Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
FEFR237_f090161469300000000ED.pdf

Overview

General Information

Sample name:FEFR237_f090161469300000000ED.pdf
Analysis ID:1430407
MD5:cddb06f6ef3ce9ce2c7056d5f55ad7bc
SHA1:7d8dac629cb54440f00974428c7751fe2b206a98
SHA256:7bb5d08f5bc407547f7f865ff4f31206bbcbcf2f0611db8e19bd80baca404c52
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64_ra
  • Acrobat.exe (PID: 6972 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\FEFR237_f090161469300000000ED.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 6260 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 3908 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1552,i,18417824236284609083,1796295958897842713,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficTCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global trafficTCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global trafficTCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global trafficTCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global trafficTCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global trafficTCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global trafficTCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global trafficTCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global trafficTCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global trafficTCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global trafficTCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global trafficTCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global trafficTCP traffic: 23.48.8.182:443 -> 192.168.2.16:49705
Source: global trafficTCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global trafficTCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global trafficTCP traffic: 23.48.8.182:443 -> 192.168.2.16:49705
Source: global trafficTCP traffic: 23.48.8.182:443 -> 192.168.2.16:49705
Source: global trafficTCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global trafficTCP traffic: 23.48.8.182:443 -> 192.168.2.16:49705
Source: global trafficTCP traffic: 23.48.8.182:443 -> 192.168.2.16:49705
Source: global trafficTCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global trafficTCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global trafficTCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global trafficTCP traffic: 23.48.8.182:443 -> 192.168.2.16:49705
Source: global trafficTCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global trafficTCP traffic: 23.48.8.182:443 -> 192.168.2.16:49705
Source: global trafficTCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global trafficTCP traffic: 23.48.8.182:443 -> 192.168.2.16:49705
Source: global trafficTCP traffic: 23.48.8.182:443 -> 192.168.2.16:49705
Source: global trafficTCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global trafficTCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global trafficTCP traffic: 23.48.8.182:443 -> 192.168.2.16:49705
Source: Joe Sandbox ViewIP Address: 23.48.8.182 23.48.8.182
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br
Source: unknownTCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknownTCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknownTCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknownTCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknownTCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknownTCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknownTCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknownTCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknownTCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknownTCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknownTCP traffic detected without corresponding DNS query: 23.48.8.182
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br
Source: eb47be62-ab09-45c0-81f2-4dde5ca78183.tmp.3.dr, fdbf1166-0c26-4580-b69c-7a8d9f1a83fa.tmp.3.drString found in binary or memory: https://chrome.cloudflare-dns.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
Source: classification engineClassification label: clean2.winPDF@15/45@0/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7064Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-23 16-21-48-109.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\FEFR237_f090161469300000000ED.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1552,i,18417824236284609083,1796295958897842713,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1552,i,18417824236284609083,1796295958897842713,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: FEFR237_f090161469300000000ED.pdfInitial sample: PDF keyword /JS count = 0
Source: FEFR237_f090161469300000000ED.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: FEFR237_f090161469300000000ED.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive12
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1430407 Sample: FEFR237_f090161469300000000ED.pdf Startdate: 23/04/2024 Architecture: WINDOWS Score: 2 6 Acrobat.exe 18 66 2->6         started        process3 8 AcroCEF.exe 106 6->8         started        process4 10 AcroCEF.exe 6 8->10         started        dnsIp5 13 23.48.8.182, 443, 49705 AKAMAI-ASN1EU United States 10->13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://chrome.cloudflare-dns.com0%URL Reputationsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://chrome.cloudflare-dns.comeb47be62-ab09-45c0-81f2-4dde5ca78183.tmp.3.dr, fdbf1166-0c26-4580-b69c-7a8d9f1a83fa.tmp.3.drfalse
  • URL Reputation: safe
unknown

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
23.48.8.182
unknownUnited States
20940AKAMAI-ASN1EUfalse

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1430407
Start date and time:2024-04-23 16:21:19 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 2m 43s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultwindowsinteractivecookbook.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:15
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:FEFR237_f090161469300000000ED.pdf
Detection:CLEAN
Classification:clean2.winPDF@15/45@0/1
Cookbook Comments:
  • Found application associated with file extension: .pdf

Warnings

  • Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 23.204.76.141, 54.227.187.23, 52.5.13.197, 23.22.254.206, 52.202.204.11, 172.64.41.3, 162.159.61.3, 23.53.35.7, 23.53.35.4, 23.221.212.219
  • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, slscr.update.microsoft.com, ssl-delivery.adobe.com.edgekey.net, acroipm2.adobe.com.edgesuite.net, a122.dscd.akamai.net, ctldl.windowsupdate.com, p13n.adobe.io, geo2.adobe.com, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com
  • VT rate limit hit for: FEFR237_f090161469300000000ED.pdf

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
23.48.8.182PO_OCF 408.xlsGet hashmaliciousUnknownBrowse
    http://tand6000.dk/files/files/zizami.pdfGet hashmaliciousPDFPhishBrowse
      https://www.colortrac.com/netapp/Get hashmaliciousUnknownBrowse
        passportscan.htaGet hashmaliciousXWorm, zgRATBrowse
          Commissions_open_20231004_Commissions_open_20231004pdf.exeGet hashmaliciousUnknownBrowse
            PAGAMENTO_COMMISSIONI_MBS_Settembre_MGpdf.exeGet hashmaliciousUnknownBrowse
              Factura_FVR23041255_Factura_FVR23041255pdf.exeGet hashmaliciousUnknownBrowse
                Ordine_Frode_1027797000003171_Ordine_Frode_1027797000003171pdf.exeGet hashmaliciousUnknownBrowse
                  Commissions_BEL6_20231004_Commissions_BEL6_20231004pdf.exeGet hashmaliciousUnknownBrowse
                    Certificazione_Partecipazione_Corso_AML_IT15318pdf.exeGet hashmaliciousUnknownBrowse

                      Domains

                      ⊘No context

                      ASNs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      AKAMAI-ASN1EUhttps://www.msn.com/en-us/autos/enthusiasts/what-s-the-difference-between-a-shelby-mustang-and-a-regular-mustang/ar-AA1ntM5Z?ocid=entnewsntp&pc=U531&cvid=8b8aa9e3e14d4164a6a2181020104694&ei=36Get hashmaliciousUnknownBrowse
                      • 23.61.11.173
                      c3nBx2HQG2.exeGet hashmaliciousGlupteba, Mars Stealer, Phorpiex, PureLog Stealer, Stealc, Vidar, zgRATBrowse
                      • 96.6.42.17
                      https://eu.docusign.net/Signing/EmailStart.aspx?a=c2316afe-212a-443e-8085-9617c789ff9e&acct=3b74c8d0-0c86-4fe6-a37e-391f3ae29b50&er=eaaa56e8-48ca-4278-8838-760c6115596aGet hashmaliciousHTMLPhisherBrowse
                      • 23.53.11.209
                      https://u43957641.ct.sendgrid.net/ls/click?upn=u001.0Q2k6Tkbkoom04JcBCS1bm-2FvOge1W36GwvuSdih0P4JugvzV4-2FrWyPqZWCP-2FjIBNLIQsDH-2BiJ-2FwtGIsQEo-2F1lg-3D-3DD4vy_FXZTG-2Bj8dxNvEuxDJrPqKA8uB9LHQ48OflWnDl8SlkMIeqE5kJRv-2BwjlJ-2BTz9LaXXbddhQoxXZFjW61L1BulkplVPhKO5ARKFw4WBNXwUjDYnN9WjvMC1qZal-2BSbiVhkNDXHzo0-2BRl2juwpMn3h9dNAq9ZBCf8LnPEOZY9GqbZetUAeU7Eutkrra6RqLG0LYTAB9pnUknxEinL3j6RW-2F5AawLVk6-2FJEsz0F-2FhvPx4oc-3DGet hashmaliciousHTMLPhisherBrowse
                      • 172.232.192.99
                      SgtB2WW8ys.elfGet hashmaliciousMiraiBrowse
                      • 104.96.77.57
                      74fa486WVX.exeGet hashmaliciousMars Stealer, PureLog Stealer, Stealc, Vidar, zgRATBrowse
                      • 23.1.33.10
                      https://runrun.it/share/portal/EfC1XUoTbGbNOUmdGet hashmaliciousHTMLPhisherBrowse
                      • 172.232.211.234
                      Calendly.dmgGet hashmaliciousUnknownBrowse
                      • 23.206.188.196
                      https://url.us.m.mimecastprotect.com/s/kCCtC5yEz0tWp5ANrfz_KPV?domain=paplastics365-my.sharepoint.comGet hashmaliciousHTMLPhisherBrowse
                      • 173.222.249.42
                      order.exeGet hashmaliciousUnknownBrowse
                      • 96.7.224.16

                      JA3 Fingerprints

                      ⊘No context

                      Dropped Files

                      ⊘No context

                      Created / dropped Files

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):290
                      Entropy (8bit):5.20602236029838
                      Encrypted:false
                      SSDEEP:6:sfJHUUq2PRN2nKuAl9OmbnIFUt8ZfJHU1Zmw+ZfJBkwORN2nKuAl9OmbjLJ:sfJUUvaHAahFUt8ZfJU1/+Zfr5JHAaSJ
                      MD5:5D649AECBF03AA6EF452B287916D9DEE
                      SHA1:16FBF040364EE7460CE2C61A3ACDDE7C3CCE3CA3
                      SHA-256:F15DF804D5F2A0A688DF07622C9B596A92A9C819A8077AE1B0A1184E6077E5CE
                      SHA-512:23838123E3AD6BB2D6E1D1E0CCC18C3A61A0CDF623CA3908FDB86237544B14256CBFAE3D6DF3E0A291F2C89C5FCF211BBF4EB4844B8D77F6441A92EE5D1201AE
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/23-16:21:46.508 1840 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/23-16:21:46.508 1840 Recovering log #3.2024/04/23-16:21:46.509 1840 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):290
                      Entropy (8bit):5.20602236029838
                      Encrypted:false
                      SSDEEP:6:sfJHUUq2PRN2nKuAl9OmbnIFUt8ZfJHU1Zmw+ZfJBkwORN2nKuAl9OmbjLJ:sfJUUvaHAahFUt8ZfJU1/+Zfr5JHAaSJ
                      MD5:5D649AECBF03AA6EF452B287916D9DEE
                      SHA1:16FBF040364EE7460CE2C61A3ACDDE7C3CCE3CA3
                      SHA-256:F15DF804D5F2A0A688DF07622C9B596A92A9C819A8077AE1B0A1184E6077E5CE
                      SHA-512:23838123E3AD6BB2D6E1D1E0CCC18C3A61A0CDF623CA3908FDB86237544B14256CBFAE3D6DF3E0A291F2C89C5FCF211BBF4EB4844B8D77F6441A92EE5D1201AE
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/23-16:21:46.508 1840 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/23-16:21:46.508 1840 Recovering log #3.2024/04/23-16:21:46.509 1840 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):334
                      Entropy (8bit):5.111456489527606
                      Encrypted:false
                      SSDEEP:6:sfWq2PRN2nKuAl9Ombzo2jMGIFUt8ZfsXZmw+ZfNkwORN2nKuAl9Ombzo2jMmLJ:sfWvaHAa8uFUt8ZfsX/+ZfN5JHAa8RJ
                      MD5:235B35B03FE8FD02EED2E72222D1365C
                      SHA1:C6BB2D37586D87C10845DE2EF6AE48AA0D0D109A
                      SHA-256:6B8932FE9D98C32391D81FC58B33ABAA37E7299BC6687B3F2D6E5F97864791FC
                      SHA-512:B04D14ADD1D46523DDE6804F56E64135A0953D73D673102899985B9630227B73966C6856D5006C846359336201AD7E742A4E6F1922CB4DA5515EFA304A3FAC41
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/23-16:21:46.406 10d4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/23-16:21:46.410 10d4 Recovering log #3.2024/04/23-16:21:46.411 10d4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):334
                      Entropy (8bit):5.111456489527606
                      Encrypted:false
                      SSDEEP:6:sfWq2PRN2nKuAl9Ombzo2jMGIFUt8ZfsXZmw+ZfNkwORN2nKuAl9Ombzo2jMmLJ:sfWvaHAa8uFUt8ZfsX/+ZfN5JHAa8RJ
                      MD5:235B35B03FE8FD02EED2E72222D1365C
                      SHA1:C6BB2D37586D87C10845DE2EF6AE48AA0D0D109A
                      SHA-256:6B8932FE9D98C32391D81FC58B33ABAA37E7299BC6687B3F2D6E5F97864791FC
                      SHA-512:B04D14ADD1D46523DDE6804F56E64135A0953D73D673102899985B9630227B73966C6856D5006C846359336201AD7E742A4E6F1922CB4DA5515EFA304A3FAC41
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/23-16:21:46.406 10d4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/23-16:21:46.410 10d4 Recovering log #3.2024/04/23-16:21:46.411 10d4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):403
                      Entropy (8bit):4.953858338552356
                      Encrypted:false
                      SSDEEP:12:YHO8sq/WLksBdOg2H9caq3QYiubrP7E4T3y:YXsRJdMHM3QYhbz7nby
                      MD5:4C313FE514B5F4E7E89329630909F8DC
                      SHA1:916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
                      SHA-256:1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
                      SHA-512:1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
                      Malicious:false
                      Reputation:moderate, very likely benign file
                      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6a4070.TMP (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):403
                      Entropy (8bit):4.953858338552356
                      Encrypted:false
                      SSDEEP:12:YHO8sq/WLksBdOg2H9caq3QYiubrP7E4T3y:YXsRJdMHM3QYhbz7nby
                      MD5:4C313FE514B5F4E7E89329630909F8DC
                      SHA1:916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
                      SHA-256:1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
                      SHA-512:1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
                      Malicious:false
                      Reputation:moderate, very likely benign file
                      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\eb47be62-ab09-45c0-81f2-4dde5ca78183.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:modified
                      Size (bytes):403
                      Entropy (8bit):4.98101842809952
                      Encrypted:false
                      SSDEEP:12:YHO8sqZnIsBdOg2HhAcaq3QYiubrP7E4T3y:YXs+ddMHhr3QYhbz7nby
                      MD5:F8C7494B6CDA324AA68A9AA27C4C8CDB
                      SHA1:2D16BC3C8C57B461B15EB1B24D348C7264F5C4A3
                      SHA-256:3F4346BB2CBD93EAAA91DB8A02D25459C7589A7131F00FDEB5FCB28CC09782BF
                      SHA-512:798D211A7A975D4D34AB05014E745935F4795A9A67A64E88CC9209FD9169FE4257A84E0B4209C52FA21A213F91615574080C6E7EDDCCB2F23D2BB46B669E3B10
                      Malicious:false
                      Reputation:low
                      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13358442117877337","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":108571},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fdbf1166-0c26-4580-b69c-7a8d9f1a83fa.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):403
                      Entropy (8bit):4.953858338552356
                      Encrypted:false
                      SSDEEP:12:YHO8sq/WLksBdOg2H9caq3QYiubrP7E4T3y:YXsRJdMHM3QYhbz7nby
                      MD5:4C313FE514B5F4E7E89329630909F8DC
                      SHA1:916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
                      SHA-256:1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
                      SHA-512:1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
                      Malicious:false
                      Reputation:moderate, very likely benign file
                      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):4509
                      Entropy (8bit):5.231217620009938
                      Encrypted:false
                      SSDEEP:96:OLSw0bSwIAnrRqLX2rSq1OUxu/0OZ0xRBTxekN8xe9NdMg/oNHg/Z:OLT0bTIeYa51Ogu/0OZARBT8kN889NdT
                      MD5:2F6F93170B9F350763FC6EE5CE704840
                      SHA1:3BA7D994DF36302562EE443AEA30427301937313
                      SHA-256:781D7156C701E7DF4406EBAD9E82A79143ABFF0FA55B119719832BFB1A94E48D
                      SHA-512:5846D18292C4E01F7531E70E51DE9DFC9A25EB3E44FF72F86286EB4527B5D1906228DFAFF203D76E2BE21FDA590DB373C500CC77F41DA7BCD755CC2252216389
                      Malicious:false
                      Preview:*...#................version.1..namespace-e...o................next-map-id.1.Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/.0y.S_r................next-map-id.2.Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/.16.X:r................next-map-id.3.Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/.2.P.@o................next-map-id.4.Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/.346.+^...............Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/....^...............Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/..?&a...............Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/_...a...............Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/...o................next-map-id.5.Pnamespace-07af9ee9_2076_4f12_94b5_

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):322
                      Entropy (8bit):5.176611755341307
                      Encrypted:false
                      SSDEEP:6:sfCAROq2PRN2nKuAl9OmbzNMxIFUt8ZfQQZmw+Zf2YkwORN2nKuAl9OmbzNMFLJ:sfCAMvaHAa8jFUt8Zfz/+Zf2Y5JHAa8E
                      MD5:4AE97C678D3818B12031EACF768AF7BB
                      SHA1:506AAE5304C55AF8E5DFFCF3C8A8569B1F4D264B
                      SHA-256:C06E51FF9518321081CE899DFFB525C657821A37DE13E1132EA5D22DDA08B711
                      SHA-512:3BCF6AB178C2990D5BCE2A1F337FCFADCD4AC97248F709DD33D2269AFFDFD9621C8B32E6338C22963304916BB56E019550D1337A4608507C9AE8D35E3965232D
                      Malicious:false
                      Preview:2024/04/23-16:21:46.552 10d4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/23-16:21:46.554 10d4 Recovering log #3.2024/04/23-16:21:46.556 10d4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):322
                      Entropy (8bit):5.176611755341307
                      Encrypted:false
                      SSDEEP:6:sfCAROq2PRN2nKuAl9OmbzNMxIFUt8ZfQQZmw+Zf2YkwORN2nKuAl9OmbzNMFLJ:sfCAMvaHAa8jFUt8Zfz/+Zf2Y5JHAa8E
                      MD5:4AE97C678D3818B12031EACF768AF7BB
                      SHA1:506AAE5304C55AF8E5DFFCF3C8A8569B1F4D264B
                      SHA-256:C06E51FF9518321081CE899DFFB525C657821A37DE13E1132EA5D22DDA08B711
                      SHA-512:3BCF6AB178C2990D5BCE2A1F337FCFADCD4AC97248F709DD33D2269AFFDFD9621C8B32E6338C22963304916BB56E019550D1337A4608507C9AE8D35E3965232D
                      Malicious:false
                      Preview:2024/04/23-16:21:46.552 10d4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/23-16:21:46.554 10d4 Recovering log #3.2024/04/23-16:21:46.556 10d4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240423142150Z-170.bmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
                      Category:dropped
                      Size (bytes):71190
                      Entropy (8bit):1.9824940484827291
                      Encrypted:false
                      SSDEEP:192:4mzm9E7AQyr/Md6RuIPGWiuLBABaZGafasaw:4mzm9E7ABMdQuIPSuLBABaZzasaw
                      MD5:463827E61EF66A539F09F0E057C59607
                      SHA1:0AF8878C5C57C3847A6EDB7DA82975B110ADF33D
                      SHA-256:E6A16E6F1327C6765DD690BADCB82139CB8F8E16996FB19E3332D0A2275C0ED0
                      SHA-512:90A3440883F5EDF5DB643DA32FCAA4C42646DC1436AC30BEFA74F3E8B4E49E934F7A33058046A4F280FBB78A9B6F2C0B1762A77C3083BDF7A2DEBFE75CC0AF93
                      Malicious:false
                      Preview:BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2
                      Category:dropped
                      Size (bytes):57344
                      Entropy (8bit):3.291927920232006
                      Encrypted:false
                      SSDEEP:192:vedRBvVui5V4R4dcQ5V4R4RtYWtEV2UUTTchqGp8F/7/z+FP:veBci5H5FY+EUUUTTcHqFzqFP
                      MD5:A4D5FECEFE05F21D6F81ACF4D9A788CF
                      SHA1:1A9AC236C80F2A2809F7DE374072E2FCCA5A775C
                      SHA-256:83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
                      SHA-512:FF106C6B9E1EA4B1F3E3AB01FAEA21BA24A885E63DDF0C36EB0A8C3C89A9430FE676039C076C50D7C46DC4E809F6A7E35A4BFED64D9033FEBD6121AC547AA5E9
                      Malicious:false
                      Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite Rollback Journal
                      Category:dropped
                      Size (bytes):16928
                      Entropy (8bit):1.2119462281523423
                      Encrypted:false
                      SSDEEP:24:7+tc/qLi+zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Ze:7MwqLmFTIF3XmHjBoGGR+jMz+Lh/
                      MD5:9FBC96E5C36FAE06376F3F234058D44A
                      SHA1:4F82D7CB355AC787D61CDFBA7A4CEDEEE3719738
                      SHA-256:C0B57168470783BF65B077F8C62E53EF73209D2A35C4201BD87842EF1AFF77EB
                      SHA-512:BFF211D9670B0A27747903F37A77D938EB136A8938C3EA12F636E3DD0C3477D9BF723895607D7D042BDE8D648484CED63923ABE11372F77B4712E748ED0B9F8B
                      Malicious:false
                      Preview:.... .c.....sD.0........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7064

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PostScript document text
                      Category:dropped
                      Size (bytes):185099
                      Entropy (8bit):5.182478651346149
                      Encrypted:false
                      SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                      MD5:94185C5850C26B3C6FC24ABC385CDA58
                      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                      Malicious:false
                      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PostScript document text
                      Category:dropped
                      Size (bytes):185099
                      Entropy (8bit):5.182478651346149
                      Encrypted:false
                      SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                      MD5:94185C5850C26B3C6FC24ABC385CDA58
                      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                      Malicious:false
                      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):231136
                      Entropy (8bit):3.372805631169117
                      Encrypted:false
                      SSDEEP:1536:qKPC4iyzDtrh1cK3XEivK7VK/3AYvYwgFyrRoL+sn:XPCaJ/3AYvYwgwFoL+sn
                      MD5:38108919D6491AF19A968FD2CBA7BB1C
                      SHA1:1127AD5A81B08F52520E4D0004BD62EE7891D34F
                      SHA-256:1782A62CAF6859C2D44EB5B9D63571315E5F6B547473D2EDD4D83BD33B58CC30
                      SHA-512:50A6B40922B527E18484D246BB0747024975E574AF121AA7745F7AC41C9497844BC435F23DAB15FC86A0A071DA9B808EA269E53D175419AFAF808F80CB0223DA
                      Malicious:false
                      Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):295
                      Entropy (8bit):5.347445091889542
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXaXcEMG4+5IRR4UhUR0Y9F2DeoAvJM3g98kUwPeUkwRe9:YvXKXcM+WRuUhUZFUVGMbLUkee9
                      MD5:E3A75A91C1091E6CC450A2AB4E3F4B72
                      SHA1:8757B82E74A97012B93CD264F0E4B19C5025419B
                      SHA-256:57AEFB7C4B430621DB61A1066B8FEA4962E7FC7AF880DC6F24674E3B7C62D3D5
                      SHA-512:E832CF941CA7A6E513DFEFAF392B6B1DDB9D5A793D3A6CBBD26D38B77630AECC1D858125D3DAA0BC6ACBA20FD164D98D2559F91C052F3C50A321239A5407BEF7
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"aaed2961-c626-4a76-9043-cc071609ed4b","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714055676178,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.296305467009376
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXaXcEMG4+5IRR4UhUR0Y9F2DeoAvJfBoTfXpnrPeUkwRe9:YvXKXcM+WRuUhUZFUVGWTfXcUkee9
                      MD5:EBD2CF38C903DBD5A1631E40A44D8BA6
                      SHA1:949CF00C4F6F3687E11215F86677826A4445123D
                      SHA-256:16D3AA45EAFEEBA437E4DD4ED7FAE1186DC1CE8D8A2D4F51D82C5807AFCF4161
                      SHA-512:2C0DF1F38788848B4E2FB705801FFDBAD072E253DDFE35CF80344BD36CD120D79A3A3231896544349E584C1A7F2D0B61081401A771165E61758539A6846F0E74
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"aaed2961-c626-4a76-9043-cc071609ed4b","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714055676178,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.274444381754644
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXaXcEMG4+5IRR4UhUR0Y9F2DeoAvJfBD2G6UpnrPeUkwRe9:YvXKXcM+WRuUhUZFUVGR22cUkee9
                      MD5:393C7CC335C89DCE5E6AD9104F1306E6
                      SHA1:97442527F84291C5600CE9EC829A4AFB413C9CD2
                      SHA-256:2E156907938FDF8F1992C39529F0210201D7C2DE5A2B59692C0EC1D90914A379
                      SHA-512:05F81946D8BB7AD24DFB545106C1C17614990D0F0FAE1898AF8DA11AF738782D2E61152B23A4CA3A8839D3DDA4DB3627C841C38C85F63A3B2FC0BC8A0F5969DA
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"aaed2961-c626-4a76-9043-cc071609ed4b","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714055676178,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):285
                      Entropy (8bit):5.3352667439839525
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXaXcEMG4+5IRR4UhUR0Y9F2DeoAvJfPmwrPeUkwRe9:YvXKXcM+WRuUhUZFUVGH56Ukee9
                      MD5:4326C22BED6DAEA4E72EF0029551AE7A
                      SHA1:F4445A5C12C148F74E6F0860EB40C5121B555D77
                      SHA-256:5E9889CEF51C81855B5B8179C79AF96E247D71A383ED5C38133F5899DAFCBC37
                      SHA-512:1354B1A9D34C4AA4BC8A0C1B777F144CF37DEF55DE76450BACC7BC17DE0784E94C8A071BC941F12E484CE05F3E520A890DFD6212ACE464BD84C69ED05FBD4B49
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"aaed2961-c626-4a76-9043-cc071609ed4b","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714055676178,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.295146299189753
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXaXcEMG4+5IRR4UhUR0Y9F2DeoAvJfJWCtMdPeUkwRe9:YvXKXcM+WRuUhUZFUVGBS8Ukee9
                      MD5:A5D6982310CE54551EF3E9F33C76180C
                      SHA1:052F060F77C6225511CA01749BCC3247348AE323
                      SHA-256:4C98A50C86345170FF76C9AF423E3F4DC11FC0C8CE6A5D2750455E95536B8CE9
                      SHA-512:326377F35223BD7B09CC4DDBF289D6E907B0ED4CD40A2E9B65591CE4D5632B14581EC414F0C910BBE8B50CD4790ED43759429CC0126FDE9B74F4444174B16390
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"aaed2961-c626-4a76-9043-cc071609ed4b","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714055676178,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.281424085247882
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXaXcEMG4+5IRR4UhUR0Y9F2DeoAvJf8dPeUkwRe9:YvXKXcM+WRuUhUZFUVGU8Ukee9
                      MD5:F681E32C0304DEC08C61D3BBAD54F638
                      SHA1:A506BF0A60924B4BF4CACF1A46D6C454B38A40AC
                      SHA-256:E9C1EF885B9ED30B036F13454F735754E9F4327BD4F825F66B7A21287A430472
                      SHA-512:8BB8E8BF1764DB6789C69BAC8BF0815C58FFAD560A5789E7D1043C6F4088BAB27B2320A16901BE72466926D745625A3D60D1FCBC5FD90C973D848D7569FA1331
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"aaed2961-c626-4a76-9043-cc071609ed4b","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714055676178,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.2845579852253195
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXaXcEMG4+5IRR4UhUR0Y9F2DeoAvJfQ1rPeUkwRe9:YvXKXcM+WRuUhUZFUVGY16Ukee9
                      MD5:0C6A2EB3255D6FF9AEDCBA310512FC40
                      SHA1:9686DE31195925DCCCC0B579388FC606B1321F1C
                      SHA-256:0409C4079BDB1C2B9BC01491C988DD4A0745C0A4BF3761FC66E9D56FFC217AA2
                      SHA-512:A29E7F34C72872F9B4AD6D5ABDCA07807849D4C022EFF4B3CD1E3BE1A17CCFD2EEB3F16D6730235B474B6C907F918096A202B3F9EC6EE09C4756928938AF780E
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"aaed2961-c626-4a76-9043-cc071609ed4b","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714055676178,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.29118161687452
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXaXcEMG4+5IRR4UhUR0Y9F2DeoAvJfFldPeUkwRe9:YvXKXcM+WRuUhUZFUVGz8Ukee9
                      MD5:EDDC114F517531A831507B2F68C6250F
                      SHA1:42715163EFEFC8EB0DB8A29D9E37665AA731369C
                      SHA-256:80A989154BE3AB3CFB336726D5BA532BD1333994E5729CF6CF63EB5605D64638
                      SHA-512:C40F1511865C6C21F8DFFF44E22E4B97EDE1EFD24EA8A8CC0130402AF4119DCB31ECE5C1C184C3BD0C3D6569C22585C007AC7603A6241C413347D86919C4DCA1
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"aaed2961-c626-4a76-9043-cc071609ed4b","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714055676178,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1372
                      Entropy (8bit):5.737592694572342
                      Encrypted:false
                      SSDEEP:24:Yv6XcM7UfUBKLgENRcbrZbq00iCCBrwJo++ns8ct4mFJNZ:Yvo7UfEEgigrNt0wSJn+ns8cvFJP
                      MD5:71723B098676E26EC433F4A4729866DA
                      SHA1:FB96268F1740D87CBB9F748B6692EA7755A4AB81
                      SHA-256:ED379D951687A31AED36DC1FB6EE796BAC914889360B7ED8C0C8933741BC42AE
                      SHA-512:4EA8E0ED0EE39FEBFC306CA7C4BBF4DB825812123BF3A958EEB49BBFA74A0AA4DEEC3CEA177255B161AC3D11779F28F2355D2F163D514C813009CF033A6C2569
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"aaed2961-c626-4a76-9043-cc071609ed4b","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714055676178,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"79887_247329ActionBlock_0","campaignId":79887,"containerId":"1","controlGroupId":"","treatmentId":"acc56846-d570-4500-a26e-7f8cf2b4acad","variationId":"247329"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJUcnkgQWNyb2JhdCBQcm8ifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNSIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTMiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIDctZGF5IHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0byBwcmVtaXVtIFBERiBhbmQgZS1zaWduaW5nIHRvb2xzLiIsImJ

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.2881692136909795
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXaXcEMG4+5IRR4UhUR0Y9F2DeoAvJfYdPeUkwRe9:YvXKXcM+WRuUhUZFUVGg8Ukee9
                      MD5:5B1769EEC8A26CC4661B0563946BB5E1
                      SHA1:6696BAEA22213F2467D8937801B27A3B7FE30784
                      SHA-256:BFB0FF13D5A4D9EBBEFD57B6A70D111E569CED73151B26D94AD02FA7AB6782D5
                      SHA-512:F429FBA365761899441BBDD3DDEE314ACEBB0C0AE3E12E582CE20D99259947AFD5F46A1C431B75D33CC8313EB48829BAC7622DC8B5BFFF75A56F6953E45232EC
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"aaed2961-c626-4a76-9043-cc071609ed4b","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714055676178,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1395
                      Entropy (8bit):5.772331542865433
                      Encrypted:false
                      SSDEEP:24:Yv6XcM7UfUMrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNh:Yvo7UfrHgDv3W2aYQfgB5OUupHrQ9FJr
                      MD5:A20F24D8B68842B5FCA3F38CF55BB3D2
                      SHA1:45315F9C53CFCB109BC016A9A992ADA57CC42194
                      SHA-256:D83C2EEA7F80B98618BD47C7E788FD4BD4150DF5199D40227A8302AC9D5356BC
                      SHA-512:0FC55CFD5C336A9A8C17875CC08451E49031B44395C8C771810892DCBC558357ADB8B24E0113F10B1E04DD4DFDF5145E362ECD8B2AEF0C863EB4163AFCDB112A
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"aaed2961-c626-4a76-9043-cc071609ed4b","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714055676178,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):291
                      Entropy (8bit):5.271797622610955
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXaXcEMG4+5IRR4UhUR0Y9F2DeoAvJfbPtdPeUkwRe9:YvXKXcM+WRuUhUZFUVGDV8Ukee9
                      MD5:BD78948C0B4298DFECAE209F444F2651
                      SHA1:182FCACD4D458DDD4B0F064776F8FB9C53E508DE
                      SHA-256:235188E3F596452D81279A187FB2A311E83D29311E75DBA130F34945899A5D92
                      SHA-512:BC25B884D8129E7B04DC3E4E6081DF4CBA81BADFDC9FA10910FA2C1BC8B84BC63978634EFBDC9734726BFE3221B777CF0A7439E02523F0CAD04F9981F62EB4FB
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"aaed2961-c626-4a76-9043-cc071609ed4b","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714055676178,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):287
                      Entropy (8bit):5.275311052761458
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXaXcEMG4+5IRR4UhUR0Y9F2DeoAvJf21rPeUkwRe9:YvXKXcM+WRuUhUZFUVG+16Ukee9
                      MD5:C0B11D4381E36FB09389B69E0BD0DED1
                      SHA1:6E8C4221330E9AA1DDDE483AB7C851DD5232B28E
                      SHA-256:ED5706A761B3C2987AB50641E02BF95A0A383DD0946743840CBCB23452BD215E
                      SHA-512:A265955302E078734D04B94DCCECC739D0C63329A89AD9E3D91972F07E146FBE62011B733DB674EF2E9C6432A2F1477A64824084E372B7357AF34835ED92D08D
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"aaed2961-c626-4a76-9043-cc071609ed4b","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714055676178,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.295004342449127
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXaXcEMG4+5IRR4UhUR0Y9F2DeoAvJfbpatdPeUkwRe9:YvXKXcM+WRuUhUZFUVGVat8Ukee9
                      MD5:D723A457EEA759F8866653D2C4A29AE0
                      SHA1:B780312AC810B79102E0D21292A1D0E94CA253BD
                      SHA-256:ACA9D36F67CBF77CB8A91FB30F29049E781C108172FE7F1644F61C5EE8C3E4D8
                      SHA-512:36F567AD48933429EB0B16F8DD0C66D3EDAE7D4CB3ED7047EC88F7EF21BCCEF4375E341389D2FECE5D9478BC9CC3474A01B8539860432F74D3275971218F1D07
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"aaed2961-c626-4a76-9043-cc071609ed4b","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714055676178,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):286
                      Entropy (8bit):5.250610437479748
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXaXcEMG4+5IRR4UhUR0Y9F2DeoAvJfshHHrPeUkwRe9:YvXKXcM+WRuUhUZFUVGUUUkee9
                      MD5:1162103BC3DF6C4B3856761ACBC3F724
                      SHA1:419865BBC48A86B0E9F22B25E74ADBD510589449
                      SHA-256:BCC532EFC44F0221A49C480C2C574AAF76950229770BF481D842A4479A6161BB
                      SHA-512:07025548E8C5A3A9D87A626CCFEE37965AF2A2ABB25B8AE129BC7C86DC072D3C9116C4A1A9305B8E70FDF4015B243F8046468354CCCB7E2944781AD351A6C2D8
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"aaed2961-c626-4a76-9043-cc071609ed4b","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714055676178,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):782
                      Entropy (8bit):5.359285292073672
                      Encrypted:false
                      SSDEEP:12:YvXKXcM+WRuUhUZFUVGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhW1:Yv6XcM7UfUx168CgEXX5kcIfANhg
                      MD5:88DE7405F193B4E813D01DCE5E975223
                      SHA1:2FF5AB153FF958CE5A4D0B80A48260841ED535D1
                      SHA-256:780A2DE9FB85912585CC69421EAB63337D9A62235147C6A5F6B400E8DE900150
                      SHA-512:BC757C86143A8567FFA06D27FBC336A5C1E4160A66456B66C4FFAA241B760C7C671D09C881A2FD56C52D3F45CD5A2E15EDC593E0241D8F8B94C2F3A7B9C2ABCF
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"aaed2961-c626-4a76-9043-cc071609ed4b","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714055676178,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1713882111212}}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):4
                      Entropy (8bit):0.8112781244591328
                      Encrypted:false
                      SSDEEP:3:e:e
                      MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                      SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                      SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                      SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                      Malicious:false
                      Preview:....

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):2814
                      Entropy (8bit):5.11871237830416
                      Encrypted:false
                      SSDEEP:48:YPC2P7Gc7fObIVdX16ruPTYBfAhPtw1TPRniq8T2b97VpK:qC2iOfObIVdXkSPTYBohPtMTZnJ8Tw7W
                      MD5:4BFCA9570C655FBEB0A60B008D0616CA
                      SHA1:68DD52540EB2FBD2241AC3375375D59E57F6893A
                      SHA-256:7F1D51B645736FC0001C9072CABEF8B0F964F7ACC75A8C8A6FFD6090D763499D
                      SHA-512:66A06B4564FF008C7381D09F8A6B0F6DB50597ED134BB32A7EE9C8F6DF47A30D488D27A9B4F37FAC8B10BECDFA82E55F4825681CF99956F313B3972CCDA3E8CB
                      Malicious:false
                      Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"f669543f2068fd5e6122ee7c1893a6cd","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1713882110000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"fabd3aeec201990bc03de49caa8f1db9","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1372,"ts":1713882110000},{"id":"Edit_InApp_Aug2020","info":{"dg":"1eaa5979de6d3b9c9bef1f9f32f870d5","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1713882110000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"683d6eefc1ba28ccb293424676d5f9d8","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1713882110000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"4461f9c96fc275cef35f5ea60aac0401","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1713882110000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"a49b6a53303329edfeda556d770cdffd","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1713882110000},

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
                      Category:dropped
                      Size (bytes):12288
                      Entropy (8bit):0.9859381489938799
                      Encrypted:false
                      SSDEEP:24:TLHRx/XYKQvGJF7urs67Y9QmQ6QeKTIcLESiAieSTF:TVl2GL7ms67YXtrxcI8G
                      MD5:E8B305B6A7F1037A22A814BFA5C945E7
                      SHA1:15308BC5C733F7A492035716F053C7CCB8F7E52D
                      SHA-256:6613F44DF7BBB51FAA8ED7F1BCC9BFF9FC5E8ACCFD47F160E533F9CE19A6E21E
                      SHA-512:41786062E6069C899CD2BF36559CBEE9C9F704555B4AFAB15E99E569528FC495229BC291BF4C872300339B31AD45F1FAFF02E50F4831B9E2B34A2037F1253FA2
                      Malicious:false
                      Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite Rollback Journal
                      Category:dropped
                      Size (bytes):8720
                      Entropy (8bit):1.3437972128546098
                      Encrypted:false
                      SSDEEP:24:7+t2ASY9QmQ6QeKT7cLESiAi0mY9QvqLBx/XYKQvGJF7ursJ:7M2lYXtr2cI8KYOqll2GL7msJ
                      MD5:2DCD01EC4234FA333467F22F25D8DEC1
                      SHA1:F2CDB134D524CF4B874AFD2FDE6A2E337414540C
                      SHA-256:FC6B3429E804C5DCDFE78619C5E23BDB0D3E8A2E375B522ABB536B339F75978F
                      SHA-512:0E324442A092E1079393501584D60EA2ED5AD73072B8FB1AF648B57060FB08FF7134A61BCD14B94F6B6D9C59FEC7445CF6FC4B97E8E46CFCFDA08F2DAEDB2EB8
                      Malicious:false
                      Preview:.... .c.......;......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Temp\MSI9ef91.LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):246
                      Entropy (8bit):3.5274671434738973
                      Encrypted:false
                      SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8rkarNcDH:Qw946cPbiOxDlbYnuRKWNQ
                      MD5:4A3C6F469D73A2A9B5306ECC9795F920
                      SHA1:8D4978BE2B26159FC83E641BDBEC297D192134FC
                      SHA-256:EA16AD7FB3B92828D169B142F983C072AB210D2B8FED0BE050208C76EF7888D4
                      SHA-512:750EC0E73BBD52BE1D21251A3918FF6B255CB2B94788F89C53F75BD0C67A48879F51000FADC72E18072FFF5FA5813579F49FBFC01DFB0C68591D43F4E973F3B6
                      Malicious:false
                      Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.3./.0.4./.2.0.2.4. . .1.6.:.2.1.:.5.3. .=.=.=.....

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-23 16-21-48-109.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393)
                      Category:dropped
                      Size (bytes):16525
                      Entropy (8bit):5.353642815103214
                      Encrypted:false
                      SSDEEP:384:tbxtsuP+XEWJJQbnR8L31M7HeltV+KYm3wsa2KjF4ODkr/O8r2IUHUHMWwEyZRN2:aPL
                      MD5:91F06491552FC977E9E8AF47786EE7C1
                      SHA1:8FEB27904897FFCC2BE1A985D479D7F75F11CEFC
                      SHA-256:06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
                      SHA-512:A63E6E0D25B88EBB6602885AB8E91167D37267B24516A11F7492F48876D3DDCAE44FFC386E146F3CF6EB4FA6AF251602143F254687B17FCFE6F00783095C5082
                      Malicious:false
                      Preview:SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig:

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393), with CRLF line terminators
                      Category:dropped
                      Size (bytes):16603
                      Entropy (8bit):5.3164542606540595
                      Encrypted:false
                      SSDEEP:384:W40xsAQxcHfikU0ezvsNrw1Nu5yVeOBBOvD1t9n62WZQWvt3auD/e/u3ISaGXP/S:CZP
                      MD5:EE2F26D9D7AD9B83BF35A2BA055F0E5E
                      SHA1:14D3F27A51688EE5D77DEB30A29075E240CD18CC
                      SHA-256:32DE9E06118625369DD60CEFF5E280E507780FAF1F06AA7D3C9CF447DA2F5F39
                      SHA-512:1789C6B89AF503860259FCC3B592F2EBA441B8758CBF89A11C3E4DD08B0B8A6CCAC204E64BE032FD9E735299FCE75D422E80D7DFADEA6D0FE4FA9946352D506B
                      Malicious:false
                      Preview:SessionID=5166223d-f8e4-4690-8e76-fcf0c20c3e0e.1713882108122 Timestamp=2024-04-23T16:21:48:122+0200 ThreadID=6164 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=5166223d-f8e4-4690-8e76-fcf0c20c3e0e.1713882108122 Timestamp=2024-04-23T16:21:48:124+0200 ThreadID=6164 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=5166223d-f8e4-4690-8e76-fcf0c20c3e0e.1713882108122 Timestamp=2024-04-23T16:21:48:124+0200 ThreadID=6164 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=5166223d-f8e4-4690-8e76-fcf0c20c3e0e.1713882108122 Timestamp=2024-04-23T16:21:48:124+0200 ThreadID=6164 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=5166223d-f8e4-4690-8e76-fcf0c20c3e0e.1713882108122 Timestamp=2024-04-23T16:21:48:124+0200 ThreadID=6164 Component=ngl-lib_NglAppLib Description="SetConf

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):29845
                      Entropy (8bit):5.4163433892247115
                      Encrypted:false
                      SSDEEP:192:0cbgIhPcbocbAIlncb2cbwI/RcbNcbQIVvcblR//7+fQd2OFOR8pORPGZitwcbTf:fhWlA/TVDIK
                      MD5:A683F7E4FD28A779A00C2DDE20EE6BF0
                      SHA1:86DD5CE6F2025B125328D535F2B10A25B5B955B5
                      SHA-256:CF447EBDD21196364DFBD4E054F1CEA8A3F313B6AACECDB3F1B37A97C87BC572
                      SHA-512:5A411646415C2E538B89D904A10B28F1324B5A9347FBE67BFEF28C498F0700FE94611A2E5476F768D6555E944756D3F0DB912946AFF7616FC79A08A19D9CC550
                      Malicious:false
                      Preview:06-10-2023 10:08:42:.---2---..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 10:08:42:.Closing File..06-10-

                      C:\Users\user\AppData\Local\Temp\acrocef_low\0c820881-fe4a-4fe6-8039-a883fe29432e.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                      Category:dropped
                      Size (bytes):758601
                      Entropy (8bit):7.98639316555857
                      Encrypted:false
                      SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                      MD5:3A49135134665364308390AC398006F1
                      SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                      SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                      SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                      Malicious:false
                      Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                      C:\Users\user\AppData\Local\Temp\acrocef_low\5dd6eb18-b238-4713-85c9-ae7ab8423ff3.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                      Category:dropped
                      Size (bytes):1419751
                      Entropy (8bit):7.976496077007677
                      Encrypted:false
                      SSDEEP:24576:/gWL07oXGZIZwYIGNPJwdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:4WLxXGZIZwZGM3mlind9i4ufFXpAXkru
                      MD5:AAAAB43627E96B02BC54A78F0EE8E32C
                      SHA1:03808205C51BA031BF69F0DF07C9C80835098104
                      SHA-256:B9ED5860C1528CAE5717E553381762D9C4ED093E546F7500F55B6B18B5C20CEA
                      SHA-512:A476038C2BC9573AFA12D831678C0D2A6EFF0C1E065F7D214A0D5684E79AA7F02710DF30524DE0E6EC90CB660E581531DFA57F038EE1BC285B9BC3DAE17D133D
                      Malicious:false
                      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                      C:\Users\user\AppData\Local\Temp\acrocef_low\620ff524-463e-4982-9f17-b639a0a50ca4.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                      Category:dropped
                      Size (bytes):386528
                      Entropy (8bit):7.9736851559892425
                      Encrypted:false
                      SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                      MD5:5C48B0AD2FEF800949466AE872E1F1E2
                      SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                      SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                      SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                      Malicious:false
                      Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                      C:\Users\user\AppData\Local\Temp\acrocef_low\f8098cd0-a471-4190-807b-9cd31b98e5e8.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                      Category:dropped
                      Size (bytes):1407294
                      Entropy (8bit):7.97605879016224
                      Encrypted:false
                      SSDEEP:24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tOWLaGZ4ZwYIGNPS:RB3mlind9i4ufFXpAXkrfUs0kWLaGZ48
                      MD5:1D64D25345DD73F100517644279994E6
                      SHA1:DE807F82098D469302955DCBE1A963CD6E887737
                      SHA-256:0A05C4CE0C4D8527D79A3C9CEE2A8B73475F53E18544622E4656C598BC814DFC
                      SHA-512:C0A37437F84B4895A7566E278046CFD50558AD84120CA0BD2EAD2259CA7A30BD67F0BDC4C043D73257773C607259A64B6F6AE4987C8B43BB47241F3C78EB9416
                      Malicious:false
                      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                      Static File Info

                      General

                      File type:PDF document, version 1.5, 1 pages (zip deflate encoded)
                      Entropy (8bit):7.933631183061793
                      TrID:
                      • Adobe Portable Document Format (5005/1) 100.00%
                      File name:FEFR237_f090161469300000000ED.pdf
                      File size:59'305 bytes
                      MD5:cddb06f6ef3ce9ce2c7056d5f55ad7bc
                      SHA1:7d8dac629cb54440f00974428c7751fe2b206a98
                      SHA256:7bb5d08f5bc407547f7f865ff4f31206bbcbcf2f0611db8e19bd80baca404c52
                      SHA512:855538744f7b973dedb8c4f3c33d1f32fc519113d4179cdab7585118a1c3f3483cfc4243ecc36f19f383561f73059e9af89b6ce8ce7562baa9874b8841412925
                      SSDEEP:1536:G8MXKVdrv9zIZ8ezNZl5CZ/l5GgDyor6eRgWUXn/F:IX8veNVvgD9me5U
                      TLSH:1543E15099C2D88CBD9B2ADE3F947550879CF7B173E9E1859C2C8E28E143FD8E51B10A
                      File Content Preview:%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(es-CO) /MarkInfo<</Marked true>>>>..endobj..2 0 obj..<</Type/Pages/Count 1/Kids[ 3 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 7 0 R/F3 10 0 R>>/XObject<</Im

                      File Icon

                      Icon Hash:62cc8caeb29e8ae0

                      Static PDF Info

                      General

                      Header:%PDF-1.5
                      Total Entropy:7.933631
                      Total Bytes:59305
                      Stream Entropy:7.964927
                      Stream Bytes:54964
                      Entropy outside Streams:4.913626
                      Bytes outside Streams:4341
                      Number of EOF found:2
                      Bytes after EOF:

                      Keywords Statistics

                      NameCount
                      obj17
                      endobj17
                      stream4
                      endstream4
                      xref2
                      trailer2
                      startxref2
                      /Page1
                      /Encrypt0
                      /ObjStm0
                      /URI0
                      /JS0
                      /JavaScript0
                      /AA0
                      /OpenAction0
                      /AcroForm0
                      /JBIG2Decode0
                      /RichMedia0
                      /Launch0
                      /EmbeddedFile0

                      Image Streams

                      IDDHASHMD5Preview
                      96179f9e9696987a96c3a324edcdb758538077eb77ced1701
                      1229575b6d1949673f467d81019eabd671b5b228c6fd866073

                      Network Behavior

                      Network Port Distribution

                      TCP Packets

                      TimestampSource PortDest PortSource IPDest IP
                      Apr 23, 2024 16:21:58.996828079 CEST49705443192.168.2.1623.48.8.182
                      Apr 23, 2024 16:21:58.996876001 CEST4434970523.48.8.182192.168.2.16
                      Apr 23, 2024 16:21:58.996946096 CEST49705443192.168.2.1623.48.8.182
                      Apr 23, 2024 16:21:58.997122049 CEST49705443192.168.2.1623.48.8.182
                      Apr 23, 2024 16:21:58.997140884 CEST4434970523.48.8.182192.168.2.16
                      Apr 23, 2024 16:21:59.347577095 CEST4434970523.48.8.182192.168.2.16
                      Apr 23, 2024 16:21:59.347919941 CEST49705443192.168.2.1623.48.8.182
                      Apr 23, 2024 16:21:59.347968102 CEST4434970523.48.8.182192.168.2.16
                      Apr 23, 2024 16:21:59.349467039 CEST4434970523.48.8.182192.168.2.16
                      Apr 23, 2024 16:21:59.349545956 CEST49705443192.168.2.1623.48.8.182
                      Apr 23, 2024 16:21:59.368969917 CEST49705443192.168.2.1623.48.8.182
                      Apr 23, 2024 16:21:59.369127989 CEST49705443192.168.2.1623.48.8.182
                      Apr 23, 2024 16:21:59.369177103 CEST4434970523.48.8.182192.168.2.16
                      Apr 23, 2024 16:21:59.416596889 CEST49705443192.168.2.1623.48.8.182
                      Apr 23, 2024 16:21:59.416626930 CEST4434970523.48.8.182192.168.2.16
                      Apr 23, 2024 16:21:59.463591099 CEST49705443192.168.2.1623.48.8.182
                      Apr 23, 2024 16:21:59.492489100 CEST4434970523.48.8.182192.168.2.16
                      Apr 23, 2024 16:21:59.492707014 CEST4434970523.48.8.182192.168.2.16
                      Apr 23, 2024 16:21:59.492770910 CEST49705443192.168.2.1623.48.8.182
                      Apr 23, 2024 16:21:59.493748903 CEST49705443192.168.2.1623.48.8.182
                      Apr 23, 2024 16:21:59.493791103 CEST4434970523.48.8.182192.168.2.16

                      HTTP Request Dependency Graph

                      • armmf.adobe.com

                      HTTPS Proxied Packets

                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      0192.168.2.164970523.48.8.1824433908C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      TimestampBytes transferredDirectionData
                      2024-04-23 14:21:59 UTC390OUTGET /onboarding/smskillreader.txt HTTP/1.1
                      Host: armmf.adobe.com
                      Connection: keep-alive
                      Accept-Language: en-US,en;q=0.9
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
                      Sec-Fetch-Site: same-origin
                      Sec-Fetch-Mode: no-cors
                      Sec-Fetch-Dest: empty
                      Accept-Encoding: gzip, deflate, br
                      2024-04-23 14:21:59 UTC247INHTTP/1.1 200 OK
                      Server: Apache
                      Last-Modified: Mon, 01 May 2023 15:02:33 GMT
                      ETag: "78-5faa31cce96da"
                      Accept-Ranges: bytes
                      Content-Length: 120
                      Content-Type: text/plain; charset=UTF-8
                      Date: Tue, 23 Apr 2024 14:21:59 GMT
                      Connection: close
                      2024-04-23 14:21:59 UTC120INData Raw: 46 69 6c 65 20 74 68 61 74 20 61 63 74 73 20 6c 69 6b 65 20 61 20 4b 69 6c 6c 20 73 77 69 74 63 68 20 66 6f 72 20 53 4d 53 20 66 75 6e 63 74 69 6f 6e 61 6c 69 74 79 20 69 6e 20 52 65 61 64 65 72 2e 20 44 65 6c 65 74 65 20 74 68 69 73 20 66 69 6c 65 20 74 6f 20 65 6e 61 62 6c 65 20 74 68 65 20 6b 69 6c 6c 20 73 77 69 74 63 68 20 69 6e 20 52 65 61 64 65 72 2e
                      Data Ascii: File that acts like a Kill switch for SMS functionality in Reader. Delete this file to enable the kill switch in Reader.


                      Statistics

                      CPU Usage

                      Click to jump to process

                      Memory Usage

                      Click to jump to process

                      High Level Behavior Distribution

                      Click to dive into process behavior distribution

                      Behavior

                      Click to jump to process

                      System Behavior

                      General

                      Target ID:0
                      Start time:16:21:44
                      Start date:23/04/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\FEFR237_f090161469300000000ED.pdf"
                      Imagebase:0x7ff792d10000
                      File size:5'641'176 bytes
                      MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      General

                      Target ID:2
                      Start time:16:21:45
                      Start date:23/04/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                      Imagebase:0x7ff7e2560000
                      File size:3'581'912 bytes
                      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      General

                      Target ID:3
                      Start time:16:21:46
                      Start date:23/04/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1552,i,18417824236284609083,1796295958897842713,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                      Imagebase:0x7ff7e2560000
                      File size:3'581'912 bytes
                      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      Disassembly

                      ⊘No disassembly