Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Confirmation Andrea Cuevas Sepulveda (Request).pdf

Overview

General Information

Sample name:Confirmation Andrea Cuevas Sepulveda (Request).pdf
Analysis ID:1428450
MD5:ff790714bec9adb9dcc958b159555c00
SHA1:4bb9d78b50fa65b281693a3cdaf559411d096a62
SHA256:9d68bfaf1a38b71af02f835d87ff1e4f6b38a305466c7fa533151a87d1604511
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

IP address seen in connection with other malware
Phishing site detected (based on OCR NLP Model)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 7656 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Confirmation Andrea Cuevas Sepulveda (Request).pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 7840 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 8020 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1568,i,589966986038949355,13703487978581972660,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: Adobe Acrobat PDFML Model on OCR Text: Matched 80.2% probability on "Digibee April 18, 2024 Andrea Cuevas Sepulveda 318 Celulosa Arauco y Constitucion Golf 150, Piso 14, Las Condes, Santiago andrea.cuevas@arauco.com Dear Andrea Cuevas Sepulveda, In connection with the audit of our financial statements, please confirm directly to our auditors, Deloitte & Touche LLP, gdayal@deloitte.com the amount owed to us as of December 31 , 2023 amounted to $83,200.00 in respect of invoice number #7290 dated December 30, 2023 issued by us to you. If the amount shown is in agreement with your records, please check "A" below. If the amount is not in agreement with your records, please check and complete "B" below. After selecting the appropriate response, please sign and date your reply and send it directly to our auditors. Your prompt attention to this request will be appreciated. This confirmation is not a request for payment; please DO NOT SEND PAYMENTS to our auditors. Yours very truly, Rafael Nardelli CFO "
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: Joe Sandbox ViewIP Address: 184.25.164.138 184.25.164.138
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: classification engineClassification label: clean2.winPDF@14/44@0/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journalJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-19 00-06-08-428.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Confirmation Andrea Cuevas Sepulveda (Request).pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1568,i,589966986038949355,13703487978581972660,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1568,i,589966986038949355,13703487978581972660,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: Confirmation Andrea Cuevas Sepulveda (Request).pdfInitial sample: PDF keyword /JS count = 0
Source: Confirmation Andrea Cuevas Sepulveda (Request).pdfInitial sample: PDF keyword /JavaScript count = 0
Source: A95iut3n_efa1dk_5z8.tmp.0.drInitial sample: PDF keyword /JS count = 0
Source: A95iut3n_efa1dk_5z8.tmp.0.drInitial sample: PDF keyword /JavaScript count = 0
Source: Confirmation Andrea Cuevas Sepulveda (Request).pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive12
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1428450 Sample: Confirmation Andrea Cuevas ... Startdate: 19/04/2024 Architecture: WINDOWS Score: 2 6 Acrobat.exe 17 73 2->6         started        process3 8 AcroCEF.exe 105 6->8         started        process4 10 AcroCEF.exe 2 8->10         started        dnsIp5 13 184.25.164.138, 443, 49740 BBIL-APBHARTIAirtelLtdIN United States 10->13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
184.25.164.138
unknownUnited States
9498BBIL-APBHARTIAirtelLtdINfalse

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1428450
Start date and time:2024-04-19 00:05:16 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 4s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultwindowspdfcookbook.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:10
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:Confirmation Andrea Cuevas Sepulveda (Request).pdf
Detection:CLEAN
Classification:clean2.winPDF@14/44@0/1
Cookbook Comments:
  • Found application associated with file extension: .pdf
  • Found PDF document
  • Close Viewer

Warnings

  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 23.201.212.159, 52.5.13.197, 52.202.204.11, 23.22.254.206, 54.227.187.23, 23.34.82.7, 23.34.82.6, 172.64.41.3, 162.159.61.3
  • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com
  • Not all processes where analyzed, report is missing behavior information
  • VT rate limit hit for: Confirmation Andrea Cuevas Sepulveda (Request).pdf

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
184.25.164.138Proposal Invitation_ Proposal is Due by the EOB May 15.emlGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
    file.pdf.download.lnkGet hashmaliciousUnknownBrowse
      Factura_SA161.pdf.lnkGet hashmaliciousRHADAMANTHYSBrowse
        Re_ Medina County Kitchen.emlGet hashmaliciousUnknownBrowse
          oiDDogdK9A.exeGet hashmaliciousLokibot, PureLog Stealer, zgRATBrowse
            New_Order.xlsGet hashmaliciousUnknownBrowse
              https://enfoldindia.org/wp-content/uploads/2019/06/Restorative-Circle-Handbook-for-CCI.pdfGet hashmaliciousUnknownBrowse
                TaxForm.lnkGet hashmaliciousDarkGate, MailPassViewBrowse
                  https://ntnusa0-my.sharepoint.com/:f:/g/personal/ajaronik_ntnusa_com/EjzRads0Sf5Ivon47-zBKVABS1TZOI64W6Uv34YFqNQjmQ?e=NuZrjrGet hashmaliciousHTMLPhisher, ReCaptcha PhishBrowse
                    SOA.xlsGet hashmaliciousUnknownBrowse

                      Domains

                      ⊘No context

                      ASNs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      BBIL-APBHARTIAirtelLtdINhttps://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:24e81d17-b801-4fad-ae25-120d655923c5Get hashmaliciousRemcosBrowse
                      • 23.209.188.17
                      Proposal Invitation_ Proposal is Due by the EOB May 15.emlGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
                      • 184.25.164.138
                      file.pdf.download.lnkGet hashmaliciousUnknownBrowse
                      • 184.25.164.138
                      Factura_SA161.pdf.lnkGet hashmaliciousRHADAMANTHYSBrowse
                      • 184.25.164.138
                      Ud310iQZnO.elfGet hashmaliciousMiraiBrowse
                      • 182.74.25.30
                      tWpGuzQQoW.elfGet hashmaliciousMiraiBrowse
                      • 122.185.203.209
                      kGbjOmkleq.elfGet hashmaliciousMiraiBrowse
                      • 125.23.195.204
                      iH18gdEj8Y.elfGet hashmaliciousMiraiBrowse
                      • 125.19.93.33
                      xmncOD7BwX.elfGet hashmaliciousMiraiBrowse
                      • 122.184.236.50
                      SFTNQEBmOA.elfGet hashmaliciousUnknownBrowse
                      • 182.79.2.232

                      JA3 Fingerprints

                      ⊘No context

                      Dropped Files

                      ⊘No context

                      Created / dropped Files

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.188443386742127
                      Encrypted:false
                      SSDEEP:6:X0GnXAQ+q2Pwkn2nKuAl9OmbnIFUt8Y0GKXAgZmw+Y0GKXAQVkwOwkn2nKuAl9Oe:X09VvYfHAahFUt8Y00g/+Y00I5JfHAae
                      MD5:BECACCA2D3585465F72E3939737BBC44
                      SHA1:F72EAA545AC77C783C008B422E6D9E01D54A3204
                      SHA-256:C10E8D429B0D61935CFDBDEF396E893FFB831D8F0828264ED2F9EA3C6BC054FF
                      SHA-512:0F8227DB048B2A8FAD6B4918834D65796114C33F1D75D6BACA7313598DB60DD73E8A543C6921B65ADB218F97CB9642A039D485FE1F3C01920C9BD836E601FE01
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/19-00:06:06.198 1f48 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/19-00:06:06.199 1f48 Recovering log #3.2024/04/19-00:06:06.199 1f48 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.188443386742127
                      Encrypted:false
                      SSDEEP:6:X0GnXAQ+q2Pwkn2nKuAl9OmbnIFUt8Y0GKXAgZmw+Y0GKXAQVkwOwkn2nKuAl9Oe:X09VvYfHAahFUt8Y00g/+Y00I5JfHAae
                      MD5:BECACCA2D3585465F72E3939737BBC44
                      SHA1:F72EAA545AC77C783C008B422E6D9E01D54A3204
                      SHA-256:C10E8D429B0D61935CFDBDEF396E893FFB831D8F0828264ED2F9EA3C6BC054FF
                      SHA-512:0F8227DB048B2A8FAD6B4918834D65796114C33F1D75D6BACA7313598DB60DD73E8A543C6921B65ADB218F97CB9642A039D485FE1F3C01920C9BD836E601FE01
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/19-00:06:06.198 1f48 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/19-00:06:06.199 1f48 Recovering log #3.2024/04/19-00:06:06.199 1f48 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):336
                      Entropy (8bit):5.14062851891231
                      Encrypted:false
                      SSDEEP:6:X0yBq2Pwkn2nKuAl9Ombzo2jMGIFUt8Y0EZmw+Y0MUbkwOwkn2nKuAl9Ombzo2jz:X0yBvYfHAa8uFUt8Y0E/+Y0Vb5JfHAaU
                      MD5:DF496AE59ECF0F673E58B92C0B9CA8D8
                      SHA1:0053F63967D0095114D351C06E3B3098A5AF8758
                      SHA-256:4505BFEFCCA6482C61C9F60538259B235A5D2957EDCFE7C6520E222F32458C8D
                      SHA-512:FBC77E265E374843EF343241BA522750611E7190555A6E543DB78626F8EDFCFC012A924FEC64CEE45CC278EFF55C0E72458C0C4253CAD357B45CD75BD01ECA4E
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/19-00:06:06.221 1fb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/19-00:06:06.222 1fb4 Recovering log #3.2024/04/19-00:06:06.223 1fb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):336
                      Entropy (8bit):5.14062851891231
                      Encrypted:false
                      SSDEEP:6:X0yBq2Pwkn2nKuAl9Ombzo2jMGIFUt8Y0EZmw+Y0MUbkwOwkn2nKuAl9Ombzo2jz:X0yBvYfHAa8uFUt8Y0E/+Y0Vb5JfHAaU
                      MD5:DF496AE59ECF0F673E58B92C0B9CA8D8
                      SHA1:0053F63967D0095114D351C06E3B3098A5AF8758
                      SHA-256:4505BFEFCCA6482C61C9F60538259B235A5D2957EDCFE7C6520E222F32458C8D
                      SHA-512:FBC77E265E374843EF343241BA522750611E7190555A6E543DB78626F8EDFCFC012A924FEC64CEE45CC278EFF55C0E72458C0C4253CAD357B45CD75BD01ECA4E
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/19-00:06:06.221 1fb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/19-00:06:06.222 1fb4 Recovering log #3.2024/04/19-00:06:06.223 1fb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5b6a8fcc-f09e-4a7d-8e95-ed1613379993.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:modified
                      Size (bytes):475
                      Entropy (8bit):4.976856963140155
                      Encrypted:false
                      SSDEEP:12:YH/um3RA8sqZGhsBdOg2H3caq3QYiubInP7E4T3y:Y2sRds3ydMH23QYhbG7nby
                      MD5:0B0CD26466D235B08D7A0C67E113B97B
                      SHA1:94C1F0A35EA7E45C3C34E5E1B8C43B55CDB47BF8
                      SHA-256:E899D4232428B44F07ABE39ADA55C50DC606BB095EF3E4C58BA3BE95E6F38DDA
                      SHA-512:C2D386BEB3169B17EA690B3A8259AAF471630F78A6DA1269CD9EE52E9B22C5B3698FB8AFA358FD1CA9C71DC379015ACD718AAAEE6BA25C1C95CDAD947E0B39FA
                      Malicious:false
                      Reputation:low
                      Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13358037978150196","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":106374},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):475
                      Entropy (8bit):4.976856963140155
                      Encrypted:false
                      SSDEEP:12:YH/um3RA8sqZGhsBdOg2H3caq3QYiubInP7E4T3y:Y2sRds3ydMH23QYhbG7nby
                      MD5:0B0CD26466D235B08D7A0C67E113B97B
                      SHA1:94C1F0A35EA7E45C3C34E5E1B8C43B55CDB47BF8
                      SHA-256:E899D4232428B44F07ABE39ADA55C50DC606BB095EF3E4C58BA3BE95E6F38DDA
                      SHA-512:C2D386BEB3169B17EA690B3A8259AAF471630F78A6DA1269CD9EE52E9B22C5B3698FB8AFA358FD1CA9C71DC379015ACD718AAAEE6BA25C1C95CDAD947E0B39FA
                      Malicious:false
                      Reputation:low
                      Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13358037978150196","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":106374},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):4730
                      Entropy (8bit):5.2565369232131385
                      Encrypted:false
                      SSDEEP:96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7vyzdTZ:etJCV4FiN/jTN/2r8Mta02fEhgO73go+
                      MD5:55DD2288FF08E6D3FA8CEFB12450B278
                      SHA1:72ADBC1792516475B33491D54E61625AE6B1A0DD
                      SHA-256:F914F742097A63CDE4B59E3066DE60A2A61F33258366DC90F1F404D1C8B189BE
                      SHA-512:45FF828AF8F931648B3CDE3C117F445AA5A0F248B655979496733BE188D6EA234C59CFBBA64F847AB41034D9C8AF2B14B969AB5CE354337308B50BE15D7869A0
                      Malicious:false
                      Reputation:low
                      Preview:*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):324
                      Entropy (8bit):5.188282817896725
                      Encrypted:false
                      SSDEEP:6:X0AYMq2Pwkn2nKuAl9OmbzNMxIFUt8Y0sCM9Zmw+Y0swkwOwkn2nKuAl9OmbzNMT:X0ANvYfHAa8jFUt8Y02/+Y0Z5JfHAa8E
                      MD5:2E4202405316F89063675E8C04AF73AB
                      SHA1:5A3B7D82B2EB2DDBE61143D509ECC22CB950E49B
                      SHA-256:4992E8DCFF679357542C418B9C8B84DD51F7F386416450106AB712B9C766D569
                      SHA-512:5687CCB0AC27214BFF839F593DDBEB3E3502E6477ADA966027118EC499DBAD8E6EFE262BFB42392ED1A6F1CA4B3D653B3E711B0DC19B6CAC8ECB4661020A2E2A
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/19-00:06:06.733 1fb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/19-00:06:06.813 1fb4 Recovering log #3.2024/04/19-00:06:06.814 1fb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):324
                      Entropy (8bit):5.188282817896725
                      Encrypted:false
                      SSDEEP:6:X0AYMq2Pwkn2nKuAl9OmbzNMxIFUt8Y0sCM9Zmw+Y0swkwOwkn2nKuAl9OmbzNMT:X0ANvYfHAa8jFUt8Y02/+Y0Z5JfHAa8E
                      MD5:2E4202405316F89063675E8C04AF73AB
                      SHA1:5A3B7D82B2EB2DDBE61143D509ECC22CB950E49B
                      SHA-256:4992E8DCFF679357542C418B9C8B84DD51F7F386416450106AB712B9C766D569
                      SHA-512:5687CCB0AC27214BFF839F593DDBEB3E3502E6477ADA966027118EC499DBAD8E6EFE262BFB42392ED1A6F1CA4B3D653B3E711B0DC19B6CAC8ECB4661020A2E2A
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/19-00:06:06.733 1fb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/19-00:06:06.813 1fb4 Recovering log #3.2024/04/19-00:06:06.814 1fb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240418220610Z-153.bmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
                      Category:dropped
                      Size (bytes):71190
                      Entropy (8bit):1.0180450991121128
                      Encrypted:false
                      SSDEEP:384:0GPsr5OBO8DX5dhVJhrk9Qu0QfRd3KW2U:0GPsr5P8DX5dhVJhrk9QGfRd+U
                      MD5:8C8C61270C69AADF2D60A9722AF8300F
                      SHA1:25E3E0747B7B6B5CEFAC68E41C74546ABE339307
                      SHA-256:906FB1D2EC24E419C98206263C766F725A874D62B366A4FAEDF9AD0350E5C435
                      SHA-512:A95CCEB99A6C73C9C8131E42045E023CFC527CC0BD80A261BD2D7EA89086041A6B7F12D907F5A95547D6722EC5F975914B4E8E427BC6B489DD43C992246B1FF4
                      Malicious:false
                      Reputation:low
                      Preview:BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
                      Category:dropped
                      Size (bytes):86016
                      Entropy (8bit):4.444964538869684
                      Encrypted:false
                      SSDEEP:384:yezci5t2iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:r5s3OazzU89UTTgUL
                      MD5:FF3D19FC4397C049D64F17AB0F4B9D70
                      SHA1:80575DE298C9B77554B8962B9BDF130F255B1CF6
                      SHA-256:7AC5288D7BE728D943AB8892D39A5125C01857056C4A33277CB9798B1474B2EF
                      SHA-512:35033F4F8AF2E707394A2276BD91CA7DBCFF9B8D88959C45EB8BB43638E784067F0684066A9CCFFC94E93A6A73957056D101407DA97BDA33BC745FB3FE8BA431
                      Malicious:false
                      Reputation:low
                      Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite Rollback Journal
                      Category:dropped
                      Size (bytes):8720
                      Entropy (8bit):3.774192574379686
                      Encrypted:false
                      SSDEEP:48:7MEp/E2ioyVbioy9oWoy1Cwoy17KOioy1noy1AYoy1Wioy1hioybioy7oy1noy1x:7npjubFOXKQKKb9IVXEBodRBkm
                      MD5:C4E82721611D9A1D4763456B640E2B28
                      SHA1:97F654368251CB811289EB8DDCA6F05639098EBE
                      SHA-256:AF125D2C79833C0C4AF69867ABD218954BE3F3189D3B4A403E7EE6A58E3867B1
                      SHA-512:C57E8C23CCC521C9A7D85024FE37741AD5E2A937D8F027849BA2CFE92CAC2514B22C3AF66753340505E3FF965BAF3F8E1C1C86567A01EB1834D21792CD73C305
                      Malicious:false
                      Reputation:low
                      Preview:.... .c.....E.v................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7748

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PostScript document text
                      Category:dropped
                      Size (bytes):185099
                      Entropy (8bit):5.182478651346149
                      Encrypted:false
                      SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                      MD5:94185C5850C26B3C6FC24ABC385CDA58
                      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                      Malicious:false
                      Reputation:moderate, very likely benign file
                      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PostScript document text
                      Category:dropped
                      Size (bytes):185099
                      Entropy (8bit):5.182478651346149
                      Encrypted:false
                      SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                      MD5:94185C5850C26B3C6FC24ABC385CDA58
                      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                      Malicious:false
                      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):243196
                      Entropy (8bit):3.3450692389394283
                      Encrypted:false
                      SSDEEP:1536:vKPCPiyzDtrh1cK3XEivK7VK/3AYvYwgqErRo+RQn:yPClJ/3AYvYwghFo+RQn
                      MD5:F5567C4FF4AB049B696D3BE0DD72A793
                      SHA1:EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916
                      SHA-256:D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
                      SHA-512:E769735991E5B1331E259608854D00CDA4F3E92285FDC500158CBD09CBCCEAD8A387F78256A43919B13EBE70C995D19242377C315B0CCBBD4F813251608C1D56
                      Malicious:false
                      Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):295
                      Entropy (8bit):5.387739553115118
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXkchD99VoZcg1vRcR0YKAoAvJM3g98kUwPeUkwRe9:YvXKXrBEZc0vpGMbLUkee9
                      MD5:F0A089B3CC61EC09482ADFD4FCEC2626
                      SHA1:2F37112A99767361D193ACF6D857ED002C80D7F6
                      SHA-256:B44BD62F10AE356BBB53F07250349348D6A74E97C969A25B576FA52174B9535F
                      SHA-512:0A5DEED6E43473DD585235978030C96D44F368912D5E9DF82108595A11C99A9FE13855F1A3B8768E28B42E3EA73B49A00703B45D633D0939C89084CDA3983F2D
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7d0aa851-cdc2-4879-8db1-c22f36fb897d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652526161,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.338692645129391
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXkchD99VoZcg1vRcR0YKAoAvJfBoTfXpnrPeUkwRe9:YvXKXrBEZc0vpGWTfXcUkee9
                      MD5:F679648207A2318E278661939ECB7A4B
                      SHA1:BD1E6832FED04298BCB79BA53D18B48CC04827F5
                      SHA-256:0E386B6853B747B6B263E48228200DCF3F666237867737E25C261653422E0316
                      SHA-512:B3F1B404EEA773F7A1F40A692E9732952F39C4E1EE0758EE96B21AB420038101CCC890D91886E64B5AE4A9497FBA74CED230D6F4FF293C8D353CA72AC259BF47
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7d0aa851-cdc2-4879-8db1-c22f36fb897d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652526161,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.3162358433480135
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXkchD99VoZcg1vRcR0YKAoAvJfBD2G6UpnrPeUkwRe9:YvXKXrBEZc0vpGR22cUkee9
                      MD5:8D658C17037BE33CEFAB570FA428D30B
                      SHA1:34EE81AE7607FEE8A06A5DA49973FBD6F5B86073
                      SHA-256:06C69798DF133D1D0C6559DD7701FC98191B76CFD503E9536A8A1178D0B1E6ED
                      SHA-512:705319A9D4C95AB3063D405C6321253313A24058ED0BDF822C2444F49AA217E626C41B904DB19605776AE98695E2B39BC8482D965C47C67C173201A36A2031CA
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7d0aa851-cdc2-4879-8db1-c22f36fb897d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652526161,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):285
                      Entropy (8bit):5.375605363408451
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXkchD99VoZcg1vRcR0YKAoAvJfPmwrPeUkwRe9:YvXKXrBEZc0vpGH56Ukee9
                      MD5:9D778E097297E117655988B15CB51299
                      SHA1:ADAAC8D843AAA5BA84774C44B91CF94B2BDF7C08
                      SHA-256:847E32D820887A59B5E7BE2372C1E51BFED02C40ABC968B5732A6D2C2DD26883
                      SHA-512:35C39C7F12F6C6C6A436EF092D0AE38695E16CF373DD3ACBC2F3B8E7D4DF0A30F4DB66AA80D4BCA2561F75BA20A298AB18329184A650D5813C820049AB09E786
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7d0aa851-cdc2-4879-8db1-c22f36fb897d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652526161,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.3347020573006585
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXkchD99VoZcg1vRcR0YKAoAvJfJWCtMdPeUkwRe9:YvXKXrBEZc0vpGBS8Ukee9
                      MD5:EF05C3DF22F505B15EF6DA2D25D864C0
                      SHA1:6504BEA64E2A2C43070AFD3D2AA5A07B0BECC7B3
                      SHA-256:D57407D567450DD2822CB3AAE8CCED6BD7B2962CE75847370174F3B1BF0D37A2
                      SHA-512:A94DCBBC5FF7B9B9925045EC8E9E00D216307FF879178A302B3149599D27DF415809BD03DAF7DD60567BDD77432182FC81137F589BFD26B821A3D1C1B194AA6C
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7d0aa851-cdc2-4879-8db1-c22f36fb897d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652526161,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.320784433723838
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXkchD99VoZcg1vRcR0YKAoAvJf8dPeUkwRe9:YvXKXrBEZc0vpGU8Ukee9
                      MD5:F339B108C91E9FC915C20EBBB707F6EE
                      SHA1:8A125AF73293FF50EDCEC843648AA1AF2E87A47F
                      SHA-256:96C3480EFEF65F0AED40BB2E923E805ABCE3C7EEC525EE6593447D948ABE6D03
                      SHA-512:B7E4A0ACC87E0ED91C7153117910CEE93161CD4CA7BB572BDC646D0FC536385F8C5A53ECAE9DFD1E5245A47A24B44DCB21EE26FE98D2A306D350BD75FE92B276
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7d0aa851-cdc2-4879-8db1-c22f36fb897d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652526161,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.325071327422359
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXkchD99VoZcg1vRcR0YKAoAvJfQ1rPeUkwRe9:YvXKXrBEZc0vpGY16Ukee9
                      MD5:87EBFE912F38A755413756BEDA071676
                      SHA1:C7C1C07C8EC52F4F1F5AB93E185BAAD442B5A50C
                      SHA-256:583587FF4E719FCB28B77ED5E9204F401689D45468326000C85DFF604D21F5F5
                      SHA-512:72ADA3BBB733744BB06C6340230F42AABB0696DA662DB852855CCD78D5A0CF26A955D8A3CE329ED269D278ADA2FB7C8D78813D7AEE0C1492872EF9B87B8DB039
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7d0aa851-cdc2-4879-8db1-c22f36fb897d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652526161,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.3289904739466465
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXkchD99VoZcg1vRcR0YKAoAvJfFldPeUkwRe9:YvXKXrBEZc0vpGz8Ukee9
                      MD5:20596F0178D9D356CAE56BD2165359B6
                      SHA1:DEB330F71092029950B115AAF5524D1C825BD27E
                      SHA-256:B3D9D3F5A2305F7BCDE994DF3141241AD2911181BE927CF2020B85C921A1A404
                      SHA-512:B9DC765DE8772B79EA85EA5C5F584894C72E13C4D7797DB2F323F456CFFDAF9D62F2357709F2B5A1B65FC67E267F15F5975F64BCC98C4F7764B2172A5EA4C988
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7d0aa851-cdc2-4879-8db1-c22f36fb897d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652526161,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1372
                      Entropy (8bit):5.739461265970753
                      Encrypted:false
                      SSDEEP:24:Yv6XrCzvVKLgENRcbrZbq00iCCBrwJo++ns8ct4mFJNw:YvG6tEgigrNt0wSJn+ns8cvFJy
                      MD5:F92153223C654F50558D90CE72DCAAC5
                      SHA1:E6387FD262C2D11ABE0CB3CC24536194A0EF0F1C
                      SHA-256:CA462B9E876B67B2BEE759EF2347F0C2E43CA4EC5F59A5D2866E8057D59F284C
                      SHA-512:F41F86D28A8A3F382C13BD07D0C9B39EE58351E071744609E63B01047CEB59BAED6823FA52104129E26C1AC67BD74899BDAD99C030DF79FE1A7B7F56B6422B9F
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7d0aa851-cdc2-4879-8db1-c22f36fb897d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652526161,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"79887_247329ActionBlock_0","campaignId":79887,"containerId":"1","controlGroupId":"","treatmentId":"acc56846-d570-4500-a26e-7f8cf2b4acad","variationId":"247329"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJUcnkgQWNyb2JhdCBQcm8ifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNSIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTMiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIDctZGF5IHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0byBwcmVtaXVtIFBERiBhbmQgZS1zaWduaW5nIHRvb2xzLiIsImJ

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.328135585207883
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXkchD99VoZcg1vRcR0YKAoAvJfYdPeUkwRe9:YvXKXrBEZc0vpGg8Ukee9
                      MD5:7B7A9DC72578FA103D1D1300637930A0
                      SHA1:E8C9456A147DDE1C53D6C6D78AADCFEF960E858C
                      SHA-256:12C48BB41DBF2EE17B741063B5DD9C5AEBCA47C0E0349819DFDD3D75A7DD4491
                      SHA-512:0E56D0A989661DC05C512474A0AF37AFB6144FA78940839B94A9FDA2F9A4322541DDCEFBD9C76047E9F091F10DBF48222D48D047E1A35A3085AADC6A966C2891
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7d0aa851-cdc2-4879-8db1-c22f36fb897d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652526161,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1395
                      Entropy (8bit):5.777673279042616
                      Encrypted:false
                      SSDEEP:24:Yv6XrCzvIrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJN4:YvG6wHgDv3W2aYQfgB5OUupHrQ9FJ+
                      MD5:5241D1D917535CB35D6ED25233020E98
                      SHA1:3B84CA4C685AD880E59FBE7DA6F6E93A076C07FB
                      SHA-256:A1B008D17179AEBB5B1C2F711789318D94FC16677FAF7D364B6E19F2E5A2702B
                      SHA-512:1D6845BC68F346AEA4726956E3002EFABDDBB396D00F030DEA356F1E69353A30602E1E75CE268E2D88B9B03D164EF3BD205C2F352047FB87AE491697380B9099
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7d0aa851-cdc2-4879-8db1-c22f36fb897d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652526161,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):291
                      Entropy (8bit):5.311489311162105
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXkchD99VoZcg1vRcR0YKAoAvJfbPtdPeUkwRe9:YvXKXrBEZc0vpGDV8Ukee9
                      MD5:93FB2FAEEF988DCE6EAC44F492607D38
                      SHA1:805E7BFFB290459D77DD2690D41B391C68B6B6E8
                      SHA-256:90465BEB430190018777BC0CCB273BDC82FB706342B29BB2BB84C866A4F1E50E
                      SHA-512:C52609E6ECB6D94B3F0240DF3516C1A3CC14D46F5CA0AF663FA1405F7394A4BA0912A174C9B477F0FA54D7A4BEC424C775D4B6746AA20C8CA66054E55B144709
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7d0aa851-cdc2-4879-8db1-c22f36fb897d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652526161,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):287
                      Entropy (8bit):5.316530202313845
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXkchD99VoZcg1vRcR0YKAoAvJf21rPeUkwRe9:YvXKXrBEZc0vpG+16Ukee9
                      MD5:F1263953DD40EBB8C332CA01247B4FBB
                      SHA1:2168B0EAC05037C0226DFF31D698B12D487C9CD3
                      SHA-256:22F0DD607C72CC9016293EBFBF7D9D77B8A8985E3067FA18E8B710953505900A
                      SHA-512:516C2164141967AF757EF83FBE5435A14136D06BDC1BE2E0540E5BCEB6ACFC7C6DFBB35D510C0428A2858D8A8DE5B29A6EC376A07DCE87D169E586A77243EA80
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7d0aa851-cdc2-4879-8db1-c22f36fb897d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652526161,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.334364690925083
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXkchD99VoZcg1vRcR0YKAoAvJfbpatdPeUkwRe9:YvXKXrBEZc0vpGVat8Ukee9
                      MD5:C11EBB147251CCA3AF544E3B642261D4
                      SHA1:B838430E4F3C3DAAB678C9EB36B464EDFA5EBB77
                      SHA-256:3ED27DFFDB033D64CAFE3132B6CC379BEB8785E4E587AAA302D3A936AC88E9F1
                      SHA-512:B087404019659E594DF28A4BEA22C6B167D85A41857E10EAA905623DB33CBDA1DC1EEFAC0EF2A258F4D4FD8D592D52EF8DB8FB1FC55F9BA2BE659397951E4CA8
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7d0aa851-cdc2-4879-8db1-c22f36fb897d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652526161,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):286
                      Entropy (8bit):5.290090464299488
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXkchD99VoZcg1vRcR0YKAoAvJfshHHrPeUkwRe9:YvXKXrBEZc0vpGUUUkee9
                      MD5:B94FDE6B5EDCD571E1FD5F38399FAB2F
                      SHA1:43F39A6DC90869887CD3D8E4BF642A2D148F9AA7
                      SHA-256:1D232630C46D838D93A3DC61ABEF18C98AC2B0BE41D68264272AFE13B0C5922D
                      SHA-512:08D3F7C02693A505CEC4A80A409D6F328DF6FCF840090EAF4DC433F55CEDDC7C0024B89776DA712D869900EC320BAC35C96E229102A0CDBD4B7EB279C8EE886B
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7d0aa851-cdc2-4879-8db1-c22f36fb897d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652526161,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):782
                      Entropy (8bit):5.370859716050473
                      Encrypted:false
                      SSDEEP:12:YvXKXrBEZc0vpGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWs:Yv6XrCzvF168CgEXX5kcIfANhp
                      MD5:F520CE67012E19022AB19129EA8D2714
                      SHA1:C48E6EF327C38B8CAC2AA2611BBE74A1204315AA
                      SHA-256:8D10B59A364415CB3C658CAEFDFD699F0FDFA3CE5C294FD96C3A2F9864525FDD
                      SHA-512:1BA5F0D02D1A541AF1CC8BA96B073FD37C2AD59DAE3B6781CC0984DA77B2CA3EF60D81CE7A6FF47AC99D3341B00C1C43CC8841EFBD025FEFF6E7FF72D7A22089
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7d0aa851-cdc2-4879-8db1-c22f36fb897d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652526161,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1713477971192}}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):4
                      Entropy (8bit):0.8112781244591328
                      Encrypted:false
                      SSDEEP:3:e:e
                      MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                      SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                      SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                      SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                      Malicious:false
                      Preview:....

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):2814
                      Entropy (8bit):5.123276611357615
                      Encrypted:false
                      SSDEEP:24:YYPYUC94TOMVPrqkwRLavjcgaytKh+/WmGzKRjcj0Sj5gX2wjx2LStHYMI5a5gtN:Yw24SyTwq1v/f1uQzP4MIk5gt97NV
                      MD5:F939E3EC0C30F5C58016C81B24EBF8C3
                      SHA1:C0FD0C380614A0BC1E2C345DA297C5A27A950A41
                      SHA-256:6C6EAEC7224FE43199C3B8C4DEB488EE606978792EE8EF357ED38103ED1BF65E
                      SHA-512:698658013E2F666A3CEB4587B88B334BE43F01C335552C5AD54F84EE375473B91376EF432417D954033C9E97E50FE11CA199C9F309D337C43069137C4E00613C
                      Malicious:false
                      Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"107c878c45a70f25217d20791f9dac1f","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1713477970000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"ecbdba32d334ac55bb185649e6f33d8b","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1372,"ts":1713477970000},{"id":"Edit_InApp_Aug2020","info":{"dg":"61d18e8f2a6ca79fc1fff090a6c17f70","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1713477970000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"109668e89d7afdeb130733639adac358","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1713477970000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"094dcadd1f2af590152e1ca8a0985a40","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1713477970000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"135bb303ae7e0d620fab51b0c8c93287","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1713477970000},

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
                      Category:dropped
                      Size (bytes):12288
                      Entropy (8bit):1.1871473839421625
                      Encrypted:false
                      SSDEEP:48:TGufl2GL7msEHUUUUUUUU6tgSvR9H9vxFGiDIAEkGVvput+:lNVmswUUUUUUUU6tg+FGSIt6t+
                      MD5:8382764D72A6060D864B126079C4B8FA
                      SHA1:BA021176361BF9F4536ADC784560A3BA7FD8A6B7
                      SHA-256:6AE39CC94058D09C5E217994F032F06DF7B39293377E6491292E4E4C55869794
                      SHA-512:E5968AB0FDC9A129917B7F77F4C176E3935F8B104A15DBD314F50A44DC61217E0E4B3BA3E35414C54707156C36AD173B52F18DB755A7F9D7F11625E6C375DFAD
                      Malicious:false
                      Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite Rollback Journal
                      Category:dropped
                      Size (bytes):8720
                      Entropy (8bit):1.607523923900047
                      Encrypted:false
                      SSDEEP:48:7M3KUUUUUUUUUU6tSvR9H9vxFGiDIAEkGVvqqFl2GL7msZ:7xUUUUUUUUUU6t+FGSIt0KVmsZ
                      MD5:F15F0035D337417097DA8C321928548C
                      SHA1:F5416887B11B17566698C20F76195883CB8A1115
                      SHA-256:143C80D72B960C77607860192EE28AEF0C44B69E63CC0F6A9D1743C4DFB9F1FD
                      SHA-512:26513ECF64F89DA3737AFF3FF48D9C6C7455CD4E13D3C01BCFF58608342797166578357D27A78F9C46E4D96EB6D638122413AB167FB49118EEF91F629ECB0CB9
                      Malicious:false
                      Preview:.... .c......+........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Temp\MSI44177.LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):246
                      Entropy (8bit):3.524398495091119
                      Encrypted:false
                      SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8m+/KCH:Qw946cPbiOxDlbYnuRKtw
                      MD5:82939DFF30BA51EF9BD7FAD0E95D1FE3
                      SHA1:86C3CE083B8C8582C6272B1613AC7FF405BFB110
                      SHA-256:749B6C280B5AD31648CCB4A6140CBAF52C376BF142AA37B2866CA58A72CA7A62
                      SHA-512:C91879979EE48E8C42A6BF3BFA6C14FC338B9A61FAFEFA3EC858FA50CD7A93FA8597E7A456AE3AF76F5F232C8FB46BE29FCAC66D577893DEC3F814F992005546
                      Malicious:false
                      Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.9./.0.4./.2.0.2.4. . .0.0.:.0.6.:.1.3. .=.=.=.....

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\A95iut3n_efa1dk_5z8.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PDF document, version 1.6, 0 pages
                      Category:dropped
                      Size (bytes):358
                      Entropy (8bit):5.066503930957641
                      Encrypted:false
                      SSDEEP:6:IngVMrexJzJT0y9VEQIFVmb/eu2g/86S1kxROOnWvcXZjvcXZyuLCSyAAO:IngVMre9T0HQIDmy9g06JXGvcpDcpRlX
                      MD5:B56F2A36DC2CED1D2DC8285B56B31A97
                      SHA1:5383B10367E07339C9B3F7F0AE32FD4220ED1471
                      SHA-256:CABD365AFBB5F7BC1E7CCE11215A70B3F9F30E7B50B3E977CB9CFC4AC7F21538
                      SHA-512:E7CB90A7F72A1E6BE890675B3EFD7CCFF98B277AA4BDF3168EA27D037878FFBA6975E2616435161922E9C540F0E7E62B92C49C0134002B43807352CEE96BE462
                      Malicious:false
                      Preview:%PDF-1.6.%......1 0 obj.<</Pages 2 0 R/Type/Catalog>>.endobj.2 0 obj.<</Count 0/Kids[]/Type/Pages>>.endobj.3 0 obj.<<>>.endobj.xref..0 4..0000000000 65535 f..0000000016 00000 n..0000000061 00000 n..0000000107 00000 n..trailer..<</Size 4/Root 1 0 R/Info 3 0 R/ID[<96814E0DEB86D94997AF5A8D43B9D048><96814E0DEB86D94997AF5A8D43B9D048>]>>..startxref..127..%%EOF..

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-19 00-06-08-428.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393)
                      Category:dropped
                      Size (bytes):16525
                      Entropy (8bit):5.345946398610936
                      Encrypted:false
                      SSDEEP:384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
                      MD5:8947C10F5AB6CFFFAE64BCA79B5A0BE3
                      SHA1:70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
                      SHA-256:4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
                      SHA-512:B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
                      Malicious:false
                      Preview:SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393), with CRLF line terminators
                      Category:dropped
                      Size (bytes):16603
                      Entropy (8bit):5.358522836598428
                      Encrypted:false
                      SSDEEP:384:1okxMg1zWzpzAzYzxYz6zTzxzVzvY9zgpBGdaxOO0K1KW0s8cF5dl722dXnmeSbL:3qlkUtYe39pmf
                      MD5:CC8D244BEEF4EACDAFBA568AE721A54E
                      SHA1:C5113EE7E5F6D37BEDCF6A8EAA1F6EC31FC74EC6
                      SHA-256:D4254D7A9F764842D868E9BB22632458B9B899C0F313EFB36146A3EBA9B7BF34
                      SHA-512:D3F6A2C9A4A74885AD55E01CD744318A69E6B8C7A3599A0A5E6F9B1D1C8FEF0CF810B4FFEC8B2A9C217A477F34A190B885FE46D32686243F8F7CF41A96182DF5
                      Malicious:false
                      Preview:SessionID=0989cba4-9a08-497c-97ca-da1212115ab1.1713477968438 Timestamp=2024-04-19T00:06:08:438+0200 ThreadID=7956 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=0989cba4-9a08-497c-97ca-da1212115ab1.1713477968438 Timestamp=2024-04-19T00:06:08:439+0200 ThreadID=7956 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=0989cba4-9a08-497c-97ca-da1212115ab1.1713477968438 Timestamp=2024-04-19T00:06:08:439+0200 ThreadID=7956 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=0989cba4-9a08-497c-97ca-da1212115ab1.1713477968438 Timestamp=2024-04-19T00:06:08:439+0200 ThreadID=7956 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=0989cba4-9a08-497c-97ca-da1212115ab1.1713477968438 Timestamp=2024-04-19T00:06:08:439+0200 ThreadID=7956 Component=ngl-lib_NglAppLib Description="SetConf

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):29845
                      Entropy (8bit):5.394432399281583
                      Encrypted:false
                      SSDEEP:768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rL:P
                      MD5:E8A10785EF99F635A54CA083C77E5F8B
                      SHA1:8A34FEF5E2A9C516355B0F72BB97ED76522D70CC
                      SHA-256:2AB9EF5DD6DA78122F3B6C0EDA57DCB9DCE0B93306828034058E8A5DF269CAD4
                      SHA-512:55AF8A0A9D22FC6998A88F69D2D2647C55FB4417011EB5B77D6F849901CCB7FE4FDF59B876A1A34E90655E63E134BAD002DF3D0AC6CA06549BC5E710AB15271C
                      Malicious:false
                      Preview:03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

                      C:\Users\user\AppData\Local\Temp\acrocef_low\518aecae-ae07-42b9-a3ad-0704a5c78b4d.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                      Category:dropped
                      Size (bytes):1419751
                      Entropy (8bit):7.976496077007677
                      Encrypted:false
                      SSDEEP:24576:/xA7ouWLaGZ7wYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVuWLaGZ7wZGk3mlind9i4ufFXpAXkru
                      MD5:13F55292D0735B9ABD4259B225D210FC
                      SHA1:810CC5D545BFA11D2825F6E1DFA69176794DA7EC
                      SHA-256:8C3FFEA68963D108599E8C5AE20DE6E9C473BF33197A03A9A7DDCD0F25A6C7F6
                      SHA-512:4F54EDA9EB61172A5243DAA718CFF42A0BF079CC0FA7BE3553CC8B79772763B49F530DD6B54A9D595C4F46B8416ADF7D5C8DAD58FC43A5C651258E669DC375DA
                      Malicious:false
                      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                      C:\Users\user\AppData\Local\Temp\acrocef_low\8a9bfb8c-db3f-4d2d-82b3-0c92158d2a46.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                      Category:dropped
                      Size (bytes):386528
                      Entropy (8bit):7.9736851559892425
                      Encrypted:false
                      SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                      MD5:5C48B0AD2FEF800949466AE872E1F1E2
                      SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                      SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                      SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                      Malicious:false
                      Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                      C:\Users\user\AppData\Local\Temp\acrocef_low\a361586b-12a5-4232-8125-c6e077619939.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                      Category:dropped
                      Size (bytes):758601
                      Entropy (8bit):7.98639316555857
                      Encrypted:false
                      SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                      MD5:3A49135134665364308390AC398006F1
                      SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                      SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                      SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                      Malicious:false
                      Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                      C:\Users\user\AppData\Local\Temp\acrocef_low\ddf33fcf-e54c-4db2-a0fd-5500b6e7d7e3.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                      Category:dropped
                      Size (bytes):1407294
                      Entropy (8bit):7.97605879016224
                      Encrypted:false
                      SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
                      MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
                      SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
                      SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
                      SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
                      Malicious:false
                      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                      Static File Info

                      General

                      File type:PDF document, version 1.4, 0 pages
                      Entropy (8bit):7.950000190852346
                      TrID:
                      • Adobe Portable Document Format (5005/1) 100.00%
                      File name:Confirmation Andrea Cuevas Sepulveda (Request).pdf
                      File size:75'313 bytes
                      MD5:ff790714bec9adb9dcc958b159555c00
                      SHA1:4bb9d78b50fa65b281693a3cdaf559411d096a62
                      SHA256:9d68bfaf1a38b71af02f835d87ff1e4f6b38a305466c7fa533151a87d1604511
                      SHA512:48da53e5a847beaf933588f935acc07fba073ef1b5498f670c66aa0e07936e78588f323f438213190fe26d66c265e2f96883c97c495b7bc11b2b077c7a6f24e8
                      SSDEEP:1536:r1p7R1A/s95zm6qjtGkxdN3DHYG7kFLYK3NNGcEd3HF1pAZzCvjJ/M:Jp7LfWt1N3EscLYuNI9HFdNM
                      TLSH:6373F144EB8484CDC57ECA50FF1D45ABA9FEF1B36AE02486707CD187D704EDAE86112A
                      File Content Preview:%PDF-1.4..%......%ABCpdf 11304..15 0 obj..<<./E 51564./H [1420 182]./L 75313./Linearized 1./N 2./O 18./T 74964.>> ..endobj....xref..15 18..0000000032 00000 n..0000001311 00000 n

                      File Icon

                      Icon Hash:62cc8caeb29e8ae0

                      Static PDF Info

                      General

                      Header:%PDF-1.4
                      Total Entropy:7.950000
                      Total Bytes:75313
                      Stream Entropy:7.991719
                      Stream Bytes:68653
                      Entropy outside Streams:5.147280
                      Bytes outside Streams:6660
                      Number of EOF found:2
                      Bytes after EOF:

                      Keywords Statistics

                      NameCount
                      obj32
                      endobj32
                      stream16
                      endstream16
                      xref2
                      trailer2
                      startxref2
                      /Page2
                      /Encrypt0
                      /ObjStm0
                      /URI0
                      /JS0
                      /JavaScript0
                      /AA0
                      /OpenAction0
                      /AcroForm0
                      /JBIG2Decode0
                      /RichMedia0
                      /Launch0
                      /EmbeddedFile0

                      Image Streams

                      IDDHASHMD5Preview
                      260154774b436d0851bfad19cdd37658b78ecce0da37b85387
                      2800c0e8c098cab2980e979608f05567c15c6a0557e0c0cced
                      293935069b922cbb36873a18d8c2b489e693e85152fd017b8f
                      300000000000000000c5f3979394a7040cc3d88bd0fb696670

                      Network Behavior

                      Network Port Distribution

                      TCP Packets

                      TimestampSource PortDest PortSource IPDest IP
                      Apr 19, 2024 00:06:19.047401905 CEST49740443192.168.2.4184.25.164.138
                      Apr 19, 2024 00:06:19.047483921 CEST44349740184.25.164.138192.168.2.4
                      Apr 19, 2024 00:06:19.047795057 CEST49740443192.168.2.4184.25.164.138
                      Apr 19, 2024 00:06:19.047933102 CEST49740443192.168.2.4184.25.164.138
                      Apr 19, 2024 00:06:19.047964096 CEST44349740184.25.164.138192.168.2.4
                      Apr 19, 2024 00:06:19.409581900 CEST44349740184.25.164.138192.168.2.4
                      Apr 19, 2024 00:06:19.409941912 CEST49740443192.168.2.4184.25.164.138
                      Apr 19, 2024 00:06:19.409997940 CEST44349740184.25.164.138192.168.2.4
                      Apr 19, 2024 00:06:19.413887978 CEST44349740184.25.164.138192.168.2.4
                      Apr 19, 2024 00:06:19.413995028 CEST49740443192.168.2.4184.25.164.138
                      Apr 19, 2024 00:06:19.415898085 CEST49740443192.168.2.4184.25.164.138
                      Apr 19, 2024 00:06:19.416081905 CEST49740443192.168.2.4184.25.164.138
                      Apr 19, 2024 00:06:19.416095018 CEST44349740184.25.164.138192.168.2.4
                      Apr 19, 2024 00:06:19.416135073 CEST44349740184.25.164.138192.168.2.4
                      Apr 19, 2024 00:06:19.455574036 CEST49740443192.168.2.4184.25.164.138
                      Apr 19, 2024 00:06:19.455629110 CEST44349740184.25.164.138192.168.2.4
                      Apr 19, 2024 00:06:19.502393961 CEST49740443192.168.2.4184.25.164.138
                      Apr 19, 2024 00:06:19.522769928 CEST44349740184.25.164.138192.168.2.4
                      Apr 19, 2024 00:06:19.522941113 CEST44349740184.25.164.138192.168.2.4
                      Apr 19, 2024 00:06:19.523214102 CEST49740443192.168.2.4184.25.164.138
                      Apr 19, 2024 00:06:19.523426056 CEST49740443192.168.2.4184.25.164.138
                      Apr 19, 2024 00:06:19.523463011 CEST44349740184.25.164.138192.168.2.4
                      Apr 19, 2024 00:06:19.523511887 CEST49740443192.168.2.4184.25.164.138
                      Apr 19, 2024 00:06:19.523536921 CEST49740443192.168.2.4184.25.164.138

                      HTTP Request Dependency Graph

                      • armmf.adobe.com

                      HTTPS Proxied Packets

                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      0192.168.2.449740184.25.164.1384438020C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      TimestampBytes transferredDirectionData
                      2024-04-18 22:06:19 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
                      Host: armmf.adobe.com
                      Connection: keep-alive
                      Accept-Language: en-US,en;q=0.9
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
                      Sec-Fetch-Site: same-origin
                      Sec-Fetch-Mode: no-cors
                      Sec-Fetch-Dest: empty
                      Accept-Encoding: gzip, deflate, br
                      If-None-Match: "78-5faa31cce96da"
                      If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
                      2024-04-18 22:06:19 UTC198INHTTP/1.1 304 Not Modified
                      Content-Type: text/plain; charset=UTF-8
                      Last-Modified: Mon, 01 May 2023 15:02:33 GMT
                      ETag: "78-5faa31cce96da"
                      Date: Thu, 18 Apr 2024 22:06:19 GMT
                      Connection: close


                      Statistics

                      CPU Usage

                      Click to jump to process

                      Memory Usage

                      Click to jump to process

                      High Level Behavior Distribution

                      Click to dive into process behavior distribution

                      Behavior

                      Click to jump to process

                      System Behavior

                      General

                      Target ID:0
                      Start time:00:06:05
                      Start date:19/04/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Confirmation Andrea Cuevas Sepulveda (Request).pdf"
                      Imagebase:0x7ff6bc1b0000
                      File size:5'641'176 bytes
                      MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      General

                      Target ID:1
                      Start time:00:06:05
                      Start date:19/04/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                      Imagebase:0x7ff74bb60000
                      File size:3'581'912 bytes
                      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      General

                      Target ID:3
                      Start time:00:06:06
                      Start date:19/04/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1568,i,589966986038949355,13703487978581972660,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                      Imagebase:0x7ff74bb60000
                      File size:3'581'912 bytes
                      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      Disassembly

                      ⊘No disassembly