Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Alchemy_Quarterly_Newsletter-April__24.pdf

Overview

General Information

Sample name:Alchemy_Quarterly_Newsletter-April__24.pdf
Analysis ID:1431807
MD5:9f7d4b9dfd805cf2c811535cd750d86c
SHA1:7c7d74d23e42c47df705c560e232a1201ba276ca
SHA256:1917bc9d6591663e5eb22710cfe9d97ab9eab4e1c650f401a6e9082c4a248d4e
Infos:

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 4416 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Alchemy_Quarterly_Newsletter-April__24.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 3560 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 7296 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1628,i,8684521670987530744,9423196504567068144,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficTCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global trafficTCP traffic: 184.31.48.185:443 -> 192.168.2.5:49715
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global trafficTCP traffic: 184.31.48.185:443 -> 192.168.2.5:49715
Source: global trafficTCP traffic: 184.31.48.185:443 -> 192.168.2.5:49715
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global trafficTCP traffic: 184.31.48.185:443 -> 192.168.2.5:49715
Source: global trafficTCP traffic: 184.31.48.185:443 -> 192.168.2.5:49715
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global trafficTCP traffic: 184.31.48.185:443 -> 192.168.2.5:49715
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global trafficTCP traffic: 184.31.48.185:443 -> 192.168.2.5:49715
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global trafficTCP traffic: 184.31.48.185:443 -> 192.168.2.5:49715
Source: global trafficTCP traffic: 184.31.48.185:443 -> 192.168.2.5:49715
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global trafficTCP traffic: 184.31.48.185:443 -> 192.168.2.5:49715
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 184.31.48.185:443
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknownTCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknownTCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknownTCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknownTCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknownTCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknownTCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknownTCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknownTCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknownTCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknownTCP traffic detected without corresponding DNS query: 184.31.48.185
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: A919h0cks_en93uu_54g.tmp.0.drString found in binary or memory: https://www.amfiindia.com/research
Source: A919h0cks_en93uu_54g.tmp.0.drString found in binary or memory: https://www.amfiindia.com/research-information/other-data/categorization-of-stocks
Source: Alchemy_Quarterly_Newsletter-April__24.pdfString found in binary or memory: https://www.amfiindia.com/research-information/other-data/categorization-of-stocks)
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: classification engineClassification label: clean1.winPDF@14/43@0/1
Source: Alchemy_Quarterly_Newsletter-April__24.pdfInitial sample: https://www.amfiindia.com/research-information/other-data/categorization-of-stocks
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journalJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-25 20-05-02-382.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Alchemy_Quarterly_Newsletter-April__24.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1628,i,8684521670987530744,9423196504567068144,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1628,i,8684521670987530744,9423196504567068144,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: Alchemy_Quarterly_Newsletter-April__24.pdfInitial sample: PDF keyword /JS count = 0
Source: Alchemy_Quarterly_Newsletter-April__24.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: A9elqs2j_en93v1_54g.tmp.0.drInitial sample: PDF keyword /JS count = 0
Source: A9elqs2j_en93v1_54g.tmp.0.drInitial sample: PDF keyword /JavaScript count = 0
Source: Alchemy_Quarterly_Newsletter-April__24.pdfInitial sample: PDF keyword /Page count = 11
Source: Alchemy_Quarterly_Newsletter-April__24.pdfInitial sample: PDF keyword stream count = 40
Source: Alchemy_Quarterly_Newsletter-April__24.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: Alchemy_Quarterly_Newsletter-April__24.pdfInitial sample: PDF keyword /ObjStm count = 17
Source: Alchemy_Quarterly_Newsletter-April__24.pdfInitial sample: PDF keyword obj count = 99
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire Infrastructure1
Spearphishing Link		2
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive12
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1431807 Sample: Alchemy_Quarterly_Newslette... Startdate: 25/04/2024 Architecture: WINDOWS Score: 1 6 Acrobat.exe 18 65 2->6         started        process3 8 AcroCEF.exe 104 6->8         started        process4 10 AcroCEF.exe 2 8->10         started        dnsIp5 13 184.31.48.185, 443, 49715 AKAMAI-ASUS United States 10->13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Alchemy_Quarterly_Newsletter-April__24.pdf0%ReversingLabs
Alchemy_Quarterly_Newsletter-April__24.pdf0%VirustotalBrowse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://www.amfiindia.com/research-information/other-data/categorization-of-stocks)Alchemy_Quarterly_Newsletter-April__24.pdffalse
    		high
    https://www.amfiindia.com/researchA919h0cks_en93uu_54g.tmp.0.drfalse
      		high
      https://www.amfiindia.com/research-information/other-data/categorization-of-stocksA919h0cks_en93uu_54g.tmp.0.drfalse
        		high

        World Map of Contacted IPs

        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs

        Public IPs

        IPDomainCountryFlagASNASN NameMalicious
        184.31.48.185
        		unknownUnited States
        		16625AKAMAI-ASUSfalse

        General Information

        Joe Sandbox version:40.0.0 Tourmaline
        Analysis ID:1431807
        Start date and time:2024-04-25 20:04:13 +02:00
        Joe Sandbox product:CloudBasic
        Overall analysis duration:0h 4m 9s
        Hypervisor based Inspection enabled:false
        Report type:full
        Cookbook file name:defaultwindowspdfcookbook.jbs
        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
        Number of analysed new started processes analysed:9
        Number of new started drivers analysed:0
        Number of existing processes analysed:0
        Number of existing drivers analysed:0
        Number of injected processes analysed:0
        Technologies:
        • HCA enabled
        • EGA enabled
        • AMSI enabled
        Analysis Mode:default
        Analysis stop reason:Timeout
        Sample name:Alchemy_Quarterly_Newsletter-April__24.pdf
        Detection:CLEAN
        Classification:clean1.winPDF@14/43@0/1
        EGA Information:Failed
        HCA Information:
        • Successful, ratio: 100%
        • Number of executed functions: 0
        • Number of non-executed functions: 0
        Cookbook Comments:
        • Found application associated with file extension: .pdf
        • Found PDF document
        • Close Viewer

        Warnings

        • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
        • Excluded IPs from analysis (whitelisted): 184.24.36.138, 54.227.187.23, 52.5.13.197, 52.202.204.11, 23.22.254.206, 172.64.41.3, 162.159.61.3, 23.209.188.149, 23.209.188.151
        • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com

        Simulations

        Behavior and APIs

        ⊘No simulations

        Joe Sandbox View / Context

        IPs

        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        184.31.48.185phish_alert_iocp_v1.4.48 (23).emlGet hashmaliciousSTRRATBrowse
          RR1-733859-11972-Transmissora_Alianca_de_Energia_Eletrica_S_A__time_10022023204823.pdf.7zGet hashmaliciousUnknownBrowse

            Domains

            ⊘No context

            ASNs

            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            AKAMAI-ASUShttp://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3DGet hashmaliciousHTMLPhisherBrowse
            • 23.59.235.214
            dwn1cGHIbV.elfGet hashmaliciousMiraiBrowse
            • 104.73.199.214
            https://bushelman-my.sharepoint.com/:b:/p/lance/ESXtc6Laa05KpaC4W3rpMEMBfLSUU1GZhgfhBL8opRqFHg?e=Wrw3leGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
            • 23.223.31.42
            [EXTERNAL] New file received.emlGet hashmaliciousHTMLPhisherBrowse
            • 23.47.176.131
            https://www.bing.com/////////////////////ck/a?!&&p=0533e94aab0b2a6eJmltdHM9MTcxMzQ4NDgwMCZpZ3VpZD0xNDE4NDZmNi1iZWY1LTY4NjUtMjQ0YS01MjkwYmYwZTY5ODQmaW5zaWQ9NTIyMA&ptn=3&ver=2&hsh=3&fclid=141846f6-bef5-6865-244a-5290bf0e6984&u=a1aHR0cHM6Ly9reDRrc3IuYXJ0aWNsZXdyaXRpbmdnZW5lcmF0b3IueHl6Lw#vds2aa29aYmRldmluc0B3ZS13b3JsZHdpZGUuY29tGet hashmaliciousHTMLPhisherBrowse
            • 23.209.84.186
            lzShU2RYJa.exeGet hashmaliciousBabuk, Clipboard Hijacker, Djvu, VidarBrowse
            • 96.17.209.196
            https://app.frame.io/presentations/da0e116a-d15f-430f-8c37-0aa7d783720f?component_clicked=digest_call_to_action&email_id=8abc710c-c18f-47f5-a884-e927cb8dcfaa&email_type=pending-reviewer-inviteGet hashmaliciousHTMLPhisherBrowse
            • 23.199.47.148
            n8XBpFdVFU.exeGet hashmaliciousBabuk, Djvu, VidarBrowse
            • 96.17.209.196
            R5391762lf.exeGet hashmaliciousClipboard Hijacker, Djvu, VidarBrowse
            • 23.66.133.162
            file.exeGet hashmaliciousVidarBrowse
            • 96.17.209.196

            JA3 Fingerprints

            ⊘No context

            Dropped Files

            ⊘No context

            Created / dropped Files

            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
            File Type:ASCII text
            Category:dropped
            Size (bytes):294
            Entropy (8bit):5.050695043380379
            Encrypted:false
            SSDEEP:6:3IFKq2P92nKuAl9OmbnIFUt8MIwZmw+MI4kwO92nKuAl9OmbjLJ:wKv4HAahFUt8m/+a5LHAaSJ
            MD5:236EA27BA05CEF71A7EACD13D0602CC9
            SHA1:21904F6AB82E91F90636F8A0C0E9776292E99436
            SHA-256:473EA076170415348D868B1B996E642B7E1A816F010330A36765A0C96015F12A
            SHA-512:CA27AE4D14C0E3F4235D7E0C72813B1700D03BDFF47720DDFE1D7654D1E338744BFAF8E20C6E411997BE190C96223D0C4006CA8530E3B351BF8EF3EFA8D892CE
            Malicious:false
            Reputation:low
            Preview:2024/04/25-20:05:00.093 10e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/25-20:05:00.094 10e0 Recovering log #3.2024/04/25-20:05:00.094 10e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
            File Type:ASCII text
            Category:dropped
            Size (bytes):294
            Entropy (8bit):5.050695043380379
            Encrypted:false
            SSDEEP:6:3IFKq2P92nKuAl9OmbnIFUt8MIwZmw+MI4kwO92nKuAl9OmbjLJ:wKv4HAahFUt8m/+a5LHAaSJ
            MD5:236EA27BA05CEF71A7EACD13D0602CC9
            SHA1:21904F6AB82E91F90636F8A0C0E9776292E99436
            SHA-256:473EA076170415348D868B1B996E642B7E1A816F010330A36765A0C96015F12A
            SHA-512:CA27AE4D14C0E3F4235D7E0C72813B1700D03BDFF47720DDFE1D7654D1E338744BFAF8E20C6E411997BE190C96223D0C4006CA8530E3B351BF8EF3EFA8D892CE
            Malicious:false
            Reputation:low
            Preview:2024/04/25-20:05:00.093 10e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/25-20:05:00.094 10e0 Recovering log #3.2024/04/25-20:05:00.094 10e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
            File Type:ASCII text
            Category:dropped
            Size (bytes):338
            Entropy (8bit):5.060730165283677
            Encrypted:false
            SSDEEP:6:3K24FIq2P92nKuAl9Ombzo2jMGIFUt8MKN9Zmw+MKNPkwO92nKuAl9Ombzo2jMmd:63Iv4HAa8uFUt8/N9/+/NP5LHAa8RJ
            MD5:6F18E6FC51CF0BC430A3720B8A7896B7
            SHA1:85CB1CAF43AB95387E49B124AF1D8F669BFD4822
            SHA-256:8E5D7100C100CB65B324CEBCF5DE066CA664B94DDEB6594B74316D4A8529C778
            SHA-512:B3FE890EEACAB68E79B7A878C66526911DE1456B9486CC2D4B566FFD505253E4201709D3B1F92145C0843F27A80EA4A866CC4A10A8913355824EC38A25F525DA
            Malicious:false
            Reputation:low
            Preview:2024/04/25-20:05:00.209 1ca4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/25-20:05:00.210 1ca4 Recovering log #3.2024/04/25-20:05:00.210 1ca4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
            File Type:ASCII text
            Category:dropped
            Size (bytes):338
            Entropy (8bit):5.060730165283677
            Encrypted:false
            SSDEEP:6:3K24FIq2P92nKuAl9Ombzo2jMGIFUt8MKN9Zmw+MKNPkwO92nKuAl9Ombzo2jMmd:63Iv4HAa8uFUt8/N9/+/NP5LHAa8RJ
            MD5:6F18E6FC51CF0BC430A3720B8A7896B7
            SHA1:85CB1CAF43AB95387E49B124AF1D8F669BFD4822
            SHA-256:8E5D7100C100CB65B324CEBCF5DE066CA664B94DDEB6594B74316D4A8529C778
            SHA-512:B3FE890EEACAB68E79B7A878C66526911DE1456B9486CC2D4B566FFD505253E4201709D3B1F92145C0843F27A80EA4A866CC4A10A8913355824EC38A25F525DA
            Malicious:false
            Reputation:low
            Preview:2024/04/25-20:05:00.209 1ca4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/25-20:05:00.210 1ca4 Recovering log #3.2024/04/25-20:05:00.210 1ca4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4e3bbaab-757e-46b1-a686-29321586e52a.tmp

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
            File Type:JSON data
            Category:modified
            Size (bytes):508
            Entropy (8bit):5.044323380795808
            Encrypted:false
            SSDEEP:12:YH/um3RA8sqZSsBdOg2HMcaq3QYiubxnP7E4T3OF+:Y2sRds0dMHv3QYhbxP7nbI+
            MD5:849639EDFE372A4A2CD9B65E6A64C778
            SHA1:AD4EF61D6112B9EDCB795CDCEE97EAB1DF8D2AC8
            SHA-256:56E4BCA83C797F757A9E0A1B2519773885999E3253CA24EEB1677482A4EE89AE
            SHA-512:2A1DE1BE5FF3D592A495F58FB2A47DAF6B7FE2B4DE3834FEA7DBFFCD0AFBCB3EFC2D9ACF7310D48E24DA79752E05D9F223F90121CCACD590FDD614EE29D3FE5D
            Malicious:false
            Reputation:low
            Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13358628312025117","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":112318},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
            File Type:JSON data
            Category:dropped
            Size (bytes):508
            Entropy (8bit):5.044323380795808
            Encrypted:false
            SSDEEP:12:YH/um3RA8sqZSsBdOg2HMcaq3QYiubxnP7E4T3OF+:Y2sRds0dMHv3QYhbxP7nbI+
            MD5:849639EDFE372A4A2CD9B65E6A64C778
            SHA1:AD4EF61D6112B9EDCB795CDCEE97EAB1DF8D2AC8
            SHA-256:56E4BCA83C797F757A9E0A1B2519773885999E3253CA24EEB1677482A4EE89AE
            SHA-512:2A1DE1BE5FF3D592A495F58FB2A47DAF6B7FE2B4DE3834FEA7DBFFCD0AFBCB3EFC2D9ACF7310D48E24DA79752E05D9F223F90121CCACD590FDD614EE29D3FE5D
            Malicious:false
            Reputation:low
            Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13358628312025117","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":112318},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
            File Type:data
            Category:dropped
            Size (bytes):4509
            Entropy (8bit):5.236990861208206
            Encrypted:false
            SSDEEP:96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUCO3vJbkZ:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLx
            MD5:7382DCE367E454E74B061E140F2FD87F
            SHA1:DACBAB20928A0BFEC0D442465859F69FE62CFE60
            SHA-256:1C8E1A99D047E94D0EC9755DAF40424B712737D3A4A20EF3A64965E012BE3C15
            SHA-512:28E883CF6D0B89E3CB47E28EE90F8F4D1B7CA6C06C97B627E51E86A63E77A7FA3C4C97A0A7B3A3B043A36FBDF0358B284CB4441B1FDFFFFEBAEBC90E29508170
            Malicious:false
            Reputation:low
            Preview:*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
            File Type:ASCII text
            Category:dropped
            Size (bytes):326
            Entropy (8bit):5.102146634945072
            Encrypted:false
            SSDEEP:6:3OlMq2P92nKuAl9OmbzNMxIFUt8MV9Zmw+MvWkwO92nKuAl9OmbzNMFLJ:+Sv4HAa8jFUt88/+8W5LHAa84J
            MD5:D271BF383A0DFDD708E5A25B0EFC83A8
            SHA1:E066AFC47C467CF5E0BDCAE77C758DE2F98B8F07
            SHA-256:090EEFA7A53EC738E70D51F87E2B7D2301AB23A92D0B3749374F86C3B8CC688F
            SHA-512:DF772A6738B236D40EED7A5817D520F764A5FAD40DD129A5C8CF8AB978086012126E5EB95EF4434580F8581860B76185072D4F4656B139C8A675BF1E63CC4FC2
            Malicious:false
            Reputation:low
            Preview:2024/04/25-20:05:00.672 1ca4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/25-20:05:00.710 1ca4 Recovering log #3.2024/04/25-20:05:00.722 1ca4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
            File Type:ASCII text
            Category:dropped
            Size (bytes):326
            Entropy (8bit):5.102146634945072
            Encrypted:false
            SSDEEP:6:3OlMq2P92nKuAl9OmbzNMxIFUt8MV9Zmw+MvWkwO92nKuAl9OmbzNMFLJ:+Sv4HAa8jFUt88/+8W5LHAa84J
            MD5:D271BF383A0DFDD708E5A25B0EFC83A8
            SHA1:E066AFC47C467CF5E0BDCAE77C758DE2F98B8F07
            SHA-256:090EEFA7A53EC738E70D51F87E2B7D2301AB23A92D0B3749374F86C3B8CC688F
            SHA-512:DF772A6738B236D40EED7A5817D520F764A5FAD40DD129A5C8CF8AB978086012126E5EB95EF4434580F8581860B76185072D4F4656B139C8A675BF1E63CC4FC2
            Malicious:false
            Reputation:low
            Preview:2024/04/25-20:05:00.672 1ca4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/25-20:05:00.710 1ca4 Recovering log #3.2024/04/25-20:05:00.722 1ca4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

            C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240425180504Z-174.bmp

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
            Category:dropped
            Size (bytes):71190
            Entropy (8bit):1.9304683848646098
            Encrypted:false
            SSDEEP:192:Cvc3qIuu7zorMuNjCh0tmc7UJyJZWgLHs+8llg8jmTwiVCUAuGoNYI:Cvc3qIuuQrMRoAkLH+mDSRI
            MD5:2640B6A863CCAE9FE06CC38D69BF19C8
            SHA1:C4582638E526224DE60C7C99BD383323DDD914F0
            SHA-256:173716DA00C14C7EFC9027D8C6F66C0DA24F573A81C0FAF57DBB9D9D03B23447
            SHA-512:C808109BFE40D27B062C44D93373E9BB3F9D790407E75FCC3B59971BC0AAF6A1D0F93181C185F00E4FF4981E5CDDDCB395CE8665E7176C0A5545B4222768947C
            Malicious:false
            Reputation:low
            Preview:BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6640

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:PostScript document text
            Category:dropped
            Size (bytes):185099
            Entropy (8bit):5.182478651346149
            Encrypted:false
            SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
            MD5:94185C5850C26B3C6FC24ABC385CDA58
            SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
            SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
            SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
            Malicious:false
            Reputation:moderate, very likely benign file
            Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:PostScript document text
            Category:dropped
            Size (bytes):185099
            Entropy (8bit):5.182478651346149
            Encrypted:false
            SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
            MD5:94185C5850C26B3C6FC24ABC385CDA58
            SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
            SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
            SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
            Malicious:false
            Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:data
            Category:dropped
            Size (bytes):227002
            Entropy (8bit):3.392780893644728
            Encrypted:false
            SSDEEP:1536:WKPC4iyzDtrh1cK3XEivK7VK/3AYvYwgF/rRoL+sn:DPCaJ/3AYvYwglFoL+sn
            MD5:87EDBEE38F56C20298F25D5D3D4D1B5C
            SHA1:7F904E9615AC3186A87472EF366DD8202855B0B7
            SHA-256:A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
            SHA-512:BBEBC1FCD5BC9AE042DD5782425BA8C47BF3EAC283B2487FC4E3FF6BF8101306DAB081E5135594165D4DC1AC120FF125AADBC5B3FFE7C646183C04DF77865E0D
            Malicious:false
            Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:JSON data
            Category:dropped
            Size (bytes):295
            Entropy (8bit):5.350723147798763
            Encrypted:false
            SSDEEP:6:YEQXJ2HXW5SUPx+FIbRI6XVW7+0Y/rCRoAvJM3g98kUwPeUkwRe9:YvXKX8SUPUYpW7MCuGMbLUkee9
            MD5:C2A7DD9AE35810E728BE6B6BC7FC7A1B
            SHA1:248467CA71ED0B6BB75197BA1E006086BE79DB62
            SHA-256:F758C20741544B5BA18A7E15A8963C622D49957795857B133C73CEA9A89D1F33
            SHA-512:77A9AB86EE43896288B85E97F333973C4863DC4FBF1F11CF06310EA6CA7BFF2D9F3958695B87085EF95B0ED64F57E010BD0335A921CF8D047EA18634565E8A20
            Malicious:false
            Preview:{"analyticsData":{"responseGUID":"99b7b082-717d-4c03-8c43-c8f4dfbde2a4","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714247735796,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:JSON data
            Category:dropped
            Size (bytes):294
            Entropy (8bit):5.289550314735322
            Encrypted:false
            SSDEEP:6:YEQXJ2HXW5SUPx+FIbRI6XVW7+0Y/rCRoAvJfBoTfXpnrPeUkwRe9:YvXKX8SUPUYpW7MCuGWTfXcUkee9
            MD5:3AF7AB937A1946FE861F59CEF136D18F
            SHA1:88FB628BFFB37D32DB6D30EC54BC33B7124EE871
            SHA-256:CE0AB102A3118878843710B32D1C9FAABD4C74E2DD6D1C2A19EEE4354A216E72
            SHA-512:A9DDE378A406B6B3898BE48D45725F7AD313999429754DE25BA1024D47EA7F49F4843E5843A098AA6E6A159D9545D1C5E586A4F9120168B4524F1FFE27B2BEF9
            Malicious:false
            Preview:{"analyticsData":{"responseGUID":"99b7b082-717d-4c03-8c43-c8f4dfbde2a4","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714247735796,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:JSON data
            Category:dropped
            Size (bytes):294
            Entropy (8bit):5.267400408312391
            Encrypted:false
            SSDEEP:6:YEQXJ2HXW5SUPx+FIbRI6XVW7+0Y/rCRoAvJfBD2G6UpnrPeUkwRe9:YvXKX8SUPUYpW7MCuGR22cUkee9
            MD5:3A8D06CEB3877327BCD700CA0BD5B96A
            SHA1:3F6235C6C242724A7F7D87E0525ED508E210A902
            SHA-256:D57BDD95F9A60FED83CBF1307BE521530662CD507B48A7536FEE855E6F1F9B35
            SHA-512:8E0E44AA7FCA2B1708433EED9865D90FA1E7F2794A79977DE182E8089F67AED744EE2783A9A7F7ECD4FA7E588892C72FB720CA4C8CD409F09F8C2528553E9ED8
            Malicious:false
            Preview:{"analyticsData":{"responseGUID":"99b7b082-717d-4c03-8c43-c8f4dfbde2a4","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714247735796,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:JSON data
            Category:dropped
            Size (bytes):285
            Entropy (8bit):5.329172508311701
            Encrypted:false
            SSDEEP:6:YEQXJ2HXW5SUPx+FIbRI6XVW7+0Y/rCRoAvJfPmwrPeUkwRe9:YvXKX8SUPUYpW7MCuGH56Ukee9
            MD5:7629125BEBFA8FBF03C961B872CD0487
            SHA1:299D68427A92CA86CEB93A600D0FE54C634DE788
            SHA-256:DC7A7D757CA49E7275C19E97FEB23354F0CDFB8689EB9351341C6C4862E03111
            SHA-512:1DC153CD39C0EDBE714CB6F971F1F01D6B0C9EBDA5940C841E578448AF24B48B4F8C3CA5DD5918F059FF461126567F5B9DF5F1010BB8894ED8C147F1EF118DB8
            Malicious:false
            Preview:{"analyticsData":{"responseGUID":"99b7b082-717d-4c03-8c43-c8f4dfbde2a4","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714247735796,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:JSON data
            Category:dropped
            Size (bytes):292
            Entropy (8bit):5.288291837905225
            Encrypted:false
            SSDEEP:6:YEQXJ2HXW5SUPx+FIbRI6XVW7+0Y/rCRoAvJfJWCtMdPeUkwRe9:YvXKX8SUPUYpW7MCuGBS8Ukee9
            MD5:A758A16F73D48E1689C1A1F09ADE0630
            SHA1:B3B4D62B17F4382ECEC0BFF0831B68EBD6AB36CF
            SHA-256:9D90BF02CCF92177609A41A306639EF0177AF67FBC985CDA89E78342BF84ED26
            SHA-512:D01FDB67D0485C8798987D2C572A65FC6849B38F23A217DE23EE21679194A56283FD592838EB098A8E81A8633E295ADB7724ADD59D8764EA2E84AACD6A96EAE4
            Malicious:false
            Preview:{"analyticsData":{"responseGUID":"99b7b082-717d-4c03-8c43-c8f4dfbde2a4","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714247735796,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:JSON data
            Category:dropped
            Size (bytes):289
            Entropy (8bit):5.273528329629824
            Encrypted:false
            SSDEEP:6:YEQXJ2HXW5SUPx+FIbRI6XVW7+0Y/rCRoAvJf8dPeUkwRe9:YvXKX8SUPUYpW7MCuGU8Ukee9
            MD5:FC8A14E251DDD97C33B5C256C3904860
            SHA1:ADF4EA44920FFF78EDDC9BE51E39C01E0B1396F1
            SHA-256:B0601FB45C921DA896BEAB8F0A72B48549FFC4D7C58B9BB9FEF6441C2949C4D7
            SHA-512:D49588D28A2F5A8EA52349AE6C6978783F79F71FA4E08FD0D72D0F1130E9487A29E8941474EB17A46A5A7D6DD0A5217593831255B97D345FE80C721845240623
            Malicious:false
            Preview:{"analyticsData":{"responseGUID":"99b7b082-717d-4c03-8c43-c8f4dfbde2a4","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714247735796,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:JSON data
            Category:dropped
            Size (bytes):292
            Entropy (8bit):5.274755500277802
            Encrypted:false
            SSDEEP:6:YEQXJ2HXW5SUPx+FIbRI6XVW7+0Y/rCRoAvJfQ1rPeUkwRe9:YvXKX8SUPUYpW7MCuGY16Ukee9
            MD5:9F7C9F9BD39FE15D7AF79AF499CE7F33
            SHA1:7CD70243660C9F7FA22B9DB5BA66B7D5C8B68851
            SHA-256:2693C1FA65EC8D096A3BC7332055BFC8F397C957EAFFC6C3D08A248AB96CAF49
            SHA-512:E69EB22C0862BBD324EC5C761E120DA9EA4F669F9CDB25D744C48752BE16EFD05F3DAC10F8E039AB803B1F9CC806EDCFDB604B7CEC2866E42BDE2B66C6A38B54
            Malicious:false
            Preview:{"analyticsData":{"responseGUID":"99b7b082-717d-4c03-8c43-c8f4dfbde2a4","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714247735796,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:JSON data
            Category:dropped
            Size (bytes):289
            Entropy (8bit):5.293663937009117
            Encrypted:false
            SSDEEP:6:YEQXJ2HXW5SUPx+FIbRI6XVW7+0Y/rCRoAvJfFldPeUkwRe9:YvXKX8SUPUYpW7MCuGz8Ukee9
            MD5:5CD79AFBF940C073BAB66F2FA607F50B
            SHA1:6DCDEE3B7E8D381ECB7CB8C65319207F7F657086
            SHA-256:C9B25874C4B6C698EBA354CC8AE303B8FAC9FC72461967BA25C152116F496ECB
            SHA-512:EC2561A0B1259C2EBE3C4BD4018714474501DC4AA659115B26ABF455604A7F85618078576E29F7EDE8DE529B583E52794E3A754012C7F10B881CFEF6C3EF62FA
            Malicious:false
            Preview:{"analyticsData":{"responseGUID":"99b7b082-717d-4c03-8c43-c8f4dfbde2a4","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714247735796,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:JSON data
            Category:dropped
            Size (bytes):1372
            Entropy (8bit):5.7381051889677295
            Encrypted:false
            SSDEEP:24:Yv6X8Li6KLgENRcbrZbq00iCCBrwJo++ns8ct4mFJN801:Yv+6EgigrNt0wSJn+ns8cvFJF
            MD5:CDFF69D65F538C6220E3CB688027B82A
            SHA1:E71F4195343C10944228AF0DB835F499BF088486
            SHA-256:48875DAF2EB59FD89548880B7696AF5E858C085377703B2F7021882191B1157F
            SHA-512:86E8ADE049CC4096FDA455FD585EFAC3CA4CAD0ABF1D333BD8EB9A84FBC605B6CEFAAD90D6ADAFB91155B489DAA6DF24818D63EE74C41D17C3FAF8A33F9C11A8
            Malicious:false
            Preview:{"analyticsData":{"responseGUID":"99b7b082-717d-4c03-8c43-c8f4dfbde2a4","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714247735796,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"79887_247329ActionBlock_0","campaignId":79887,"containerId":"1","controlGroupId":"","treatmentId":"acc56846-d570-4500-a26e-7f8cf2b4acad","variationId":"247329"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJUcnkgQWNyb2JhdCBQcm8ifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNSIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTMiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIDctZGF5IHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0byBwcmVtaXVtIFBERiBhbmQgZS1zaWduaW5nIHRvb2xzLiIsImJ

            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:JSON data
            Category:dropped
            Size (bytes):289
            Entropy (8bit):5.282248768571157
            Encrypted:false
            SSDEEP:6:YEQXJ2HXW5SUPx+FIbRI6XVW7+0Y/rCRoAvJfYdPeUkwRe9:YvXKX8SUPUYpW7MCuGg8Ukee9
            MD5:8F955EE5B7247004D86F21F116E11720
            SHA1:723A78989BB4B0BA292A9E4210B2AEC0586B24ED
            SHA-256:1B0F4305CAC3E9D484ECE13D71986AEB21F9A474571DBB58361A7D9EC6B38D0C
            SHA-512:382D0A390F51E9D9154F7B558043B174D4367116357FCA0FEC1CC271BEB6ECEBC5FF75C5AD718AB98B7864A9BDE98993C3AA2BB8164E7B60785DCE03BEB2F55A
            Malicious:false
            Preview:{"analyticsData":{"responseGUID":"99b7b082-717d-4c03-8c43-c8f4dfbde2a4","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714247735796,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:JSON data
            Category:dropped
            Size (bytes):1395
            Entropy (8bit):5.775595550534218
            Encrypted:false
            SSDEEP:24:Yv6X8LiprLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNE01:Yv+pHgDv3W2aYQfgB5OUupHrQ9FJR
            MD5:9804D20D0A867D377244B0FDC35A070E
            SHA1:5C7FBD5C434E1C8CDD38A00B53F12B3021617213
            SHA-256:412A24C960645A02830DF092D29764D267D95ED127F8CFEE8EE12ADC36C2B3C2
            SHA-512:5D6687F313559F098A6413C4EBE45F4B93A19CF768EC73ADD66C408BBEC7C8886030252F4757189948CD935946E04CD33A004AFC24D410543CA2E0638891EF12
            Malicious:false
            Preview:{"analyticsData":{"responseGUID":"99b7b082-717d-4c03-8c43-c8f4dfbde2a4","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714247735796,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:JSON data
            Category:dropped
            Size (bytes):291
            Entropy (8bit):5.265917867835597
            Encrypted:false
            SSDEEP:6:YEQXJ2HXW5SUPx+FIbRI6XVW7+0Y/rCRoAvJfbPtdPeUkwRe9:YvXKX8SUPUYpW7MCuGDV8Ukee9
            MD5:20E1CCAD680C9019DFE06345E4FFEF9A
            SHA1:37ED4AA1A6E4975921E14A970041AE3184506E1A
            SHA-256:C1DAF5058825D247CB34CAC5E1AF4F8BBD9AE596C7E1BB0E82D1E005D257ADB3
            SHA-512:0A91B63A59A985567A6C711F56A16432EC3E4213B663D04AB3A6FDF662D6DE21E1A34F213950A6E319405C87EFD7304DAFBB8BC5F08B0DDE80967917CEE61F31
            Malicious:false
            Preview:{"analyticsData":{"responseGUID":"99b7b082-717d-4c03-8c43-c8f4dfbde2a4","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714247735796,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:JSON data
            Category:dropped
            Size (bytes):287
            Entropy (8bit):5.267031002956108
            Encrypted:false
            SSDEEP:6:YEQXJ2HXW5SUPx+FIbRI6XVW7+0Y/rCRoAvJf21rPeUkwRe9:YvXKX8SUPUYpW7MCuG+16Ukee9
            MD5:EEE8CDE3D946709C6AA8DAC9AF55F1D9
            SHA1:0104E07B367E3582DBF92AFD85F7DDAADA6484C7
            SHA-256:BC92E52FDACFC94DE928448F28955696486E690CCBFEE621FB8A070560B3A88D
            SHA-512:C3EF5A48DE18444F94615C538EDCC2C7F5081929AE7071113C9D018146CA481CDFBFCD1DF05557C440BF081D97F0E88C716A1A6C274E01E412BA496C0C4CE897
            Malicious:false
            Preview:{"analyticsData":{"responseGUID":"99b7b082-717d-4c03-8c43-c8f4dfbde2a4","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714247735796,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:JSON data
            Category:dropped
            Size (bytes):289
            Entropy (8bit):5.288790079255083
            Encrypted:false
            SSDEEP:6:YEQXJ2HXW5SUPx+FIbRI6XVW7+0Y/rCRoAvJfbpatdPeUkwRe9:YvXKX8SUPUYpW7MCuGVat8Ukee9
            MD5:705623FC0224DF6F46DDC74FF254695B
            SHA1:554936837B3011918352770123099F190BF30DEE
            SHA-256:804ABDFF937CE9946C41B9E65F194DB864A04D272E5F5AE62AA59F547662B392
            SHA-512:94091AA98B86DE0ABF3AE411F8A9F9C194803F6FC7239AFAE8EA82CECCD52C399EB42E64B1E8915B8ECFED54D054FD959E3F1FECBDF0D844259AAFDC00175512
            Malicious:false
            Preview:{"analyticsData":{"responseGUID":"99b7b082-717d-4c03-8c43-c8f4dfbde2a4","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714247735796,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:JSON data
            Category:dropped
            Size (bytes):286
            Entropy (8bit):5.240756535261598
            Encrypted:false
            SSDEEP:6:YEQXJ2HXW5SUPx+FIbRI6XVW7+0Y/rCRoAvJfshHHrPeUkwRe9:YvXKX8SUPUYpW7MCuGUUUkee9
            MD5:79544C42521B6C9F89D86EDFCCA0295E
            SHA1:8C76D005F312D08BCF987557D3EA57C3E7DC0271
            SHA-256:504E4FE8CDDB6AA78AFCF5129FDE85C5C7F5564116E5C1C1820CBBB2DCB230F4
            SHA-512:E52874A4501D61BC414CD66A00B412B68916FC677B06DBEC3D3F5DE4F60D167A7D6B55CF1FC0627E204155291C8EC142AF219A423D1511C3E7D8ADB30775B71A
            Malicious:false
            Preview:{"analyticsData":{"responseGUID":"99b7b082-717d-4c03-8c43-c8f4dfbde2a4","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714247735796,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:JSON data
            Category:dropped
            Size (bytes):782
            Entropy (8bit):5.366157314080212
            Encrypted:false
            SSDEEP:12:YvXKX8SUPUYpW7MCuGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWYV01:Yv6X8LiI168CgEXX5kcIfANhT01
            MD5:DB19C57D10CF8AE62FCAF0DBA89A360A
            SHA1:3F8E070D2C79B195CC81C8EAEFC77E11146ABCA9
            SHA-256:E010ECDFD999F36D377BECF799FE593781FBE4211FF2AD2C221A73B68B303099
            SHA-512:39701F97B7FC362D2A21F45A4451F86A357DD4166F55DBCFCEF47FED41D0BF405A417E16A4DCB20ACC4C769536B7CAFD68B2FE739A2D31D18E1F6C0F4C34A3DB
            Malicious:false
            Preview:{"analyticsData":{"responseGUID":"99b7b082-717d-4c03-8c43-c8f4dfbde2a4","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714247735796,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1714068305825}}}}

            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:data
            Category:dropped
            Size (bytes):4
            Entropy (8bit):0.8112781244591328
            Encrypted:false
            SSDEEP:3:e:e
            MD5:DC84B0D741E5BEAE8070013ADDCC8C28
            SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
            SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
            SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
            Malicious:false
            Preview:....

            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:JSON data
            Category:dropped
            Size (bytes):2814
            Entropy (8bit):5.13883554286607
            Encrypted:false
            SSDEEP:48:YBV6RefsaSjg6dLfIxAQWomRlQEMBn9jo:MP/SM6dTAAQyRlhMX8
            MD5:2CAD0E0D5BA37FD6257B7554D103D2EC
            SHA1:4787E97F6F95FBBD1B213D9F2BF1D049915D13CA
            SHA-256:F18C620A71331F627E34BFE8DA49904DA33085BDE6633335590E35EB3BED668C
            SHA-512:78B9E57A5DA4587DB5429B66B3E0C50F41A539D9F683908624989E7FF423F0AFD93743DE66FDC3F3187C65D9EBA8CEBD17BFD9C21E7973C2A3B9282B9B30906B
            Malicious:false
            Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e4d651f7f0e60512c5142b200b8920c5","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1714068305000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"8c1b1dd7c63c21ed252eb8798285fb9d","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1372,"ts":1714068305000},{"id":"Edit_InApp_Aug2020","info":{"dg":"680a9cb87c942bf88cdf09a119c97336","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1714068305000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"4557243c33465b13380f0d74323873e6","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1714068305000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"747bddc08fb8ea174e1b5622a8758b2e","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1714068305000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"ad7682d610c18e348eed9833dc70cbbc","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1714068305000},

            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
            Category:dropped
            Size (bytes):12288
            Entropy (8bit):0.9836269328810748
            Encrypted:false
            SSDEEP:24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpJKP4zJwtNBwtNbRZ6bRZ4OKPF:TVl2GL7ms6ggOVpAAzutYtp6P2d
            MD5:B2D4C781F3D4FE6BE1E8F23836035AD3
            SHA1:7A13E08981BCE8E3C2EC294E23BE37920E44A9CF
            SHA-256:ACA836959869496E10DF10D407337A7D6124B11892285A2A33B3E22F7A49EA17
            SHA-512:9D8F7B433B6E18DE2E3CE1BB88DF94F34EF50E0C876DB160C54D668E0B836977365019E6AB7A6940B9E64C40025352E0496B1A2B4F4C1043922F3CFE6FEFFDC6
            Malicious:false
            Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:SQLite Rollback Journal
            Category:dropped
            Size (bytes):8720
            Entropy (8bit):1.3378973289746885
            Encrypted:false
            SSDEEP:24:7+t5vAD1RZKHs/Ds/SpJKPPzJwtNBwtNbRZ6bRZWf1RZKdqLBx/XYKQvGJF7urs8:7MNGgOVpAnzutYtp6PMgqll2GL7ms8
            MD5:BAA20ABE8805D49FF1113B62D4155143
            SHA1:7A3BBD59291CA0C6C765164C0BC02E94FAD457B7
            SHA-256:F3B079E4364C500CA537A64F506D0F07C92437DDE4CC2315D1330A65D83078AC
            SHA-512:295AC9C93EB0BE9153672E385DA5E5189110D00C225D94AD59AE2D6A5227E4EDDD0F31FD30DFC35003C46D1A161E193320F528D4D5982C4138DEE715B38C47A8
            Malicious:false
            Preview:.... .c......&&;......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

            C:\Users\user\AppData\Local\Temp\MSIeb975.LOG

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
            Category:dropped
            Size (bytes):246
            Entropy (8bit):3.5046637269111454
            Encrypted:false
            SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8+WlNPWl:Qw946cPbiOxDlbYnuRK8el
            MD5:1459D8805F044A3977F2A7E6749FCD20
            SHA1:221A4D64E232932A4FA17D5B9FCA1FD00C969022
            SHA-256:2EB4A9B92D8BF44C30B5A785FC6EC86F07BE789DF9BA8B4B51D50A4264DC9112
            SHA-512:7394538246ADD8338CF30FDDE8C0B0B4DBE0CCCF93973E415205BB263CDFF751BD7988556450E35DA9A20608B7263DAEA3C53AF875085C36DCF37100F833000F
            Malicious:false
            Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.5./.0.4./.2.0.2.4. . .2.0.:.0.5.:.0.7. .=.=.=.....

            C:\Users\user\AppData\Local\Temp\acrobat_sbx\A919h0cks_en93uu_54g.tmp

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:data
            Category:dropped
            Size (bytes):3910912
            Entropy (8bit):1.760316161828955
            Encrypted:false
            SSDEEP:3072:W6AqcptqP2yiDQcdda1MG/P5P6l3EqE9AF5Tnin8jegKYCu7l1VxGl7PtwQSReb4:ESJ5ec9KTASetcJ36lBebXRHlys
            MD5:9AA606E670AFE0344747962B1181E7B3
            SHA1:07B5B639EFF3FC1ED3ABBFDD41F7542463DC9470
            SHA-256:6F4918B2F64CD30E84259BACDC4F90D27F24481B9FF6CEB34745CEA557E53BF4
            SHA-512:FF6EDF8A454D72BC39DAFC8357C471BB3CC0D05DE6507E977146F4848A68938CBA7BE42A4AC3FACBE2148D7368EBC7A3384EB4D2FCA1B68E2A6EFE510919EF55
            Malicious:false
            Preview:....................................................................................................................................................................................en..........................................................................................................5...................Jainy Dave..................................................................................................5...................D:20240416113257+05'30'.....................................................................................5...........V...R......M.i.c.r.o.s.o.f.t... .P.o.w.e.r.P.o.i.n.t... .f.o.r. .M.i.c.r.o.s.o.f.t. .3.6.5..........................................................................................................................................................5...........V...R......M.i.c.r.o.s.o.f.t... .P.o.w.e.r.P.o.i.n.t... .f.o.r. .M.i.c.r.o.s.o.f.t. .3.6.5..................................................................................................

            C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9elqs2j_en93v1_54g.tmp

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:PDF document, version 1.6, 0 pages
            Category:dropped
            Size (bytes):358
            Entropy (8bit):5.076608541208585
            Encrypted:false
            SSDEEP:6:IngVMrexJzJT0y9VEQIFVmb/eu2g/86S1kxROOv6GRDleGRDluCSyAAO:IngVMre9T0HQIDmy9g06JXXDulX
            MD5:121E254F71C38E2071853F6730B07E83
            SHA1:69BFBCD8E5515AE1C5D7E77E1D6036B1E5EF52D5
            SHA-256:E5145F8B44D78339C96EB756F92F51D43FEBF7FCBAF3254217AFF9AA9C030AEC
            SHA-512:950167555F0627E276A9634C0446F250BCA6642AB0B542E5A193C5AB1BE48245B09F055063D6338A49B97E903E413536DA629B18C7EBFE109E0ABE192ABA27B4
            Malicious:false
            Preview:%PDF-1.6.%......1 0 obj.<</Pages 2 0 R/Type/Catalog>>.endobj.2 0 obj.<</Count 0/Kids[]/Type/Pages>>.endobj.3 0 obj.<<>>.endobj.xref..0 4..0000000000 65535 f..0000000016 00000 n..0000000061 00000 n..0000000107 00000 n..trailer..<</Size 4/Root 1 0 R/Info 3 0 R/ID[<672FE199A5FB3649B47834F338F0172A><672FE199A5FB3649B47834F338F0172A>]>>..startxref..127..%%EOF..

            C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-25 20-05-02-382.log

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:ASCII text, with very long lines (393)
            Category:dropped
            Size (bytes):16525
            Entropy (8bit):5.376360055978702
            Encrypted:false
            SSDEEP:384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
            MD5:1336667A75083BF81E2632FABAA88B67
            SHA1:46E40800B27D95DAED0DBB830E0D0BA85C031D40
            SHA-256:F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
            SHA-512:D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
            Malicious:false
            Preview:SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

            C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:ASCII text, with very long lines (393), with CRLF line terminators
            Category:dropped
            Size (bytes):16603
            Entropy (8bit):5.322750854110725
            Encrypted:false
            SSDEEP:384:7C2T22qP2N9Q2QAB/RDh8NlqlkPG8ErwfbZnf59EJagOVwn+LAc+3+riAiDWBR5C:JZX
            MD5:23B12D34A917AF07F4FFC15480293AE5
            SHA1:AB543291F5B3E7B917D52AEDA66E6C80F1E11AE3
            SHA-256:0BFA5CC6842A2E27A76FF5ACC507A48789B0F470DA8BC07DFFDE6EEAD59757DC
            SHA-512:DEBEF7E26AA1A8CF9AA211997009BCF21A51061962A4231365E29C62040D0ABEC897F6B101B0272E282E58AAD20954AE11D9BF418C8FB7DDB6DFF65CA2337834
            Malicious:false
            Preview:SessionID=22dee6e3-724a-406d-b534-15f038af2181.1714068302485 Timestamp=2024-04-25T20:05:02:485+0200 ThreadID=4616 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=22dee6e3-724a-406d-b534-15f038af2181.1714068302485 Timestamp=2024-04-25T20:05:02:486+0200 ThreadID=4616 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=22dee6e3-724a-406d-b534-15f038af2181.1714068302485 Timestamp=2024-04-25T20:05:02:486+0200 ThreadID=4616 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=22dee6e3-724a-406d-b534-15f038af2181.1714068302485 Timestamp=2024-04-25T20:05:02:486+0200 ThreadID=4616 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=22dee6e3-724a-406d-b534-15f038af2181.1714068302485 Timestamp=2024-04-25T20:05:02:486+0200 ThreadID=4616 Component=ngl-lib_NglAppLib Description="SetConf

            C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            File Type:ASCII text, with CRLF line terminators
            Category:dropped
            Size (bytes):29845
            Entropy (8bit):5.3876338753198425
            Encrypted:false
            SSDEEP:768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbN:irg
            MD5:31934BB00B8AD0023C760B3A30CC867E
            SHA1:D21477775784661905A0919EFFD9366C48CDA742
            SHA-256:D58163CA5332FDD31E5CFD26FC7C5F4B2FA15359E4B1797E69E8616AD8F329C7
            SHA-512:768E322ED9E352CF2A1707860EF893113A3ECFFF60A4210A09F90E1139AF6B6531AF56AEA32B2C1F63CE105A3011E93BD8D45FEF1F824AF9AF5354506CD2C01C
            Malicious:false
            Preview:04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

            C:\Users\user\AppData\Local\Temp\acrocef_low\6c9789ee-24d0-4545-8a26-dd1155140891.tmp

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
            File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
            Category:dropped
            Size (bytes):1419751
            Entropy (8bit):7.976496077007677
            Encrypted:false
            SSDEEP:24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
            MD5:18E3D04537AF72FDBEB3760B2D10C80E
            SHA1:B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
            SHA-256:BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
            SHA-512:2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
            Malicious:false
            Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

            C:\Users\user\AppData\Local\Temp\acrocef_low\853d4b8e-c721-4de5-a920-1f2100034927.tmp

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
            File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
            Category:dropped
            Size (bytes):386528
            Entropy (8bit):7.9736851559892425
            Encrypted:false
            SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
            MD5:5C48B0AD2FEF800949466AE872E1F1E2
            SHA1:337D617AE142815EDDACB48484628C1F16692A2F
            SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
            SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
            Malicious:false
            Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

            C:\Users\user\AppData\Local\Temp\acrocef_low\aa958ec5-3988-4fa6-8527-d210dab67988.tmp

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
            File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
            Category:dropped
            Size (bytes):1407294
            Entropy (8bit):7.97605879016224
            Encrypted:false
            SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
            MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
            SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
            SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
            SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
            Malicious:false
            Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

            C:\Users\user\AppData\Local\Temp\acrocef_low\ed1599cc-5dd9-4718-b5c6-1639667deda5.tmp

            Download File
            Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
            File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
            Category:dropped
            Size (bytes):758601
            Entropy (8bit):7.98639316555857
            Encrypted:false
            SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
            MD5:3A49135134665364308390AC398006F1
            SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
            SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
            SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
            Malicious:false
            Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

            Static File Info

            General

            File type:PDF document, version 1.7, 11 pages
            Entropy (8bit):7.423150438633679
            TrID:
            • Adobe Portable Document Format (5005/1) 100.00%
            File name:Alchemy_Quarterly_Newsletter-April__24.pdf
            File size:698'166 bytes
            MD5:9f7d4b9dfd805cf2c811535cd750d86c
            SHA1:7c7d74d23e42c47df705c560e232a1201ba276ca
            SHA256:1917bc9d6591663e5eb22710cfe9d97ab9eab4e1c650f401a6e9082c4a248d4e
            SHA512:20ce011cb587bd7ea1b109a6672870f8fbe0cf312daedfc76b00645e777fea4bf0fbb5ab375d9da31ae6784dcafedf3cd8782fdffff9efd15ad7e0c7c51e6ae1
            SSDEEP:12288:apf1mPO3OeMSBJFayrCrK0RO/Y9xpcStvbVnzMb/p:a5v3OeMSBL2foY9HtDd4bB
            TLSH:94E4E2A0899D3DEFC79A13D01B6F3D6E706E7132F2C82B096328D7411268A7B664754F
            File Content Preview:%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en) /StructTreeRoot 66 0 R/Outlines 54 0 R/MarkInfo<</Marked true>>/Metadata 8595 0 R/ViewerPreferences 8596 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 11/Kids[ 3 0 R 25 0 R 32 0 R 34 0 R 36 0 R

            File Icon

            Icon Hash:62cc8caeb29e8ae0

            Static PDF Info

            General

            Header:%PDF-1.7
            Total Entropy:7.423150
            Total Bytes:698166
            Stream Entropy:7.993776
            Stream Bytes:510491
            Entropy outside Streams:3.570767
            Bytes outside Streams:187675
            Number of EOF found:2
            Bytes after EOF:

            Keywords Statistics

            NameCount
            obj99
            endobj99
            stream40
            endstream40
            xref2
            trailer2
            startxref2
            /Page11
            /Encrypt0
            /ObjStm17
            /URI4
            /JS0
            /JavaScript0
            /AA0
            /OpenAction0
            /AcroForm0
            /JBIG2Decode0
            /RichMedia0
            /Launch0
            /EmbeddedFile0

            Image Streams

            IDDHASHMD5Preview
            60030b0c4c8581000298a3725030f24806563c2eed69b1ec2
            70030f0cce8f0100076b91b26247838cf23d9d13530b3de91
            804140c2c2c0c06004f827f78ace2c6bee4c6fc222ad9403d
            914140cac0cac969236b53b6e7497afe7401bc10c2c498852

            Network Behavior

            Network Port Distribution

            TCP Packets

            TimestampSource PortDest PortSource IPDest IP
            Apr 25, 2024 20:05:12.878005028 CEST49715443192.168.2.5184.31.48.185
            Apr 25, 2024 20:05:12.878051043 CEST44349715184.31.48.185192.168.2.5
            Apr 25, 2024 20:05:12.878146887 CEST49715443192.168.2.5184.31.48.185
            Apr 25, 2024 20:05:12.878302097 CEST49715443192.168.2.5184.31.48.185
            Apr 25, 2024 20:05:12.878314972 CEST44349715184.31.48.185192.168.2.5
            Apr 25, 2024 20:05:13.222239971 CEST44349715184.31.48.185192.168.2.5
            Apr 25, 2024 20:05:13.222721100 CEST49715443192.168.2.5184.31.48.185
            Apr 25, 2024 20:05:13.222764969 CEST44349715184.31.48.185192.168.2.5
            Apr 25, 2024 20:05:13.223793030 CEST44349715184.31.48.185192.168.2.5
            Apr 25, 2024 20:05:13.223865032 CEST49715443192.168.2.5184.31.48.185
            Apr 25, 2024 20:05:13.225891113 CEST49715443192.168.2.5184.31.48.185
            Apr 25, 2024 20:05:13.225971937 CEST44349715184.31.48.185192.168.2.5
            Apr 25, 2024 20:05:13.226238012 CEST49715443192.168.2.5184.31.48.185
            Apr 25, 2024 20:05:13.226254940 CEST44349715184.31.48.185192.168.2.5
            Apr 25, 2024 20:05:13.276484013 CEST49715443192.168.2.5184.31.48.185
            Apr 25, 2024 20:05:13.336313963 CEST44349715184.31.48.185192.168.2.5
            Apr 25, 2024 20:05:13.336378098 CEST44349715184.31.48.185192.168.2.5
            Apr 25, 2024 20:05:13.336987019 CEST49715443192.168.2.5184.31.48.185
            Apr 25, 2024 20:05:13.337028980 CEST44349715184.31.48.185192.168.2.5
            Apr 25, 2024 20:05:13.337063074 CEST49715443192.168.2.5184.31.48.185
            Apr 25, 2024 20:05:13.338746071 CEST49715443192.168.2.5184.31.48.185

            HTTP Request Dependency Graph

            • armmf.adobe.com

            HTTPS Proxied Packets

            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
            0192.168.2.549715184.31.48.1854437296C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
            TimestampBytes transferredDirectionData
            2024-04-25 18:05:13 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
            Host: armmf.adobe.com
            Connection: keep-alive
            Accept-Language: en-US,en;q=0.9
            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
            Sec-Fetch-Site: same-origin
            Sec-Fetch-Mode: no-cors
            Sec-Fetch-Dest: empty
            Accept-Encoding: gzip, deflate, br
            If-None-Match: "78-5faa31cce96da"
            If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
            2024-04-25 18:05:13 UTC198INHTTP/1.1 304 Not Modified
            Content-Type: text/plain; charset=UTF-8
            Last-Modified: Mon, 01 May 2023 15:02:33 GMT
            ETag: "78-5faa31cce96da"
            Date: Thu, 25 Apr 2024 18:05:13 GMT
            Connection: close


            Statistics

            CPU Usage

            Click to jump to process

            Memory Usage

            Click to jump to process

            High Level Behavior Distribution

            Click to dive into process behavior distribution

            Behavior

            Click to jump to process

            System Behavior

            General

            Target ID:0
            Start time:20:04:59
            Start date:25/04/2024
            Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
            Wow64 process (32bit):false
            Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Alchemy_Quarterly_Newsletter-April__24.pdf"
            Imagebase:0x7ff686a00000
            File size:5'641'176 bytes
            MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:moderate
            Has exited:true

            General

            Target ID:2
            Start time:20:04:59
            Start date:25/04/2024
            Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
            Wow64 process (32bit):false
            Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
            Imagebase:0x7ff6413e0000
            File size:3'581'912 bytes
            MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:moderate
            Has exited:true

            General

            Target ID:4
            Start time:20:05:00
            Start date:25/04/2024
            Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
            Wow64 process (32bit):false
            Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1628,i,8684521670987530744,9423196504567068144,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
            Imagebase:0x7ff6413e0000
            File size:3'581'912 bytes
            MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:moderate
            Has exited:true

            Disassembly

            ⊘No disassembly