Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
whatever.pdf

Overview

General Information

Sample name:whatever.pdf
Analysis ID:1562729
MD5:49000a69db20e7941f2920dc1cbc5112
SHA1:a649cceb446ff91519c12e9ad822ac614fe25847
SHA256:2291425fa2c209b2841477887048721d207ece76b1527d763b55acc7cf01251b
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 6728 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\whatever.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 3264 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 7188 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2180 --field-trial-handle=1500,i,12905710345105868703,1686702495363007112,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficDNS query: name: x1.i.lencr.org
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global trafficTCP traffic: 23.195.76.153:443 -> 192.168.2.4:49743
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global trafficTCP traffic: 23.195.76.153:443 -> 192.168.2.4:49743
Source: global trafficTCP traffic: 23.195.76.153:443 -> 192.168.2.4:49743
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global trafficTCP traffic: 23.195.76.153:443 -> 192.168.2.4:49743
Source: global trafficTCP traffic: 23.195.76.153:443 -> 192.168.2.4:49743
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global trafficTCP traffic: 23.195.76.153:443 -> 192.168.2.4:49743
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global trafficTCP traffic: 23.195.76.153:443 -> 192.168.2.4:49743
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global trafficTCP traffic: 23.195.76.153:443 -> 192.168.2.4:49743
Source: global trafficTCP traffic: 23.195.76.153:443 -> 192.168.2.4:49743
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global trafficTCP traffic: 23.195.76.153:443 -> 192.168.2.4:49743
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global trafficTCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: Joe Sandbox ViewIP Address: 23.195.76.153 23.195.76.153
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknownTCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknownTCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknownTCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknownTCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknownTCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknownTCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknownTCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknownTCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknownTCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknownTCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknownTCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global trafficDNS traffic detected: DNS query: x1.i.lencr.org
Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.drString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.drString found in binary or memory: http://x1.i.lencr.org/
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: classification engineClassification label: clean2.winPDF@15/53@1/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journalJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-25 17-41-02-958.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\whatever.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2180 --field-trial-handle=1500,i,12905710345105868703,1686702495363007112,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2180 --field-trial-handle=1500,i,12905710345105868703,1686702495363007112,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: whatever.pdfInitial sample: PDF keyword /JS count = 0
Source: whatever.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: whatever.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts3
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media2
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive13
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1562729 Sample: whatever.pdf Startdate: 25/11/2024 Architecture: WINDOWS Score: 2 14 x1.i.lencr.org 2->14 16 bg.microsoft.map.fastly.net 2->16 7 Acrobat.exe 18 76 2->7         started        process3 process4 9 AcroCEF.exe 106 7->9         started        process5 11 AcroCEF.exe 4 9->11         started        dnsIp6 18 23.195.76.153, 443, 49743 NTT-COMMUNICATIONS-2914US United States 11->18

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
bg.microsoft.map.fastly.net
199.232.210.172
truefalse
    		high
    x1.i.lencr.org
    		unknown
    		unknownfalse
      		high

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      http://x1.i.lencr.org/2D85F72862B55C4EADD9E66E06947F3D0.1.drfalse
        		high

        World Map of Contacted IPs

        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs

        Public IPs

        IPDomainCountryFlagASNASN NameMalicious
        23.195.76.153
        		unknownUnited States
        		2914NTT-COMMUNICATIONS-2914USfalse

        General Information

        Joe Sandbox version:41.0.0 Charoite
        Analysis ID:1562729
        Start date and time:2024-11-25 23:40:08 +01:00
        Joe Sandbox product:CloudBasic
        Overall analysis duration:0h 4m 3s
        Hypervisor based Inspection enabled:false
        Report type:full
        Cookbook file name:defaultwindowspdfcookbook.jbs
        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
        Number of analysed new started processes analysed:10
        Number of new started drivers analysed:0
        Number of existing processes analysed:0
        Number of existing drivers analysed:0
        Number of injected processes analysed:0
        Technologies:
        • EGA enabled
        • AMSI enabled
        Analysis Mode:default
        Analysis stop reason:Timeout
        Sample name:whatever.pdf
        Detection:CLEAN
        Classification:clean2.winPDF@15/53@1/1
        Cookbook Comments:
        • Found application associated with file extension: .pdf
        • Found PDF document
        • Close Viewer

        Warnings

        • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
        • Excluded IPs from analysis (whitelisted): 23.218.208.137, 23.32.238.128, 23.32.238.89, 2.19.198.65, 23.32.238.96, 23.32.238.130, 18.213.11.84, 34.237.241.83, 50.16.47.176, 54.224.241.105, 162.159.61.3, 172.64.41.3, 23.195.39.65, 199.232.210.172, 23.32.238.163, 2.19.198.75, 23.32.238.147, 23.32.238.137
        • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
        • Not all processes where analyzed, report is missing behavior information
        • Report size getting too big, too many NtCreateFile calls found.
        • VT rate limit hit for: whatever.pdf

        Simulations

        Behavior and APIs

        TimeTypeDescription
        17:41:15API Interceptor2x Sleep call for process: AcroCEF.exe modified

        Joe Sandbox View / Context

        IPs

        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        23.195.76.153Invoice-99007553423-protected.pdfGet hashmaliciousUnknownBrowse
          Kellyb Timesheet Report.pdfGet hashmaliciousHTMLPhisherBrowse
            Demande de proposition du Fondation qu#U00e9b#U00e9coise du cancer.pdfGet hashmaliciousUnknownBrowse
              Atlanta Office Interiors #024-010.pdfGet hashmaliciousUnknownBrowse
                Contract_Agreement_Monday October 2024.pdfGet hashmaliciousUnknownBrowse
                  Open 99 Restaurants Benefits Enrollment.pdfGet hashmaliciousHTMLPhisherBrowse
                    DOC-72212087.pdfGet hashmaliciousHTMLPhisherBrowse
                      [EXTERNAL] Complete with AdobeSignPDF_ Approve and Sign TRCOT.emlGet hashmaliciousUnknownBrowse
                        Secured Doc-[uiC-22723].pdfGet hashmaliciousHTMLPhisherBrowse
                          Secured Doc-[qnz-33059].pdfGet hashmaliciousHTMLPhisherBrowse

                            Domains

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            bg.microsoft.map.fastly.netFumari INC.emlGet hashmaliciousUnknownBrowse
                            • 199.232.210.172
                            fpAb6lVZ9A.dllGet hashmaliciousCobaltStrikeBrowse
                            • 199.232.214.172
                            Customer forms.pdfGet hashmaliciousUnknownBrowse
                            • 199.232.214.172
                            IJ9n6ms5CT.exeGet hashmaliciousUnknownBrowse
                            • 199.232.210.172
                            Evidence of copyright infringement.batGet hashmaliciousUnknownBrowse
                            • 199.232.214.172
                            AccountDocuments - christinal.docxGet hashmaliciousUnknownBrowse
                            • 199.232.214.172
                            Disputes.accdbGet hashmaliciousUnknownBrowse
                            • 199.232.214.172
                            ZwmyzMxFKL.exeGet hashmaliciousBlackMoonBrowse
                            • 199.232.210.172
                            PVJ6cLZQ0T.xlsGet hashmaliciousUnknownBrowse
                            • 199.232.214.172
                            Pe4905VGl1.batGet hashmaliciousAsyncRATBrowse
                            • 199.232.214.172

                            ASNs

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            NTT-COMMUNICATIONS-2914USfbot.ppc.elfGet hashmaliciousMirai, MoobotBrowse
                            • 198.173.254.24
                            fbot.sh4.elfGet hashmaliciousMirai, MoobotBrowse
                            • 204.142.152.149
                            Invoice-99007553423-protected.pdfGet hashmaliciousUnknownBrowse
                            • 23.195.76.153
                            la.bot.arm7.elfGet hashmaliciousUnknownBrowse
                            • 216.42.68.65
                            la.bot.powerpc.elfGet hashmaliciousUnknownBrowse
                            • 205.11.88.171
                            la.bot.mips.elfGet hashmaliciousUnknownBrowse
                            • 207.55.169.62
                            la.bot.arm.elfGet hashmaliciousUnknownBrowse
                            • 198.173.230.56
                            loligang.sh4.elfGet hashmaliciousMiraiBrowse
                            • 207.58.17.43
                            loligang.mips.elfGet hashmaliciousMiraiBrowse
                            • 198.66.165.214
                            apep.mpsl.elfGet hashmaliciousMiraiBrowse
                            • 205.30.240.186

                            JA3 Fingerprints

                            ⊘No context

                            Dropped Files

                            ⊘No context

                            Created / dropped Files

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:ASCII text
                            Category:dropped
                            Size (bytes):289
                            Entropy (8bit):5.191658810372603
                            Encrypted:false
                            SSDEEP:6:HApL0q2Pwkn2nKuAl9OmbnIFUt8YApN5XZmw+YApN5FkwOwkn2nKuAl9OmbjLJ:g50vYfHAahFUt87xX/+7xF5JfHAaSJ
                            MD5:08FC691601FF5036BA1A86322E8AA51F
                            SHA1:55E6CD1C2425A368EC1070DDD00A55C49F004EC9
                            SHA-256:CF6A6235A1A786FEEA0A4A0B4D8CD757DCE5BA6C81B9540933DB6398A8C751D8
                            SHA-512:2A991156C177DB32B1572D58768658C511A2F72575B5B9263B3F5F6CFF12E20CBCCBD5C50EBCDE862EC06F1947D8A3717B113E6AD417233C31E495120DBE741B
                            Malicious:false
                            Reputation:low
                            Preview:2024/11/25-17:41:01.063 154 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/25-17:41:01.065 154 Recovering log #3.2024/11/25-17:41:01.065 154 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:ASCII text
                            Category:dropped
                            Size (bytes):289
                            Entropy (8bit):5.191658810372603
                            Encrypted:false
                            SSDEEP:6:HApL0q2Pwkn2nKuAl9OmbnIFUt8YApN5XZmw+YApN5FkwOwkn2nKuAl9OmbjLJ:g50vYfHAahFUt87xX/+7xF5JfHAaSJ
                            MD5:08FC691601FF5036BA1A86322E8AA51F
                            SHA1:55E6CD1C2425A368EC1070DDD00A55C49F004EC9
                            SHA-256:CF6A6235A1A786FEEA0A4A0B4D8CD757DCE5BA6C81B9540933DB6398A8C751D8
                            SHA-512:2A991156C177DB32B1572D58768658C511A2F72575B5B9263B3F5F6CFF12E20CBCCBD5C50EBCDE862EC06F1947D8A3717B113E6AD417233C31E495120DBE741B
                            Malicious:false
                            Reputation:low
                            Preview:2024/11/25-17:41:01.063 154 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/25-17:41:01.065 154 Recovering log #3.2024/11/25-17:41:01.065 154 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:ASCII text
                            Category:dropped
                            Size (bytes):336
                            Entropy (8bit):5.14231583691271
                            Encrypted:false
                            SSDEEP:6:HAp8URN9+q2Pwkn2nKuAl9Ombzo2jMGIFUt8YApeGREJZmw+YApeGRE9VkwOwknV:giq9+vYfHAa8uFUt87sGREJ/+7sGRE9a
                            MD5:95CB02BCF38DBB3832C07F642EAA8E1E
                            SHA1:92B79905D3FE84AC667507620CEE166D218D0D45
                            SHA-256:F01ECABDEE89DEFE24D27870BFFEDE1A50262D66AE4D205E53465B057C7CF13F
                            SHA-512:85D48D6219C2FC26AD848B1FDD7800EF3F3EB51F6C2CA47037800605B8562C5AE12582E86625DA35EEF89AECA90CEDC6050B48E449768B63307391B2C93DEE37
                            Malicious:false
                            Reputation:low
                            Preview:2024/11/25-17:41:01.161 1c4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/11/25-17:41:01.162 1c4c Recovering log #3.2024/11/25-17:41:01.162 1c4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:ASCII text
                            Category:dropped
                            Size (bytes):336
                            Entropy (8bit):5.14231583691271
                            Encrypted:false
                            SSDEEP:6:HAp8URN9+q2Pwkn2nKuAl9Ombzo2jMGIFUt8YApeGREJZmw+YApeGRE9VkwOwknV:giq9+vYfHAa8uFUt87sGREJ/+7sGRE9a
                            MD5:95CB02BCF38DBB3832C07F642EAA8E1E
                            SHA1:92B79905D3FE84AC667507620CEE166D218D0D45
                            SHA-256:F01ECABDEE89DEFE24D27870BFFEDE1A50262D66AE4D205E53465B057C7CF13F
                            SHA-512:85D48D6219C2FC26AD848B1FDD7800EF3F3EB51F6C2CA47037800605B8562C5AE12582E86625DA35EEF89AECA90CEDC6050B48E449768B63307391B2C93DEE37
                            Malicious:false
                            Reputation:low
                            Preview:2024/11/25-17:41:01.161 1c4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/11/25-17:41:01.162 1c4c Recovering log #3.2024/11/25-17:41:01.162 1c4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\576d58f6-76b7-4b2f-800e-733b6f544198.tmp

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):475
                            Entropy (8bit):4.967403857886107
                            Encrypted:false
                            SSDEEP:12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
                            MD5:B7761633048D74E3C02F61AD04E00147
                            SHA1:72A2D446DF757BAEA2C7A58C050925976E4C9372
                            SHA-256:1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
                            SHA-512:397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
                            Malicious:false
                            Reputation:moderate, very likely benign file
                            Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):475
                            Entropy (8bit):4.967403857886107
                            Encrypted:false
                            SSDEEP:12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
                            MD5:B7761633048D74E3C02F61AD04E00147
                            SHA1:72A2D446DF757BAEA2C7A58C050925976E4C9372
                            SHA-256:1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
                            SHA-512:397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
                            Malicious:false
                            Reputation:moderate, very likely benign file
                            Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3cdea4.TMP (copy)

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):475
                            Entropy (8bit):4.967403857886107
                            Encrypted:false
                            SSDEEP:12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
                            MD5:B7761633048D74E3C02F61AD04E00147
                            SHA1:72A2D446DF757BAEA2C7A58C050925976E4C9372
                            SHA-256:1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
                            SHA-512:397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
                            Malicious:false
                            Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e0e617d5-46a5-420b-9ffa-db3dd906d64f.tmp

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:JSON data
                            Category:modified
                            Size (bytes):475
                            Entropy (8bit):4.960151555911252
                            Encrypted:false
                            SSDEEP:12:YH/um3RA8sq2SQsBdOg2HAcaq3QYiubInP7E4TX:Y2sRdsFSFdMHr3QYhbG7n7
                            MD5:554E819780E7AD02A7232829476714FC
                            SHA1:BFCD9E24CF35E8520087EFDB7CC7C3BD809CD345
                            SHA-256:033EEC8D458A70BFBF7B9D6CD5A1BE1657A1EFC058BA3B8D2476592FFC5E3BD6
                            SHA-512:BFE541B9FE86E9DDB028A07DE6EC8947089301F6B0897720D702A86493751EBBA815F393EFFC469E7E689E8F8495848B30C24D705A7A46F2772728A7476FEBF9
                            Malicious:false
                            Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377134473261268","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":656553},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):4730
                            Entropy (8bit):5.25768259644992
                            Encrypted:false
                            SSDEEP:96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo70OqQ1Kql1hGZ:etJCV4FiN/jTN/2r8Mta02fEhgO73gow
                            MD5:EF49B7D4081B12589B2D978A41678230
                            SHA1:2C1ED4229EDDD9CBCA61FCF7ECC6810E8894049A
                            SHA-256:39D4996A31054841E1DF672172023CF4A24C84B74BA73306D6909EBAA3171083
                            SHA-512:607FF44ED5878F99539BF42A946BF2D2C405029E0C5004FC1AC3AFA6106CAEAB293F24E716C8285C91CF93DBACD8FF5575E8FC235C8D0F1E40965EA339A0D0F9
                            Malicious:false
                            Preview:*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:ASCII text
                            Category:dropped
                            Size (bytes):324
                            Entropy (8bit):5.14427634137583
                            Encrypted:false
                            SSDEEP:6:HAp+s9+q2Pwkn2nKuAl9OmbzNMxIFUt8YAphYNJZmw+YApcs9VkwOwkn2nKuAl9c:gws9+vYfHAa8jFUt87yJ/+739V5JfHAo
                            MD5:E3B911D03098EA2DF0996ED459A2E61B
                            SHA1:A1705336EE3D569AB3A5832B3C8D03A3049143DE
                            SHA-256:52840193AC6102779B8C3FBFFA1D28A140CCD20F22A73184A78D03B62E78B7B3
                            SHA-512:877CCDC42C1129850700624B662F68C3796E65208F0F4AE0FFB211C2E94E8D0069E0ACFE867CE671C8540DFF20875F3A74DAFF50195D82888A40BA1DB2EBB6A7
                            Malicious:false
                            Preview:2024/11/25-17:41:01.310 1c4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/11/25-17:41:01.333 1c4c Recovering log #3.2024/11/25-17:41:01.334 1c4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:ASCII text
                            Category:dropped
                            Size (bytes):324
                            Entropy (8bit):5.14427634137583
                            Encrypted:false
                            SSDEEP:6:HAp+s9+q2Pwkn2nKuAl9OmbzNMxIFUt8YAphYNJZmw+YApcs9VkwOwkn2nKuAl9c:gws9+vYfHAa8jFUt87yJ/+739V5JfHAo
                            MD5:E3B911D03098EA2DF0996ED459A2E61B
                            SHA1:A1705336EE3D569AB3A5832B3C8D03A3049143DE
                            SHA-256:52840193AC6102779B8C3FBFFA1D28A140CCD20F22A73184A78D03B62E78B7B3
                            SHA-512:877CCDC42C1129850700624B662F68C3796E65208F0F4AE0FFB211C2E94E8D0069E0ACFE867CE671C8540DFF20875F3A74DAFF50195D82888A40BA1DB2EBB6A7
                            Malicious:false
                            Preview:2024/11/25-17:41:01.310 1c4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/11/25-17:41:01.333 1c4c Recovering log #3.2024/11/25-17:41:01.334 1c4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                            C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241125224105Z-151.bmp

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
                            Category:dropped
                            Size (bytes):71190
                            Entropy (8bit):0.02436170066110048
                            Encrypted:false
                            SSDEEP:3:uIX0llBasxRYLkbBTpC/u/alWH9KNanR2ibMHaR8w:ujlhLKGa4M2
                            MD5:15657DF5CD901634F5172FBFA68562BB
                            SHA1:95F5596CB44A10AD597F7BBE5A8703FBD96D0CFF
                            SHA-256:038F361ED5955E9685A224342C8B73E43DB5708E49953CB0EFC205F0ABE6A065
                            SHA-512:86377CFEEA2D951A6D10922EA7E7E95AD6CBB566C5AEAC647467A3301911F8F273675327184A0455390DFB581320135AC7A15EF8975819099ED9F93DC9625319
                            Malicious:false
                            Preview:BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
                            Category:dropped
                            Size (bytes):86016
                            Entropy (8bit):4.445020778331242
                            Encrypted:false
                            SSDEEP:384:yezci5tUiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rDs3OazzU89UTTgUL
                            MD5:62E62CAA4AAAFC4E3E08A5378E119172
                            SHA1:BCC9F38A341E356E6064444692FD71A01E14887A
                            SHA-256:6A3146843D60E55D30CCCA64115121B84AD32E5B9CD5A5AB1BA8E632D5510AD0
                            SHA-512:BA190BD8484E13E8503A337714B8BE150514183129915CB6458F40136EA7D12C826C2292526568488CA010D2CC85FB9B72A4EE822327BB45DE6B7085252196AF
                            Malicious:false
                            Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:SQLite Rollback Journal
                            Category:dropped
                            Size (bytes):8720
                            Entropy (8bit):3.7763053122486125
                            Encrypted:false
                            SSDEEP:48:7Msp/E2ioyVcioy9oWoy1Cwoy1YKOioy1noy1AYoy1Wioy1hioybioyaoy1noy1r:7LpjucFvXKQ3ub9IVXEBodRBks
                            MD5:EE98D8BD602614D81BE1E657AFC0C336
                            SHA1:523E82D2D7036B83DFCB27D292D75A4CB4A3F1AC
                            SHA-256:8DAA4C8EAE49ED9059BC7620C2D9BA2A5B36E97D2CBED599ED6613BFC59A9C01
                            SHA-512:B525B2CA1F287F3149D32B630863CE1D06864F6ACF76373C533AEC871290842388B97E702ED04BEF0994CD3822178741E479D3E6B594FFDD19393876399DDCF9
                            Malicious:false
                            Preview:.... .c.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:Certificate, Version=3
                            Category:dropped
                            Size (bytes):1391
                            Entropy (8bit):7.705940075877404
                            Encrypted:false
                            SSDEEP:24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
                            MD5:0CD2F9E0DA1773E9ED864DA5E370E74E
                            SHA1:CABD2A79A1076A31F21D253635CB039D4329A5E8
                            SHA-256:96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
                            SHA-512:3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
                            Malicious:false
                            Preview:0..k0..S............@.YDc.c...0...*.H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0...*.H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I.....*.A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.|C.t..t.....0.[q6....00\H..;..}`...).........A.......|.;F.H*..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..|o..;.....'...}~.."......

                            C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                            Category:dropped
                            Size (bytes):71954
                            Entropy (8bit):7.996617769952133
                            Encrypted:true
                            SSDEEP:1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
                            MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
                            SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
                            SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
                            SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
                            Malicious:false
                            Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

                            C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):192
                            Entropy (8bit):2.775162490582081
                            Encrypted:false
                            SSDEEP:3:kkFklgDO1EttfllXlE/HT8kDl7/ltNNX8RolJuRdxLlGB9lQRYwpDdt:kK5KWeT86l7tTNMa8RdWBwRd
                            MD5:379E9582B695F4CF5878CFA1D3E910A5
                            SHA1:0ABF91033F38AE8047FA5B26AD5D205113B7556A
                            SHA-256:C0048275FBF435D6F0027FCC76BECCB7B5A73168DE5E766DDE87CF80379BECBF
                            SHA-512:59757ABC30C82ED46E622A75DB2FA44ED450339CACA5740685D3E115E17C54C88A2FE859BC3F9D42CA4D78A25313E1F05C1A46E031BDC6D32CB2CD5D6D2BA8C0
                            Malicious:false
                            Preview:p...... ...........".?..(....................................................... ..........W....+<..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

                            C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:data
                            Category:modified
                            Size (bytes):328
                            Entropy (8bit):3.253995428229512
                            Encrypted:false
                            SSDEEP:6:kKRwWL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:qWiDImsLNkPlE99SNxAhUe/3
                            MD5:86A3F7437146F24A95E70D354150CD1F
                            SHA1:161287FA51CFE1D55FA3C6EB1F648F63E29A8856
                            SHA-256:036D3646DA4A6B30461A5B780CCD9CDCC31C46ACDF6B78132C61157983A6089D
                            SHA-512:E44E865C35AE64F77BB0382196BCAC6DFED9703768B4CBA69D0356D44624360C495B715E92291D6127CC17ED1FEF9769FF2FC53D655B201235333C832DEFB462
                            Malicious:false
                            Preview:p...... ...........5.?..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:PostScript document text
                            Category:dropped
                            Size (bytes):1233
                            Entropy (8bit):5.233980037532449
                            Encrypted:false
                            SSDEEP:24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
                            MD5:8BA9D8BEBA42C23A5DB405994B54903F
                            SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
                            SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
                            SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
                            Malicious:false
                            Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4956

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:PostScript document text
                            Category:dropped
                            Size (bytes):1233
                            Entropy (8bit):5.233980037532449
                            Encrypted:false
                            SSDEEP:24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
                            MD5:8BA9D8BEBA42C23A5DB405994B54903F
                            SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
                            SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
                            SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
                            Malicious:false
                            Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:PostScript document text
                            Category:dropped
                            Size (bytes):1233
                            Entropy (8bit):5.233980037532449
                            Encrypted:false
                            SSDEEP:24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
                            MD5:8BA9D8BEBA42C23A5DB405994B54903F
                            SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
                            SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
                            SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
                            Malicious:false
                            Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:PostScript document text
                            Category:dropped
                            Size (bytes):10880
                            Entropy (8bit):5.214360287289079
                            Encrypted:false
                            SSDEEP:192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
                            MD5:B60EE534029885BD6DECA42D1263BDC0
                            SHA1:4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
                            SHA-256:B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
                            SHA-512:52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
                            Malicious:false
                            Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4956

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:PostScript document text
                            Category:dropped
                            Size (bytes):10880
                            Entropy (8bit):5.214360287289079
                            Encrypted:false
                            SSDEEP:192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
                            MD5:B60EE534029885BD6DECA42D1263BDC0
                            SHA1:4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
                            SHA-256:B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
                            SHA-512:52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
                            Malicious:false
                            Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):243196
                            Entropy (8bit):3.3450692389394283
                            Encrypted:false
                            SSDEEP:1536:vKPCPiyzDtrh1cK3XEivK7VK/3AYvYwgqErRo+RQn:yPClJ/3AYvYwghFo+RQn
                            MD5:F5567C4FF4AB049B696D3BE0DD72A793
                            SHA1:EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916
                            SHA-256:D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
                            SHA-512:E769735991E5B1331E259608854D00CDA4F3E92285FDC500158CBD09CBCCEAD8A387F78256A43919B13EBE70C995D19242377C315B0CCBBD4F813251608C1D56
                            Malicious:false
                            Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):295
                            Entropy (8bit):5.356997894630794
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HX7vHnTdnVoZcg1vRcR0YieoAvJM3g98kUwPeUkwRe9:YvXKX7fxWZc0vnVGMbLUkee9
                            MD5:85D263103403DA40239B8FCF848201D0
                            SHA1:BAB9556AAC883917B1441A593C72B0AC4251BBAA
                            SHA-256:F0B0A2ABDFC960D10433C90CFFBE536D625F2AC0E00B2A08D52A1540F402CAD6
                            SHA-512:0231EC99B1413A206943AA2CD8F5B7B4DC93A380F0B3F4A0C4026E348D366F31877C7ADC10886827052B9BE91C5B6ED8FAF6F6C73965E108CAB7244BA24CA670
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"a7471418-ac90-4b02-867f-e4d06ac9dcdb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732752565458,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):294
                            Entropy (8bit):5.3071646709563245
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HX7vHnTdnVoZcg1vRcR0YieoAvJfBoTfXpnrPeUkwRe9:YvXKX7fxWZc0vnVGWTfXcUkee9
                            MD5:773A74E4A8C858B9F2F2F9F8E70A6BCF
                            SHA1:3F2A5D05DBEB3B7987A11DBA59EC8A5956BA2C9B
                            SHA-256:A4D753318FE2AAB9E14440F3BA9A7432116F6B6B970D98E2CA9D4B779EC1648E
                            SHA-512:D73DA36F3C01672FE2D3EF18BF1546FC98723591C6C24A948DCF74AF9873A9A034B486894079A9BA386ADEBE5CD3C8051235A6A75673698EF50BD2FBE2B42D70
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"a7471418-ac90-4b02-867f-e4d06ac9dcdb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732752565458,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):294
                            Entropy (8bit):5.285014764533394
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HX7vHnTdnVoZcg1vRcR0YieoAvJfBD2G6UpnrPeUkwRe9:YvXKX7fxWZc0vnVGR22cUkee9
                            MD5:3F2673D726E1CE3C94373B50276ADD7D
                            SHA1:D5F12E3540D8355FAE81916F4FB42A2A8E40D439
                            SHA-256:60EABA6873F30C7D1FE961FA82C6D25018A01CA1974ED1A534027564EEE8AFA5
                            SHA-512:6FB3C645BA47A3E98157BD58698CA15E1A7D944041D53492DC94ADD8C975CE9641FC3DD8564C998EED12959B4A8BE4858DE60FC1CEB9928931D6EC3A2EA511C6
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"a7471418-ac90-4b02-867f-e4d06ac9dcdb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732752565458,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):285
                            Entropy (8bit):5.343785050240466
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HX7vHnTdnVoZcg1vRcR0YieoAvJfPmwrPeUkwRe9:YvXKX7fxWZc0vnVGH56Ukee9
                            MD5:6E911DAB548FAEB64450B8909EE7EDFD
                            SHA1:FBD250B25954B3E15BAFE0173FFF995B802BDEA7
                            SHA-256:20937EFC18A50D682147F9B8CF9AA5A001CF2CB869B4EEC896CA5E4D97EAC946
                            SHA-512:BF79498FEF9DC2DD3A0999EF32F65E210489BAE2BF2A1B615852342AB8D02D7BE105DB148B9485BD6B68A1DDF6A7EF40D467C939A97A12ACA75B1E56C973EB35
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"a7471418-ac90-4b02-867f-e4d06ac9dcdb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732752565458,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):1123
                            Entropy (8bit):5.688041066542932
                            Encrypted:false
                            SSDEEP:24:Yv6Xwzv6pLgE9cQx8LennAvzBvkn0RCmK8czOCCSE:YvvShgy6SAFv5Ah8cv/E
                            MD5:221DAFAB1CDBEE8E557053489290A77C
                            SHA1:1F8E79C5259B462E43CE9358D92629ABF8CF2F48
                            SHA-256:943222CAE461E2B907EC2D30E35EBBDC2888C863D4676BCAC8B57C8DE4D38A34
                            SHA-512:8D97441AC12EA1FA979EC2FAE47084BED024497E9F680324BB7ACD1011741ED50BCD3778C6EB5C6F1FF6828B1B7D948F7C57EAC2FD018E43125B3EF415038591
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"a7471418-ac90-4b02-867f-e4d06ac9dcdb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732752565458,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):1122
                            Entropy (8bit):5.680755870148579
                            Encrypted:false
                            SSDEEP:24:Yv6XwzvcVLgEwcp06ybnAvz7xHn0RCmK8czOCYHfl8zdBR:YvvUFgSNycJUAh8cvYH2
                            MD5:FB22E024EF42FC6107A52770FA33C9A3
                            SHA1:5A9AF955A314A2B75011368E22450EC55CAD726F
                            SHA-256:763B007A5035BF3870D361DC0D7403C35222BABA296A850496F28CEB5F82C878
                            SHA-512:F214CFD1AD97142DC86978693DA30DB898BFAD4E0EEAE2307FF3A51D5E9A6F8D19211F9DB7EFC542208501BFF9A88BD88182D75E260C8283D2FF7FB967D325DA
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"a7471418-ac90-4b02-867f-e4d06ac9dcdb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732752565458,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93181_288855ActionBlock_0","campaignId":93181,"containerId":"1","controlGroupId":"","treatmentId":"1aad653c-ef44-43f7-be1c-3a2ba2cf2cfc","variationId":"288855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuIFBERiBmb3JtcyAmIGFncmVlbWVudHMuIn0sInRjY

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):292
                            Entropy (8bit):5.2931598769355475
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HX7vHnTdnVoZcg1vRcR0YieoAvJfQ1rPeUkwRe9:YvXKX7fxWZc0vnVGY16Ukee9
                            MD5:2D010DDD67E1576904BA0B35E4A275E8
                            SHA1:FB60172C002136DC7A2A3C8E0A6D735688CEEDD2
                            SHA-256:0BAB87F8D5F1C5A4B980075F61BAF186F4D6AB11C1F5C1253D6129F7703E9755
                            SHA-512:DE2DDB0A2E4933A6A692325D84CA7AACE107AC6FDCDB51F1FC9F3705A6BC5F46E044E5AB6A257A1A214A2C88D1611F0B5AA838A8C9D4DDD767903B33AA9DEA90
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"a7471418-ac90-4b02-867f-e4d06ac9dcdb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732752565458,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):1102
                            Entropy (8bit):5.672470927297343
                            Encrypted:false
                            SSDEEP:24:Yv6XwzvB2LgErcXWl7y0nAvzIBcSJCBViVR:Yvv5ogH47yfkB5kVE
                            MD5:CD4618DA11FC24996FCAED7D118CFC4C
                            SHA1:E89624AA039F7AAEABE28C1A403BF7D653AC8936
                            SHA-256:2756B5BE57A2F18995B83C5345FC896E30FD0AD54437B39A7046951C111366C0
                            SHA-512:EEE87452F7910DBD9CE05436E8339E9BFD52F40C117EC1B517241F22A51D2A850A7F2420CACEDC0E1CAF664C7D0210B36C614DDD5B26BC4F35174A918B425236
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"a7471418-ac90-4b02-867f-e4d06ac9dcdb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732752565458,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93181_288855ActionBlock_1","campaignId":93181,"containerId":"1","controlGroupId":"","treatmentId":"533ab5eb-b236-4889-89a5-ac002261d71e","variationId":"288855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkVkaXRQREZSZHJBcHBGdWxsIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTRweCIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTJweCIsImZvbnRfc3R5bGUiOiItMSJ9LCJ0aXRsZSI6bnVsbCwiZGVzY3JpcHRpb24iOiJFZGl0IHRleHQsIGltYWdlcywgcGFnZXMsIGFuZCBtb3JlLiJ9LCJ0Y2F0SWQiOm51bGx9","da

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):1164
                            Entropy (8bit):5.695635503793581
                            Encrypted:false
                            SSDEEP:24:Yv6XwzvBKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK5R:YvvJEgqprtrS5OZjSlwTmAfSKT
                            MD5:4CB7A7B6A546A22C07BAC2872555C956
                            SHA1:ABC7030D2E558716D7C9C24B3357026D257007EC
                            SHA-256:19A2532AEB88198E4BC5BADD4AAF32B8CB638B191D28CBA8A0C2937AB573B1A6
                            SHA-512:8013ECDD5B39B631CE0BF5387645D180DBCFA8945586D87A878047D7CA536D8CCEB98B7EB015B575B65354CA401F43F8B85968554B580D53540B6DA8F7B32CE7
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"a7471418-ac90-4b02-867f-e4d06ac9dcdb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732752565458,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):289
                            Entropy (8bit):5.295599055915153
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HX7vHnTdnVoZcg1vRcR0YieoAvJfYdPeUkwRe9:YvXKX7fxWZc0vnVGg8Ukee9
                            MD5:CA92F0B855F4FD7AB19579A7F10F2213
                            SHA1:DC9947CD78B0335CE6C878BDEF20CAB6D8F4BBDD
                            SHA-256:622778417E1FEFAB8BE7102BDE714CB280901D846E1C01B7145AFA9CC683F9D9
                            SHA-512:9F1A0617D838BC01E7447F902E60DE7FF3CF0FB3DEBBA659430AFFEED46E08756B99EBE9BF80BE151B072829DEDF98574D2CDFBCCFAB86C853BDEA16E59131E2
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"a7471418-ac90-4b02-867f-e4d06ac9dcdb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732752565458,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):284
                            Entropy (8bit):5.281571947328082
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HX7vHnTdnVoZcg1vRcR0YieoAvJf+dPeUkwRe9:YvXKX7fxWZc0vnVG28Ukee9
                            MD5:80769CF534FA433D6ECF606F2E4D19B9
                            SHA1:C74BC0FD3F4255DF55C87F4A4253C9BA318BCAAA
                            SHA-256:7C6A1D8ABD5BBBB932ED37BEC36022B096FFAF3F7192903F5852EB3E0F3D46D4
                            SHA-512:6A90A2A4D13185348BECA17C671D0F72F96E6817E200FC74D5873264F100C9D172549878FC79E1E25604C939FC8A1F3934DE857578401245E539788B38746F8E
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"a7471418-ac90-4b02-867f-e4d06ac9dcdb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732752565458,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):291
                            Entropy (8bit):5.279176400627401
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HX7vHnTdnVoZcg1vRcR0YieoAvJfbPtdPeUkwRe9:YvXKX7fxWZc0vnVGDV8Ukee9
                            MD5:FED0444CC831FE8B12E85406A3BF0EE0
                            SHA1:4D2BE4A982897B1445AB954E238E29B64E5116CC
                            SHA-256:8014DF327E2E1BBD68C8F26A13FFC1718B005527A178026549F6A812061CAE6A
                            SHA-512:CBE4769965B7982994E493E910995A57A1B59C3E5479EE985445DC0DAF82DA357FCCBC06FF3EAFC3C8233D829C00AAF347639EE4A5AA4F767491FED68AA67B0E
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"a7471418-ac90-4b02-867f-e4d06ac9dcdb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732752565458,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):287
                            Entropy (8bit):5.284062803212282
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HX7vHnTdnVoZcg1vRcR0YieoAvJf21rPeUkwRe9:YvXKX7fxWZc0vnVG+16Ukee9
                            MD5:DAE8F07D1CB939EE3AF3AB8DC4FCDA99
                            SHA1:CE5318D532E39E9FF6430ED51F73B1C28BB999E8
                            SHA-256:FE5CB62D5EDCFD79FACEE6DF1B40588AF9A8C965C375AD381CB42D61899EAA0F
                            SHA-512:DD1058CDC3F10EB2D0A2E65770EE2CDC8EC310C2323542D7541F3DB2502328D67B9ACD6D12DE733EF5857E4134E36707C6AB64027A41FA78B4E702EE9B087A18
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"a7471418-ac90-4b02-867f-e4d06ac9dcdb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732752565458,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):1090
                            Entropy (8bit):5.664840001333842
                            Encrypted:false
                            SSDEEP:24:Yv6XwzvmamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSE:YvvQBgkDMUJUAh8cvME
                            MD5:32C9D3E95961AEBC4FB7756D168DBAE6
                            SHA1:5EB0C10E908D5F613366ED5DF1EA21E78BC77AB7
                            SHA-256:844911ABD285DCFB66AEF6945EF084FBABFBCDE0A3D753FDEF1333CD882119E2
                            SHA-512:FE52C13E30202019AE9DE914AC83F7263C7F88CE398F675D1CB1C0A0FE5EE6409AD15A6D43570A0A96ABCD89027DE7C70CECBC2D34B09920FCE97C828E914543
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"a7471418-ac90-4b02-867f-e4d06ac9dcdb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732752565458,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):286
                            Entropy (8bit):5.258251220821533
                            Encrypted:false
                            SSDEEP:6:YEQXJ2HX7vHnTdnVoZcg1vRcR0YieoAvJfshHHrPeUkwRe9:YvXKX7fxWZc0vnVGUUUkee9
                            MD5:0828981CB7300CBCF83B3AE77E5E0787
                            SHA1:329CB4D17E32C85BA7638C7D144AD9AA48C2F8FD
                            SHA-256:57D385039CE04DA17877FF34BEC432A1832DEEB65B705D84EC2B1FB5B5FCA37B
                            SHA-512:0079ED81ABA3D8CFEDDDFFF590EA72137A909DE985633C9069E8BA9934A14AB1C4A0F93231DFCE7A27A725DDD1C0EAFD7EA63A700C238D4A215CEC4FACD22382
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"a7471418-ac90-4b02-867f-e4d06ac9dcdb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732752565458,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):782
                            Entropy (8bit):5.363984486595037
                            Encrypted:false
                            SSDEEP:12:YvXKX7fxWZc0vnVGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWwY:Yv6Xwzvx168CgEXX5kcIfANhE
                            MD5:E13CD40B907B8ADEC0D8C31C558CBB4E
                            SHA1:979B4C7F97A3A4795CCC4070BB5DC11E9D985660
                            SHA-256:6176A287356F04886ADF5B2298B3DA094440B97C4C64990CE5B5DABE1B57EFFE
                            SHA-512:4073C556973A13B511BD24EF34ACA1BA3C63F0ED81520CD2312281B8FC5BD4AF509D498978068567D9D988811FD20C0BAE88C3E892C6F596C5296DB78267BEA5
                            Malicious:false
                            Preview:{"analyticsData":{"responseGUID":"a7471418-ac90-4b02-867f-e4d06ac9dcdb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1732752565458,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1732574470491}}}}

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):4
                            Entropy (8bit):0.8112781244591328
                            Encrypted:false
                            SSDEEP:3:e:e
                            MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                            SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                            SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                            SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                            Malicious:false
                            Preview:....

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):2817
                            Entropy (8bit):5.133237499929256
                            Encrypted:false
                            SSDEEP:24:Y/KkvlcaKW1ay/7CYxlCRq1bEB624xi+BoRjoj0SbSTcYCn2Mo2LSl75DEGg5MXo:Y/KWFlkq186J1BSq0Dwxon7JEhUi9l
                            MD5:DE09691ED0ECD6ED6EDB9D33CEFC63FA
                            SHA1:CA716E9B2548B5C5EBC066F3CF6A16DDF54B9F52
                            SHA-256:83632E79CFB37BC98E14CC8A49FBCDDBA0760EE61ACD1D7245490A11B10A43A5
                            SHA-512:FA8395B307FEE97EC2DEAC03D150F5E867ED7F98C204E5FFDB0159EB310D799768CBE6574A3F0433974690DB0DDCD0DC5DA2064C39493990C45E8C7F3C3B005B
                            Malicious:false
                            Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"3f9d801b7ecf67f91fe5a7ab453bb69b","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1122,"ts":1732574470000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"a3c3b8a0f0d8b5c933c852b228fd50c4","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1732574470000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"98e9cd7fc28184022b6f9630ae93e64d","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1732574470000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"e989e90856c075d46db366ee2785f43b","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1732574470000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"0dd9b7f34330ae232df465793d6e2438","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1102,"ts":1732574470000},{"id":"Edit_InApp_Aug2020","info":{"dg":"31a0cac880754a8ea940d8ecb5703a67","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":17

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
                            Category:dropped
                            Size (bytes):12288
                            Entropy (8bit):1.188426362172911
                            Encrypted:false
                            SSDEEP:48:TGufl2GL7msEHUUUUUUUU9SvR9H9vxFGiDIAEkGVvpV:lNVmswUUUUUUUU9+FGSItJ
                            MD5:184EBC29C7477A57D62BEC77BEF74CB8
                            SHA1:580396D11CD25182B45D940DA1A390908A1AB838
                            SHA-256:62D0ED8A0AA3A0B351C36E817004A2947D1EAE4630F613D37C762ECCD32915C3
                            SHA-512:FE2910CEF4D97CBF982FD839A458E9159F5F624CD224C5B60322C86CCA98CDE33451AE5EE6DE620C8112621A7DF108E80C0A388C9D9AC21353FF397833EF5707
                            Malicious:false
                            Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:SQLite Rollback Journal
                            Category:dropped
                            Size (bytes):8720
                            Entropy (8bit):1.6077272037789776
                            Encrypted:false
                            SSDEEP:48:7MnKUUUUUUUUUUFvR9H9vxFGiDIAEkGVvMqFl2GL7msF:7xUUUUUUUUUUhFGSIt6KVmsF
                            MD5:9D74A38E382A476BA68E700FBE82C227
                            SHA1:95DA4AE1C71FF5F35F25955DD2A6D37FABA8C1B0
                            SHA-256:B8A86906EE23B7C3A92B4B400DBDE42652A774F3CA7D8EC73243A08E1F0B87A1
                            SHA-512:095FE8084A95B19FC15DA66B291EC4E7E06AEEA7E6D27F26311A79C98E55651FE98DF41EFFD887B0AC13F20AA012901EC3F718261460722A7355A63672023DC2
                            Malicious:false
                            Preview:.... .c........7......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):66726
                            Entropy (8bit):5.392739213842091
                            Encrypted:false
                            SSDEEP:768:RNOpblrU6TBH44ADKZEgS664WOI2StpCeokCmR9jWBlSgYyu:6a6TZ44ADESh4WOI2StBifK
                            MD5:428B5ACF7A6A084E60952A578FB67DBA
                            SHA1:3661C8664AA78DA51942FFF34F546972D26DAD4F
                            SHA-256:9B9D77810810B31D25ED6E06774F10B1C8C981269E0F0C62941C7A7D6B464C52
                            SHA-512:631B2226C30C1125B3EF93084DC289F7334F7CD4C2DA5FEBF641D1E5316ABBFE8D70B61E2827A5816643F58BF4E8B1D7ED35FAC483F43FE9431D4940979C015B
                            Malicious:false
                            Preview:4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

                            C:\Users\user\AppData\Local\Temp\MSIc9ff5.LOG

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):246
                            Entropy (8bit):3.51161293806784
                            Encrypted:false
                            SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8fvXF:Qw946cPbiOxDlbYnuRKeF
                            MD5:03186069B1FA81460777B97829EAD199
                            SHA1:F069814528630DB67D85DBA74663D115B0678C73
                            SHA-256:09B610A8A67F29001DA0A8FE4D0860411730A2EA679EE572E0A245BD680117F6
                            SHA-512:D0EAB73B9D443A214B38445AA911BE72B930BE09E5F718A0B28DBDC31D7643CFDC83665452058422F761855ADC94A5E785BB8F9688E72D8D50165BDF72D334E8
                            Malicious:false
                            Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.5./.1.1./.2.0.2.4. . .1.7.:.4.1.:.0.8. .=.=.=.....

                            C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-25 17-41-02-958.log

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:ASCII text, with very long lines (393)
                            Category:dropped
                            Size (bytes):16525
                            Entropy (8bit):5.345946398610936
                            Encrypted:false
                            SSDEEP:384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
                            MD5:8947C10F5AB6CFFFAE64BCA79B5A0BE3
                            SHA1:70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
                            SHA-256:4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
                            SHA-512:B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
                            Malicious:false
                            Preview:SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

                            C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:ASCII text, with very long lines (393), with CRLF line terminators
                            Category:dropped
                            Size (bytes):16603
                            Entropy (8bit):5.356749630737231
                            Encrypted:false
                            SSDEEP:384:bUt/5/i/p/5uuuYYuauTu7uUuauh5ZJ5LunuUui/s/q/J/ZUQUBUwSEpEl1z1R1X:d9GF
                            MD5:7F5C9323220D66A8A04B6A3D3868A9F0
                            SHA1:982D2F35A60D93672BF7BFDC3401954738980304
                            SHA-256:E47D7D5D61C842D307AF107CEEA9C674065A3CFB43571D9027A06F46AB664604
                            SHA-512:C494EA530B039640F36F82AEFA74707E8B2DB0CCD101F0BFE81D8FDFF67538D2E94C47F7193D3662DF90D8BFD53A5676E0847222230463B5DBD0308953D911F6
                            Malicious:false
                            Preview:SessionID=33aa06f5-eb67-4c11-bf31-017c208db3e2.1732574462993 Timestamp=2024-11-25T17:41:02:993-0500 ThreadID=7680 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=33aa06f5-eb67-4c11-bf31-017c208db3e2.1732574462993 Timestamp=2024-11-25T17:41:02:994-0500 ThreadID=7680 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=33aa06f5-eb67-4c11-bf31-017c208db3e2.1732574462993 Timestamp=2024-11-25T17:41:02:994-0500 ThreadID=7680 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=33aa06f5-eb67-4c11-bf31-017c208db3e2.1732574462993 Timestamp=2024-11-25T17:41:02:994-0500 ThreadID=7680 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=33aa06f5-eb67-4c11-bf31-017c208db3e2.1732574462993 Timestamp=2024-11-25T17:41:02:994-0500 ThreadID=7680 Component=ngl-lib_NglAppLib Description="SetConf

                            C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):29752
                            Entropy (8bit):5.384945600387277
                            Encrypted:false
                            SSDEEP:768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rT:X
                            MD5:4CDFE410861EDC0DC167C97647840D15
                            SHA1:342F073CB6EA11744D941B6E6D87D95BC26E3076
                            SHA-256:F0F413555AC9A082D4706CBEBB18248D94C9F414C9F80E89FF2643A58A8DDA3D
                            SHA-512:FCD700EA5EE6067938A58220BA35C9E9D4938DA2226E32115B8AB3B383424A1506CBF93D67D6719284DFFB44DE7DB4B07567AC7D8D23D182A0376431816CFBE3
                            Malicious:false
                            Preview:03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

                            C:\Users\user\AppData\Local\Temp\acrocef_low\00298d50-be2b-481f-bc31-0ccca799ce81.tmp

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                            Category:dropped
                            Size (bytes):1419751
                            Entropy (8bit):7.976496077007677
                            Encrypted:false
                            SSDEEP:24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
                            MD5:18E3D04537AF72FDBEB3760B2D10C80E
                            SHA1:B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
                            SHA-256:BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
                            SHA-512:2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
                            Malicious:false
                            Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                            C:\Users\user\AppData\Local\Temp\acrocef_low\631d9690-e338-4ec3-9aef-03636d549d1e.tmp

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                            Category:dropped
                            Size (bytes):386528
                            Entropy (8bit):7.9736851559892425
                            Encrypted:false
                            SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                            MD5:5C48B0AD2FEF800949466AE872E1F1E2
                            SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                            SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                            SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                            Malicious:false
                            Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                            C:\Users\user\AppData\Local\Temp\acrocef_low\c9cb1629-d1fa-4763-8322-0e028e0b4c08.tmp

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                            Category:dropped
                            Size (bytes):1407294
                            Entropy (8bit):7.97605879016224
                            Encrypted:false
                            SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
                            MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
                            SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
                            SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
                            SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
                            Malicious:false
                            Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                            C:\Users\user\AppData\Local\Temp\acrocef_low\ef1d79dd-2b2c-4ecf-9b5c-a2fd48c8641c.tmp

                            Download File
                            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                            Category:dropped
                            Size (bytes):758601
                            Entropy (8bit):7.98639316555857
                            Encrypted:false
                            SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                            MD5:3A49135134665364308390AC398006F1
                            SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                            SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                            SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                            Malicious:false
                            Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                            Static File Info

                            General

                            File type:PDF document, version 1.7, 1 pages (zip deflate encoded)
                            Entropy (8bit):7.070559760428004
                            TrID:
                            • Adobe Portable Document Format (5005/1) 100.00%
                            File name:whatever.pdf
                            File size:14'072 bytes
                            MD5:49000a69db20e7941f2920dc1cbc5112
                            SHA1:a649cceb446ff91519c12e9ad822ac614fe25847
                            SHA256:2291425fa2c209b2841477887048721d207ece76b1527d763b55acc7cf01251b
                            SHA512:fe728249ef6f98dadc85b32c86bdef0ac708280ad9ea7f5daf4af6bb0ebd101d42fe0554af9a68b7b147ae845daefee81a81cfdbde3b3f5d615e0abebd614cd0
                            SSDEEP:384:yHML0/LRUjuehMor2LN6NeQJSaSZtgkmN/Eb0Y6zWLSSIigpcWx0:ysIlU9Lri0B6TmSJ9IGz
                            TLSH:B9523AA082252DCCF597EE906F5D7C59662E727338C885963C6E8B0B0741F9AE923643
                            File Content Preview:%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en) /StructTreeRoot 10 0 R/MarkInfo<</Marked true>>/Metadata 20 0 R/ViewerPreferences 21 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 1/Kids[ 3 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/R

                            File Icon

                            Icon Hash:62cc8caeb29e8ae0

                            Static PDF Info

                            General

                            Header:%PDF-1.7
                            Total Entropy:7.070560
                            Total Bytes:14072
                            Stream Entropy:7.168158
                            Stream Bytes:11221
                            Entropy outside Streams:5.242709
                            Bytes outside Streams:2851
                            Number of EOF found:2
                            Bytes after EOF:

                            Keywords Statistics

                            NameCount
                            obj15
                            endobj15
                            stream5
                            endstream5
                            xref2
                            trailer2
                            startxref2
                            /Page1
                            /Encrypt0
                            /ObjStm1
                            /URI0
                            /JS0
                            /JavaScript0
                            /AA0
                            /OpenAction0
                            /AcroForm0
                            /JBIG2Decode0
                            /RichMedia0
                            /Launch0
                            /EmbeddedFile0

                            Network Behavior

                            Network Port Distribution

                            TCP Packets

                            TimestampSource PortDest PortSource IPDest IP
                            Nov 25, 2024 23:41:13.933404922 CET49743443192.168.2.423.195.76.153
                            Nov 25, 2024 23:41:13.933433056 CET4434974323.195.76.153192.168.2.4
                            Nov 25, 2024 23:41:13.933512926 CET49743443192.168.2.423.195.76.153
                            Nov 25, 2024 23:41:13.933662891 CET49743443192.168.2.423.195.76.153
                            Nov 25, 2024 23:41:13.933681965 CET4434974323.195.76.153192.168.2.4
                            Nov 25, 2024 23:41:15.643035889 CET4434974323.195.76.153192.168.2.4
                            Nov 25, 2024 23:41:15.643366098 CET49743443192.168.2.423.195.76.153
                            Nov 25, 2024 23:41:15.643392086 CET4434974323.195.76.153192.168.2.4
                            Nov 25, 2024 23:41:15.644433975 CET4434974323.195.76.153192.168.2.4
                            Nov 25, 2024 23:41:15.644515991 CET49743443192.168.2.423.195.76.153
                            Nov 25, 2024 23:41:15.651079893 CET49743443192.168.2.423.195.76.153
                            Nov 25, 2024 23:41:15.651161909 CET4434974323.195.76.153192.168.2.4
                            Nov 25, 2024 23:41:15.651287079 CET49743443192.168.2.423.195.76.153
                            Nov 25, 2024 23:41:15.651295900 CET4434974323.195.76.153192.168.2.4
                            Nov 25, 2024 23:41:15.706221104 CET49743443192.168.2.423.195.76.153
                            Nov 25, 2024 23:41:15.985580921 CET4434974323.195.76.153192.168.2.4
                            Nov 25, 2024 23:41:15.985687017 CET4434974323.195.76.153192.168.2.4
                            Nov 25, 2024 23:41:15.985744953 CET49743443192.168.2.423.195.76.153
                            Nov 25, 2024 23:41:15.986093998 CET49743443192.168.2.423.195.76.153
                            Nov 25, 2024 23:41:15.986113071 CET4434974323.195.76.153192.168.2.4
                            Nov 25, 2024 23:41:15.986124992 CET49743443192.168.2.423.195.76.153
                            Nov 25, 2024 23:41:15.986165047 CET49743443192.168.2.423.195.76.153

                            UDP Packets

                            TimestampSource PortDest PortSource IPDest IP
                            Nov 25, 2024 23:41:14.298686981 CET5303053192.168.2.41.1.1.1

                            DNS Queries

                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                            Nov 25, 2024 23:41:14.298686981 CET192.168.2.41.1.1.10xb00dStandard query (0)x1.i.lencr.orgA (IP address)IN (0x0001)false

                            DNS Answers

                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                            Nov 25, 2024 23:41:14.615122080 CET1.1.1.1192.168.2.40xb00dNo error (0)x1.i.lencr.orgcrl.root-x1.letsencrypt.org.edgekey.netCNAME (Canonical name)IN (0x0001)false
                            Nov 25, 2024 23:41:16.431113005 CET1.1.1.1192.168.2.40xbdd0No error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
                            Nov 25, 2024 23:41:16.431113005 CET1.1.1.1192.168.2.40xbdd0No error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false

                            HTTP Request Dependency Graph

                            • armmf.adobe.com

                            HTTPS Proxied Packets

                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            0192.168.2.44974323.195.76.1534437188C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            TimestampBytes transferredDirectionData
                            2024-11-25 22:41:15 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
                            Host: armmf.adobe.com
                            Connection: keep-alive
                            Accept-Language: en-US,en;q=0.9
                            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
                            Sec-Fetch-Site: same-origin
                            Sec-Fetch-Mode: no-cors
                            Sec-Fetch-Dest: empty
                            Accept-Encoding: gzip, deflate, br
                            If-None-Match: "78-5faa31cce96da"
                            If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
                            2024-11-25 22:41:15 UTC198INHTTP/1.1 304 Not Modified
                            Content-Type: text/plain; charset=UTF-8
                            Last-Modified: Mon, 01 May 2023 15:02:33 GMT
                            ETag: "78-5faa31cce96da"
                            Date: Mon, 25 Nov 2024 22:41:15 GMT
                            Connection: close


                            Statistics

                            CPU Usage

                            Click to jump to process

                            Memory Usage

                            Click to jump to process

                            High Level Behavior Distribution

                            Click to dive into process behavior distribution

                            Behavior

                            Click to jump to process

                            System Behavior

                            General

                            Target ID:0
                            Start time:17:40:59
                            Start date:25/11/2024
                            Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                            Wow64 process (32bit):false
                            Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\whatever.pdf"
                            Imagebase:0x7ff6bc1b0000
                            File size:5'641'176 bytes
                            MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true

                            General

                            Target ID:1
                            Start time:17:41:00
                            Start date:25/11/2024
                            Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            Wow64 process (32bit):false
                            Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                            Imagebase:0x7ff74bb60000
                            File size:3'581'912 bytes
                            MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true

                            General

                            Target ID:3
                            Start time:17:41:01
                            Start date:25/11/2024
                            Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                            Wow64 process (32bit):false
                            Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2180 --field-trial-handle=1500,i,12905710345105868703,1686702495363007112,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                            Imagebase:0x7ff74bb60000
                            File size:3'581'912 bytes
                            MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true

                            Disassembly

                            ⊘No disassembly