Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Document 35405 (2).pdf

Overview

General Information

Sample name:Document 35405 (2).pdf
Analysis ID:1419159
MD5:4ff9fae10d7736c3572aa9e790956a1f
SHA1:38b58154a27f443d3ee999e492ab25bd5cb3d5f2
SHA256:366cf33daf5f3807960a5c3120a793385a038b40483c593c8f3e971879b01c20
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 7464 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Document 35405 (2).pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 7636 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 7844 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1520,i,339784488602095305,13813244706349730919,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.94.108.142:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.94.108.142:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.94.108.142:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.94.108.142:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.94.108.142:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.94.108.142:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.94.108.142:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.94.108.142:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.94.108.142:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.94.108.142:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.94.108.142:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.94.108.142:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.94.108.142:443
Source: global trafficTCP traffic: 104.94.108.142:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.94.108.142:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.94.108.142:443
Source: global trafficTCP traffic: 104.94.108.142:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 104.94.108.142:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.94.108.142:443
Source: global trafficTCP traffic: 104.94.108.142:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 104.94.108.142:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.94.108.142:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.94.108.142:443
Source: global trafficTCP traffic: 104.94.108.142:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.94.108.142:443
Source: global trafficTCP traffic: 104.94.108.142:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.94.108.142:443
Source: global trafficTCP traffic: 104.94.108.142:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 104.94.108.142:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.94.108.142:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.94.108.142:443
Source: global trafficTCP traffic: 104.94.108.142:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.94.108.142:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 104.94.108.142:443
Source: Joe Sandbox ViewIP Address: 104.94.108.142 104.94.108.142
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknownTCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknownTCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknownTCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknownTCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknownTCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknownTCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknownTCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknownTCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknownTCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknownTCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknownTCP traffic detected without corresponding DNS query: 104.94.108.142
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: classification engineClassification label: clean2.winPDF@14/44@0/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journalJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-03 08-01-39-145.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Document 35405 (2).pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1520,i,339784488602095305,13813244706349730919,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1520,i,339784488602095305,13813244706349730919,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: Document 35405 (2).pdfInitial sample: PDF keyword /JS count = 0
Source: Document 35405 (2).pdfInitial sample: PDF keyword /JavaScript count = 0
Source: A9qavzco_9othzo_5to.tmp.0.drInitial sample: PDF keyword /JS count = 0
Source: A9qavzco_9othzo_5to.tmp.0.drInitial sample: PDF keyword /JavaScript count = 0
Source: Document 35405 (2).pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: Document 35405 (2).pdfInitial sample: PDF keyword obj count = 60
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive12
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1419159 Sample: Document 35405 (2).pdf Startdate: 03/04/2024 Architecture: WINDOWS Score: 2 6 Acrobat.exe 18 73 2->6         started        process3 8 AcroCEF.exe 105 6->8         started        process4 10 AcroCEF.exe 2 8->10         started        dnsIp5 13 104.94.108.142, 443, 49740 AKAMAI-ASUS United States 10->13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Document 35405 (2).pdf0%ReversingLabs
Document 35405 (2).pdf0%VirustotalBrowse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
104.94.108.142
unknownUnited States
16625AKAMAI-ASUSfalse

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1419159
Start date and time:2024-04-03 08:00:51 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 3m 49s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultwindowspdfcookbook.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:10
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:Document 35405 (2).pdf
Detection:CLEAN
Classification:clean2.winPDF@14/44@0/1
EGA Information:Failed
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 0
  • Number of non-executed functions: 0
Cookbook Comments:
  • Found application associated with file extension: .pdf
  • Found PDF document
  • Close Viewer

Warnings

  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 23.204.76.141, 34.237.241.83, 50.16.47.176, 18.213.11.84, 54.224.241.105, 23.219.155.165, 23.219.155.148, 162.159.61.3, 172.64.41.3, 23.61.251.103, 23.61.251.67
  • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com
  • Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
104.94.108.142RFd2zutX8H.exeGet hashmaliciousUnknownBrowse
    Benefits Open Enrollment 2024 #U007e Closes on Friday For CarbolineGet hashmaliciousHTMLPhisherBrowse
      Invoices.xlsGet hashmaliciousUnknownBrowse
        Orden_T7405.xla.xlsxGet hashmaliciousUnknownBrowse
          IF-07b_SIGS-EN-ICS-IC-002_SMC-SCU ICD_v31_19-03-2014.pdf.exeGet hashmaliciousUnknownBrowse
            btui2YGkc5.exeGet hashmaliciousNetSupport RATBrowse
              btui2YGkc5.exeGet hashmaliciousNetSupport RATBrowse
                swift_copy.xlsGet hashmaliciousUnknownBrowse
                  kSWf9QrxMR.exeGet hashmaliciousScreenConnect ToolBrowse
                    Iu4a4i5N15.exeGet hashmaliciousUnknownBrowse

                      Domains

                      ⊘No context

                      ASNs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      AKAMAI-ASUShttps://castorndpollux.com/R9283762154.zipGet hashmaliciousXWormBrowse
                      • 23.202.106.101
                      file.exeGet hashmaliciousVidarBrowse
                      • 23.61.62.148
                      https://www.aihr.com/blog/execution-excellence-impact/Get hashmaliciousUnknownBrowse
                      • 23.39.130.103
                      https://flow.page/sync1systems.com&d=DwMGaQGet hashmaliciousUnknownBrowse
                      • 23.221.212.203
                      file.exeGet hashmaliciousVidarBrowse
                      • 23.194.234.100
                      https://microsoftonlineservice.com.general-meel.xyz/w?cms=mr.been@uk.comGet hashmaliciousHTMLPhisherBrowse
                      • 184.26.74.213
                      SecuriteInfo.com.Win32.PWSX-gen.28191.20359.exeGet hashmaliciousVidarBrowse
                      • 23.194.234.100
                      https://dbdhdhd.weeblysite.com/Get hashmaliciousUnknownBrowse
                      • 23.215.0.171
                      https://mailsupport884747474.weeblysite.com/Get hashmaliciousUnknownBrowse
                      • 23.40.179.76
                      file.exeGet hashmaliciousVidarBrowse
                      • 104.105.90.131

                      JA3 Fingerprints

                      ⊘No context

                      Dropped Files

                      ⊘No context

                      Created / dropped Files

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.170153303581807
                      Encrypted:false
                      SSDEEP:6:7VB4e4q2Pwkn2nKuAl9OmbnIFUt8sVB4EYnJZmw+sVB4EYnDkwOwkn2nKuAl9Omt:RB4e4vYfHAahFUt80B4jnJ/+0B4jnD50
                      MD5:1145DF7A1697FB4E7117543DFE306913
                      SHA1:B5F3E4275DD68ECE1168ABA566D26F356CB1ED8B
                      SHA-256:9FFA1FB0CEE951702AD937E823987AC8264B545840CADAB3E7725626D5F62B9D
                      SHA-512:7FF153B45B05EE4624AFA988E0F2EF97E31F9285A8FF6C35DD6EF04B37C5019874E468F7270D0008BB947A14C5C7FCAE27076F211A17B41373EBB9996E3B3492
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/03-08:01:37.037 1df4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/03-08:01:37.038 1df4 Recovering log #3.2024/04/03-08:01:37.038 1df4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.170153303581807
                      Encrypted:false
                      SSDEEP:6:7VB4e4q2Pwkn2nKuAl9OmbnIFUt8sVB4EYnJZmw+sVB4EYnDkwOwkn2nKuAl9Omt:RB4e4vYfHAahFUt80B4jnJ/+0B4jnD50
                      MD5:1145DF7A1697FB4E7117543DFE306913
                      SHA1:B5F3E4275DD68ECE1168ABA566D26F356CB1ED8B
                      SHA-256:9FFA1FB0CEE951702AD937E823987AC8264B545840CADAB3E7725626D5F62B9D
                      SHA-512:7FF153B45B05EE4624AFA988E0F2EF97E31F9285A8FF6C35DD6EF04B37C5019874E468F7270D0008BB947A14C5C7FCAE27076F211A17B41373EBB9996E3B3492
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/03-08:01:37.037 1df4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/03-08:01:37.038 1df4 Recovering log #3.2024/04/03-08:01:37.038 1df4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):336
                      Entropy (8bit):5.098254488410645
                      Encrypted:false
                      SSDEEP:6:7VB43hOq2Pwkn2nKuAl9Ombzo2jMGIFUt8sVB43YZZmw+sVB43YzkwOwkn2nKuAv:RB438vYfHAa8uFUt80B43YZ/+0B43Yzs
                      MD5:0B34927FD28622BE91B23B8A67A0FE55
                      SHA1:9A3AC2DE4E1F03CA866E75872AFF62CAE7D3350B
                      SHA-256:0BEC6C76C5720140D5331160EAC66AB23E4840B6D5F175B01838C18B639F6B0D
                      SHA-512:818B6F69736AB8E176F790EEAE6C46334B28069BACFAE650C777C39EC1B45700B123FE5D72CD6391B734D49E2A55BBAB11D8235D788A575BBACE0D1489883FD3
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/03-08:01:37.081 1ee0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/03-08:01:37.082 1ee0 Recovering log #3.2024/04/03-08:01:37.082 1ee0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):336
                      Entropy (8bit):5.098254488410645
                      Encrypted:false
                      SSDEEP:6:7VB43hOq2Pwkn2nKuAl9Ombzo2jMGIFUt8sVB43YZZmw+sVB43YzkwOwkn2nKuAv:RB438vYfHAa8uFUt80B43YZ/+0B43Yzs
                      MD5:0B34927FD28622BE91B23B8A67A0FE55
                      SHA1:9A3AC2DE4E1F03CA866E75872AFF62CAE7D3350B
                      SHA-256:0BEC6C76C5720140D5331160EAC66AB23E4840B6D5F175B01838C18B639F6B0D
                      SHA-512:818B6F69736AB8E176F790EEAE6C46334B28069BACFAE650C777C39EC1B45700B123FE5D72CD6391B734D49E2A55BBAB11D8235D788A575BBACE0D1489883FD3
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/03-08:01:37.081 1ee0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/03-08:01:37.082 1ee0 Recovering log #3.2024/04/03-08:01:37.082 1ee0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\64262265-499b-43b4-9288-6eb699ef8e29.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:modified
                      Size (bytes):475
                      Entropy (8bit):4.966983371696171
                      Encrypted:false
                      SSDEEP:12:YH/um3RA8sqZgBsBdOg2Htcaq3QYiubInP7E4T3y:Y2sRdsidMHc3QYhbG7nby
                      MD5:618FECACCE152E17D428AA2C83EE1502
                      SHA1:F97730018008ADE7859C7D1F1E399F027C1924DE
                      SHA-256:083D7A5F2EC7394534C497257848DDD87111BDEAE1997A0BEADB3840B7CB073D
                      SHA-512:E89973B5D5F25DDF3C317834A65EBD6E40AB6F924D0B794DC3C25C4518632F358A81C8FDC918CDDAD1307BB4783B459B1FB1A42793282FD6DDD9D06D82F87F34
                      Malicious:false
                      Reputation:low
                      Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13356684108928220","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125995},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):475
                      Entropy (8bit):4.966983371696171
                      Encrypted:false
                      SSDEEP:12:YH/um3RA8sqZgBsBdOg2Htcaq3QYiubInP7E4T3y:Y2sRdsidMHc3QYhbG7nby
                      MD5:618FECACCE152E17D428AA2C83EE1502
                      SHA1:F97730018008ADE7859C7D1F1E399F027C1924DE
                      SHA-256:083D7A5F2EC7394534C497257848DDD87111BDEAE1997A0BEADB3840B7CB073D
                      SHA-512:E89973B5D5F25DDF3C317834A65EBD6E40AB6F924D0B794DC3C25C4518632F358A81C8FDC918CDDAD1307BB4783B459B1FB1A42793282FD6DDD9D06D82F87F34
                      Malicious:false
                      Reputation:low
                      Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13356684108928220","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125995},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):4730
                      Entropy (8bit):5.2555312992368215
                      Encrypted:false
                      SSDEEP:96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7dfl7Z:etJCV4FiN/jTN/2r8Mta02fEhgO73goV
                      MD5:2E1A2338C470389A9B5E79236E71043B
                      SHA1:3635EADBCD548F415F233474FC12F4DEC824D2A4
                      SHA-256:A9F2ED4A144E7A27FB822B715E6079CE2FC5A60D4C784DCEC3562ED613C27155
                      SHA-512:E158B8DD4ED710D2C6B11FCCC2AD14F2735ECBB8E9941EAAE9ADD10D3BACADC595E0A7083CF92D6A8F42943B33CCDBC54EAE7E77AD2A14F820007C794554AA26
                      Malicious:false
                      Reputation:low
                      Preview:*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):324
                      Entropy (8bit):5.134201527511092
                      Encrypted:false
                      SSDEEP:6:7VB4aPhq2Pwkn2nKuAl9OmbzNMxIFUt8sVB4CPZmw+sVB4S+VFkwOwkn2nKuAl9c:RB4ivYfHAa8jFUt80B4CP/+0B4l75Jfv
                      MD5:A8F438DFE9FE5416D123FDA4FBC9DF46
                      SHA1:A1CF231465FBCBA2F78144A75FD776EFFB8629C0
                      SHA-256:7B7B6CF9DDEBDA17EF7E64890AF9339CA91444CC8E15C10EE4BAF45D4ED43F4B
                      SHA-512:4CBFEE7B23EA6471156638DCD859D3F6F2EDD0B5035B69A603E672DB4B7F9E272B544252A82B694F2C8A1E5164EA44A7F812FF7C240E7F444D9C996CBF5E02C9
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/03-08:01:37.348 1ee0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/03-08:01:37.349 1ee0 Recovering log #3.2024/04/03-08:01:37.353 1ee0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):324
                      Entropy (8bit):5.134201527511092
                      Encrypted:false
                      SSDEEP:6:7VB4aPhq2Pwkn2nKuAl9OmbzNMxIFUt8sVB4CPZmw+sVB4S+VFkwOwkn2nKuAl9c:RB4ivYfHAa8jFUt80B4CP/+0B4l75Jfv
                      MD5:A8F438DFE9FE5416D123FDA4FBC9DF46
                      SHA1:A1CF231465FBCBA2F78144A75FD776EFFB8629C0
                      SHA-256:7B7B6CF9DDEBDA17EF7E64890AF9339CA91444CC8E15C10EE4BAF45D4ED43F4B
                      SHA-512:4CBFEE7B23EA6471156638DCD859D3F6F2EDD0B5035B69A603E672DB4B7F9E272B544252A82B694F2C8A1E5164EA44A7F812FF7C240E7F444D9C996CBF5E02C9
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/03-08:01:37.348 1ee0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/03-08:01:37.349 1ee0 Recovering log #3.2024/04/03-08:01:37.353 1ee0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240403060141Z-153.bmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
                      Category:dropped
                      Size (bytes):65110
                      Entropy (8bit):1.1197295883984177
                      Encrypted:false
                      SSDEEP:96:QqMzNpM/MuMvEMMM1/MMMMMiEJEMMM3Gh4M9JaW6MQnMEMmMMRMrWMMFXWMMErhG:huN2Xxge9LaI/Gf
                      MD5:033F4032395A1D74208179F7FA73E311
                      SHA1:C3B795776DE57D3D4E8C1FA1E104D3B62BB2B736
                      SHA-256:237829B14154F7621EDB8A3C747834CE4ADF007D29A5E17AD51AEB3F9A86C8B0
                      SHA-512:96E468FFABB51FCB006F12083168A7470FE078C57AA6A7C4D8E7F48576BE87DB350B658B5B647E1B625EABF7A0A3C6C957635A623E4FF2A14C686D62A5D650A3
                      Malicious:false
                      Reputation:low
                      Preview:BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
                      Category:dropped
                      Size (bytes):86016
                      Entropy (8bit):4.445143940660979
                      Encrypted:false
                      SSDEEP:384:yezci5tciBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:r7s3OazzU89UTTgUL
                      MD5:2481042FCF702265ECC072BB16973122
                      SHA1:A8855CB0CAD0FDD04333932AC179C3FEFBB3C9D5
                      SHA-256:C24438BC8E7BC7B8D69DE9C13CEB41ABC96C18AED44DFF0E63846A742F75942B
                      SHA-512:42E7EB0DD284BE0E9BDFB23F26328CA86DF6EC0CA1E17279E8D0E57B2CB65B1394359BDCC13791848F9C68D1F51CEFD3A7C5AA78DF9BEA5D565C02FA6E8F4F81
                      Malicious:false
                      Reputation:low
                      Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite Rollback Journal
                      Category:dropped
                      Size (bytes):8720
                      Entropy (8bit):3.772869055606107
                      Encrypted:false
                      SSDEEP:48:7MUp/E2ioyVoNioy9oWoy1Cwoy1jWKOioy1noy1AYoy1Wioy1hioybioyRSoy1nG:7LpjuoNF2OXKQkQwb9IVXEBodRBkJ
                      MD5:3BA111E0995FB0B3DDEF9B7387A81AF3
                      SHA1:752C31157731FCD7D97832924C1BB4902F4A36BA
                      SHA-256:882E50281F224E0014F4E327962733C0ABEFD8ADB64582641ECCEF556FE03116
                      SHA-512:55C3975D107F146EF06E96A40F727DE1D669DCE39013B455DBE121FD2643FCB6BB9F16744D17C2BB8CBF5787DE527A0845022DB4F9295E228D0A7D72B6E399D5
                      Malicious:false
                      Reputation:low
                      Preview:.... .c......(HS...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7548

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PostScript document text
                      Category:dropped
                      Size (bytes):185099
                      Entropy (8bit):5.182478651346149
                      Encrypted:false
                      SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                      MD5:94185C5850C26B3C6FC24ABC385CDA58
                      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                      Malicious:false
                      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PostScript document text
                      Category:dropped
                      Size (bytes):185099
                      Entropy (8bit):5.182478651346149
                      Encrypted:false
                      SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                      MD5:94185C5850C26B3C6FC24ABC385CDA58
                      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                      Malicious:false
                      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):243196
                      Entropy (8bit):3.3450692389394283
                      Encrypted:false
                      SSDEEP:1536:vKPCPiyzDtrh1cK3XEivK7VK/3AYvYwgqErRo+RQn:yPClJ/3AYvYwghFo+RQn
                      MD5:F5567C4FF4AB049B696D3BE0DD72A793
                      SHA1:EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916
                      SHA-256:D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
                      SHA-512:E769735991E5B1331E259608854D00CDA4F3E92285FDC500158CBD09CBCCEAD8A387F78256A43919B13EBE70C995D19242377C315B0CCBBD4F813251608C1D56
                      Malicious:false
                      Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):295
                      Entropy (8bit):5.36771586803543
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXR+AeT6QnHVoZcg1vRcR0Ypj8DoAvJM3g98kUwPeUkwRe9:YvXKXZeT6Qn2Zc0vej8sGMbLUkee9
                      MD5:8028F7B9061DBF5808929754AAD52EC8
                      SHA1:8C19640B8A751D170F60E5502F6B2B86872B593A
                      SHA-256:09A247DA80B146DB21AC186F700E9CA0C859663BD6361D1F7372CFE6A407B20B
                      SHA-512:336FD6DE3752EE894005727FE64254246310EA5E2C33EA3119A912844CCA6EF6CCD876D532EFAF1009A137D809CABEC279DA5D9EBF2EE81C9B97D53985003E3D
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"36bc4736-62e3-4361-be76-105f693a5993","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1712297112066,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.318217723834961
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXR+AeT6QnHVoZcg1vRcR0Ypj8DoAvJfBoTfXpnrPeUkwRe9:YvXKXZeT6Qn2Zc0vej8sGWTfXcUkee9
                      MD5:FA555A82BC575D5973074DC9E2629BC4
                      SHA1:B703B796ABA5FD7AB5B347354E8232BC3467FA05
                      SHA-256:0922442FA9CD212C543127F3D7B72464E4E5F95977F0CF60DFD807F060D6426D
                      SHA-512:55410A8078945D806D711AE48815C75B06E03F5F572129B2F59A5BA21FCA42B9ADA2165D13CA20BF7DCE820AFF3C69BCD0BE839927FE084500F99B87A916D367
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"36bc4736-62e3-4361-be76-105f693a5993","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1712297112066,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.297212759230037
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXR+AeT6QnHVoZcg1vRcR0Ypj8DoAvJfBD2G6UpnrPeUkwRe9:YvXKXZeT6Qn2Zc0vej8sGR22cUkee9
                      MD5:59CE9AF185F7B8EAC989346B88A3EE2B
                      SHA1:5CF2C0ACCF94A30989E3CA72C8F3330C70517EC4
                      SHA-256:34D866D5B43475E1B3BB3114380A32C37773A47CFF7F16E52DD32473600235A3
                      SHA-512:DACCF89015A288DB69BF9896BA955402817AC238E325F0993F80D79A4FDFC334B547A6F558589CBF4EA67B5E6277817E6B0EA2F1A3E3E29C477EF98ED81F6ED6
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"36bc4736-62e3-4361-be76-105f693a5993","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1712297112066,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):285
                      Entropy (8bit):5.354879092887369
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXR+AeT6QnHVoZcg1vRcR0Ypj8DoAvJfPmwrPeUkwRe9:YvXKXZeT6Qn2Zc0vej8sGH56Ukee9
                      MD5:9A922FF37C7A3451CC2661E62C780264
                      SHA1:EDD6E53F01934E246B17B6BD6917FF127C52B700
                      SHA-256:33CC0C9CD7F7EFCBF2B1BACFACA937EFA716429B87B0F2D30878B98638E88DA4
                      SHA-512:57E501CCE32EBFB2B57BCEB8A30AAC4B182F2F9A5F9069D21E533CBB26B1B1A657B5974A3E7C81A6223968CB2BCFF4CB55F5CF5137B59DD0FA40FBA26806A401
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"36bc4736-62e3-4361-be76-105f693a5993","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1712297112066,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.317205762778501
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXR+AeT6QnHVoZcg1vRcR0Ypj8DoAvJfJWCtMdPeUkwRe9:YvXKXZeT6Qn2Zc0vej8sGBS8Ukee9
                      MD5:D10BE0EB5538DC3DE90937F0B7E5D119
                      SHA1:7447E7AE97B6CD66CA90134A5A82625F4BB0700C
                      SHA-256:71DFFD5EC91741E4DFDDC9519494518042C273DB55A47027A2EB587CFDFACA3F
                      SHA-512:338D2E2A94E5793C3A899B5A76E751ECE5AC480713ADF1177BA09FCA874D95DF4F1BB0C41CE319AD459C4C8312E66843E0E25546ADDB42BAB6F9D3B718875232
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"36bc4736-62e3-4361-be76-105f693a5993","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1712297112066,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.304667025163679
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXR+AeT6QnHVoZcg1vRcR0Ypj8DoAvJf8dPeUkwRe9:YvXKXZeT6Qn2Zc0vej8sGU8Ukee9
                      MD5:51B6327CAE3DE852BADB4188CFDD7AFD
                      SHA1:357AC803E9F6A3C487043E894116003B1B936BF3
                      SHA-256:81C4E05B517296264A358858FC05CF2E0D17D40CFDA8619F0A4561AF62CB0F44
                      SHA-512:A4C253C51CDC941E87DFA0D40856493DD0BDA05DC6AABC6D51D83AE7BA02394AE2478B49E12AE03B0CB34528DF591C1175C23C2DB7FD31E8B7A100EFF409581A
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"36bc4736-62e3-4361-be76-105f693a5993","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1712297112066,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.308210714517896
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXR+AeT6QnHVoZcg1vRcR0Ypj8DoAvJfQ1rPeUkwRe9:YvXKXZeT6Qn2Zc0vej8sGY16Ukee9
                      MD5:1D39F1D1AEC0E9CA85582FB42E9F474B
                      SHA1:B3F621AAA543A86F209CE3D5A45E51643ADDB7A6
                      SHA-256:61EC65F34BDADF23B6EDD076AE6215B2464C18805E532DDC7E3FA53046D9FDFD
                      SHA-512:94EDFEAED343CC18A454A73781A819107B72DAB2F3363A99B382A53C3F825DF9322E9C5F3EEB6EFD32DB3A157883F29899F2D08292959AC5615CCF2E906E1577
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"36bc4736-62e3-4361-be76-105f693a5993","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1712297112066,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.315736583656418
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXR+AeT6QnHVoZcg1vRcR0Ypj8DoAvJfFldPeUkwRe9:YvXKXZeT6Qn2Zc0vej8sGz8Ukee9
                      MD5:349CB613BB55D9D1C47786705D50DCCE
                      SHA1:9952EE6EA3AEC746CA76770E77B52DFA9683D362
                      SHA-256:B65569B9854F1DC52CC6012FC1A50F3AD0AD8B06B3BE6ACF6400131F83E715AC
                      SHA-512:1F66184F6B65A8AFEAF80F19886669E9AFA540A713F5FE5843D728DC3797CEE78117C406EA3D701D3D87228442D3102E175245023F82B8C1B1DFF6FAF7996428
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"36bc4736-62e3-4361-be76-105f693a5993","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1712297112066,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):295
                      Entropy (8bit):5.32988921902364
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXR+AeT6QnHVoZcg1vRcR0Ypj8DoAvJfzdPeUkwRe9:YvXKXZeT6Qn2Zc0vej8sGb8Ukee9
                      MD5:5E25406511C6A78C559E6EAB5DEE5260
                      SHA1:93932A2F7E7316D70A74DA7CA267E62F35D4EF8F
                      SHA-256:A6E5CC4E5EA60F9D39C4696D38792D6FBFA8D5AA2D467877C0060CE760A74DCE
                      SHA-512:4B19E735CECFCB7D404176C9C1662075008AC867225D66B04A3790F0C218033D84147EBB481C6A962A3288670D04542A2F74F7C330A8BDDAD0AF84C82E4E31C9
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"36bc4736-62e3-4361-be76-105f693a5993","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1712297112066,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.310457668251238
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXR+AeT6QnHVoZcg1vRcR0Ypj8DoAvJfYdPeUkwRe9:YvXKXZeT6Qn2Zc0vej8sGg8Ukee9
                      MD5:AC72E549FB0128B7ED2835803C6EF599
                      SHA1:EC419737BF24B940207AA7CFFCEC5565DB50D66B
                      SHA-256:CA5DEA40E696B44D08D175278EF66F4FBA788D61D0B65A8062DC2A7F7A63BE28
                      SHA-512:C4E9C4E1E446EC1FAF1AFE03F37A4A07488A57BC67F9CA805963690E40E1258396263873561E1EA2CDE161BDBC9DF981FEB1CC7763D941CE31717D642D49E99F
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"36bc4736-62e3-4361-be76-105f693a5993","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1712297112066,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1395
                      Entropy (8bit):5.776118088090005
                      Encrypted:false
                      SSDEEP:24:Yv6XZmVn2zvejCrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJN6:YvKmwmjCHgDv3W2aYQfgB5OUupHrQ9Fy
                      MD5:4180A6033FA7B488D2604152D600F1C9
                      SHA1:1562EBD0145342B05B66CBD6787D9F8DDB35E233
                      SHA-256:E01EDCBAFFCA10A90B8CBE3501DDF3754349B6EDA9C4C647ADC3CE251417C4F9
                      SHA-512:B890820487EC4663B831F7483C58A19EE02DF2F2B98C63E4885B3E510AC6388C54252279064BD7545D1AFAE8103478776683C8AE92B91C00812493E2D830CF51
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"36bc4736-62e3-4361-be76-105f693a5993","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1712297112066,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):291
                      Entropy (8bit):5.293932891916502
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXR+AeT6QnHVoZcg1vRcR0Ypj8DoAvJfbPtdPeUkwRe9:YvXKXZeT6Qn2Zc0vej8sGDV8Ukee9
                      MD5:3438F003DAD3167C911BDDDF3333FED6
                      SHA1:276447ED25DC6A1850424DA039DE91D56DC72F71
                      SHA-256:5DC532E39119151E046D448B5C474DD4352230FD840A96A6F7F4CB4DFF89A404
                      SHA-512:76D79E0B62AA8376AAA998A03AC34FE7FEB48DB27D2676E4D0FFC813F25CEA8EF9687486FF235C3C6A8D51EE66CD52D55765E92BCD5749AB53E619C7D7F6C184
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"36bc4736-62e3-4361-be76-105f693a5993","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1712297112066,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):287
                      Entropy (8bit):5.298414713687176
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXR+AeT6QnHVoZcg1vRcR0Ypj8DoAvJf21rPeUkwRe9:YvXKXZeT6Qn2Zc0vej8sG+16Ukee9
                      MD5:A45F76B241AF06808091777CE66467D8
                      SHA1:40D0804EEC66DC82C948E8CDBC302D10AB9E08AC
                      SHA-256:9D49DCE518053BBEE2DD048F1E2E48A79DFE7AFCB15BA6EA790F280B12E30236
                      SHA-512:CEB8D864071791B88CB0326B22546D4E87DFC2F273314ECCC6787AF18FA7584B0CE506E605C4744412B83553FF3E1C1C9B791EF5AF638152FC2C96DC7DD3EEEE
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"36bc4736-62e3-4361-be76-105f693a5993","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1712297112066,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.317292797009386
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXR+AeT6QnHVoZcg1vRcR0Ypj8DoAvJfbpatdPeUkwRe9:YvXKXZeT6Qn2Zc0vej8sGVat8Ukee9
                      MD5:20B618B3F19281A7A5A78D25A1F0CE5F
                      SHA1:938AE1891C486BE085796B718360149858776EC2
                      SHA-256:6B1B3EB72DE2CECC7C3E46641CDB0BEDC4B4476CBBA74F7579C718506B9F2073
                      SHA-512:6EB27DDA72E212AA77A8F41E7AA04BF76D97000344C94073E803647AE714C6DD9741AEF9A1182096938EF73C1AAEB8EE9E13A1E2EBD43CEC30B709E219D9236D
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"36bc4736-62e3-4361-be76-105f693a5993","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1712297112066,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):286
                      Entropy (8bit):5.276697547188031
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXR+AeT6QnHVoZcg1vRcR0Ypj8DoAvJfshHHrPeUkwRe9:YvXKXZeT6Qn2Zc0vej8sGUUUkee9
                      MD5:0720059214B85468B3832C3D25D9AD63
                      SHA1:21A099991F836C6611F917D434FE84582EE6DAD8
                      SHA-256:BE4F1B240224F6018D1942FF1BEBC7371A27EFB6AA500C9E29291F95157C1FC1
                      SHA-512:5985061817027F2E2F0CBB32264B7C1ABC372B1C1E1089C2496317F58CF68963ABC159BF888BAD7B8B3D7D6F1110BD021E073BFA58D0A77819E42421168AA7F9
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"36bc4736-62e3-4361-be76-105f693a5993","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1712297112066,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):782
                      Entropy (8bit):5.369726431076865
                      Encrypted:false
                      SSDEEP:12:YvXKXZeT6Qn2Zc0vej8sGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhW+:Yv6XZmVn2zvejn168CgEXX5kcIfANhj
                      MD5:C9B0E90C00AD4B4C60E0B032A316DC7F
                      SHA1:76221FBA0B042BBF58B6998987B8C058615367EA
                      SHA-256:35149FC78C8314CE0801668A8B8E7D86B2F2B9D5C926CB1F977BCC78AF43E76E
                      SHA-512:6343B567E56A3360013DF2DFC9F9AFD8E291DAFC5FD7FBEA85D0A5140CD658C7FB816F7D3B6168F97C861F2AC5052A9EBCF3E4EFEA69E9B4A7369306E7AF737D
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"36bc4736-62e3-4361-be76-105f693a5993","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1712297112066,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1712124102125}}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):4
                      Entropy (8bit):0.8112781244591328
                      Encrypted:false
                      SSDEEP:3:e:e
                      MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                      SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                      SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                      SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                      Malicious:false
                      Preview:....

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):2813
                      Entropy (8bit):5.112472546553872
                      Encrypted:false
                      SSDEEP:24:Y1zCCSAsa7ez9dpbI5aUuhaynU95wiYAWiePjMhsj0SJHU0Ah2zl/2LSLVxyq5yh:Y1OhAsa6JLbKb9mggq+SvolV8q09k6
                      MD5:69BCEC4C0DC7EAD33B4FBD6BC96A63F2
                      SHA1:2E87C71E2FEFC0DF6613CAD715F2F35064AF82A7
                      SHA-256:AAC0A801521296AA9811892500621674490715AB94651B567ABFF8413FC1390B
                      SHA-512:8BD75DDEAB822C1054DE4446D248D9DCBB8389F1DEC640D1C6A0D2A0A212200AF7E03A9106CD641B2CC21BD9D3F712AD03A77213ED774F58699100CE4AC75A9B
                      Malicious:false
                      Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"688af089f0099111350a1526133e6388","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1712124101000},{"id":"Edit_InApp_Aug2020","info":{"dg":"4650a3c390220c876758fa439c8c6176","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1712124101000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"fa2170fc8b3783a96f631b1ccec1aa93","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1712124101000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"a7897c63cada16ec86a760ac5adde936","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1712124101000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"30d256b92d0005e1c0af96c6c4b10641","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1712124101000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"f26839247617f4fd46ac1f0f1322ac58","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1712124101000},{

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
                      Category:dropped
                      Size (bytes):12288
                      Entropy (8bit):1.187223166924125
                      Encrypted:false
                      SSDEEP:48:TGufl2GL7msEHUUUUUUUUfSvR9H9vxFGiDIAEkGVvpD:lNVmswUUUUUUUUf+FGSIt/
                      MD5:923504E05B7F750CB1830D1B54C711DD
                      SHA1:3D209C3DF4436711470085DF2CFDE35471E37FD2
                      SHA-256:C54D596E92E0C12838F589226C3B1AA5E8512188DD841C1D8AE3FA48941F3495
                      SHA-512:97569171CC931802370944602EB0A0655CA4013AD44F940F21BC16BA4744AEC9DCB78BA96F9120A5B16A074D88984BAE23D7B3D2986F493818EEEF9993CE813F
                      Malicious:false
                      Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite Rollback Journal
                      Category:dropped
                      Size (bytes):8720
                      Entropy (8bit):1.6052144200227587
                      Encrypted:false
                      SSDEEP:48:7MEKUUUUUUUUUUjvR9H9vxFGiDIAEkGVvQvqFl2GL7mst:7AUUUUUUUUUUzFGSIt+KVmst
                      MD5:16E8644845120888DC736837A8A548AC
                      SHA1:75C660AB2B55F1600E54D94306B0685060FD54A1
                      SHA-256:C4C046F5C3F3FEDAE9777044A226D1AD1D77A24E1613D1609CCECCDF48BC3418
                      SHA-512:4063CD86E04AFA2B6F4256E5FFF0A363D37F6731175CA3CB58F3094F9579E2A401CFD67EE965C23F0155A37D1A191A72E330DCA0421B8B39D5E45E55A8AC6D32
                      Malicious:false
                      Preview:.... .c......3........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Temp\MSI49ac0.LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):246
                      Entropy (8bit):3.513199765407527
                      Encrypted:false
                      SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K82b4v:Qw946cPbiOxDlbYnuRKX8
                      MD5:2AA144B3240C0914048204D56EA030B9
                      SHA1:DC0A1591E5F723DE7E67E7B3EEB1EFE57E62531F
                      SHA-256:AE0031586761E829F5CC9BE53CDD442DCD4F0D5C92878E6058646E8D9F50E51D
                      SHA-512:E9672F670F4713E55E96B64F740ACDB3D6E4EFB43B49A195D1604CB69BAC2E57DA043D340009E6EE64B5316B79591DB9726B75CCE2FD76099FB723BA1549B20D
                      Malicious:false
                      Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .0.3./.0.4./.2.0.2.4. . .0.8.:.0.1.:.4.4. .=.=.=.....

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9qavzco_9othzo_5to.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PDF document, version 1.6, 0 pages
                      Category:dropped
                      Size (bytes):358
                      Entropy (8bit):5.050663613536289
                      Encrypted:false
                      SSDEEP:6:IngVMrexJzJT0y9VEQIFVmb/eu2g/86S1kxROOtWXy5Wv36fXy5Wv3VbmCSyAAO:IngVMre9T0HQIDmy9g06JXd95G6q5GxC
                      MD5:D0DB636BAA31AC1367ADCAB2E27BFDA2
                      SHA1:D9816453571A47327F219E3538076C31C9A58CC0
                      SHA-256:C099365BC332934B28D139572767C836DD68E12CE08FC5317C4C9F4C70641ADF
                      SHA-512:08A6C125249CCBA0C85E45226C946D703AD61ABF7FB3AE7D9A6CF34BF5A23DFE163BA9A2740C1E2E135C9F48B7B656748C0B46A7A836456C8C2E2F8FECFD4955
                      Malicious:false
                      Preview:%PDF-1.6.%......1 0 obj.<</Pages 2 0 R/Type/Catalog>>.endobj.2 0 obj.<</Count 0/Kids[]/Type/Pages>>.endobj.3 0 obj.<<>>.endobj.xref..0 4..0000000000 65535 f..0000000016 00000 n..0000000061 00000 n..0000000107 00000 n..trailer..<</Size 4/Root 1 0 R/Info 3 0 R/ID[<72CCC7C241230843B31A9B6521D87B52><72CCC7C241230843B31A9B6521D87B52>]>>..startxref..127..%%EOF..

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-03 08-01-39-145.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393)
                      Category:dropped
                      Size (bytes):16525
                      Entropy (8bit):5.345946398610936
                      Encrypted:false
                      SSDEEP:384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
                      MD5:8947C10F5AB6CFFFAE64BCA79B5A0BE3
                      SHA1:70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
                      SHA-256:4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
                      SHA-512:B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
                      Malicious:false
                      Preview:SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393), with CRLF line terminators
                      Category:dropped
                      Size (bytes):16603
                      Entropy (8bit):5.392542826022398
                      Encrypted:false
                      SSDEEP:384:PE4hgkF9Un//zVVcCsftYybbo3Waf746tat76gKOqxhTJc8MXz3apaLCCMOP6COC:CoD
                      MD5:540FAB7EEDBE8AC40CD9CD09B69AE695
                      SHA1:94BE2CE7EA85F748B7CD18197EE614E61DAFD44F
                      SHA-256:35DC1B924D43F32838382779DE009709B63ED3B5EB23087FABFAA01FF16D6D91
                      SHA-512:79B4CF743F9AE5ED34C7E5FE13F5F054D69A058A78FD3E580E34B35CC80BA3E9DC394A4A1A08348E09434868A43BEF9CF44E03ABE6CA6A105AB619F370110873
                      Malicious:false
                      Preview:SessionID=fe458629-21fb-459d-afbd-bf9f3d5b587d.1712124099165 Timestamp=2024-04-03T08:01:39:165+0200 ThreadID=7628 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=fe458629-21fb-459d-afbd-bf9f3d5b587d.1712124099165 Timestamp=2024-04-03T08:01:39:166+0200 ThreadID=7628 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=fe458629-21fb-459d-afbd-bf9f3d5b587d.1712124099165 Timestamp=2024-04-03T08:01:39:166+0200 ThreadID=7628 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=fe458629-21fb-459d-afbd-bf9f3d5b587d.1712124099165 Timestamp=2024-04-03T08:01:39:166+0200 ThreadID=7628 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=fe458629-21fb-459d-afbd-bf9f3d5b587d.1712124099165 Timestamp=2024-04-03T08:01:39:166+0200 ThreadID=7628 Component=ngl-lib_NglAppLib Description="SetConf

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):29845
                      Entropy (8bit):5.3884745042415725
                      Encrypted:false
                      SSDEEP:768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rb:H
                      MD5:032B8AE375843ABE748D0E4816938CF9
                      SHA1:5EC94058B270CE18069F5DCEC13421E7E13C1565
                      SHA-256:A574C496C0A1E902785F33E4CC839E43D09939411FA99D724105D453E58201BB
                      SHA-512:516865738154041B02F13B08F000FFE5738DB0FA07C3D66F6F7C073C77156A2C3BE36C4633991BC366C32529BC0AF5E2C1669BAC3D79239298E4CD74450F289E
                      Malicious:false
                      Preview:03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

                      C:\Users\user\AppData\Local\Temp\acrocef_low\27aa4394-5c71-4c21-ad89-d21e5b9de350.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                      Category:dropped
                      Size (bytes):1419751
                      Entropy (8bit):7.976496077007677
                      Encrypted:false
                      SSDEEP:24576:/x0WL07oXGZuwYIGNPJwdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:J0WLxXGZuwZGM3mlind9i4ufFXpAXkru
                      MD5:E1FE9FA2454D30CD849F2060D8FED227
                      SHA1:5B5A33E386D7A2254DB5934F688C1F1A72A9D6C9
                      SHA-256:4B0AD0558FB8C3D63817011FCA33E51A9E9C46A91407B705C4E5150AE4E5A3E4
                      SHA-512:C81A8B39C571531DC52A71E34188D3C95797B69E82A74896019723E0217A00D58367118886DDEEEC4AEAAF8A80931BA22459104847E2B0D8A77070BFEE3BE7F1
                      Malicious:false
                      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                      C:\Users\user\AppData\Local\Temp\acrocef_low\4f4bfc8e-c888-421e-9a29-0e20f7e6c8b6.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                      Category:dropped
                      Size (bytes):386528
                      Entropy (8bit):7.9736851559892425
                      Encrypted:false
                      SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                      MD5:5C48B0AD2FEF800949466AE872E1F1E2
                      SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                      SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                      SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                      Malicious:false
                      Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                      C:\Users\user\AppData\Local\Temp\acrocef_low\903f4874-e88d-4896-bbb0-a6c76df6a93e.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                      Category:dropped
                      Size (bytes):758601
                      Entropy (8bit):7.98639316555857
                      Encrypted:false
                      SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                      MD5:3A49135134665364308390AC398006F1
                      SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                      SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                      SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                      Malicious:false
                      Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                      C:\Users\user\AppData\Local\Temp\acrocef_low\b7df2499-41d9-44bd-83bb-bcd55759edb9.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                      Category:dropped
                      Size (bytes):1407294
                      Entropy (8bit):7.97605879016224
                      Encrypted:false
                      SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
                      MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
                      SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
                      SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
                      SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
                      Malicious:false
                      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                      Static File Info

                      General

                      File type:PDF document, version 1.5, 1 pages
                      Entropy (8bit):7.991199266962408
                      TrID:
                      • Adobe Portable Document Format (5005/1) 100.00%
                      File name:Document 35405 (2).pdf
                      File size:342'409 bytes
                      MD5:4ff9fae10d7736c3572aa9e790956a1f
                      SHA1:38b58154a27f443d3ee999e492ab25bd5cb3d5f2
                      SHA256:366cf33daf5f3807960a5c3120a793385a038b40483c593c8f3e971879b01c20
                      SHA512:3b04752ea93fb334f6477198523aff1665b563e40c0c689a6d471a088f8523f9727b24fa38ec6c8d2686e3d281832d28c96abe2ec6ee5ed1083160e2b9de8d6e
                      SSDEEP:6144:JdCmmdsTkTEineK9uAQ3gMO9qYcBnvHCGGUvQQL57e8yf0SZcRczHq8SJwL:LCVwin791Q3gMOiPC+QQL54f0CEiK8SA
                      TLSH:F7742336ACD02D2CEC938D018E737406576EFA1271DC1C89657E8A5066CEFC4EBA7396
                      File Content Preview:%PDF-1.5.%.....6 0 obj.<<./Type /ExtGState./BM /Normal./ca 1.>>.endobj.7 0 obj.<<./Type /ExtGState./BM /Normal./CA 1.>>.endobj.10 0 obj.<<./Filter /FlateDecode./Length 83672./Length1 278920.>>.stream.x....`.....o.=gwg.d7.c.%\.Y ..FXB.a@.U........x......j.

                      File Icon

                      Icon Hash:62cc8caeb29e8ae0

                      Static PDF Info

                      General

                      Header:%PDF-1.5
                      Total Entropy:7.991199
                      Total Bytes:342409
                      Stream Entropy:7.994965
                      Stream Bytes:333016
                      Entropy outside Streams:5.000969
                      Bytes outside Streams:9393
                      Number of EOF found:1
                      Bytes after EOF:

                      Keywords Statistics

                      NameCount
                      obj60
                      endobj60
                      stream8
                      endstream8
                      xref1
                      trailer1
                      startxref1
                      /Page1
                      /Encrypt0
                      /ObjStm0
                      /URI0
                      /JS0
                      /JavaScript0
                      /AA0
                      /OpenAction0
                      /AcroForm0
                      /JBIG2Decode0
                      /RichMedia0
                      /Launch0
                      /EmbeddedFile0

                      Network Behavior

                      Network Port Distribution

                      TCP Packets

                      TimestampSource PortDest PortSource IPDest IP
                      Apr 3, 2024 08:01:49.486036062 CEST49740443192.168.2.4104.94.108.142
                      Apr 3, 2024 08:01:49.486053944 CEST44349740104.94.108.142192.168.2.4
                      Apr 3, 2024 08:01:49.486119986 CEST49740443192.168.2.4104.94.108.142
                      Apr 3, 2024 08:01:49.486290932 CEST49740443192.168.2.4104.94.108.142
                      Apr 3, 2024 08:01:49.486300945 CEST44349740104.94.108.142192.168.2.4
                      Apr 3, 2024 08:01:49.867472887 CEST44349740104.94.108.142192.168.2.4
                      Apr 3, 2024 08:01:49.867877007 CEST49740443192.168.2.4104.94.108.142
                      Apr 3, 2024 08:01:49.867889881 CEST44349740104.94.108.142192.168.2.4
                      Apr 3, 2024 08:01:49.868941069 CEST44349740104.94.108.142192.168.2.4
                      Apr 3, 2024 08:01:49.869000912 CEST49740443192.168.2.4104.94.108.142
                      Apr 3, 2024 08:01:49.870754957 CEST49740443192.168.2.4104.94.108.142
                      Apr 3, 2024 08:01:49.870810032 CEST44349740104.94.108.142192.168.2.4
                      Apr 3, 2024 08:01:49.871040106 CEST49740443192.168.2.4104.94.108.142
                      Apr 3, 2024 08:01:49.871045113 CEST44349740104.94.108.142192.168.2.4
                      Apr 3, 2024 08:01:49.915339947 CEST49740443192.168.2.4104.94.108.142
                      Apr 3, 2024 08:01:49.997411013 CEST44349740104.94.108.142192.168.2.4
                      Apr 3, 2024 08:01:49.997538090 CEST44349740104.94.108.142192.168.2.4
                      Apr 3, 2024 08:01:49.997586012 CEST49740443192.168.2.4104.94.108.142
                      Apr 3, 2024 08:01:49.997840881 CEST49740443192.168.2.4104.94.108.142
                      Apr 3, 2024 08:01:49.997852087 CEST44349740104.94.108.142192.168.2.4
                      Apr 3, 2024 08:01:49.997860909 CEST49740443192.168.2.4104.94.108.142
                      Apr 3, 2024 08:01:49.997899055 CEST49740443192.168.2.4104.94.108.142

                      HTTP Request Dependency Graph

                      • armmf.adobe.com

                      HTTPS Proxied Packets

                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      0192.168.2.449740104.94.108.1424437844C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      TimestampBytes transferredDirectionData
                      2024-04-03 06:01:49 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
                      Host: armmf.adobe.com
                      Connection: keep-alive
                      Accept-Language: en-US,en;q=0.9
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
                      Sec-Fetch-Site: same-origin
                      Sec-Fetch-Mode: no-cors
                      Sec-Fetch-Dest: empty
                      Accept-Encoding: gzip, deflate, br
                      If-None-Match: "78-5faa31cce96da"
                      If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
                      2024-04-03 06:01:49 UTC198INHTTP/1.1 304 Not Modified
                      Content-Type: text/plain; charset=UTF-8
                      Last-Modified: Mon, 01 May 2023 15:02:33 GMT
                      ETag: "78-5faa31cce96da"
                      Date: Wed, 03 Apr 2024 06:01:49 GMT
                      Connection: close


                      Statistics

                      CPU Usage

                      Click to jump to process

                      Memory Usage

                      Click to jump to process

                      High Level Behavior Distribution

                      Click to dive into process behavior distribution

                      Behavior

                      Click to jump to process

                      System Behavior

                      General

                      Target ID:0
                      Start time:08:01:36
                      Start date:03/04/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Document 35405 (2).pdf"
                      Imagebase:0x7ff6bc1b0000
                      File size:5'641'176 bytes
                      MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      General

                      Target ID:1
                      Start time:08:01:36
                      Start date:03/04/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                      Imagebase:0x7ff74bb60000
                      File size:3'581'912 bytes
                      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      General

                      Target ID:3
                      Start time:08:01:37
                      Start date:03/04/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1520,i,339784488602095305,13813244706349730919,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                      Imagebase:0x7ff74bb60000
                      File size:3'581'912 bytes
                      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      Disassembly

                      ⊘No disassembly