Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
W-9 Blank - March 2024 revision.pdf

Overview

General Information

Sample name:W-9 Blank - March 2024 revision.pdf
Analysis ID:1427110
MD5:4e7f7065f6e4a526452ffacb0134bc50
SHA1:3c265a136ba7fa236cdfc7b8f8b7853ed6c63e08
SHA256:2d420cbb4123dcf1fb82595b2359cfbb5d81f00b9df9d359fcc7af361d093f53
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64_ra
  • Acrobat.exe (PID: 5912 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\W-9 Blank - March 2024 revision.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 3552 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 6340 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2260 --field-trial-handle=1576,i,17669440550934361566,2057664599773174521,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficTCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global trafficTCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global trafficTCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global trafficTCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global trafficTCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global trafficTCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global trafficTCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global trafficTCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global trafficTCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global trafficTCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global trafficTCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global trafficTCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global trafficTCP traffic: 23.54.200.159:443 -> 192.168.2.16:49714
Source: global trafficTCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global trafficTCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global trafficTCP traffic: 23.54.200.159:443 -> 192.168.2.16:49714
Source: global trafficTCP traffic: 23.54.200.159:443 -> 192.168.2.16:49714
Source: global trafficTCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global trafficTCP traffic: 23.54.200.159:443 -> 192.168.2.16:49714
Source: global trafficTCP traffic: 23.54.200.159:443 -> 192.168.2.16:49714
Source: global trafficTCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global trafficTCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global trafficTCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global trafficTCP traffic: 23.54.200.159:443 -> 192.168.2.16:49714
Source: global trafficTCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global trafficTCP traffic: 23.54.200.159:443 -> 192.168.2.16:49714
Source: global trafficTCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global trafficTCP traffic: 23.54.200.159:443 -> 192.168.2.16:49714
Source: global trafficTCP traffic: 23.54.200.159:443 -> 192.168.2.16:49714
Source: global trafficTCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global trafficTCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global trafficTCP traffic: 23.54.200.159:443 -> 192.168.2.16:49714
Source: Joe Sandbox ViewIP Address: 23.54.200.159 23.54.200.159
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.159
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br
Source: W-9 Blank - March 2024 revision.pdfString found in binary or memory: http://www.aiim.org/pdfua/ns/id/
Source: 277dd1d6-3c9f-4726-b373-68efc296bc69.tmp.3.dr, 8848a2dd-243e-41bc-921a-0039a5e3c480.tmp.3.drString found in binary or memory: https://chrome.cloudflare-dns.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
Source: classification engineClassification label: clean2.winPDF@15/46@0/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCacheJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9491l1w_169jtfc_4u0.tmpJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\W-9 Blank - March 2024 revision.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2260 --field-trial-handle=1576,i,17669440550934361566,2057664599773174521,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2260 --field-trial-handle=1576,i,17669440550934361566,2057664599773174521,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: A9491l1w_169jtfc_4u0.tmp.0.drInitial sample: PDF keyword /JS count = 0
Source: A9491l1w_169jtfc_4u0.tmp.0.drInitial sample: PDF keyword /JavaScript count = 0
Source: A9sbk45l_169jtfd_4u0.tmp.0.drInitial sample: PDF keyword /JS count = 0
Source: A9sbk45l_169jtfd_4u0.tmp.0.drInitial sample: PDF keyword /JavaScript count = 0
Source: A9m1c204_169jtff_4u0.tmp.0.drInitial sample: PDF keyword /JS count = 0
Source: A9m1c204_169jtff_4u0.tmp.0.drInitial sample: PDF keyword /JavaScript count = 0
Source: A9491l1w_169jtfc_4u0.tmp.0.drInitial sample: PDF keyword /EmbeddedFile count = 0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information queried: ProcessInformationJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS Memory1
System Information Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive12
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1427110 Sample: W-9 Blank - March 2024 revi... Startdate: 17/04/2024 Architecture: WINDOWS Score: 2 6 Acrobat.exe 20 100 2->6         started        process3 8 AcroCEF.exe 106 6->8         started        process4 10 AcroCEF.exe 6 8->10         started        dnsIp5 13 23.54.200.159, 443, 49714 AKAMAI-ASUS United States 10->13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
W-9 Blank - March 2024 revision.pdf0%ReversingLabs
W-9 Blank - March 2024 revision.pdf0%VirustotalBrowse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://chrome.cloudflare-dns.com0%URL Reputationsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://chrome.cloudflare-dns.com277dd1d6-3c9f-4726-b373-68efc296bc69.tmp.3.dr, 8848a2dd-243e-41bc-921a-0039a5e3c480.tmp.3.drfalse
  • URL Reputation: safe
unknown
http://www.aiim.org/pdfua/ns/id/W-9 Blank - March 2024 revision.pdffalse
    		high

    World Map of Contacted IPs

    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs

    Public IPs

    IPDomainCountryFlagASNASN NameMalicious
    23.54.200.159
    		unknownUnited States
    		16625AKAMAI-ASUSfalse

    General Information

    Joe Sandbox version:40.0.0 Tourmaline
    Analysis ID:1427110
    Start date and time:2024-04-17 01:57:16 +02:00
    Joe Sandbox product:CloudBasic
    Overall analysis duration:0h 4m 1s
    Hypervisor based Inspection enabled:false
    Report type:full
    Cookbook file name:defaultwindowsinteractivecookbook.jbs
    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
    Number of analysed new started processes analysed:17
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • HCA enabled
    • EGA enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:Timeout
    Sample name:W-9 Blank - March 2024 revision.pdf
    Detection:CLEAN
    Classification:clean2.winPDF@15/46@0/1
    EGA Information:Failed
    HCA Information:
    • Successful, ratio: 100%
    • Number of executed functions: 0
    • Number of non-executed functions: 0
    Cookbook Comments:
    • Found application associated with file extension: .pdf

    Warnings

    • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
    • Excluded IPs from analysis (whitelisted): 23.36.68.10, 34.193.227.236, 54.144.73.197, 107.22.247.231, 18.207.85.246, 172.64.41.3, 162.159.61.3, 23.209.188.149, 23.209.188.151, 23.49.5.143, 23.49.5.147, 23.192.229.132, 23.192.229.136
    • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, slscr.update.microsoft.com, ssl-delivery.adobe.com.edgekey.net, acroipm2.adobe.com.edgesuite.net, a122.dscd.akamai.net, p13n.adobe.io, geo2.adobe.com, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com
    • Not all processes where analyzed, report is missing behavior information

    Simulations

    Behavior and APIs

    ⊘No simulations

    Joe Sandbox View / Context

    IPs

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    23.54.200.159vivek_support.imgGet hashmaliciousUnknownBrowse
      EES Offer VT.xlsGet hashmaliciousUnknownBrowse
        Wezwanie_swiadka.pdf.exeGet hashmaliciousLimeRATBrowse
          Purchase Order List 1 & 2.xlsGet hashmaliciousUnknownBrowse
            http://jimdo-storage.global.ssl.fastly.net/file/d84078ba-6799-4efe-a9ce-6a49e5d637d8/12423872027.pdfGet hashmaliciousUnknownBrowse
              https://app.box.com/s/cf3xjx2mmpt2vnadnh2br5kbeknr6bvwGet hashmaliciousUnknownBrowse
                phish_alert_iocp_v1.4.48 (23).emlGet hashmaliciousSTRRATBrowse
                  https://hon6yh6idrd.jp.larksuite.com/file/HRUubUMKZoc3TLxj8cbjnZPfpbhGet hashmaliciousUnknownBrowse
                    CI-20231030-057.xlsGet hashmaliciousUnknownBrowse
                      https://tritonstonela-my.sharepoint.com/:f:/g/personal/ruser_tritonstone_com/EsVFvvGi7gJEgs2pgb3xPc4Bjoj6KNFWeFskNa0PXry6Wg?e=1JeaEmGet hashmaliciousHTMLPhisher, ReCaptcha PhishBrowse

                        Domains

                        ⊘No context

                        ASNs

                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        AKAMAI-ASUShttps://webex-install.comGet hashmaliciousNetSupport RATBrowse
                        • 23.63.206.91
                        file.exeGet hashmaliciousUnknownBrowse
                        • 23.223.31.21
                        sYlwfFFwFb.elfGet hashmaliciousMiraiBrowse
                        • 23.44.156.67
                        BUBPZkk1Sm.elfGet hashmaliciousMiraiBrowse
                        • 23.203.64.50
                        bnNLsZqj8B.elfGet hashmaliciousMiraiBrowse
                        • 173.222.172.170
                        vEnh6fr6F0.elfGet hashmaliciousUnknownBrowse
                        • 23.199.228.203
                        https://ecouterrepondeurvocal.pro/35-hnJZibGet hashmaliciousUnknownBrowse
                        • 23.49.5.136
                        P5uKPY120j.elfGet hashmaliciousMiraiBrowse
                        • 23.72.22.165
                        994LJMbRxE.elfGet hashmaliciousMiraiBrowse
                        • 23.4.28.35
                        BNuwexy0tz.elfGet hashmaliciousMiraiBrowse
                        • 96.26.52.28

                        JA3 Fingerprints

                        ⊘No context

                        Dropped Files

                        ⊘No context

                        Created / dropped Files

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):290
                        Entropy (8bit):5.226761538250914
                        Encrypted:false
                        SSDEEP:6:ZViUjI3+q2PRN2nKuAl9OmbnIFUt8WViUkaZmw+WViUk2VkwORN2nKuAl9OmbjLJ:HsOvaHAahFUt8CZ/+Cz5JHAaSJ
                        MD5:5D6BC45FB7008CE920EEF51F0C5A29E2
                        SHA1:817D9A3138809C9848C2E9482135EFF74579E139
                        SHA-256:09F424697F28F889BA84E28F4A09EB035053A837F43680ADF5AD4E68C4A023F1
                        SHA-512:11F376B3E6651E63E1EB20CD61BFED53D2AA75FD6C11CD106D7466C9BC991C06A870877D62C36DB8B2D766AC55F80892D9DDF23D4293D3987E2FF0A50C6FCA83
                        Malicious:false
                        Reputation:low
                        Preview:2024/04/17-01:57:54.197 1778 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/17-01:57:54.198 1778 Recovering log #3.2024/04/17-01:57:54.198 1778 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):290
                        Entropy (8bit):5.226761538250914
                        Encrypted:false
                        SSDEEP:6:ZViUjI3+q2PRN2nKuAl9OmbnIFUt8WViUkaZmw+WViUk2VkwORN2nKuAl9OmbjLJ:HsOvaHAahFUt8CZ/+Cz5JHAaSJ
                        MD5:5D6BC45FB7008CE920EEF51F0C5A29E2
                        SHA1:817D9A3138809C9848C2E9482135EFF74579E139
                        SHA-256:09F424697F28F889BA84E28F4A09EB035053A837F43680ADF5AD4E68C4A023F1
                        SHA-512:11F376B3E6651E63E1EB20CD61BFED53D2AA75FD6C11CD106D7466C9BC991C06A870877D62C36DB8B2D766AC55F80892D9DDF23D4293D3987E2FF0A50C6FCA83
                        Malicious:false
                        Reputation:low
                        Preview:2024/04/17-01:57:54.197 1778 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/17-01:57:54.198 1778 Recovering log #3.2024/04/17-01:57:54.198 1778 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):334
                        Entropy (8bit):5.144805153609905
                        Encrypted:false
                        SSDEEP:6:ZViU/Aq2PRN2nKuAl9Ombzo2jMGIFUt8WViUPwZmw+WViUrzkwORN2nKuAl9OmbX:H/AvaHAa8uFUt8Co/+Crz5JHAa8RJ
                        MD5:943567F8BA3F40F765C4919091BD71B2
                        SHA1:FB4EDD0DEAED8F763A21810B0D79E0FDEF863563
                        SHA-256:F5F67791BAFB969085D61CF28AF77FE9725A1CDAFF1A1075B56A13EFAA3ACB05
                        SHA-512:6F173F8AD530F117FCDC8EE3000CC580C94098CD26061611D3A933091EC1545D6D6E501DB0CCB30CE2CEFBD980AE928254C3633BDC5329F8FB5F094676C6D87F
                        Malicious:false
                        Reputation:low
                        Preview:2024/04/17-01:57:54.110 19e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/17-01:57:54.113 19e0 Recovering log #3.2024/04/17-01:57:54.114 19e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):334
                        Entropy (8bit):5.144805153609905
                        Encrypted:false
                        SSDEEP:6:ZViU/Aq2PRN2nKuAl9Ombzo2jMGIFUt8WViUPwZmw+WViUrzkwORN2nKuAl9OmbX:H/AvaHAa8uFUt8Co/+Crz5JHAa8RJ
                        MD5:943567F8BA3F40F765C4919091BD71B2
                        SHA1:FB4EDD0DEAED8F763A21810B0D79E0FDEF863563
                        SHA-256:F5F67791BAFB969085D61CF28AF77FE9725A1CDAFF1A1075B56A13EFAA3ACB05
                        SHA-512:6F173F8AD530F117FCDC8EE3000CC580C94098CD26061611D3A933091EC1545D6D6E501DB0CCB30CE2CEFBD980AE928254C3633BDC5329F8FB5F094676C6D87F
                        Malicious:false
                        Reputation:low
                        Preview:2024/04/17-01:57:54.110 19e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/17-01:57:54.113 19e0 Recovering log #3.2024/04/17-01:57:54.114 19e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\277dd1d6-3c9f-4726-b373-68efc296bc69.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:JSON data
                        Category:modified
                        Size (bytes):403
                        Entropy (8bit):4.98937591086441
                        Encrypted:false
                        SSDEEP:12:YHO8sqZcsBdOg2HFcaq3QYiubrP7E4T3y:YXsGdMHk3QYhbz7nby
                        MD5:657F6C75329D3AA08F4E8DBE302C07DC
                        SHA1:93DA91F24B1A1DC1E0F2966B3002DD2678379747
                        SHA-256:715CACE1F4F1E51623F56EEA0A9765BA7F349C3C9C6B168FD764ECE42F145ADF
                        SHA-512:C671BB1809256CD5C620B8D311309B0175EA8812ABAF111448C357C045C1FB6EB597D90B30F68B866467916B9E38BC478944C7BAECFF06ECB1F883E93D8789DD
                        Malicious:false
                        Reputation:low
                        Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13357871885615622","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":106945},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8848a2dd-243e-41bc-921a-0039a5e3c480.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):403
                        Entropy (8bit):4.953858338552356
                        Encrypted:false
                        SSDEEP:12:YHO8sq/WLksBdOg2H9caq3QYiubrP7E4T3y:YXsRJdMHM3QYhbz7nby
                        MD5:4C313FE514B5F4E7E89329630909F8DC
                        SHA1:916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
                        SHA-256:1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
                        SHA-512:1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
                        Malicious:false
                        Reputation:moderate, very likely benign file
                        Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):403
                        Entropy (8bit):4.953858338552356
                        Encrypted:false
                        SSDEEP:12:YHO8sq/WLksBdOg2H9caq3QYiubrP7E4T3y:YXsRJdMHM3QYhbz7nby
                        MD5:4C313FE514B5F4E7E89329630909F8DC
                        SHA1:916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
                        SHA-256:1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
                        SHA-512:1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
                        Malicious:false
                        Reputation:moderate, very likely benign file
                        Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5dd78f.TMP (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):403
                        Entropy (8bit):4.953858338552356
                        Encrypted:false
                        SSDEEP:12:YHO8sq/WLksBdOg2H9caq3QYiubrP7E4T3y:YXsRJdMHM3QYhbz7nby
                        MD5:4C313FE514B5F4E7E89329630909F8DC
                        SHA1:916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
                        SHA-256:1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
                        SHA-512:1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
                        Malicious:false
                        Reputation:moderate, very likely benign file
                        Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):4099
                        Entropy (8bit):5.230966421438717
                        Encrypted:false
                        SSDEEP:96:OLSw0bSwIAnrRqLX2rSq1OUxu/0OZ0xRBTxekN8xekC+eW5aY:OLT0bTIeYa51Ogu/0OZARBT8kN88hPWB
                        MD5:90A006B22AC5301A5297E61F6329C1D2
                        SHA1:8DC487F49E9B7B7EA833E0F74C548572315B7E46
                        SHA-256:CB16C3C04F6530B677638D5C9AA0CC78D768B1485AA3A4B30A5E0FD16F4D02E9
                        SHA-512:A296353EC2351666518B5B426E1C33F5356493011F43E4878FD891835DB0F267BD6C0F601D82615CB437952070876728787A1E411D2F83D3DF985B4873AAF740
                        Malicious:false
                        Preview:*...#................version.1..namespace-e...o................next-map-id.1.Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/.0y.S_r................next-map-id.2.Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/.16.X:r................next-map-id.3.Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/.2.P.@o................next-map-id.4.Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/.346.+^...............Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/....^...............Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/..?&a...............Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/_...a...............Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/...o................next-map-id.5.Pnamespace-07af9ee9_2076_4f12_94b5_

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):322
                        Entropy (8bit):5.201991418835146
                        Encrypted:false
                        SSDEEP:6:ZViHvIq2PRN2nKuAl9OmbzNMxIFUt8WVinZmw+WVi8kwORN2nKuAl9OmbzNMFLJ:ovIvaHAa8jFUt8V/+q5JHAa84J
                        MD5:BA3D7D9AF94AB3DA7506045AE23872C4
                        SHA1:8DF995F274B280539D180BE5D2903F02B879F747
                        SHA-256:D10CEF105CA057D35DC6A406F5B5C5AA8F1EBB57929141D26DBB9867ED811C6B
                        SHA-512:97B7F3491AFA6CC595E0B050BF767636D30A494E72CCA03C888AC50B52BAD17E2BD963B55B6F8176DC5269E6D859AE6CC456FBA9F45A3CB6DA7E6E2CDB05D6FA
                        Malicious:false
                        Preview:2024/04/17-01:57:54.236 19e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/17-01:57:54.238 19e0 Recovering log #3.2024/04/17-01:57:54.240 19e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):322
                        Entropy (8bit):5.201991418835146
                        Encrypted:false
                        SSDEEP:6:ZViHvIq2PRN2nKuAl9OmbzNMxIFUt8WVinZmw+WVi8kwORN2nKuAl9OmbzNMFLJ:ovIvaHAa8jFUt8V/+q5JHAa84J
                        MD5:BA3D7D9AF94AB3DA7506045AE23872C4
                        SHA1:8DF995F274B280539D180BE5D2903F02B879F747
                        SHA-256:D10CEF105CA057D35DC6A406F5B5C5AA8F1EBB57929141D26DBB9867ED811C6B
                        SHA-512:97B7F3491AFA6CC595E0B050BF767636D30A494E72CCA03C888AC50B52BAD17E2BD963B55B6F8176DC5269E6D859AE6CC456FBA9F45A3CB6DA7E6E2CDB05D6FA
                        Malicious:false
                        Preview:2024/04/17-01:57:54.236 19e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/17-01:57:54.238 19e0 Recovering log #3.2024/04/17-01:57:54.240 19e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240416235758Z-276.bmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
                        Category:dropped
                        Size (bytes):71190
                        Entropy (8bit):1.5815784782085038
                        Encrypted:false
                        SSDEEP:96:w1oZMqX8efH1MyTDMT3M4M3qAM4MtHhMM47zFiM6MMrMMx6XgMMMMM4YfI4MM1MB:3AHoAePgT
                        MD5:64F36373DD14F2D05E45B3430EABE0DA
                        SHA1:6B293984AE01F9253421DC20BDD718644F4DB4F9
                        SHA-256:D1E3F20F275AA7B1BD1E31D606C2A1FDB5AB0E400BE608517039BEB408AF0565
                        SHA-512:B1418272765CD3B554F93169A313BE584E819DD92668FA68AF9CB0281582683C8C290C5CD5739FB729C56DF8E0F9E2809FAC27C4B0DA310080DE4E3010B66C07
                        Malicious:false
                        Preview:BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2
                        Category:dropped
                        Size (bytes):57344
                        Entropy (8bit):3.291927920232006
                        Encrypted:false
                        SSDEEP:192:vedRBvVui5V4R4dcQ5V4R4RtYWtEV2UUTTchqGp8F/7/z+FP:veBci5H5FY+EUUUTTcHqFzqFP
                        MD5:A4D5FECEFE05F21D6F81ACF4D9A788CF
                        SHA1:1A9AC236C80F2A2809F7DE374072E2FCCA5A775C
                        SHA-256:83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
                        SHA-512:FF106C6B9E1EA4B1F3E3AB01FAEA21BA24A885E63DDF0C36EB0A8C3C89A9430FE676039C076C50D7C46DC4E809F6A7E35A4BFED64D9033FEBD6121AC547AA5E9
                        Malicious:false
                        Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:SQLite Rollback Journal
                        Category:dropped
                        Size (bytes):16928
                        Entropy (8bit):1.2160291275063093
                        Encrypted:false
                        SSDEEP:24:7+tdIlqLi+zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+S:7MdeqLmFTIF3XmHjBoGGR+jMz+Lhx
                        MD5:2DD0B6DBC3609ECD62F0D0CC160BF68D
                        SHA1:484238314BBBAA96DC2CABF984ABBD2972C7654D
                        SHA-256:D6DD29DED7BCA7D858DDCCE4E4DABE4FEBC116E625F5F88E422443975D5BAADF
                        SHA-512:7E9D35098A420B2BBCA98652ADE35C360755E34E76B4951E31E668A4E5103A2B7F5AD30D21E1F96A2A544EABAFF74FB3D44451046D9291CE94EF01B8805A6793
                        Malicious:false
                        Preview:.... .c.....zW..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):295
                        Entropy (8bit):5.3799279538630085
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXHVfgZF5IRR4UhUR0Yc8DoAvJM3g98kUwPeUkwRe9:YvXKX12WRuUhUg8sGMbLUkee9
                        MD5:133E86228BB7B7CAD2CFF801FD4C9C0A
                        SHA1:203E3D2951163862D43F00F20F155857AA341005
                        SHA-256:47607FE4973200CDF933215099E099AB9D11C0F022D151C18819577AC414C0AD
                        SHA-512:D3E8D8E3E6DDA1EC7DEBBB43085590A3028D79F74069B7CFDF1467E69303141AF006B1D2C15B0F23620D38D39727E70A13A6D666EBA764EB8BF20BF415E7873D
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"13429c90-acf3-4f4c-9f96-4318b7ff278c","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1713486540382,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):294
                        Entropy (8bit):5.327392463761877
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXHVfgZF5IRR4UhUR0Yc8DoAvJfBoTfXpnrPeUkwRe9:YvXKX12WRuUhUg8sGWTfXcUkee9
                        MD5:C696A63C6F32B11D2BC9EF514E3C0322
                        SHA1:079E502F5023CB14D13BF65353979517AF9B26FF
                        SHA-256:FEF9A1BE3ADCA773EB8906F8F7886973CC59098F94BEF0C0B2794C28819897CF
                        SHA-512:955706ED14D841FF8A38E4F084AE710CF8E9CF002F612564317E953858167BFFD9B96421956D5ACB7787D8B83464C03B1AD595440F2A1800B0A7E464EBDCF660
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"13429c90-acf3-4f4c-9f96-4318b7ff278c","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1713486540382,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):294
                        Entropy (8bit):5.304557817607058
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXHVfgZF5IRR4UhUR0Yc8DoAvJfBD2G6UpnrPeUkwRe9:YvXKX12WRuUhUg8sGR22cUkee9
                        MD5:858733A8FA906F9611E47851B5FD037F
                        SHA1:7EFF231B4F29F20167A8FDB6EED1EBA4C347FD31
                        SHA-256:B8A170E80BEEA166420E1F841A1437E1CF31B22FFC320CAFBE771D1149CEC7B8
                        SHA-512:68A24C8E2787651930F554F233DF46CF63AACCC78E4C7643AD0533B74AA932452A035088DC947FC36DE342130DEED3E1E70C236F0E50A85842C56702D017301E
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"13429c90-acf3-4f4c-9f96-4318b7ff278c","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1713486540382,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):285
                        Entropy (8bit):5.368889355500349
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXHVfgZF5IRR4UhUR0Yc8DoAvJfPmwrPeUkwRe9:YvXKX12WRuUhUg8sGH56Ukee9
                        MD5:DEFBF362E16AD9EC0ED847C5DA210434
                        SHA1:1DB95D466AB9F9F134B37F70EB63347FE6E4D4A0
                        SHA-256:9880C2C4EA25C96BBE5597B3F5E026494EAE73A15A0137E682A230CC8205A092
                        SHA-512:70998352CFA50E2FFAEC2F531D8FAFA5C967C4813E470409F9FB8F9B0B2CD96229EFF455C6B505BD777EE839437905C88203E317BA5AE0E20AA8ADEF921BB373
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"13429c90-acf3-4f4c-9f96-4318b7ff278c","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1713486540382,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):292
                        Entropy (8bit):5.3347834475288725
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXHVfgZF5IRR4UhUR0Yc8DoAvJfJWCtMdPeUkwRe9:YvXKX12WRuUhUg8sGBS8Ukee9
                        MD5:89EB9CC13C01F2058E582C33CBC8417E
                        SHA1:8B17E4319829BC0FD3023C6C9C45C1688EA23D83
                        SHA-256:B1BD7E8CB0445931FB57DC8916CECC97E68404AE72C9773449F5A4FC7F07DB58
                        SHA-512:06289AA0A4AF66C277B19D0C1AB98B2F0AFF4CB3C58001926AB01CE6ABC6BE72BAF241FA5E6CAAC0FDA8BF75DBCF6423EABC8444FC02362C9B7D262D4C31F5BF
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"13429c90-acf3-4f4c-9f96-4318b7ff278c","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1713486540382,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):289
                        Entropy (8bit):5.320450183976785
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXHVfgZF5IRR4UhUR0Yc8DoAvJf8dPeUkwRe9:YvXKX12WRuUhUg8sGU8Ukee9
                        MD5:DEC37824BE1C6F401DF5C540E34749BB
                        SHA1:B9772E41E4696F2CC338C8A1977E04759B81C869
                        SHA-256:06FD1C3BD920ACC3346A3D40F43918AA1D2F710EC513E91BDD76B03D8BBC101E
                        SHA-512:E2E52FAC4F4FC376029D53380661D1CF406542D6F42BBEC1BA8D2D4579BE31DAE2500A5ADBDF27653868448631EE3ED98925480C86B56C84425231FAC98722E7
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"13429c90-acf3-4f4c-9f96-4318b7ff278c","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1713486540382,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):292
                        Entropy (8bit):5.323183130885091
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXHVfgZF5IRR4UhUR0Yc8DoAvJfQ1rPeUkwRe9:YvXKX12WRuUhUg8sGY16Ukee9
                        MD5:F2DA25A8B6DF229237A60BBAF65A334A
                        SHA1:87B16A732BA87E43731280631CFA5DFEB53ABDB4
                        SHA-256:ECAC5E62CF7FCFB9713CDC5ADDA2FE6171B1E5AA5DD0BED8DE2DA2A553E955AC
                        SHA-512:46017307DEFEE8BE32426C0B796BBDAF74CEE39489028B8BBE222B6E13AE2CFFB8546E188C57B7B221E943152A18843CD5006AC0FA0B580CAD0A52C978B09FDF
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"13429c90-acf3-4f4c-9f96-4318b7ff278c","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1713486540382,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):289
                        Entropy (8bit):5.332890712681591
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXHVfgZF5IRR4UhUR0Yc8DoAvJfFldPeUkwRe9:YvXKX12WRuUhUg8sGz8Ukee9
                        MD5:DE0C5ED1054D7937F24E3622D4E3B7A5
                        SHA1:FD5E3353D2856649430AFF288882C6EA92ABC84C
                        SHA-256:83D8961AD26B74EA698CFC5CF917D611C820431154E3125411D4914D70525EF4
                        SHA-512:B60BDF555DFC8E832865C84306F5C26BAAD0E9AF670CFC6D6B71DFF503242D4A505B08160713F2C33D5329614ECEE4FD32375453CE17A9127AF76B77C7D29AF7
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"13429c90-acf3-4f4c-9f96-4318b7ff278c","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1713486540382,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):1372
                        Entropy (8bit):5.744501453333552
                        Encrypted:false
                        SSDEEP:24:Yv6X1TUg8UKLgENRcbrZbq00iCCBrwJo++ns8ct4mFJNa1:YvwTUUEgigrNt0wSJn+ns8cvFJO
                        MD5:D200DAA156AAF673703DE58FF3BAA4DB
                        SHA1:4AA276B4961B87FA2D709B871E322F24962ACE3E
                        SHA-256:16BFA370504D52F7F6D138AE09DBEB962BE0919A8F7D3701439E3606E856EB56
                        SHA-512:92EA97E5C1CC665C6DA88BABC693FA3025740B212552F4209BF86B9705B5B95D7802C7B5593D73724EF40660578E138B713561A1DCF495AE6914F201FEC7113E
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"13429c90-acf3-4f4c-9f96-4318b7ff278c","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1713486540382,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"79887_247329ActionBlock_0","campaignId":79887,"containerId":"1","controlGroupId":"","treatmentId":"acc56846-d570-4500-a26e-7f8cf2b4acad","variationId":"247329"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJUcnkgQWNyb2JhdCBQcm8ifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNSIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTMiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIDctZGF5IHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0byBwcmVtaXVtIFBERiBhbmQgZS1zaWduaW5nIHRvb2xzLiIsImJ

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):289
                        Entropy (8bit):5.3282178203173585
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXHVfgZF5IRR4UhUR0Yc8DoAvJfYdPeUkwRe9:YvXKX12WRuUhUg8sGg8Ukee9
                        MD5:F2717EE14567A2E464CA37037B65B142
                        SHA1:BDF94A3036CBF0B3E1F6AA6E9F5C632BC89D700C
                        SHA-256:43DB24011ED29CFB277D2B3A1AC2330DAF369BE7BE2FE77431B7C5F462AB1679
                        SHA-512:B9BC185794C294A1353F8A907EF1E259303DF90E660FFCD06B3E96C78954A32E83391959F4900022D2E75752DBF4CA85287C86534AC46C0C85779FE591661EDE
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"13429c90-acf3-4f4c-9f96-4318b7ff278c","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1713486540382,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):1395
                        Entropy (8bit):5.780513718701534
                        Encrypted:false
                        SSDEEP:24:Yv6X1TUg87rLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNC1:YvwTU7HgDv3W2aYQfgB5OUupHrQ9FJy
                        MD5:2661BFDB32BB997FF300F765C944ADFD
                        SHA1:8BF91A0569CF0780C41060D2F3C9270177E0D175
                        SHA-256:971C95B2AE69A139FDF2D68DEC0B104224ADE0A67F6726C13A4B076905479D43
                        SHA-512:C400DBC99CE12E958E00FC71D703E065F13E96E29BE0ABE3D392F305C4779CD93E2AA3374617004AE7349F41E0ABD9683701D5C8CA5060EB3B4E474314B75528
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"13429c90-acf3-4f4c-9f96-4318b7ff278c","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1713486540382,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):291
                        Entropy (8bit):5.3115709810818235
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXHVfgZF5IRR4UhUR0Yc8DoAvJfbPtdPeUkwRe9:YvXKX12WRuUhUg8sGDV8Ukee9
                        MD5:A692F1EA9D3EF037F8A8A8BE51260D92
                        SHA1:0E86924E43C9FFD170AC5A93F6988F7CE440DEF7
                        SHA-256:5BCDD0EF8EAEEC0AE62FA9C6DF74483F0F25F3ECA2925A8C742E5647655D2A29
                        SHA-512:D5053345FEA89F9C4CB4F0361B1CCD058ABA27314D747FB391A3702BB460EED9301C5DE38D488D736EF234781ED36EC8327509C0ACB9CD82EF3293429DC2F042
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"13429c90-acf3-4f4c-9f96-4318b7ff278c","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1713486540382,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):287
                        Entropy (8bit):5.315028497556544
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXHVfgZF5IRR4UhUR0Yc8DoAvJf21rPeUkwRe9:YvXKX12WRuUhUg8sG+16Ukee9
                        MD5:4B7325B5A479FC78BB82E0A006C44E34
                        SHA1:BC96AB9C7A3D50793C6C987612B7408199B3C29D
                        SHA-256:6D107387AE6C3C550A0503707B0F82F505CD52BF533B6AB898D4BC9B7A8B3A66
                        SHA-512:1B2B826CAF3330B2A356A12983B694BCAE22E1C56C7B2BB62EE98A568AA9074E7BDB5D846455F4C8529974DAAD7C0E93CC2B7A827BB76105A31E6F33AB0B297D
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"13429c90-acf3-4f4c-9f96-4318b7ff278c","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1713486540382,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):289
                        Entropy (8bit):5.334446926034559
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXHVfgZF5IRR4UhUR0Yc8DoAvJfbpatdPeUkwRe9:YvXKX12WRuUhUg8sGVat8Ukee9
                        MD5:23E4D7D98B1B98E805FEE5B2770CCC33
                        SHA1:D22E9F562D41871986E6068020DCEBE9A02A504E
                        SHA-256:AD8409AB98D5CFA8FE52C44525FC9316FF159361E6A0470BA5A304C675259BAA
                        SHA-512:E9FBBCB04BC2974FFD3D46D4CB7ED2537B08F3FAEF684637250B1577B0CF76C4ECD6F8AA682F33DBC3F3FBA9DC3696E7CB241FB7EE2B0E2F60FAF203160D31A5
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"13429c90-acf3-4f4c-9f96-4318b7ff278c","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1713486540382,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):286
                        Entropy (8bit):5.292757041284796
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXHVfgZF5IRR4UhUR0Yc8DoAvJfshHHrPeUkwRe9:YvXKX12WRuUhUg8sGUUUkee9
                        MD5:7C1233615CF5FD8F8758C8D435295D66
                        SHA1:29E0F657F23DEB9D1192D7BAEC2FFA8393B9D39D
                        SHA-256:CB87FFFA809971790330A374DF39E288F3D9F501F673AD6CB566C40D281BC1BD
                        SHA-512:4411EEA64CAF23761784F200D35C631C6AE254153B18AE00E5F78887B31663FFA5B2FACB25277CBC8A0DC94F367B1AF77B5534A3F6E64C6B031A4187B9BFB70D
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"13429c90-acf3-4f4c-9f96-4318b7ff278c","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1713486540382,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):782
                        Entropy (8bit):5.375889835412844
                        Encrypted:false
                        SSDEEP:12:YvXKX12WRuUhUg8sGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWe1:Yv6X1TUg8C168CgEXX5kcIfANhT1
                        MD5:BED6D8F0D60AABBA5FC066C2D4F8B7BF
                        SHA1:FAEB714C20D5A35A78148B18038C2CC657F2E0A9
                        SHA-256:782E497589C74A5821E372C5CB38EDA1A79B6C0447ED24A1D1DF779364C65372
                        SHA-512:70FDF5031EC98C2D5401276F0A06B4D2A0AB631DF416669713CCA0898101B8AABAA3F258B481DD5F9C3BB414CCDCA8825C190E5C9613C7603C6FDD9A182777CA
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"13429c90-acf3-4f4c-9f96-4318b7ff278c","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1713486540382,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1713311880413}}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):4
                        Entropy (8bit):0.8112781244591328
                        Encrypted:false
                        SSDEEP:3:e:e
                        MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                        SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                        SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                        SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                        Malicious:false
                        Preview:....

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):2814
                        Entropy (8bit):5.122750575166613
                        Encrypted:false
                        SSDEEP:24:YirHlF7yLaRCMlhGSJU82VKPvHGa2sayHYtkj4HI9R40PjVgivvj0SyfwbC2W7XW:YiqMlemUrKotMDVvv7KPXOpa9oZ9jR+2
                        MD5:744AE0CB61EEA6C0AED6E4B968B2A319
                        SHA1:1F08CB41F7E6F83E02AE2BEB0193DEA02A652F29
                        SHA-256:5DD62319AA7DD1D74B4C41CCF824EEABE69E7A3610E5BBDA495F9D694FE7FAEE
                        SHA-512:37BB25C0AEB2A2F62048F69A9AA5C92E4A92B28DCE4CE8661B02D61A67328C7FB76C8A0556B70FB17E4103AD81E9A9E9BD4D94688AB48FC33CAF778D7848B582
                        Malicious:false
                        Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"1482fccf09e167b0c29ab7e11b8fea84","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1713311879000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"e5e1213c3b23d5dd54929ab97db91a56","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1372,"ts":1713311879000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"87d28cfc5ce64671bcbd6672e4dfcd65","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1713311879000},{"id":"Edit_InApp_Aug2020","info":{"dg":"8db4da7ffa4e2204b84298971f520043","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1713311879000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"83c6da73b82202eeaf9e1a882f957cb2","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1713311879000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"d2c6545ba6f0a4925c0a40ad277329c3","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1713311879000},

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 23, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 23
                        Category:dropped
                        Size (bytes):12288
                        Entropy (8bit):0.9969671513885456
                        Encrypted:false
                        SSDEEP:24:TLxx/XYKQvGJF7urs4cY9QRQ6QudvVX1r9X9OS9VkVXUt6:TVl2GL7ms5YEtLVlrdoS9VkVJ
                        MD5:507995DD73452FF540C7707A61C67DB7
                        SHA1:8DC4ABEE2D4662B3B46B1C1EE492B78C5D350E56
                        SHA-256:53D12DC98A4C81589A96EC8A108444EBD524CA7DBD27B5B586017F75DC469F1C
                        SHA-512:D927A6904D498AC33DDFDDDB2CE64DFA9458072D1BD9F0C28E326E02C672AB0EBC595CCC6AE26D658D233731CB0592284874DF216493F03B5C3132957DC99D2F
                        Malicious:false
                        Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:SQLite Rollback Journal
                        Category:dropped
                        Size (bytes):8720
                        Entropy (8bit):1.3614163327737432
                        Encrypted:false
                        SSDEEP:24:7+tEY9QRQ6QudvVXqcL49OS9VkVX1qLWwx/XYKQvGJF7ursLY:7MEYEtLVacMoS9VkVFqll2GL7msLY
                        MD5:E1965652DD842D786D51BBBD5F4A9CF2
                        SHA1:6C188F8D6B84AF67A95914EE1B36609C64450944
                        SHA-256:C810E01402D0255ADE209E5FDEDD88B1C3EEB3E461B3575E5825B3B4350B1FBA
                        SHA-512:C98738E6D2A85080F6CF3C9A61E5E2AE6A6B8C9B4E9750E024672A669E1514C4E4C76AA40DFB437C9C8B47E5BDB4577338EA5A65D53D99377F277F466D69C488
                        Malicious:false
                        Preview:.... .c......X.x......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j............?.........7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Temp\MSIcd0ec.LOG

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):246
                        Entropy (8bit):3.5177502348333967
                        Encrypted:false
                        SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8niQH:Qw946cPbiOxDlbYnuRKEH
                        MD5:AD2F902B4800A7E86C825D1A59C1F189
                        SHA1:7D3D83E29341BBEB52A7FDAA6BD985299D6832CF
                        SHA-256:0A7886F2D1CFCD7D5B55EFEA0BC3F16417F53E65092469ECE6C57D061899EE19
                        SHA-512:8A96C84666B82E30768DCB8FE3BD2E1DA7F09159F72355A54C075A43869D3F1FC8704DF52F129662FA385FBE0993690DCFC80F42AD37A29CAC048A2928DA29F0
                        Malicious:false
                        Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.7./.0.4./.2.0.2.4. . .0.1.:.5.8.:.0.2. .=.=.=.....

                        C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9491l1w_169jtfc_4u0.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:PDF document, version 1.6, 0 pages
                        Category:dropped
                        Size (bytes):358
                        Entropy (8bit):5.04819771073566
                        Encrypted:false
                        SSDEEP:6:IngVMrexJzJT0y9VEQIFVmb/eu2g/86S1kxROOimj3tmj38CCSyAAO:IngVMre9T0HQIDmy9g06JX93i38ClX
                        MD5:2DF23D079FC83EAE8114D25CF4A634AC
                        SHA1:9CA71AC208EDE2BA0257D6A45E2952C26BB86A66
                        SHA-256:53E65E7F4B95A55E719397CEC703A41E32E0C6EA8C7334322A5404D270F206BD
                        SHA-512:CFC8D18D4387BADB309630F2DDE5BFE72DF5B6DC89AC57E361FD70E0768C53AF1B05FA8E297BCA7023B3074E4F7C4C8E758E4E842E3A7F2E42D3C84419604E98
                        Malicious:false
                        Preview:%PDF-1.6.%......1 0 obj.<</Pages 2 0 R/Type/Catalog>>.endobj.2 0 obj.<</Count 0/Kids[]/Type/Pages>>.endobj.3 0 obj.<<>>.endobj.xref..0 4..0000000000 65535 f..0000000016 00000 n..0000000061 00000 n..0000000107 00000 n..trailer..<</Size 4/Root 1 0 R/Info 3 0 R/ID[<EAC2CA1BF9477F49901F8F3B74CCC0AC><EAC2CA1BF9477F49901F8F3B74CCC0AC>]>>..startxref..127..%%EOF..

                        C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9m1c204_169jtff_4u0.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:PDF document, version 1.6, 0 pages
                        Category:dropped
                        Size (bytes):358
                        Entropy (8bit):5.054390790876946
                        Encrypted:false
                        SSDEEP:6:IngVMrexJzJT0y9VEQIFVmb/eu2g/86S1kxROOOcHxlcH9CSyAAO:IngVMre9T0HQIDmy9g06JXecHxqH9lX
                        MD5:592075E11999BEE229874A7ED2ACA2F3
                        SHA1:06E46BFE89F230EA86AEA71C7B19CA2A842F7502
                        SHA-256:C085E35FBEB7D414BE7846E7A28D55106376444969F81EB4FF41BDE32C1EB3C9
                        SHA-512:6BF8AFFE32FB85C215A5D71F884E3DFE93AD83287947040AD58C6A20B0137341121DD1367B509DE34A36B7E4A147375E66E7A38F828CA36FCCD7D3A34E246AEE
                        Malicious:false
                        Preview:%PDF-1.6.%......1 0 obj.<</Pages 2 0 R/Type/Catalog>>.endobj.2 0 obj.<</Count 0/Kids[]/Type/Pages>>.endobj.3 0 obj.<<>>.endobj.xref..0 4..0000000000 65535 f..0000000016 00000 n..0000000061 00000 n..0000000107 00000 n..trailer..<</Size 4/Root 1 0 R/Info 3 0 R/ID[<DC3E12CF06AAB34290D1F91563815A82><DC3E12CF06AAB34290D1F91563815A82>]>>..startxref..127..%%EOF..

                        C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9sbk45l_169jtfd_4u0.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:PDF document, version 1.6, 0 pages
                        Category:dropped
                        Size (bytes):358
                        Entropy (8bit):5.059696369522269
                        Encrypted:false
                        SSDEEP:6:IngVMrexJzJT0y9VEQIFVmb/eu2g/86S1kxROOykcX+nGnXhTkcX+nGn/CSyAAO:IngVMre9T0HQIDmy9g06JXCpYGxlYG/R
                        MD5:F97AA699D6F4DC9FD50FBB082C6E3343
                        SHA1:CF39E438F2D23755C8A87AA6751463C9927DA7CB
                        SHA-256:F4A83AC8E27433EBC2018C1F42F1BEEF58BDC7150E878468E61692F80D6B0B3E
                        SHA-512:CEE709FABF299395F844BCF0EB52F78303191A4A690711A5E2D39EB2ABAA834C04F9C726281CF6AC01CD272779F8BDC1104DF582FF4287FAB47C97D86AC077C4
                        Malicious:false
                        Preview:%PDF-1.6.%......1 0 obj.<</Pages 2 0 R/Type/Catalog>>.endobj.2 0 obj.<</Count 0/Kids[]/Type/Pages>>.endobj.3 0 obj.<<>>.endobj.xref..0 4..0000000000 65535 f..0000000016 00000 n..0000000061 00000 n..0000000107 00000 n..trailer..<</Size 4/Root 1 0 R/Info 3 0 R/ID[<81A86A27428E8F49827348748B8B9B0B><81A86A27428E8F49827348748B8B9B0B>]>>..startxref..127..%%EOF..

                        C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-17 01-57-57-386.log

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:ASCII text, with very long lines (393)
                        Category:dropped
                        Size (bytes):16525
                        Entropy (8bit):5.353642815103214
                        Encrypted:false
                        SSDEEP:384:tbxtsuP+XEWJJQbnR8L31M7HeltV+KYm3wsa2KjF4ODkr/O8r2IUHUHMWwEyZRN2:aPL
                        MD5:91F06491552FC977E9E8AF47786EE7C1
                        SHA1:8FEB27904897FFCC2BE1A985D479D7F75F11CEFC
                        SHA-256:06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
                        SHA-512:A63E6E0D25B88EBB6602885AB8E91167D37267B24516A11F7492F48876D3DDCAE44FFC386E146F3CF6EB4FA6AF251602143F254687B17FCFE6F00783095C5082
                        Malicious:false
                        Preview:SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig:

                        C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:ASCII text, with very long lines (393), with CRLF line terminators
                        Category:dropped
                        Size (bytes):15114
                        Entropy (8bit):5.372070094762051
                        Encrypted:false
                        SSDEEP:384:8Ww/4W1lO7NzY+gtB6HgC76epw91XP5TQF3xpXpEfC4mNXSgFM2wZ9gR7xfSF1Nx:pO
                        MD5:81B38F74129CB9C1A084DD88060AB41D
                        SHA1:9E57BE186D698B131D993CBDF7A3E1DDEC24430B
                        SHA-256:E0455E64A8922EE8C02D338E11CF3D4BB330CC9A85D4C72297F9E476240F3A01
                        SHA-512:267039101489DDB8CE2422FF42C94337878BA92AB0E6048574CDB78968A1EC9A6D8344C90D23D040351BBD1C793C7B2E6DFA775CD95956A7EBFC5288DD302368
                        Malicious:false
                        Preview:SessionID=16868051-2c2d-44ec-8dbc-c0016f662da1.1713311877396 Timestamp=2024-04-17T01:57:57:396+0200 ThreadID=5856 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=16868051-2c2d-44ec-8dbc-c0016f662da1.1713311877396 Timestamp=2024-04-17T01:57:57:397+0200 ThreadID=5856 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=16868051-2c2d-44ec-8dbc-c0016f662da1.1713311877396 Timestamp=2024-04-17T01:57:57:397+0200 ThreadID=5856 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=16868051-2c2d-44ec-8dbc-c0016f662da1.1713311877396 Timestamp=2024-04-17T01:57:57:397+0200 ThreadID=5856 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=16868051-2c2d-44ec-8dbc-c0016f662da1.1713311877396 Timestamp=2024-04-17T01:57:57:397+0200 ThreadID=5856 Component=ngl-lib_NglAppLib Description="SetConf

                        C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):29752
                        Entropy (8bit):5.42523861935409
                        Encrypted:false
                        SSDEEP:192:0cbgIhPcbocbAIlncb2cbwI/RcbNcbQIVvcbUcb4IVbcbB:fhWlA/TViVo
                        MD5:5020DD61018F8E21AB9E2A7F2F3C27CE
                        SHA1:0F159C73ACB880E4D50C8939C9DD7150BE9315B0
                        SHA-256:B95A5EC1A85DD7179C1CB8D72667FB10206D96334A8F218E585570E8724A9044
                        SHA-512:F254CA8CA35BACF0518596FB6CEB9B38DA6A7A3B54EB812D886441BD4D421C34B51CCFBE668F0A89D08D3FCB5E8B989822DEAE01C307FFE57F0DF4F7E1444DB8
                        Malicious:false
                        Preview:06-10-2023 10:08:42:.---2---..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 10:08:42:.Closing File..06-10-

                        C:\Users\user\AppData\Local\Temp\acrocef_low\2fbb8b65-71df-4186-8d2e-d2ae6b0d1ff0.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                        Category:dropped
                        Size (bytes):758601
                        Entropy (8bit):7.98639316555857
                        Encrypted:false
                        SSDEEP:12288:bWNh3P6+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:C3PDegf121YS8lkipdjMMNB1DofjgJJg
                        MD5:59EE5E2FB56A099CAA8EDFD7AF821ED6
                        SHA1:F5DC4F876768D57B69EC894ADE0A66E813BFED92
                        SHA-256:E100AAAA4FB2B3D78E3B6475C3B48BE189C5A39F73CFC2D22423F2CE928D3E75
                        SHA-512:77A45C89F6019F92576D88AE67B59F9D6D36BA6FDC020419DAB55DBD8492BA97B3DAC18278EB0210F90758B3D643EA8DCF8EC2BD1481930A59B8BB515E7440FE
                        Malicious:false
                        Preview:...........].s..R/c..D@..\......3Z.....E.,...d{.k.~..H3....-......A...<>n.......X..Dp..d......f.{...9&F..........R.UW-..^..zC.kjOUUMm...nW...Z.7.J.R.....=*.R........4..(WCMQ..u]]R...R......5.*..N)].....!.-.d]M....7.......i..rmP...6A.Z .=..~..$C-..}..Mo.T......:._'.S....r.9....6.....r....#...<U@.Iiu..X].T x.j....x...:q.....j]P3......[.5]|..7;.5....^..7(.E..@..s...2..}..j....*...t.5J...6Rf..%P{2T^$Y.V.O9.W...4...\ .5............Q.&j....h.+.u......W...4f]..s..(...:....`.<W_...z*Bs|tF5 NI4.zD..5...u...!........M.0.K%F....,.c.....>R6..i..Am.y.~5..S....M...^......F.&..V...Z.......i....b....V..,.UH"...W...5}A.....KUT..=6jZ.....B...Z...Y(..u...=....x,2..."._Cf.....b...z7..... r..#.r..L9....2...R,..J?&..p..~.....3.=z...w..m..U..%._#<....r.....B.z..G..D.:4m.Z.&.N......</..Dz+.......vn.....;Qhk....!dw...A......3..a..K...).Q.`t[..)].6.%@....v.g.%E>;Z...uz.L..6Ct..O.Eo.O.e..........J.J$...:....K..)......F.....ZWE...z..5..g.io...l2[.,m9X..f......5|:bj[.._R{gi...^

                        C:\Users\user\AppData\Local\Temp\acrocef_low\394ac64a-43b1-47c5-8a41-edf99e4aca24.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                        Category:dropped
                        Size (bytes):1419751
                        Entropy (8bit):7.976496077007677
                        Encrypted:false
                        SSDEEP:24576:/xaWL07oywYIGNPUGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JaWLxywZG6GZn3mlind9i4ufFXpAXkru
                        MD5:FFA982D6F2F9B46A1DECDD28BF3EF0E1
                        SHA1:B1D05ED9BD6A80BD0E3377E9F62B47EF83FCC0C8
                        SHA-256:93D954FA4BBEDCDFBC7BF14FA1BB3986056261F4A5035C3CFF229FF16D12B78B
                        SHA-512:BF2931508F2039FFF4A74EC9B2FF2706FCF05DC5D56E22CA9C74B7C4AF9E8B4173419791DE648FD77AE7C4B441734E7C70C964A2B91C816FC98C9BA78BEB7879
                        Malicious:false
                        Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                        C:\Users\user\AppData\Local\Temp\acrocef_low\67134e13-5502-4003-a59c-f2122a9b68ac.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                        Category:dropped
                        Size (bytes):386528
                        Entropy (8bit):7.9736851559892425
                        Encrypted:false
                        SSDEEP:6144:rBgI81ReWQ53+sQ3POSTJJJJEQ6T9UkRm1XX/FLYVbxrr/IxktOQZ1mau4yBwsOo:r+Tegs6lTJJJJv+9UZd1ybxrr/IxkB1m
                        MD5:774036904FF86EB19FCE18B796528E1E
                        SHA1:2BA0EBF3FC7BEF9EF5BFAD32070BD3C785904E16
                        SHA-256:D2FC8EA3DDD3F095F7A469927179B408102471627C91275EDB4D7356F8E453AD
                        SHA-512:9E9662EA15AE3345166C1E51235CDCE3123B27848E4A4651CC4D2173BDD973E4AD2F8994EFF34A221A9F07AA676F52BEB6D90FF374F6CCB0D06FA39C3EFE6B31
                        Malicious:false
                        Preview:...........[l\[.......p.a$..$.K...&%J.J...Wuo..dI.vk4.E..P.u..(.....1.I....A...............0.....$ctg.H.'....@.Zk...~.s.A]M.A..:g?.^{...cjL...X..#.Q{......z...m...K.U]-..^V.........@..P...U.R..z.......?......]nG..O{..n........y...v7...~C#..O.z...:...H&..6M;........c..#.y4u.~6.?...V?.%?SW.....K...[..`N.i.1..:..@?i.Q..O...`.....m.!y.{...?=.. .....Zk......%.6......o<.....yA}......no......u,.....U...a.......[S.n..`.....:...1......X..u.u...`..B=.&M.y..s.....}.i..l.'u]. ...6.s`....zdN.F.>;.d%D..}3..b..~..k.......,hl.j..._...F..p.z..o...C..,.Ss.u.Xd..a.Y.{.p...?.k..t,&..'...........^.f.hg....y..Y...i..m....<..^......yK.......;.5...E...K..Q.;k..|;..B.{m..eS..>b..>...6...wmC.i.....wv..k..{..X...RB.P..?w......1l.H..{{.`g.P.8.Z..v_.G.....f.%+z.....p.P..u}.T.....~r]..W7..._..c.k.....@....y.K...uOSj........^....B..]..~{..;...c....r.J.m.S.}.....k....u*^...5./...{......3.I.p.t...V..........W-..|.K.N.....n.........Bl...#)..;..4.x.....'....A....x..

                        C:\Users\user\AppData\Local\Temp\acrocef_low\bd1ff109-7b0f-4bfa-802b-cf2c3032c774.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                        Category:dropped
                        Size (bytes):1407294
                        Entropy (8bit):7.97605879016224
                        Encrypted:false
                        SSDEEP:24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tOWLaGZ4ZwYIGNPS:RB3mlind9i4ufFXpAXkrfUs0kWLaGZ48
                        MD5:1D64D25345DD73F100517644279994E6
                        SHA1:DE807F82098D469302955DCBE1A963CD6E887737
                        SHA-256:0A05C4CE0C4D8527D79A3C9CEE2A8B73475F53E18544622E4656C598BC814DFC
                        SHA-512:C0A37437F84B4895A7566E278046CFD50558AD84120CA0BD2EAD2259CA7A30BD67F0BDC4C043D73257773C607259A64B6F6AE4987C8B43BB47241F3C78EB9416
                        Malicious:false
                        Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                        C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:ISO-8859 text, with very long lines (3486), with CRLF, CR line terminators
                        Category:dropped
                        Size (bytes):14456
                        Entropy (8bit):4.2098179599164975
                        Encrypted:false
                        SSDEEP:192:gcPqYV/saFlwwR+kMqe8TlZMX1sgUVa3ddMVsuNeMcGdSD9obOUAVlcMudM/Y14e:g7Q/X4kMb0lZ6mgtdHOelGdWaolvsTZ
                        MD5:32FCA302C8B872738373D7CCB1E75FD4
                        SHA1:DA85FAF24ED0ECFD5D69CCFD6286D8B77D7EB4F1
                        SHA-256:CD0DD26304B88C20801FE80B33C49C009E2E5D4411B5D7F83252E1D90CD461C6
                        SHA-512:57F8CC85FAFB15455074431216E47433E50DF5DE74ED74C395B7FF2C433DB7CE06F0A1C1FE1EFDC17229DBC33325D559789F43901556DD1A12963B94F01D5A1F
                        Malicious:false
                        Preview:%PPKLITE-2.1.%......1 0 obj.<</PPK<</AddressBook<</Entries[2 0 R 3 0 R 4 0 R 5 0 R 6 0 R]/NextID 1006/Type/AddressBook>>/Type/PPK/User<</Type/User>>/V 65537>>/Type/Catalog>>.endobj.2 0 obj.<</ABEType 1/Cert<308204A130820389A00302010202043E1CBD28300D06092A864886F70D01010505003069310B300906035504061302555331233021060355040A131A41646F62652053797374656D7320496E636F72706F7261746564311D301B060355040B131441646F6265205472757374205365727669636573311630140603550403130D41646F626520526F6F74204341301E170D3033303130383233333732335A170D3233303130393030303732335A3069310B300906035504061302555331233021060355040A131A41646F62652053797374656D7320496E636F72706F7261746564311D301B060355040B131441646F6265205472757374205365727669636573311630140603550403130D41646F626520526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100CC4F5484F7A7A2E733537F3F9C12886B2C9947677E0F1EB9AD1488F9C310D81DF0F0D59F690A2F5935B0CC6CA94C9C15A09FCE20BFA0CF54E2E02066453F3986387E9CC48E0722C624F60112B035DF55EA6990B

                        Static File Info

                        General

                        File type:
                        Entropy (8bit):7.795081950047265
                        TrID:
                        • Adobe Portable Document Format (5005/1) 100.00%
                        File name:W-9 Blank - March 2024 revision.pdf
                        File size:140'815 bytes
                        MD5:4e7f7065f6e4a526452ffacb0134bc50
                        SHA1:3c265a136ba7fa236cdfc7b8f8b7853ed6c63e08
                        SHA256:2d420cbb4123dcf1fb82595b2359cfbb5d81f00b9df9d359fcc7af361d093f53
                        SHA512:b2024cd63a5a9e3a2245b72c36bdfea1f083373b01e7e2acc3e5f264053ba6e3030073d5966dbc1f01f99c221dea28e1c24c8b9b44e1de812faa5d565e1c1df2
                        SSDEEP:3072:NZ99tHvNziv76ksxL+dugQh2h7nU/SQqwCe+l/OrHKq:NJtvNis9+dHQh6HQECHv
                        TLSH:8DD3E084570358E4D4534A60B72CB66ACAFF70E67ECC28077D8C06D64F41E93B6A86DB
                        File Content Preview:%PDF-1.7.%......1031 0 obj.<</Linearized 1/L 126744/O 1036/E 31275/N 6/T 126277/H [ 515 302]>>.endobj. ..1052 0 obj.<</DecodeParms<</Columns 4/Predictor 12>>/Filter/FlateDecode/ID[<12253618B019F6419353B3C715534797><17D07252539C784A909EE21165D93

                        File Icon

                        Icon Hash:62cc8caeb29e8ae0

                        Network Behavior

                        Network Port Distribution

                        TCP Packets

                        TimestampSource PortDest PortSource IPDest IP
                        Apr 17, 2024 01:58:06.583720922 CEST49714443192.168.2.1623.54.200.159
                        Apr 17, 2024 01:58:06.583748102 CEST4434971423.54.200.159192.168.2.16
                        Apr 17, 2024 01:58:06.583895922 CEST49714443192.168.2.1623.54.200.159
                        Apr 17, 2024 01:58:06.584033012 CEST49714443192.168.2.1623.54.200.159
                        Apr 17, 2024 01:58:06.584048033 CEST4434971423.54.200.159192.168.2.16
                        Apr 17, 2024 01:58:06.905601978 CEST4434971423.54.200.159192.168.2.16
                        Apr 17, 2024 01:58:06.906270981 CEST49714443192.168.2.1623.54.200.159
                        Apr 17, 2024 01:58:06.906282902 CEST4434971423.54.200.159192.168.2.16
                        Apr 17, 2024 01:58:06.909843922 CEST4434971423.54.200.159192.168.2.16
                        Apr 17, 2024 01:58:06.909966946 CEST49714443192.168.2.1623.54.200.159
                        Apr 17, 2024 01:58:06.911760092 CEST49714443192.168.2.1623.54.200.159
                        Apr 17, 2024 01:58:06.911760092 CEST49714443192.168.2.1623.54.200.159
                        Apr 17, 2024 01:58:06.911931038 CEST4434971423.54.200.159192.168.2.16
                        Apr 17, 2024 01:58:06.952056885 CEST49714443192.168.2.1623.54.200.159
                        Apr 17, 2024 01:58:06.952064037 CEST4434971423.54.200.159192.168.2.16
                        Apr 17, 2024 01:58:07.000041008 CEST49714443192.168.2.1623.54.200.159
                        Apr 17, 2024 01:58:07.017849922 CEST4434971423.54.200.159192.168.2.16
                        Apr 17, 2024 01:58:07.018043041 CEST4434971423.54.200.159192.168.2.16
                        Apr 17, 2024 01:58:07.018121958 CEST49714443192.168.2.1623.54.200.159
                        Apr 17, 2024 01:58:07.020896912 CEST49714443192.168.2.1623.54.200.159
                        Apr 17, 2024 01:58:07.020910025 CEST4434971423.54.200.159192.168.2.16

                        HTTP Request Dependency Graph

                        • armmf.adobe.com

                        HTTPS Proxied Packets

                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                        0192.168.2.164971423.54.200.1594436340C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        TimestampBytes transferredDirectionData
                        2024-04-16 23:58:06 UTC390OUTGET /onboarding/smskillreader.txt HTTP/1.1
                        Host: armmf.adobe.com
                        Connection: keep-alive
                        Accept-Language: en-US,en;q=0.9
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
                        Sec-Fetch-Site: same-origin
                        Sec-Fetch-Mode: no-cors
                        Sec-Fetch-Dest: empty
                        Accept-Encoding: gzip, deflate, br
                        2024-04-16 23:58:07 UTC247INHTTP/1.1 200 OK
                        Server: Apache
                        Last-Modified: Mon, 01 May 2023 15:02:33 GMT
                        ETag: "78-5faa31cce96da"
                        Accept-Ranges: bytes
                        Content-Length: 120
                        Content-Type: text/plain; charset=UTF-8
                        Date: Tue, 16 Apr 2024 23:58:06 GMT
                        Connection: close
                        2024-04-16 23:58:07 UTC120INData Raw: 46 69 6c 65 20 74 68 61 74 20 61 63 74 73 20 6c 69 6b 65 20 61 20 4b 69 6c 6c 20 73 77 69 74 63 68 20 66 6f 72 20 53 4d 53 20 66 75 6e 63 74 69 6f 6e 61 6c 69 74 79 20 69 6e 20 52 65 61 64 65 72 2e 20 44 65 6c 65 74 65 20 74 68 69 73 20 66 69 6c 65 20 74 6f 20 65 6e 61 62 6c 65 20 74 68 65 20 6b 69 6c 6c 20 73 77 69 74 63 68 20 69 6e 20 52 65 61 64 65 72 2e
                        Data Ascii: File that acts like a Kill switch for SMS functionality in Reader. Delete this file to enable the kill switch in Reader.


                        Statistics

                        CPU Usage

                        Click to jump to process

                        Memory Usage

                        Click to jump to process

                        High Level Behavior Distribution

                        Click to dive into process behavior distribution

                        Behavior

                        Click to jump to process

                        System Behavior

                        General

                        Target ID:0
                        Start time:01:57:49
                        Start date:17/04/2024
                        Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        Wow64 process (32bit):false
                        Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\W-9 Blank - March 2024 revision.pdf"
                        Imagebase:0x7ff744680000
                        File size:5'641'176 bytes
                        MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:moderate
                        Has exited:false

                        General

                        Target ID:2
                        Start time:01:57:53
                        Start date:17/04/2024
                        Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        Wow64 process (32bit):false
                        Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                        Imagebase:0x7ff68f9d0000
                        File size:3'581'912 bytes
                        MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:moderate
                        Has exited:false

                        General

                        Target ID:3
                        Start time:01:57:54
                        Start date:17/04/2024
                        Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        Wow64 process (32bit):false
                        Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2260 --field-trial-handle=1576,i,17669440550934361566,2057664599773174521,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                        Imagebase:0x7ff68f9d0000
                        File size:3'581'912 bytes
                        MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:moderate
                        Has exited:false

                        Disassembly

                        ⊘No disassembly