4434974823.200.196.138192.168.2.4
                          Nov 24, 2024 03:41:08.162606955 CET49748443192.168.2.423.200.196.138
                          Nov 24, 2024 03:41:08.207326889 CET4434974823.200.196.138192.168.2.4
                          Nov 24, 2024 03:41:08.210032940 CET49748443192.168.2.423.200.196.138
                          Nov 24, 2024 03:41:08.210042953 CET4434974823.200.196.138192.168.2.4
                          Nov 24, 2024 03:41:08.256916046 CET49748443192.168.2.423.200.196.138
                          Nov 24, 2024 03:41:08.497163057 CET4434974823.200.196.138192.168.2.4
                          Nov 24, 2024 03:41:08.497328043 CET4434974823.200.196.138192.168.2.4
                          Nov 24, 2024 03:41:08.497375011 CET49748443192.168.2.423.200.196.138
                          Nov 24, 2024 03:41:08.497782946 CET49748443192.168.2.423.200.196.138
                          Nov 24, 2024 03:41:08.497801065 CET4434974823.200.196.138192.168.2.4
                          Nov 24, 2024 03:41:08.497812986 CET49748443192.168.2.423.200.196.138
                          Nov 24, 2024 03:41:08.498032093 CET49748443192.168.2.423.200.196.138

                          UDP Packets

                          TimestampSource PortDest PortSource IPDest IP
                          Nov 24, 2024 03:41:02.133935928 CET4978253192.168.2.41.1.1.1

                          DNS Queries

                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                          Nov 24, 2024 03:41:02.133935928 CET192.168.2.41.1.1.10xfd4eStandard query (0)x1.i.lencr.orgA (IP address)IN (0x0001)false

                          DNS Answers

                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                          Nov 24, 2024 03:41:02.479465961 CET1.1.1.1192.168.2.40xfd4eNo error (0)x1.i.lencr.orgcrl.root-x1.letsencrypt.org.edgekey.netCNAME (Canonical name)IN (0x0001)false

                          HTTP Request Dependency Graph

                          • armmf.adobe.com

                          HTTPS Proxied Packets

                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                          0192.168.2.44974823.200.196.1384437912C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          TimestampBytes transferredDirectionData
                          2024-11-24 02:41:08 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
                          Host: armmf.adobe.com
                          Connection: keep-alive
                          Accept-Language: en-US,en;q=0.9
                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
                          Sec-Fetch-Site: same-origin
                          Sec-Fetch-Mode: no-cors
                          Sec-Fetch-Dest: empty
                          Accept-Encoding: gzip, deflate, br
                          If-None-Match: "78-5faa31cce96da"
                          If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
                          2024-11-24 02:41:08 UTC198INHTTP/1.1 304 Not Modified
                          Content-Type: text/plain; charset=UTF-8
                          Last-Modified: Mon, 01 May 2023 15:02:33 GMT
                          ETag: "78-5faa31cce96da"
                          Date: Sun, 24 Nov 2024 02:41:08 GMT
                          Connection: close


                          Statistics

                          CPU Usage

                          Click to jump to process

                          Memory Usage

                          Click to jump to process

                          High Level Behavior Distribution

                          Click to dive into process behavior distribution

                          Behavior

                          Click to jump to process

                          System Behavior

                          General

                          Target ID:0
                          Start time:21:40:51
                          Start date:23/11/2024
                          Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          Wow64 process (32bit):false
                          Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\W9po7Vc6bl.pdf"
                          Imagebase:0x7ff6bc1b0000
                          File size:5'641'176 bytes
                          MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Reputation:high
                          Has exited:true

                          General

                          Target ID:1
                          Start time:21:40:52
                          Start date:23/11/2024
                          Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          Wow64 process (32bit):false
                          Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                          Imagebase:0x7ff74bb60000
                          File size:3'581'912 bytes
                          MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Reputation:high
                          Has exited:true

                          General

                          Target ID:3
                          Start time:21:40:53
                          Start date:23/11/2024
                          Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          Wow64 process (32bit):false
                          Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1672,i,12757576538781070382,9876864705769082499,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                          Imagebase:0x7ff74bb60000
                          File size:3'581'912 bytes
                          MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Reputation:high
                          Has exited:true

                          Disassembly

                          ⊘No disassembly