Joe Sandbox Cloud Basic Analysis Report
Edit tour

Windows Analysis Report
PRM360 Vulnerabilty.pdf

Overview

General Information

Sample name:PRM360 Vulnerabilty.pdf
Analysis ID:1425918
MD5:704ff2ead1c61e0afa35c513ca6daff0
SHA1:4647fb0aaf4c1c56b7870bd4be7534e689416b7c
SHA256:422c07632a709d48200fe6069df7b9636a3fc658ccefb4d03fc610f1436394bc
Infos:

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 7308 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\PRM360 Vulnerabilty.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 7492 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 7692 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1568,i,3619652238769408371,2296209543720641968,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

  • • Software Vulnerabilities
  • • Networking
  • • System Summary
  • • Hooking and other Techniques for Hiding and Protection

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.3.84.164:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.3.84.164:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.3.84.164:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.3.84.164:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.3.84.164:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.3.84.164:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.3.84.164:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.3.84.164:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.3.84.164:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.3.84.164:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.3.84.164:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.3.84.164:443
Source: global trafficTCP traffic: 23.3.84.164:443 -> 192.168.2.4:49742
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.3.84.164:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.3.84.164:443
Source: global trafficTCP traffic: 23.3.84.164:443 -> 192.168.2.4:49742
Source: global trafficTCP traffic: 23.3.84.164:443 -> 192.168.2.4:49742
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.3.84.164:443
Source: global trafficTCP traffic: 23.3.84.164:443 -> 192.168.2.4:49742
Source: global trafficTCP traffic: 23.3.84.164:443 -> 192.168.2.4:49742
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.3.84.164:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.3.84.164:443
Source: global trafficTCP traffic: 23.3.84.164:443 -> 192.168.2.4:49742
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.3.84.164:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.3.84.164:443
Source: global trafficTCP traffic: 23.3.84.164:443 -> 192.168.2.4:49742
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.3.84.164:443
Source: global trafficTCP traffic: 23.3.84.164:443 -> 192.168.2.4:49742
Source: global trafficTCP traffic: 23.3.84.164:443 -> 192.168.2.4:49742
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.3.84.164:443
Source: global trafficTCP traffic: 192.168.2.4:49742 -> 23.3.84.164:443
Source: global trafficTCP traffic: 23.3.84.164:443 -> 192.168.2.4:49742
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 23.3.84.164
Source: unknownTCP traffic detected without corresponding DNS query: 23.3.84.164
Source: unknownTCP traffic detected without corresponding DNS query: 23.3.84.164
Source: unknownTCP traffic detected without corresponding DNS query: 23.3.84.164
Source: unknownTCP traffic detected without corresponding DNS query: 23.3.84.164
Source: unknownTCP traffic detected without corresponding DNS query: 23.3.84.164
Source: unknownTCP traffic detected without corresponding DNS query: 23.3.84.164
Source: unknownTCP traffic detected without corresponding DNS query: 23.3.84.164
Source: unknownTCP traffic detected without corresponding DNS query: 23.3.84.164
Source: unknownTCP traffic detected without corresponding DNS query: 23.3.84.164
Source: unknownTCP traffic detected without corresponding DNS query: 23.3.84.164
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: classification engineClassification label: clean1.winPDF@14/43@0/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journalJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-15 06-32-46-822.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\PRM360 Vulnerabilty.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1568,i,3619652238769408371,2296209543720641968,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1568,i,3619652238769408371,2296209543720641968,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: PRM360 Vulnerabilty.pdfInitial sample: PDF keyword /JS count = 0
Source: PRM360 Vulnerabilty.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: PRM360 Vulnerabilty.pdfInitial sample: PDF keyword /Page count = 16
Source: PRM360 Vulnerabilty.pdfInitial sample: PDF keyword stream count = 48
Source: PRM360 Vulnerabilty.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: PRM360 Vulnerabilty.pdfInitial sample: PDF keyword obj count = 101
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive12
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1425918 Sample: PRM360 Vulnerabilty.pdf Startdate: 15/04/2024 Architecture: WINDOWS Score: 1 6 Acrobat.exe 18 74 2->6         started        process3 8 AcroCEF.exe 104 6->8         started        process4 10 AcroCEF.exe 2 8->10         started        dnsIp5 13 23.3.84.164, 443, 49742 AKAMAI-ASUS United States 10->13

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
23.3.84.164
unknownUnited States
16625AKAMAI-ASUSfalse

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1425918
Start date and time:2024-04-15 06:31:51 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 38s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultwindowspdfcookbook.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:10
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:PRM360 Vulnerabilty.pdf
Detection:CLEAN
Classification:clean1.winPDF@14/43@0/1
EGA Information:Failed
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 0
  • Number of non-executed functions: 0
Cookbook Comments:
  • Found application associated with file extension: .pdf
  • Found PDF document
  • Close Viewer
  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 23.39.0.135, 3.219.243.226, 52.22.41.97, 3.233.129.217, 52.6.155.20, 23.219.38.26, 23.219.38.58, 162.159.61.3, 172.64.41.3, 23.217.118.215, 23.217.118.201
  • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com
  • Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
23.3.84.164SOA_OCT.xlsGet hashmaliciousUnknownBrowse

    Domains

    ⊘No context

    ASNs

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    AKAMAI-ASUS2EFEN3j6ml.elfGet hashmaliciousUnknownBrowse
    • 95.101.191.173
    desktop-20a11ho.lnkGet hashmaliciousUnknownBrowse
    • 23.15.136.202
    SecuriteInfo.com.Linux.Siggen.9999.4607.18461.elfGet hashmaliciousMiraiBrowse
    • 23.44.120.51
    o2mV9s50D5.elfGet hashmaliciousMiraiBrowse
    • 104.90.135.193
    w17yCE18dz.elfGet hashmaliciousMiraiBrowse
    • 184.30.64.230
    YrwQEQwAlQ.elfGet hashmaliciousMiraiBrowse
    • 2.16.80.59
    HTTPS://tnfarmbureau.orgGet hashmaliciousUnknownBrowse
    • 104.102.130.13
    SecuriteInfo.com.Win32.MalwareX-gen.8794.16509.exeGet hashmaliciousUnknownBrowse
    • 69.192.108.161
    ss.exeGet hashmaliciousCryptOneBrowse
    • 104.105.90.131
    ss.exeGet hashmaliciousCryptOneBrowse
    • 104.105.90.131

    JA3 Fingerprints

    ⊘No context

    Dropped Files

    ⊘No context

    Created / dropped Files

    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):292
    Entropy (8bit):5.201482039850251
    Encrypted:false
    SSDEEP:6:bDfVq2Pwkn2nKuAl9OmbnIFUt8U6MXSgZmw+U6MXSIkwOwkn2nKuAl9OmbjLJ:bD9vYfHAahFUt8U6yX/+U6yF5JfHAaSJ
    MD5:939E1431005180F71F4CFC8E103F4CA9
    SHA1:65272E816E4A650AE0D5B3395CA189DD73731652
    SHA-256:B369506B87938FACBEDFEEAA978F9DEE113ABBAA30C2B2C22B3324A8883B6074
    SHA-512:5B9AC6AEA0064DDB4B5F97394935B126FD26A9B11A5C93A6A543785D89350D36E3923A24610BB127D4D6DDE3951339DDD5E8F4B03206A1C4357A0974AE9A5B1C
    Malicious:false
    Reputation:low
    Preview:2024/04/15-06:32:44.518 1db4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/15-06:32:44.520 1db4 Recovering log #3.2024/04/15-06:32:44.520 1db4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):292
    Entropy (8bit):5.201482039850251
    Encrypted:false
    SSDEEP:6:bDfVq2Pwkn2nKuAl9OmbnIFUt8U6MXSgZmw+U6MXSIkwOwkn2nKuAl9OmbjLJ:bD9vYfHAahFUt8U6yX/+U6yF5JfHAaSJ
    MD5:939E1431005180F71F4CFC8E103F4CA9
    SHA1:65272E816E4A650AE0D5B3395CA189DD73731652
    SHA-256:B369506B87938FACBEDFEEAA978F9DEE113ABBAA30C2B2C22B3324A8883B6074
    SHA-512:5B9AC6AEA0064DDB4B5F97394935B126FD26A9B11A5C93A6A543785D89350D36E3923A24610BB127D4D6DDE3951339DDD5E8F4B03206A1C4357A0974AE9A5B1C
    Malicious:false
    Reputation:low
    Preview:2024/04/15-06:32:44.518 1db4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/15-06:32:44.520 1db4 Recovering log #3.2024/04/15-06:32:44.520 1db4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):336
    Entropy (8bit):5.198830757048638
    Encrypted:false
    SSDEEP:6:bsOq2Pwkn2nKuAl9Ombzo2jMGIFUt8UkrhZmw+UzzkwOwkn2nKuAl9Ombzo2jMmd:bsOvYfHAa8uFUt8Ukrh/+U/5JfHAa8RJ
    MD5:5D50D78D36E3D0AE89077895A50C2700
    SHA1:49DEDE80B1567B050CAD77B0BFBCF96947C5E33B
    SHA-256:AF867D508F37E7CB81EACCBD02F701F2589194D913B5BB3AB0441C5BE8EC6392
    SHA-512:CEA5860471849011281E687184D2EE9D16BE38C72E9F58E3825FA295A23759AB9BBFF995C64F92DDA1B1C7BE77CF4DB1650250546169F9BBE761AE7E541B4A7E
    Malicious:false
    Reputation:low
    Preview:2024/04/15-06:32:44.878 1e60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/15-06:32:44.881 1e60 Recovering log #3.2024/04/15-06:32:44.882 1e60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):336
    Entropy (8bit):5.198830757048638
    Encrypted:false
    SSDEEP:6:bsOq2Pwkn2nKuAl9Ombzo2jMGIFUt8UkrhZmw+UzzkwOwkn2nKuAl9Ombzo2jMmd:bsOvYfHAa8uFUt8Ukrh/+U/5JfHAa8RJ
    MD5:5D50D78D36E3D0AE89077895A50C2700
    SHA1:49DEDE80B1567B050CAD77B0BFBCF96947C5E33B
    SHA-256:AF867D508F37E7CB81EACCBD02F701F2589194D913B5BB3AB0441C5BE8EC6392
    SHA-512:CEA5860471849011281E687184D2EE9D16BE38C72E9F58E3825FA295A23759AB9BBFF995C64F92DDA1B1C7BE77CF4DB1650250546169F9BBE761AE7E541B4A7E
    Malicious:false
    Reputation:low
    Preview:2024/04/15-06:32:44.878 1e60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/15-06:32:44.881 1e60 Recovering log #3.2024/04/15-06:32:44.882 1e60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1a5a2a03-deb5-412b-8c39-72ac1d397184.tmp

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:JSON data
    Category:modified
    Size (bytes):475
    Entropy (8bit):4.9602737064168165
    Encrypted:false
    SSDEEP:12:YH/um3RA8sqZrsBdOg2HkAcaq3QYiubInP7E4T3y:Y2sRdszdMH03QYhbG7nby
    MD5:C70389A4C0F178BF5A2031D12C79EE2B
    SHA1:AEFA13046B39DFA6D456C7F3B21C54F5AE4E245E
    SHA-256:1D4A56DDFBF74144F3A89ED3994A8BC4D69FD51EC2C4C66250D1DBD83950740E
    SHA-512:7CDFA2A41FF0A9773FBD1C016DAE81E0095FC2C721E6D9E46B5FFA49C797FBD7B263519F3507FF250BD5C9256E8813C9529899394D29EA931CD8F6F6AEE66371
    Malicious:false
    Reputation:low
    Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13357715576527427","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":154951},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):475
    Entropy (8bit):4.9602737064168165
    Encrypted:false
    SSDEEP:12:YH/um3RA8sqZrsBdOg2HkAcaq3QYiubInP7E4T3y:Y2sRdszdMH03QYhbG7nby
    MD5:C70389A4C0F178BF5A2031D12C79EE2B
    SHA1:AEFA13046B39DFA6D456C7F3B21C54F5AE4E245E
    SHA-256:1D4A56DDFBF74144F3A89ED3994A8BC4D69FD51EC2C4C66250D1DBD83950740E
    SHA-512:7CDFA2A41FF0A9773FBD1C016DAE81E0095FC2C721E6D9E46B5FFA49C797FBD7B263519F3507FF250BD5C9256E8813C9529899394D29EA931CD8F6F6AEE66371
    Malicious:false
    Reputation:low
    Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13357715576527427","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":154951},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:data
    Category:dropped
    Size (bytes):4730
    Entropy (8bit):5.251170045380677
    Encrypted:false
    SSDEEP:96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7SC6eyJZ:etJCV4FiN/jTN/2r8Mta02fEhgO73goK
    MD5:3C866F10FE5DDD288DB81BCCB26E70D6
    SHA1:5D1A34006FDAB4B65812AC6B462C9998FA746119
    SHA-256:0F63FE03C203FE8EF2BAFA1AFF44B63F3383A9DB78D6B466C56B61B4003652B9
    SHA-512:907703257ED57712899F89BA65501F658904673B25BA177759A551E4336819F9F72519F51537ACC4B3828AF56CA866DEDDFC600E0FBCA5D62E560C36C529EA6E
    Malicious:false
    Reputation:low
    Preview:*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):324
    Entropy (8bit):5.189259418205441
    Encrypted:false
    SSDEEP:6:bK0q2Pwkn2nKuAl9OmbzNMxIFUt8UKpVXZmw+UKVnkwOwkn2nKuAl9OmbzNMFLJ:bXvYfHAa8jFUt8UE/+UA5JfHAa84J
    MD5:DCB1B1235DBD38762EC6DD54D39F10FC
    SHA1:A72DD823AD0155BEC79B02605B552512F17F64EF
    SHA-256:E48BF61F3C290C0B4A95D95BE5890D1F02E10F023D04D3933DD0A6ABA950B521
    SHA-512:ACE1DD0A051E692B946F15691F41C3EC016CADC7AEFADE3C59FE0AA1E55D5C9DC45862A45F935388E5C6CCBB386CC0FD3F906B99C455DC8E31C9A18BAD83D1AC
    Malicious:false
    Reputation:low
    Preview:2024/04/15-06:32:45.248 1e60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/15-06:32:45.264 1e60 Recovering log #3.2024/04/15-06:32:45.273 1e60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):324
    Entropy (8bit):5.189259418205441
    Encrypted:false
    SSDEEP:6:bK0q2Pwkn2nKuAl9OmbzNMxIFUt8UKpVXZmw+UKVnkwOwkn2nKuAl9OmbzNMFLJ:bXvYfHAa8jFUt8UE/+UA5JfHAa84J
    MD5:DCB1B1235DBD38762EC6DD54D39F10FC
    SHA1:A72DD823AD0155BEC79B02605B552512F17F64EF
    SHA-256:E48BF61F3C290C0B4A95D95BE5890D1F02E10F023D04D3933DD0A6ABA950B521
    SHA-512:ACE1DD0A051E692B946F15691F41C3EC016CADC7AEFADE3C59FE0AA1E55D5C9DC45862A45F935388E5C6CCBB386CC0FD3F906B99C455DC8E31C9A18BAD83D1AC
    Malicious:false
    Reputation:low
    Preview:2024/04/15-06:32:45.248 1e60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/15-06:32:45.264 1e60 Recovering log #3.2024/04/15-06:32:45.273 1e60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

    C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240415043248Z-162.bmp

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:PC bitmap, Windows 3.x format, 164 x -115 x 32, cbSize 75494, bits offset 54
    Category:dropped
    Size (bytes):75494
    Entropy (8bit):1.3011785079343385
    Encrypted:false
    SSDEEP:96:GKvns4a5DP9WVMK1MMREnhMMVygGali2KOMMREnhMMVyUMERMMMMMEhMMMa+LR8p:qD1mnb49ibG+x3
    MD5:13CB58ED805A5D8B1EB8E113081DFF73
    SHA1:C5C2029B337274C736E8D9A72C6051BEF71C0C42
    SHA-256:646E9CD36C64DFABF9558611EB3B55906FF9BAA81142F9FEC2AA4709ED4595A8
    SHA-512:4F6119B7FC69B290F8BA4A472A3DB1B6D66EB46492321FF40161E65D6AE9966433B7AE5B8466E9A16155099169C17CC992C5646981AC2D9CD7C18CBD8926E352
    Malicious:false
    Reputation:low
    Preview:BM.&......6...(............. ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................q.................+&...(...(....................................................................................................................................................................................................................................................................................................

    C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
    Category:dropped
    Size (bytes):86016
    Entropy (8bit):4.4453332347870615
    Encrypted:false
    SSDEEP:384:yezci5t4iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rfs3OazzU89UTTgUL
    MD5:D3FE7F480A5FE42409A0FABF9809A351
    SHA1:6B27898291B8E42685DC86FCEEBE41CB768720B7
    SHA-256:A8F2C9AFFE54F2F6FC02E954336915FCAE116A29D5896DCB975BEC46B2989BD4
    SHA-512:25FE1E4EEE94C11C48965924217889293D9E6F6BA6949F53AEB5854667D4BC9CEB6893FC284A079CB1A39A33B5FDEEB8DED6B6C6690658D644736A4D01F2E7E2
    Malicious:false
    Reputation:low
    Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

    C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:SQLite Rollback Journal
    Category:dropped
    Size (bytes):8720
    Entropy (8bit):3.7738958204375708
    Encrypted:false
    SSDEEP:48:7Myp/E2ioyVd8Rioy9oWoy1Cwoy108aKOioy1noy1AYoy1Wioy1hioybioy+8Ook:7RpjuORFcSXKQqMYFb9IVXEBodRBks
    MD5:C647A2EDDE93BC981D28FA02A952AF9E
    SHA1:7C28628AD16A4DE534AC4F9F27F1376C9CAE5DBD
    SHA-256:61B7D1B82A60765BBF907401C76B67D7C9A7173F10EC3BA022F06F0AFC1F4937
    SHA-512:04CBF67990985D5CB394CD6EBF991F1FD75BB7F17FD481CE8B9245264F920F22075A386A7598758D4B95CB4169EFADF74C63F20DC9146A8C703B7F4EA15E2A8A
    Malicious:false
    Reputation:low
    Preview:.... .c.....t{................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7372

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:PostScript document text
    Category:dropped
    Size (bytes):185099
    Entropy (8bit):5.182478651346149
    Encrypted:false
    SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
    MD5:94185C5850C26B3C6FC24ABC385CDA58
    SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
    SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
    SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
    Malicious:false
    Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:PostScript document text
    Category:dropped
    Size (bytes):185099
    Entropy (8bit):5.182478651346149
    Encrypted:false
    SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
    MD5:94185C5850C26B3C6FC24ABC385CDA58
    SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
    SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
    SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
    Malicious:false
    Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:data
    Category:dropped
    Size (bytes):244540
    Entropy (8bit):3.3415042960460593
    Encrypted:false
    SSDEEP:1536:vKPCPiyzDtrh1cK3XEivK7VK/3AYvYwggErRo+RQn:yPClJ/3AYvYwgrFo+RQn
    MD5:758B42992DDFC41CB5E57069C621B54A
    SHA1:D0C28AF6CF1BD2208DA97DEDE57F6C78CEC98DCD
    SHA-256:55DF75758DD6CA825ED2DC9380EDC8469351191308C34CACFC44205197ABD25D
    SHA-512:437918372167A402005A728DCBBEF7B3A9580B794AD6A948A435C9D57C1672ACC1B7376E2A09113B66600EF5049D23625174256565BC639125A2F2BD07928926
    Malicious:false
    Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):295
    Entropy (8bit):5.3764113020966136
    Encrypted:false
    SSDEEP:6:YEQXJ2HXHiIRdg6lludVoZcg1vRcR0YYFjeoAvJM3g98kUwPeUkwRe9:YvXKXHiYllukZc0vhGMbLUkee9
    MD5:939059174691B6EBDDC4AE40C0D2F3F1
    SHA1:015C56B999244EC522BCF8A71E65B8A71715338C
    SHA-256:A0BEDF33E1F7C90A52BDC973A69EF9D52E54E8B079C6224355B598DED6F4B41B
    SHA-512:EFCAC67958C95920DBDBA818AC7EBE15DD144E149A71531764DB47DF7854A4C7B8C9662128A6D9BBDD0984F152F4F2A68CE48E77FCEACCF3B46A751BAD3133AA
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"9360d5f8-c0a1-4838-ba05-4af1eb74b1c2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713331550436,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):294
    Entropy (8bit):5.32610275427085
    Encrypted:false
    SSDEEP:6:YEQXJ2HXHiIRdg6lludVoZcg1vRcR0YYFjeoAvJfBoTfXpnrPeUkwRe9:YvXKXHiYllukZc0vhGWTfXcUkee9
    MD5:0DFAA0B87B292F3D6A98F4559603B918
    SHA1:4799CE371018DB0ED30327D61EA8DE76BCB23F1E
    SHA-256:81718B3D85C778EECB6018597809D1298369BF172C603B46EA43F36C1C25B2D3
    SHA-512:559A34D78D94D3CD77A7B6987DC313B1E291118106228392018D7810BFDA11C95F84C9090384E9A5910D15E29FC333081F200840F2C09074D762360874C47B0D
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"9360d5f8-c0a1-4838-ba05-4af1eb74b1c2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713331550436,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):294
    Entropy (8bit):5.304362249628657
    Encrypted:false
    SSDEEP:6:YEQXJ2HXHiIRdg6lludVoZcg1vRcR0YYFjeoAvJfBD2G6UpnrPeUkwRe9:YvXKXHiYllukZc0vhGR22cUkee9
    MD5:DB26C9E9D9C9F5EE3773DBF97A113A1F
    SHA1:08B9EE49D352AAE75237F20CCACDFD5699DB3B6F
    SHA-256:390E1AECB461FB1F4469CC55082840A56F9136BAA7137EC1C878DE48B5A6F0C7
    SHA-512:62F3BF5B377455C632E3C3E8B0403080E8B6C87ED544858DF640FFA35F2E33528AE6A17A30BC28493AC18C67FFF473A78CFBB6FBAA232CAE474F36AB11E2AE9A
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"9360d5f8-c0a1-4838-ba05-4af1eb74b1c2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713331550436,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):285
    Entropy (8bit):5.363879629898069
    Encrypted:false
    SSDEEP:6:YEQXJ2HXHiIRdg6lludVoZcg1vRcR0YYFjeoAvJfPmwrPeUkwRe9:YvXKXHiYllukZc0vhGH56Ukee9
    MD5:DC302D05C772555BFA20887913DCD1F5
    SHA1:86CC971BC096359FA9EE82CB7AAF7E1A698A8AA3
    SHA-256:44D3C5778942F1524BE6C189099CF695A5C81368096808A6124C689A46E303F2
    SHA-512:627C493B902FF0B1A964FA1D691253F1C28E6CC9C9DC22539DF7FC6602779B69AB64D29F87C0E986A7144762A5F95AB442E9C64065905AC61C28F580A1A77950
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"9360d5f8-c0a1-4838-ba05-4af1eb74b1c2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713331550436,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):292
    Entropy (8bit):5.324355893837891
    Encrypted:false
    SSDEEP:6:YEQXJ2HXHiIRdg6lludVoZcg1vRcR0YYFjeoAvJfJWCtMdPeUkwRe9:YvXKXHiYllukZc0vhGBS8Ukee9
    MD5:DB4DA87A4884C72C9F7176EFDE060CA4
    SHA1:A280F576DD2715322D16EDCFEF52CEECDA0B83AF
    SHA-256:28C48644497FA8507DC2BEE197C1CE0C81C0DDC26FC598A19044D9E57BB7005B
    SHA-512:CADF5CA2AAEE25A33B819BB9108B8246768A384F406106A784C313FD26D26F786622B3E04F1C37E13A04D4FEFA68FC2999766BDF12D3757453CD3B28A8D55A82
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"9360d5f8-c0a1-4838-ba05-4af1eb74b1c2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713331550436,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):289
    Entropy (8bit):5.3110975231763025
    Encrypted:false
    SSDEEP:6:YEQXJ2HXHiIRdg6lludVoZcg1vRcR0YYFjeoAvJf8dPeUkwRe9:YvXKXHiYllukZc0vhGU8Ukee9
    MD5:12C3C59693FD4396A58CEFCCD2AFCC1B
    SHA1:0C70DC13B5E6A7538A8C5FF7996AD13C55BBEEBA
    SHA-256:34E8E8ECC0628A46F05B51E637013F2A1DD1D2ED8044508A1F189F920C9F8508
    SHA-512:87159090D1C23693CED22FD01CC244BA3D46CE66F47CAD82225C0AFCE36C448BAAD465DD6BD17A7E3FAFD5B58B703C4DF0E5F4402A368A954137A4BB565FCD3D
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"9360d5f8-c0a1-4838-ba05-4af1eb74b1c2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713331550436,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):292
    Entropy (8bit):5.315465741942321
    Encrypted:false
    SSDEEP:6:YEQXJ2HXHiIRdg6lludVoZcg1vRcR0YYFjeoAvJfQ1rPeUkwRe9:YvXKXHiYllukZc0vhGY16Ukee9
    MD5:1B40159860241A5739DFE5C683D02ECD
    SHA1:D2B4610B57591F44D838B1D040CFA86C9E9FD5B5
    SHA-256:375D2112622914A6EA114DFF3A26F4F30F08BA8BEB9A5EED759ADF5F3D652ADD
    SHA-512:0219F7B8AE0D5A590A3F7CDB9AE7E0455CC7FD3D370C227A5E6BD52E42A11BE66772C6D18977BE03E98A9C46FF1CFDA766D7F0C92D99A6BE85EE287252ABBABD
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"9360d5f8-c0a1-4838-ba05-4af1eb74b1c2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713331550436,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):289
    Entropy (8bit):5.321405776975766
    Encrypted:false
    SSDEEP:6:YEQXJ2HXHiIRdg6lludVoZcg1vRcR0YYFjeoAvJfFldPeUkwRe9:YvXKXHiYllukZc0vhGz8Ukee9
    MD5:374A4F91BFD248A89CB8BE21F7432F3F
    SHA1:A1AA21E4E5F895369790DD39158C41E23CADF48D
    SHA-256:1AB8A729B129910FC648F23AFB47E22DC8F1D70E1FEA136C8862070768E1D6F7
    SHA-512:87DAC1FDE52DD2E648C9523866F1E86C1EDCB4FF382A64A5063E6379AA1DE653D00F63C1AD09D2D5CA7B5CE7304431007D3D886B0DBF00BBC3F91168A1F226FA
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"9360d5f8-c0a1-4838-ba05-4af1eb74b1c2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713331550436,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):295
    Entropy (8bit):5.336406960857983
    Encrypted:false
    SSDEEP:6:YEQXJ2HXHiIRdg6lludVoZcg1vRcR0YYFjeoAvJfzdPeUkwRe9:YvXKXHiYllukZc0vhGb8Ukee9
    MD5:B2D76DF0D9DB809620E4D582EDD86C53
    SHA1:98B5E984A2089323E54D652D131D5FE0331A9043
    SHA-256:4C8759661CAFAB871881ACCE36F72EF92A949095B764BF9F8798F4BC0B4B3B63
    SHA-512:0304FA1676342DF642480BFAEA4CDE6A2072808A2DA3236572A360FF873E6F4C9543851DFDDB8131D9674F2179E4488A1524CD38B8D2A7C4B33A010A12DBA408
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"9360d5f8-c0a1-4838-ba05-4af1eb74b1c2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713331550436,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):289
    Entropy (8bit):5.317682022124394
    Encrypted:false
    SSDEEP:6:YEQXJ2HXHiIRdg6lludVoZcg1vRcR0YYFjeoAvJfYdPeUkwRe9:YvXKXHiYllukZc0vhGg8Ukee9
    MD5:377D11E74A839D8082CACAE5D8E501D2
    SHA1:68B017C7A77797DEBD3E9DAAA9102B5ED42281EA
    SHA-256:716DCF9BAADE487272BCCF3FA8D1AC41E2D07ACB6FE08DD3D072EB22CA760DEC
    SHA-512:938D52771D30A07987F8524C61FA470C5AEEA1234494F006D34DA09B5C90B4CEB5D815DEC98124EACE02992B591857AD22BCAAE58CEDBC916DE988091997224D
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"9360d5f8-c0a1-4838-ba05-4af1eb74b1c2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713331550436,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):1395
    Entropy (8bit):5.777506317603443
    Encrypted:false
    SSDEEP:24:Yv6XCY6kzvArLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNQ:Yvg6soHgDv3W2aYQfgB5OUupHrQ9FJu
    MD5:BDC1E54AF5E689E0E841ACD4E3760E50
    SHA1:C08A9B9BD8E8CEC9BFB53BBC8C9F6F6BD95AC5C0
    SHA-256:FAD7300CB1DC618C9E4DEEC9D91C9D4C89DD312DE5263498ACEE244E4BC04FBB
    SHA-512:CA6ACCD0B502C974DB2A2DE74777EF8809C2F567B8EAB361DBBDAC49377743246A08279B97A279A3FE0855106D187899CB87085BFF35D26AA4C7D416DD7772AE
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"9360d5f8-c0a1-4838-ba05-4af1eb74b1c2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713331550436,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):291
    Entropy (8bit):5.301107593873003
    Encrypted:false
    SSDEEP:6:YEQXJ2HXHiIRdg6lludVoZcg1vRcR0YYFjeoAvJfbPtdPeUkwRe9:YvXKXHiYllukZc0vhGDV8Ukee9
    MD5:0A296C3DE033F85EBAFEEC40A1F66A41
    SHA1:D53D6F190D211FB070A1D5C67FA6F85A5BBD7450
    SHA-256:ACB427CDB794BB1BF7E5FDB98EFC075D40D2AA3678F3E819AEFF2FF20878F6FE
    SHA-512:8BAAC005B4B498966E386D43FCDAABA3D65B62C117CFF6B71A36F6FD15132E248573DFC93C07A1EE0E1B4C3674C927FF503B9035F62C69CBCF936A633F0C5D2A
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"9360d5f8-c0a1-4838-ba05-4af1eb74b1c2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713331550436,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):287
    Entropy (8bit):5.306299657687788
    Encrypted:false
    SSDEEP:6:YEQXJ2HXHiIRdg6lludVoZcg1vRcR0YYFjeoAvJf21rPeUkwRe9:YvXKXHiYllukZc0vhG+16Ukee9
    MD5:2BD132BB7DA8390B554D645650F81919
    SHA1:B6D34727EB59DE306216CA03537C81FCA3C04FDD
    SHA-256:639F9B30F29DA231238840E003DEA99620FB26F59D9889C38849BB74182ADC9C
    SHA-512:48B24B3F3138B794364B92E8268355768C1570F108453042249DA7F885C69BB3B4E15BB5C4D936D8F314B4BC209D5D1A926AEBA2472C8048651248FCC5015CDD
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"9360d5f8-c0a1-4838-ba05-4af1eb74b1c2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713331550436,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):289
    Entropy (8bit):5.3242233328083195
    Encrypted:false
    SSDEEP:6:YEQXJ2HXHiIRdg6lludVoZcg1vRcR0YYFjeoAvJfbpatdPeUkwRe9:YvXKXHiYllukZc0vhGVat8Ukee9
    MD5:5CE7AAB43C1D6A1ADE83B25A54B5545D
    SHA1:875F426A92C250CE6A3B66C5B078AF8CF89F9FA3
    SHA-256:3F0FC34E237D0D027A1E1234239302A77AADC8287EBD6FA9C2A33D479DE6D1E9
    SHA-512:E6838C65A1D8D539D49C67E4883307B53895E3D43DA5CFFC9966767BFD687268DBB6896D6581D915A29F2F049A02B1263F1036A72CAC04426FC45168E9B2321F
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"9360d5f8-c0a1-4838-ba05-4af1eb74b1c2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713331550436,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):286
    Entropy (8bit):5.28242620757017
    Encrypted:false
    SSDEEP:6:YEQXJ2HXHiIRdg6lludVoZcg1vRcR0YYFjeoAvJfshHHrPeUkwRe9:YvXKXHiYllukZc0vhGUUUkee9
    MD5:10FB3FC63BEB81D06A311D64B73E71B9
    SHA1:0EC56800A6D78E0A5B5786549B719B57F07FB64C
    SHA-256:9848830522BF2A60D447EE532B6CDA2BB958DC30B519D17E72D9510DA495C7A4
    SHA-512:EBB5D7C84CFA71DC18F11A86B3FB88B2338B032956ACB3825D47DCC5674735F9C4AD9580DABB45282D0D9D1D08130F448F99FFAFB713254E5B88DCBF1C8DD9E1
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"9360d5f8-c0a1-4838-ba05-4af1eb74b1c2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713331550436,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):782
    Entropy (8bit):5.372022842520321
    Encrypted:false
    SSDEEP:12:YvXKXHiYllukZc0vhGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWs:Yv6XCY6kzvt168CgEXX5kcIfANhR
    MD5:A58DA07BF924B634A6A7B8F36D2B8234
    SHA1:6E84FF774722A09C39BFF0AE3BE5A93D258D1A45
    SHA-256:BCD95D50E77DC5C37CF3C5E330BFC792E86ABA9F8936B5A05ABF69A75E91966C
    SHA-512:DF374DAD4E1712EE8BD878B7B324ABD0764FC061E6D678643DF802EB43C2B32FBE54E4C395E212CCC6A50FAF2D07E072D1C554F2E9AEB917D2A813E0FEE9C94B
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"9360d5f8-c0a1-4838-ba05-4af1eb74b1c2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713331550436,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1713155570464}}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:data
    Category:dropped
    Size (bytes):4
    Entropy (8bit):0.8112781244591328
    Encrypted:false
    SSDEEP:3:e:e
    MD5:DC84B0D741E5BEAE8070013ADDCC8C28
    SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
    SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
    SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
    Malicious:false
    Preview:....

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):2813
    Entropy (8bit):5.123227640497302
    Encrypted:false
    SSDEEP:24:YzjCvOUG7OBqONQp98aaayqMFzabGVNEjSIj0S01g2c2LSeb0v3Im/5l902uKOG:Y39UBBNQguq8JRFogwm/L9p
    MD5:23122993984C94FD981FC5A144EEE2B3
    SHA1:8A973A5B764953C8BC9278A1EF3801F0C6FD7FAB
    SHA-256:0A2E0E13B77D6F565366916E8A0D4B5249F6E59D0BA0B694A3BC19913D97D5B3
    SHA-512:589FFBA9EF9D53AA7F204A2E1FC0A7DE0155C9054EB5827A7D3D4C5CBDA308CE08AA972C5C95B4A40E81297D087FB295E56A57C6418FF3FBB051BBCE8DB87819
    Malicious:false
    Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"268de230baa1058c39e21690ccdaafef","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1713155570000},{"id":"Edit_InApp_Aug2020","info":{"dg":"03c786ed5ea053532f75ee440b6fe10f","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1713155570000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"585cce96041fb41335a01e3401f27712","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1713155570000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d1d9908e4a20ee27d6aa3ceb7e4062ae","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1713155570000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"1b2dc18fb76ca31dd6de483d121b9759","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1713155570000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"99cb375f2df97369074e151169f5127c","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1713155570000},{

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
    Category:dropped
    Size (bytes):12288
    Entropy (8bit):1.1894077637022427
    Encrypted:false
    SSDEEP:48:TGufl2GL7msEHUUUUUUUUEQLSvR9H9vxFGiDIAEkGVvpgcQj:lNVmswUUUUUUUUEQL+FGSItEcQj
    MD5:2468CF1407296B04A4B7F5DE3705A249
    SHA1:478AB35524A4749C4B87892B06CEA9099C3119E5
    SHA-256:475A627670D1D3A7B0DB8C7736A957E2F8860768762BA60BB353945C10C81632
    SHA-512:70014B7FEA72157334B33B5C4A442DA288079A5A9C1034A236869D13F1E69F722174E4B42C16E6201680E08B763AB7851F19158CDBA42E79F23635904B7D1FA4
    Malicious:false
    Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:SQLite Rollback Journal
    Category:dropped
    Size (bytes):8720
    Entropy (8bit):1.6067956204452787
    Encrypted:false
    SSDEEP:48:7MVKUUUUUUUUUUEQfvR9H9vxFGiDIAEkGVvSqFl2GL7msH:7/UUUUUUUUUUEQXFGSIt4KVmsH
    MD5:FEC395D87EF8EF5CC7ACFD246A6ED072
    SHA1:E956A14BCA96A5C42AB6954E2F3B00C53D04D623
    SHA-256:283CB06EC4478A11C1F79B6139B69FF64A29A6C1FA036950ACB89752A00642A9
    SHA-512:4CF4A508EC94B8EB77EE42584EAA5DED78F5AD18C8A73A70A6F83F2F3F2C65BC9ACE887F9816F4E7559A5DB5D337CB2D04C6059E1E29E6B2EC77C7426C3F7C76
    Malicious:false
    Preview:.... .c.....V Z.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

    C:\Users\user\AppData\Local\Temp\MSI5863c.LOG

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
    Category:dropped
    Size (bytes):246
    Entropy (8bit):3.529459928009153
    Encrypted:false
    SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8+kKNQlaCH:Qw946cPbiOxDlbYnuRKvClaCH
    MD5:A5DE1BB9656C977B740A31D2ED485AF3
    SHA1:ACF2112A921B5A1785BDCA7A376D8D47DB92E8E2
    SHA-256:ADE9FDE12317FA89159B508F9811C6421D53DCDDA36A3AD7E83161E3229F77F6
    SHA-512:0C46468419A2A8EB42BF1AD764BFF59BA7B22AB2CC1F11FC64E88BC1102C74F0ED75142FA85F3725359AF1B163E0BE73E04FFF484CF08F3321F81C1133C51C9A
    Malicious:false
    Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.5./.0.4./.2.0.2.4. . .0.6.:.3.2.:.5.2. .=.=.=.....

    C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-15 06-32-46-822.log

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:ASCII text, with very long lines (393)
    Category:dropped
    Size (bytes):16525
    Entropy (8bit):5.345946398610936
    Encrypted:false
    SSDEEP:384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
    MD5:8947C10F5AB6CFFFAE64BCA79B5A0BE3
    SHA1:70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
    SHA-256:4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
    SHA-512:B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
    Malicious:false
    Preview:SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

    C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:ASCII text, with very long lines (393), with CRLF line terminators
    Category:dropped
    Size (bytes):16603
    Entropy (8bit):5.3866026504109135
    Encrypted:false
    SSDEEP:384:utxk1RwlEnXCLYe5ENsp3ZzTUvmFgULF2gcS+SrKSMtjt2zzQ5aJqJY1S4iN0MoC:Yep
    MD5:69A17CD77F35E3CF240BE625A47E3252
    SHA1:B5183690E6CFAE94FCDCE47021BEE6B48B297109
    SHA-256:5B53F4FF26A377E186B41568DCE05CBFC8F440D774EC58359FFADD19A39C73B5
    SHA-512:32285F7950FC899C828F9DA904DDB25F195538B366CE6C0F1EAEF423DC316FAF9775295D279B3295D577689C1E7EE42FA0B4A463970C3921D098E7EAF0A1C54B
    Malicious:false
    Preview:SessionID=19ba5e55-974b-4d35-826d-c99747d8d72a.1713155566840 Timestamp=2024-04-15T06:32:46:840+0200 ThreadID=7484 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=19ba5e55-974b-4d35-826d-c99747d8d72a.1713155566840 Timestamp=2024-04-15T06:32:46:854+0200 ThreadID=7484 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=19ba5e55-974b-4d35-826d-c99747d8d72a.1713155566840 Timestamp=2024-04-15T06:32:46:854+0200 ThreadID=7484 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=19ba5e55-974b-4d35-826d-c99747d8d72a.1713155566840 Timestamp=2024-04-15T06:32:46:858+0200 ThreadID=7484 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=19ba5e55-974b-4d35-826d-c99747d8d72a.1713155566840 Timestamp=2024-04-15T06:32:46:858+0200 ThreadID=7484 Component=ngl-lib_NglAppLib Description="SetConf

    C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):29845
    Entropy (8bit):5.3951935245603115
    Encrypted:false
    SSDEEP:768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rj:MjulNpTqC488wR3+Y
    MD5:762913FD3EBCE8AB9412DE10B7F82A74
    SHA1:06E6C57BDC3099B62488BAF11951977E324CDAB3
    SHA-256:1E38DCF353D95EDB34EA872619AA03EEDA880FF61F8D1A832A7B84AB470B883A
    SHA-512:75414E52727887D7FCE0F3DFF404945A95F97860A47AB3B715B354DF0F6F903E59C38DBDCA9AB0112CCA9B0C98982AE91240B9C3BF314249325642D77C8A73D1
    Malicious:false
    Preview:03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

    C:\Users\user\AppData\Local\Temp\acrocef_low\3f01de2e-d932-41b4-b8ba-aa6fbefcb29b.tmp

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
    Category:dropped
    Size (bytes):1419751
    Entropy (8bit):7.976496077007677
    Encrypted:false
    SSDEEP:24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
    MD5:18E3D04537AF72FDBEB3760B2D10C80E
    SHA1:B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
    SHA-256:BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
    SHA-512:2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
    Malicious:false
    Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

    C:\Users\user\AppData\Local\Temp\acrocef_low\5f479ce3-ab06-4036-9dc6-7204826b1b4b.tmp

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
    Category:dropped
    Size (bytes):758601
    Entropy (8bit):7.98639316555857
    Encrypted:false
    SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
    MD5:3A49135134665364308390AC398006F1
    SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
    SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
    SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
    Malicious:false
    Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

    C:\Users\user\AppData\Local\Temp\acrocef_low\ac548db0-f65f-4ca3-b8ae-95f6820c78da.tmp

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
    Category:dropped
    Size (bytes):386528
    Entropy (8bit):7.9736851559892425
    Encrypted:false
    SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
    MD5:5C48B0AD2FEF800949466AE872E1F1E2
    SHA1:337D617AE142815EDDACB48484628C1F16692A2F
    SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
    SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
    Malicious:false
    Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

    C:\Users\user\AppData\Local\Temp\acrocef_low\e59fa07d-7bde-4613-acfe-e933548d9f68.tmp

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
    Category:dropped
    Size (bytes):1407294
    Entropy (8bit):7.97605879016224
    Encrypted:false
    SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
    MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
    SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
    SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
    SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
    Malicious:false
    Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

    Static File Info

    General

    File type:PDF document, version 1.4
    Entropy (8bit):7.867743441791171
    TrID:
    • Adobe Portable Document Format (5005/1) 100.00%
    File name:PRM360 Vulnerabilty.pdf
    File size:6'177'623 bytes
    MD5:704ff2ead1c61e0afa35c513ca6daff0
    SHA1:4647fb0aaf4c1c56b7870bd4be7534e689416b7c
    SHA256:422c07632a709d48200fe6069df7b9636a3fc658ccefb4d03fc610f1436394bc
    SHA512:03131d4e2a9bd37707bfc6b961eb7e440975a13a4bcfdf8561d6805baa44a49fc2c8d2445a0a583ef9dbe18e844be116601d5e9eb701e9db96eb752db1b02f9b
    SSDEEP:98304:fa7OLDBk1BUVNZJy4s7XinhI45lAia5tIXfhJ0Ci6GWDUQvGKE1MVyWgIX/:f0OL9YUOyhI456t8ZJ0Ci9IU9KEmyWFP
    TLSH:5556A0078C088B53A52C83E97D170D9D2F1A6B5CE9927AFF10661ECB3F606255C9F42E
    File Content Preview:%PDF-1.4.%......75 0 obj.<</Linearized 1/L 6177623/O 77/E 125387/N 16/T 6176003/H [ 836 447]>>.endobj. ..xref..75 27..0000000016 00000 n..0000001283 00000 n..0000001346 00000 n..0000001514 00000 n..0000001717 00000 n..0000001748 00000 n..000000

    File Icon

    Icon Hash:62cc8caeb29e8ae0

    Static PDF Info

    General

    Header:%PDF-1.4
    Total Entropy:7.867743
    Total Bytes:6177623
    Stream Entropy:7.866511
    Stream Bytes:6159182
    Entropy outside Streams:5.253497
    Bytes outside Streams:18441
    Number of EOF found:2
    Bytes after EOF:
    NameCount
    obj101
    endobj101
    stream48
    endstream48
    xref2
    trailer2
    startxref2
    /Page16
    /Encrypt0
    /ObjStm0
    /URI0
    /JS0
    /JavaScript0
    /AA0
    /OpenAction0
    /AcroForm0
    /JBIG2Decode0
    /RichMedia0
    /Launch0
    /EmbeddedFile0
    IDDHASHMD5Preview
    886d6b6b650b330323772e3d1b701cc45c37921c7ca6de7861
    89e8965549493596e88511cf604efbaa9478a2dbf6eb28e25d
    996d6b6b651d53332bd8b6aed96f801d9c01b8fa2dedc8501b
    100e8965549493596e81b3bdda12202c404d8dc6dd5200ee559
    4b5b4b3b7b737b3f39f6cf7193bed493444db3a5540fa9d4a

    Network Behavior

    Download Network PCAP: filtered – full

    TimestampSource PortDest PortSource IPDest IP
    Apr 15, 2024 06:32:56.908395052 CEST49742443192.168.2.423.3.84.164
    Apr 15, 2024 06:32:56.908433914 CEST4434974223.3.84.164192.168.2.4
    Apr 15, 2024 06:32:56.908502102 CEST49742443192.168.2.423.3.84.164
    Apr 15, 2024 06:32:56.908675909 CEST49742443192.168.2.423.3.84.164
    Apr 15, 2024 06:32:56.908689976 CEST4434974223.3.84.164192.168.2.4
    Apr 15, 2024 06:32:57.394983053 CEST4434974223.3.84.164192.168.2.4
    Apr 15, 2024 06:32:57.395477057 CEST49742443192.168.2.423.3.84.164
    Apr 15, 2024 06:32:57.395504951 CEST4434974223.3.84.164192.168.2.4
    Apr 15, 2024 06:32:57.399122000 CEST4434974223.3.84.164192.168.2.4
    Apr 15, 2024 06:32:57.399200916 CEST49742443192.168.2.423.3.84.164
    Apr 15, 2024 06:32:57.401143074 CEST49742443192.168.2.423.3.84.164
    Apr 15, 2024 06:32:57.401318073 CEST4434974223.3.84.164192.168.2.4
    Apr 15, 2024 06:32:57.401357889 CEST49742443192.168.2.423.3.84.164
    Apr 15, 2024 06:32:57.444350958 CEST49742443192.168.2.423.3.84.164
    Apr 15, 2024 06:32:57.444365025 CEST4434974223.3.84.164192.168.2.4
    Apr 15, 2024 06:32:57.491168022 CEST49742443192.168.2.423.3.84.164
    Apr 15, 2024 06:32:57.675522089 CEST4434974223.3.84.164192.168.2.4
    Apr 15, 2024 06:32:57.675673008 CEST4434974223.3.84.164192.168.2.4
    Apr 15, 2024 06:32:57.675772905 CEST49742443192.168.2.423.3.84.164
    Apr 15, 2024 06:32:57.676122904 CEST49742443192.168.2.423.3.84.164
    Apr 15, 2024 06:32:57.676151037 CEST4434974223.3.84.164192.168.2.4

    HTTP Request Dependency Graph

    • armmf.adobe.com

    HTTPS Proxied Packets

    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
    0192.168.2.44974223.3.84.1644437692C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    TimestampBytes transferredDirectionData
    2024-04-15 04:32:57 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
    Host: armmf.adobe.com
    Connection: keep-alive
    Accept-Language: en-US,en;q=0.9
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
    Sec-Fetch-Site: same-origin
    Sec-Fetch-Mode: no-cors
    Sec-Fetch-Dest: empty
    Accept-Encoding: gzip, deflate, br
    If-None-Match: "78-5faa31cce96da"
    If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
    2024-04-15 04:32:57 UTC198INHTTP/1.1 304 Not Modified
    Content-Type: text/plain; charset=UTF-8
    Last-Modified: Mon, 01 May 2023 15:02:33 GMT
    ETag: "78-5faa31cce96da"
    Date: Mon, 15 Apr 2024 04:32:57 GMT
    Connection: close


    Statistics

    CPU Usage

    050100s020406080100

    Click to jump to process

    Memory Usage

    050100s0.00204060MB

    Click to jump to process

    High Level Behavior Distribution

    • • File
    • • Registry

    Click to dive into process behavior distribution

    Behavior

    Click to jump to process

    System Behavior

    General

    Target ID:0
    Start time:06:32:43
    Start date:15/04/2024
    Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    Wow64 process (32bit):false
    Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\PRM360 Vulnerabilty.pdf"
    Imagebase:0x7ff6bc1b0000
    File size:5'641'176 bytes
    MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:moderate
    Has exited:true
    Show Windows behavior

    File Activities

    Show Windows behavior

    Section Activities

    Show Windows behavior

    Registry Activities

    Show Windows behavior

    COM Activities

    Show Windows behavior

    Mutex Activities

    Show Windows behavior

    Process Activities

    Show Windows behavior

    Thread Activities

    Show Windows behavior

    Memory Activities

    Show Windows behavior

    System Activities

    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
    Show Windows behavior

    Windows UI Activities

    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

    General

    Target ID:1
    Start time:06:32:44
    Start date:15/04/2024
    Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    Wow64 process (32bit):false
    Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
    Imagebase:0x7ff74bb60000
    File size:3'581'912 bytes
    MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:moderate
    Has exited:true
    Show Windows behavior

    File Activities

    Show Windows behavior

    Section Activities

    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
    Show Windows behavior

    Mutex Activities

    Show Windows behavior

    Process Activities

    Show Windows behavior

    Thread Activities

    Show Windows behavior

    Memory Activities

    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
    Show Windows behavior

    Process Token Activities

    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

    General

    Target ID:3
    Start time:06:32:44
    Start date:15/04/2024
    Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    Wow64 process (32bit):false
    Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1568,i,3619652238769408371,2296209543720641968,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
    Imagebase:0x7ff74bb60000
    File size:3'581'912 bytes
    MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:moderate
    Has exited:true
    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
    Show Windows behavior

    Section Activities

    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
    Show Windows behavior

    Process Activities

    Show Windows behavior

    Thread Activities

    Show Windows behavior

    Memory Activities

    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

    Disassembly

    ⊘No disassembly