Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Usc credit Union Bank Letter- copy.pdf

Overview

General Information

Sample name:Usc credit Union Bank Letter- copy.pdf
Analysis ID:1528502
MD5:b0c27a59f6b7246a6ccd99bd675d66f6
SHA1:478c5f6502d7e529e13a5a6c902eb00765dd594a
SHA256:93235fca9fbe77a4dc06e55dbc89b657a852a19045d1c04b7d7df7f09c6adb36
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 6984 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Usc credit Union Bank Letter- copy.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 6360 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 4140 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1556,i,8437841704339123093,10600651356444801376,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficDNS query: name: x1.i.lencr.org
Source: global trafficTCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.12:49730
Source: global trafficTCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.12:49730
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.12:49730
Source: global trafficTCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.12:49730
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.12:49730
Source: global trafficTCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.12:49730
Source: global trafficTCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.12:49730
Source: global trafficTCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.12:49730
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.12:49730
Source: global trafficTCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global trafficTCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global trafficTCP traffic: 23.56.162.185:443 -> 192.168.2.12:49730
Source: global trafficTCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: Joe Sandbox ViewIP Address: 23.56.162.185 23.56.162.185
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global trafficDNS traffic detected: DNS query: x1.i.lencr.org
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.drString found in binary or memory: http://x1.i.lencr.org/
Source: ReaderMessages.0.drString found in binary or memory: https://www.adobe.co
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: classification engineClassification label: clean2.winPDF@14/43@1/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journalJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-07 18-19-51-434.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Usc credit Union Bank Letter- copy.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1556,i,8437841704339123093,10600651356444801376,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1556,i,8437841704339123093,10600651356444801376,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: Usc credit Union Bank Letter- copy.pdfInitial sample: PDF keyword /JS count = 0
Source: Usc credit Union Bank Letter- copy.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: Usc credit Union Bank Letter- copy.pdfInitial sample: PDF keyword stream count = 104
Source: Usc credit Union Bank Letter- copy.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: Usc credit Union Bank Letter- copy.pdfInitial sample: PDF keyword endstream count = 104
Source: Usc credit Union Bank Letter- copy.pdfInitial sample: PDF keyword obj count = 107
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts3
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media2
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive13
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1528502 Sample: Usc credit Union Bank Lette... Startdate: 08/10/2024 Architecture: WINDOWS Score: 2 14 x1.i.lencr.org 2->14 7 Acrobat.exe 18 68 2->7         started        process3 process4 9 AcroCEF.exe 108 7->9         started        process5 11 AcroCEF.exe 4 9->11         started        dnsIp6 16 23.56.162.185, 443, 49730 AKAMAI-ASUS United States 11->16

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://x1.i.lencr.org/0%URL Reputationsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
x1.i.lencr.org
unknown
unknownfalse
    		unknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://x1.i.lencr.org/2D85F72862B55C4EADD9E66E06947F3D0.2.drfalse
    • URL Reputation: safe
    		unknown
    https://www.adobe.coReaderMessages.0.drfalse
      		unknown

      World Map of Contacted IPs

      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs

      Public IPs

      IPDomainCountryFlagASNASN NameMalicious
      23.56.162.185
      		unknownUnited States
      		16625AKAMAI-ASUSfalse

      General Information

      Joe Sandbox version:41.0.0 Charoite
      Analysis ID:1528502
      Start date and time:2024-10-08 00:18:46 +02:00
      Joe Sandbox product:CloudBasic
      Overall analysis duration:0h 4m 15s
      Hypervisor based Inspection enabled:false
      Report type:full
      Cookbook file name:defaultwindowspdfcookbook.jbs
      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
      Number of analysed new started processes analysed:12
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • EGA enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Sample name:Usc credit Union Bank Letter- copy.pdf
      Detection:CLEAN
      Classification:clean2.winPDF@14/43@1/1
      Cookbook Comments:
      • Found application associated with file extension: .pdf
      • Found PDF document
      • Close Viewer

      Warnings

      • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
      • Excluded IPs from analysis (whitelisted): 184.28.88.176, 54.227.187.23, 23.22.254.206, 52.202.204.11, 52.5.13.197, 172.64.41.3, 162.159.61.3, 2.19.126.143, 2.19.126.149, 2.23.197.184
      • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com, crl.root-x1.letsencrypt.org.edgekey.net
      • VT rate limit hit for: Usc credit Union Bank Letter- copy.pdf

      Simulations

      Behavior and APIs

      TimeTypeDescription
      18:20:01API Interceptor1x Sleep call for process: AcroCEF.exe modified

      Joe Sandbox View / Context

      IPs

      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      23.56.162.185https://app.collabow.io/d/GNgkdZO5gKluqEP3mMdbEwzWbgEyOeRe8sIh64SLMvsNGet hashmaliciousUnknownBrowse
        Refrence-Order#63729.pdfGet hashmaliciousAzorultBrowse
          DV2mrnfX2d.exeGet hashmaliciousRhysidaBrowse
            Xkci1BfrmX.lnkGet hashmaliciousLonePageBrowse
              Snc2ZNvAZP.pdfGet hashmaliciousUnknownBrowse
                Purchase Order IBT LPO-2320.emlGet hashmaliciousUnknownBrowse
                  Final_Contract_Copy-532392974.pdfGet hashmaliciousUnknownBrowse
                    Cbequipment-Voice Audio Interface.pdfGet hashmaliciousHTMLPhisherBrowse
                      Runbook - Carolinas Animal Hospital - 2022-05-25 11.28 UTC -04.00.pdfGet hashmaliciousUnknownBrowse
                        Hajj_Advisory pdf lnk.lnkGet hashmaliciousUnknownBrowse

                          Domains

                          ⊘No context

                          ASNs

                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                          AKAMAI-ASUS9Y6R8fs0wd.exeGet hashmaliciousLummaCBrowse
                          • 104.102.49.254
                          file.exeGet hashmaliciousLummaCBrowse
                          • 104.102.49.254
                          PFW1cgN8EK.exeGet hashmaliciousLummaCBrowse
                          • 104.102.49.254
                          file.exeGet hashmaliciousLummaCBrowse
                          • 104.102.49.254
                          SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exeGet hashmaliciousLummaCBrowse
                          • 104.102.49.254
                          utmggBCMML.exeGet hashmaliciousLummaCBrowse
                          • 104.102.49.254
                          lihZ6gUU7V.exeGet hashmaliciousLummaC, Stealc, VidarBrowse
                          • 104.102.49.254
                          Bn7LPdQA1s.exeGet hashmaliciousLummaC, VidarBrowse
                          • 104.102.49.254
                          https://www.dropbox.com/scl/fi/qo6796ed7hlrt0v8k9nr6/Patagonia-Health-Barcode-Scanner-Setup-2024.exe?rlkey=5bmndvx8124ztopqewiogbnlt&st=yvxpokhf&dl=0Get hashmaliciousUnknownBrowse
                          • 184.28.90.27
                          file.exeGet hashmaliciousLummaCBrowse
                          • 104.102.49.254

                          JA3 Fingerprints

                          ⊘No context

                          Dropped Files

                          ⊘No context

                          Created / dropped Files

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:ASCII text
                          Category:dropped
                          Size (bytes):292
                          Entropy (8bit):5.202740471441105
                          Encrypted:false
                          SSDEEP:6:7Jd1+q2Pv2nKuAl9OmbnIFUt8IJdxm5Zmw+IJdxmtVkwOv2nKuAl9OmbjLJ:7JdAv2HAahFUt8IJdxa/+IJdxm5bHAae
                          MD5:B3C0109F3B6476BA253792B1DA91684B
                          SHA1:EDC387D02B4087FC40E559801FCB6093715F514C
                          SHA-256:AB78D6735D26E65623174901CC9EDC5AAB9EBAB8AB09009C124F7A7C09808D50
                          SHA-512:469742D2C7A3583FFE919D484386B1FF998FCE2BBDC32E6B75F7C53EEDDA01276AA1A4A930AB9621505ADD5331FB10FD11BE6A9E86ACDC08276B99B9F939E449
                          Malicious:false
                          Reputation:low
                          Preview:2024/10/07-18:19:48.814 1998 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/07-18:19:48.817 1998 Recovering log #3.2024/10/07-18:19:48.817 1998 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:ASCII text
                          Category:dropped
                          Size (bytes):292
                          Entropy (8bit):5.202740471441105
                          Encrypted:false
                          SSDEEP:6:7Jd1+q2Pv2nKuAl9OmbnIFUt8IJdxm5Zmw+IJdxmtVkwOv2nKuAl9OmbjLJ:7JdAv2HAahFUt8IJdxa/+IJdxm5bHAae
                          MD5:B3C0109F3B6476BA253792B1DA91684B
                          SHA1:EDC387D02B4087FC40E559801FCB6093715F514C
                          SHA-256:AB78D6735D26E65623174901CC9EDC5AAB9EBAB8AB09009C124F7A7C09808D50
                          SHA-512:469742D2C7A3583FFE919D484386B1FF998FCE2BBDC32E6B75F7C53EEDDA01276AA1A4A930AB9621505ADD5331FB10FD11BE6A9E86ACDC08276B99B9F939E449
                          Malicious:false
                          Reputation:low
                          Preview:2024/10/07-18:19:48.814 1998 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/07-18:19:48.817 1998 Recovering log #3.2024/10/07-18:19:48.817 1998 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:ASCII text
                          Category:dropped
                          Size (bytes):333
                          Entropy (8bit):5.187702065444167
                          Encrypted:false
                          SSDEEP:6:7JddFAq2Pv2nKuAl9Ombzo2jMGIFUt8IJdXZZmw+IJd2FvDkwOv2nKuAl9Ombzos:7JdMv2HAa8uFUt8IJdJ/+IJd21D5bHAv
                          MD5:72852A505CB137C5BEDCAEC70EC72B37
                          SHA1:1395948F707180350F38F18649129E0AA0971643
                          SHA-256:9BBE4EA959C81C5D80E3535A933761EF07F89090AFAC1216BB41FD85205078ED
                          SHA-512:65EBC0E1ACD1202250D59260E10FE6029A2F549263EFD72557D8B133E754477FACAB6D67EAFE75955371206105019B5FB8492A046AF7ED541D3E10BCADB9B747
                          Malicious:false
                          Reputation:low
                          Preview:2024/10/07-18:19:48.879 c70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/07-18:19:48.884 c70 Recovering log #3.2024/10/07-18:19:48.885 c70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:ASCII text
                          Category:dropped
                          Size (bytes):333
                          Entropy (8bit):5.187702065444167
                          Encrypted:false
                          SSDEEP:6:7JddFAq2Pv2nKuAl9Ombzo2jMGIFUt8IJdXZZmw+IJd2FvDkwOv2nKuAl9Ombzos:7JdMv2HAa8uFUt8IJdJ/+IJd21D5bHAv
                          MD5:72852A505CB137C5BEDCAEC70EC72B37
                          SHA1:1395948F707180350F38F18649129E0AA0971643
                          SHA-256:9BBE4EA959C81C5D80E3535A933761EF07F89090AFAC1216BB41FD85205078ED
                          SHA-512:65EBC0E1ACD1202250D59260E10FE6029A2F549263EFD72557D8B133E754477FACAB6D67EAFE75955371206105019B5FB8492A046AF7ED541D3E10BCADB9B747
                          Malicious:false
                          Reputation:low
                          Preview:2024/10/07-18:19:48.879 c70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/07-18:19:48.884 c70 Recovering log #3.2024/10/07-18:19:48.885 c70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):476
                          Entropy (8bit):4.973885314919398
                          Encrypted:false
                          SSDEEP:12:YH/um3RA8sqlsBdOg2Hzgcaq3QYiubPP7E4T3y:Y2sRdsTdMHP3QYhbH7nby
                          MD5:DDAB5BAFCF18A1EE8D48E2DCD81D4304
                          SHA1:84BE5CEEFD41BF4193751104B4FE7060E7D2CEF7
                          SHA-256:BE2DAF8CD23A0E07AB44BB9AE89B7504F2D7E684393FC8FA35C6E05552F41C8D
                          SHA-512:08898E3676C21FF2381B1950A9D285E89C0F674027DDE5FDB605E6FCBDF91EDE3FD0D12A8E60EE633DF283EADC9800FFCE7A4837ADE3843E39660213094F7E67
                          Malicious:false
                          Reputation:low
                          Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372899601310349","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":109673},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.12","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cb32f0db-2877-4726-92e1-ec3eff87d4d0.tmp

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:JSON data
                          Category:modified
                          Size (bytes):476
                          Entropy (8bit):4.973885314919398
                          Encrypted:false
                          SSDEEP:12:YH/um3RA8sqlsBdOg2Hzgcaq3QYiubPP7E4T3y:Y2sRdsTdMHP3QYhbH7nby
                          MD5:DDAB5BAFCF18A1EE8D48E2DCD81D4304
                          SHA1:84BE5CEEFD41BF4193751104B4FE7060E7D2CEF7
                          SHA-256:BE2DAF8CD23A0E07AB44BB9AE89B7504F2D7E684393FC8FA35C6E05552F41C8D
                          SHA-512:08898E3676C21FF2381B1950A9D285E89C0F674027DDE5FDB605E6FCBDF91EDE3FD0D12A8E60EE633DF283EADC9800FFCE7A4837ADE3843E39660213094F7E67
                          Malicious:false
                          Reputation:low
                          Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372899601310349","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":109673},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.12","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:data
                          Category:dropped
                          Size (bytes):4288
                          Entropy (8bit):5.210423556770481
                          Encrypted:false
                          SSDEEP:96:GQux1TtQoLOdBrjx5uaLOKhtr8OU8tZdUtFuHHoQHzOinwbFiZ:zux1TNOdBrjxQIOK/4OvZdUPuHHoQHSQ
                          MD5:172B35BF98CF40F027F0B42B16747851
                          SHA1:9ACA24AE43EAE79B1C95181DDACC5D40AFFFB315
                          SHA-256:73A5A4322A01091DFAD4ECAB7EB176FC83D48C67465EF28F93559AE6644F9AE8
                          SHA-512:995DC0D10CC8E6C8D0A7E1692DB3C21630F8C8D6298E18B0D9FB98E91E68945EA3325CF5E723640C8D8363D89F34539588667200188FF55286BA33329DE53B12
                          Malicious:false
                          Reputation:low
                          Preview:*...#................version.1..namespace-....o................next-map-id.1.Pnamespace-7e305c39_d2cf_4529_a05a_c594b19b130d-https://rna-resource.acrobat.com/.08..ur................next-map-id.2.Snamespace-3b7a0125_ffe4_43e4_9267_9114e9bd4ef0-https://rna-v2-resource.acrobat.com/.1..kr................next-map-id.3.Snamespace-b5707108_0a77_4f86_8085_b3b780fa5fd7-https://rna-v2-resource.acrobat.com/.2a60.o................next-map-id.4.Pnamespace-706bf942_8f67_4abb_a866_2428106408be-https://rna-resource.acrobat.com/.3....^...............Pnamespace-7e305c39_d2cf_4529_a05a_c594b19b130d-https://rna-resource.acrobat.com/$...r................next-map-id.5.Snamespace-8636f107_899a_42b0_9217_ddfd773d1c84-https://rna-v2-resource.acrobat.com/.4..p.r................next-map-id.6.Snamespace-7b9f8588_400e_4560_9274_0b14323a49a1-https://rna-v2-resource.acrobat.com/.5]..ro................next-map-id.7.Pnamespace-c8af9c4a_d01c_48c1_9e5d_35b6c87a8d52-https://rna-resource.acrobat.com/.6...uo..............

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:ASCII text
                          Category:dropped
                          Size (bytes):321
                          Entropy (8bit):5.210513817426663
                          Encrypted:false
                          SSDEEP:6:72o4q2Pv2nKuAl9OmbzNMxIFUt8I2uJZmw+IQ6kwOv2nKuAl9OmbzNMFLJ:72o4v2HAa8jFUt8I2uJ/+Ib5bHAa84J
                          MD5:E44891A5043ECFCEB2A89951C7B17541
                          SHA1:685629BFBB6B97684B40A14EAFEFFDEF3AE9263F
                          SHA-256:CF809FBA31AFA90EF7E4AC92FE6984819F04913AF20648D1A5D1E8703DB997EC
                          SHA-512:B5CF5CBAE11A9D171EBC497CD00C1E2271E2C7AE3CC3538AAE83BDE170F33DCCFA115950FA78A6B210A8121EC4356D20388AC10764E1B821DBDC7E24E5A99C3E
                          Malicious:false
                          Reputation:low
                          Preview:2024/10/07-18:19:49.315 c70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/07-18:19:49.317 c70 Recovering log #3.2024/10/07-18:19:49.324 c70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:ASCII text
                          Category:dropped
                          Size (bytes):321
                          Entropy (8bit):5.210513817426663
                          Encrypted:false
                          SSDEEP:6:72o4q2Pv2nKuAl9OmbzNMxIFUt8I2uJZmw+IQ6kwOv2nKuAl9OmbzNMFLJ:72o4v2HAa8jFUt8I2uJ/+Ib5bHAa84J
                          MD5:E44891A5043ECFCEB2A89951C7B17541
                          SHA1:685629BFBB6B97684B40A14EAFEFFDEF3AE9263F
                          SHA-256:CF809FBA31AFA90EF7E4AC92FE6984819F04913AF20648D1A5D1E8703DB997EC
                          SHA-512:B5CF5CBAE11A9D171EBC497CD00C1E2271E2C7AE3CC3538AAE83BDE170F33DCCFA115950FA78A6B210A8121EC4356D20388AC10764E1B821DBDC7E24E5A99C3E
                          Malicious:false
                          Reputation:low
                          Preview:2024/10/07-18:19:49.315 c70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/07-18:19:49.317 c70 Recovering log #3.2024/10/07-18:19:49.324 c70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                          C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241007221953Z-204.bmp

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
                          Category:dropped
                          Size (bytes):71190
                          Entropy (8bit):1.8248418584756152
                          Encrypted:false
                          SSDEEP:192:6wZYG272cbdrpnqYYU28Y8AVb1GarWhRn93dhOkAiRr5bolZKwE:JWKcprpvp2nVYar2bQ1sTT
                          MD5:855B1B69058F487CCCFC29757ECF53C1
                          SHA1:F212E8690D811C93492EB9F2EC2F979BA8AACA41
                          SHA-256:751DD61E955D7F5EBB0500D3C7381AC645B6A10E80D138B4E8E04D7B7E9AEA23
                          SHA-512:973454C8287FD5F9AE86B7DC16E4084D928AA7E48C4F4CBFEBC61FBADCA8FD8296AAC0BC8DF1FB7D1265B320D723D00DEA19C07F0BE111EF2477403841CEC2F0
                          Malicious:false
                          Preview:BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                          C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
                          Category:dropped
                          Size (bytes):86016
                          Entropy (8bit):4.438155701634519
                          Encrypted:false
                          SSDEEP:384:ye1ci5G1iBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:S5urVgazUpUTTGt
                          MD5:2967512E5EAB9FF4B9D5F1A4DAC0A93E
                          SHA1:50341F70C7750560D70D0E98CB70BDC6E24B37B5
                          SHA-256:DE480D75CC87910759E2816960B1C6C491BDFA217489EF0A7256540C8D813010
                          SHA-512:4458DFF9AB2FA97CBE5AEE04157EC27D8F381AB0F5D3DB8FFF817535343CE27B8CAEDE280F2A02B929953F441BED1CEEDC6B24243339B73804D36634EA70EB53
                          Malicious:false
                          Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                          C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:SQLite Rollback Journal
                          Category:dropped
                          Size (bytes):8720
                          Entropy (8bit):3.7657772994415395
                          Encrypted:false
                          SSDEEP:48:7MMJioyVZioyhoy1C7oy16oy1zKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1O+:7LJuZn6XjBilb9IVXEBodRBk7
                          MD5:2AC2243103F189CA0E4A7551E4633671
                          SHA1:5BFEE24F7A9ECBE81A1D7B2C5E3FB385DADDE085
                          SHA-256:DAF08526137A06B258BA4B75A1E42498598CDCBCDAEEE94CABCBBD1C938B9A5A
                          SHA-512:5D05F4FD204C04B55E96947160E25866F669B68EE503EC2EC6986983035B1A446F371C8BAD97F9B190C58DD22E815F977FCA211E36175880527747B309FB3E6D
                          Malicious:false
                          Preview:.... .c........U...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                          C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:Certificate, Version=3
                          Category:dropped
                          Size (bytes):1391
                          Entropy (8bit):7.705940075877404
                          Encrypted:false
                          SSDEEP:24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
                          MD5:0CD2F9E0DA1773E9ED864DA5E370E74E
                          SHA1:CABD2A79A1076A31F21D253635CB039D4329A5E8
                          SHA-256:96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
                          SHA-512:3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
                          Malicious:false
                          Preview:0..k0..S............@.YDc.c...0...*.H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0...*.H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I.....*.A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.|C.t..t.....0.[q6....00\H..;..}`...).........A.......|.;F.H*..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..|o..;.....'...}~.."......

                          C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:data
                          Category:dropped
                          Size (bytes):192
                          Entropy (8bit):2.7673182398396405
                          Encrypted:false
                          SSDEEP:3:kkFklLSbEVXfllXlE/HT8kmlJXNNX8RolJuRdxLlGB9lQRYwpDdt:kKhbEmT8zNMa8RdWBwRd
                          MD5:A46386D77778D7EE52FF0BFE780EA4B7
                          SHA1:AE763FD935C4AC96F83C320C2C9B3E0E8A2419E4
                          SHA-256:DA8641CA4DD27C390796368E3D22A060FAA23E815287C93502E5F731D1E0F354
                          SHA-512:D40D269F4FA1700396ED935A0631CD4421A60B0AF43A0C07FB96DCD5A284C13F444185E4F570A5C1F7602AD79B83EFC7EA7776BDFDC3B1415E525156C9AF1B4D
                          Malicious:false
                          Preview:p...... ........8.>.....(....................................................... ..........W.....H..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:data
                          Category:dropped
                          Size (bytes):227002
                          Entropy (8bit):3.392780893644728
                          Encrypted:false
                          SSDEEP:1536:qKPC4iyzDtrh1cK3XEihW7VK/3AYvYwgF/rRoL+sn:XPCyl/3AYvYwglFoL+sn
                          MD5:AC4D831D284E1A0B031212C23457E437
                          SHA1:81956E4DEC35B1BB75D7DE5C9D2CF2B68C1C6416
                          SHA-256:B91563F11F3D99A8267709DC454B7591DA1E1409742DECBF5DC79F3E2589A469
                          SHA-512:F647862252580EE86825D9564CB6E8C407DAFF395CDD3FF05A3764C514CAE7B7E9A6946661AD6C7C15F1639E03987FD419BF31E5C9BA038156B0492A057AE659
                          Malicious:false
                          Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):295
                          Entropy (8bit):5.376371509737731
                          Encrypted:false
                          SSDEEP:6:YEQXJ2HXFcuVwQdhlzFkF0YGBRVeoAvJM3g98kUwPeUkwRe9:YvXKXFcuVHZ5VGMbLUkee9
                          MD5:AE49849ED413CDD8E9EA8D0496FA3C1E
                          SHA1:4B6B9A1CB3DA711D3FFC898A83B92C1459265308
                          SHA-256:97BAFAF10ADE397B36007629F8550D1C9678F5A8279A87C34CFD5AB94E677D45
                          SHA-512:C36F2F1877A2DD42AA16D0DDA3F99353E56CAABC7E81E7A1436BACFE25F4EF166EA43FE3FC67254BA7C4002F14FEB61F2ED29A5A85234E6F6655A601FAA1F261
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"2991c4c2-32e8-48b6-b4f8-feb28ebbc13d","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1728517300086,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):294
                          Entropy (8bit):5.314003175190374
                          Encrypted:false
                          SSDEEP:6:YEQXJ2HXFcuVwQdhlzFkF0YGBRVeoAvJfBoTfXpnrPeUkwRe9:YvXKXFcuVHZ5VGWTfXcUkee9
                          MD5:85C1F59CABB57E9FB567D6A4784E73FC
                          SHA1:89F5AE741621389D00D0D5FE05E79E03E29083CE
                          SHA-256:6C5DA5ED68434FA3FB330A7A12F6C3A2BA3BE8C1CFE4BDD8A677FE3E8AA6BF6C
                          SHA-512:C66F9422C82B288CC78319D65039ECF41CDE78733AC58BADEFE11778725458719B7BF72C7512657FF1188612F2E034A9CEC4639CB0E30CC88C7DD5149FF8E441
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"2991c4c2-32e8-48b6-b4f8-feb28ebbc13d","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1728517300086,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):294
                          Entropy (8bit):5.292414848455235
                          Encrypted:false
                          SSDEEP:6:YEQXJ2HXFcuVwQdhlzFkF0YGBRVeoAvJfBD2G6UpnrPeUkwRe9:YvXKXFcuVHZ5VGR22cUkee9
                          MD5:314554D7004E094AA5222D177E06B6FB
                          SHA1:BFFF60D3F5626316DC5B34274B341ACEB02ED63C
                          SHA-256:B53EA807EA9ADECF847C03CEDB504D2BA830C1E6C67D45B089A478A3FFBFB982
                          SHA-512:396A75421A7B36BDA8B09954981AB0C777734184E649A1AEE2C288DA3F53CB5D19B9038A02007D83515E08CE6FFDFDF3460B7DF278253B3A0D8E2D77FD1A9458
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"2991c4c2-32e8-48b6-b4f8-feb28ebbc13d","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1728517300086,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):285
                          Entropy (8bit):5.3569677184387565
                          Encrypted:false
                          SSDEEP:6:YEQXJ2HXFcuVwQdhlzFkF0YGBRVeoAvJfPmwrPeUkwRe9:YvXKXFcuVHZ5VGH56Ukee9
                          MD5:FA1822D8DEB103C8F69632F61AF592D9
                          SHA1:919A5466B6BED3956FB3AC597D0CA1CD9E914A55
                          SHA-256:F3EE6A1B6893DFA6152A3E8388CD2FCCA03D1B99FFB93AF2EB7E969B6DFDA9CD
                          SHA-512:0E6D9631425E113428EE12121B5E9D47D806BE0FF39EFCDF73670038C4282CEF82FEF74DC6E280A8AC3585A8F769DDFF304E417DA839389C615DF43587E6CAF1
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"2991c4c2-32e8-48b6-b4f8-feb28ebbc13d","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1728517300086,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):1091
                          Entropy (8bit):5.68645081225643
                          Encrypted:false
                          SSDEEP:24:Yv6XLZIpLgE7cgD6SOGtnnl0RCmK8czOCYvSFvn:YvuZIhgs6SraAh8cvYKFvn
                          MD5:033EE2B579DB08C58C95AD0FC53B7844
                          SHA1:F33594A2FA7CFE353A542D9E2F0F910B4D5248E0
                          SHA-256:3E46D91D858F397956AF473C0992F6928014B2A98523489996B283FF09F523AE
                          SHA-512:F0F70B1BE6013DF6EF8394A5EAAB62A6BB1E281C13FC6FAA5AF788097A71872F2E3A91DB2429E4F87D63830F2F4CDBE5C2940D2B1674239F0A7325CF8743128A
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"2991c4c2-32e8-48b6-b4f8-feb28ebbc13d","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1728517300086,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"89628_281075ActionBlock_2","campaignId":89628,"containerId":"1","controlGroupId":"","treatmentId":"67a3a874-888f-4d96-9f3d-26e70c3e0be1","variationId":"281075"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQgUERGIGZpbGVzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNhdElkIjoiUkdTMDM1MS1FTlUtQ2hhbGxlbmdlcjIifQ==","dataType":"ap

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):1050
                          Entropy (8bit):5.655748380859934
                          Encrypted:false
                          SSDEEP:24:Yv6XLZaVLgEF0c7sbnl0RCmK8czOCYHflEpwiVovn:YvuZaFg6sGAh8cvYHWpwFvn
                          MD5:B023CF6BFAC9E7A5C0C4FBD7AFBB4AEF
                          SHA1:D74334D837A5B4459F6117A6995DA5C35BF958AD
                          SHA-256:30C66354C533C1C4D0FA7D5483AE476FC6785E0BF631FE775709A3284488CE60
                          SHA-512:AC65C55CC34E58CD902240158C5FA891E17EBB66FDC7303776388F7F1B243F62F86380DBB908E93EB3BA40E96AAB78DCD84D0427CCD05036F5714E660EE12909
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"2991c4c2-32e8-48b6-b4f8-feb28ebbc13d","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1728517300086,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_0","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"0924134e-3c59-4f53-b731-add558c56fec","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuZm9ybXMgJiBhZ3JlZW1lbnRzLiJ9LCJ0Y2F0SWQiOm51bGx9","dataType":"application\/json","encodingScheme":true},"

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):292
                          Entropy (8bit):5.305868520204317
                          Encrypted:false
                          SSDEEP:6:YEQXJ2HXFcuVwQdhlzFkF0YGBRVeoAvJfQ1rPeUkwRe9:YvXKXFcuVHZ5VGY16Ukee9
                          MD5:E886D5A04975CEA1F7778B48256E49A9
                          SHA1:955B432E02B99DA469BB8DAA25DAFA31DE68D22F
                          SHA-256:56E611C4446C52B6197C069CA09C2B6A2E6AC0CD04BDABBE8E3600C7FFA49573
                          SHA-512:2AA110316DA17EA5EA108E3A5922AEF0E92333C69804BD5E94DBA5875752AEC9C1B5955C54B7F51A1CA6F6CB2784FEEC32349BC5C8073A94B72AA867113452D0
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"2991c4c2-32e8-48b6-b4f8-feb28ebbc13d","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1728517300086,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):1098
                          Entropy (8bit):5.689024632449539
                          Encrypted:false
                          SSDEEP:24:Yv6XLZH2LgEFcs2SOGt0nl0RCmK8czOCUaBtCrfSFvn:YvuZHogq2SrhAh8cvUgEmFvn
                          MD5:596A3185491EB61024D02DD11390F021
                          SHA1:7CBAB9D1B20442FA61D8E77D4FDC81269854C673
                          SHA-256:A8B365A8002E4FBA5EDACD8901374AE82DB5C6E28D4F533309333F069338419E
                          SHA-512:4DA797E04CCA8D54CC274534432AB6DCDBB69718AC6AA48296D84A3FFAC77771F383792C4A0DBD97A97273CC8083BC1B41B62D16E085E1E2305C3B08234CF8B3
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"2991c4c2-32e8-48b6-b4f8-feb28ebbc13d","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1728517300086,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"89628_281075ActionBlock_0","campaignId":89628,"containerId":"1","controlGroupId":"","treatmentId":"abdf1d9d-2114-4953-95a6-4eed783b9872","variationId":"281075"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IlR1cm4gc2Nhbm5lZCBwYXBlciBkb2N1bWVudHNcbmludG8gaW5zdGFudGx5IGVkaXRhYmxlIFBERnMuIn0sInRjYXRJZCI6IlJHUzAzNTEtRU5VLUNoYWxsZW5nZXIyIn0=","dataTy

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):1164
                          Entropy (8bit):5.698577430414487
                          Encrypted:false
                          SSDEEP:24:Yv6XLZrKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK5ovn:YvuZrEgqprtrS5OZjSlwTmAfSKWvn
                          MD5:2DE427B24555B8619E951FA791F84F8D
                          SHA1:4057B9E0F773D8EE889F300C5CDECF5D10EE330C
                          SHA-256:9736795690C0376E6A049FCB0090A9235A30C2B11304B9DFC4A976350602AD78
                          SHA-512:ECA6D7F9E792E765DCF806FC13B75DAFA22635937E6E92A0B107A3B2D9A7FCAB85DA5B56ACE30133B670C2B662EB4555FCBF3275880E1D382DBB4B30C243B02E
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"2991c4c2-32e8-48b6-b4f8-feb28ebbc13d","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1728517300086,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):289
                          Entropy (8bit):5.314948384663603
                          Encrypted:false
                          SSDEEP:6:YEQXJ2HXFcuVwQdhlzFkF0YGBRVeoAvJfYdPeUkwRe9:YvXKXFcuVHZ5VGg8Ukee9
                          MD5:F193DC6275A14F58B5664044F1D78FB7
                          SHA1:A299E84B066FB64AB1985AF8EAB6E03AFA0A0CE0
                          SHA-256:C31D7C9FCB121A84C639E9B348052D0DD9320CFE4F50D526FE181D9486A1AFED
                          SHA-512:2CBEC7D75BD145ADD8147FA84A741B365A61636F55B9698E980A724F74732C32776F5443FB022976F7E49130A86941E5133C684D92FEFE88ACB1073FECF42631
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"2991c4c2-32e8-48b6-b4f8-feb28ebbc13d","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1728517300086,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):1395
                          Entropy (8bit):5.771148406486854
                          Encrypted:false
                          SSDEEP:24:Yv6XLZWrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNwvn:YvuZWHgDv3W2aYQfgB5OUupHrQ9FJWvn
                          MD5:E9F0A4F3DCCD7DE5D03C8A84D931D600
                          SHA1:AFF4D39AA5CA5AE2271C1F6D5A9B67E4D200EE1D
                          SHA-256:16C20363069CA02BD18B603F6829132657FBA65A7C2399A39642437FECE1D5C3
                          SHA-512:206964151F85B3A0BA61FA5E522C680F2F78AC89638B874342441B236BBF45E7DAFA9441CAB4CE544E6B0E0D6C82F038BBAC9267A6D2AF810FD18ADB5D1D3E65
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"2991c4c2-32e8-48b6-b4f8-feb28ebbc13d","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1728517300086,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):291
                          Entropy (8bit):5.298392744298543
                          Encrypted:false
                          SSDEEP:6:YEQXJ2HXFcuVwQdhlzFkF0YGBRVeoAvJfbPtdPeUkwRe9:YvXKXFcuVHZ5VGDV8Ukee9
                          MD5:788BC7FE968782492F4B06338C79EA39
                          SHA1:2A00EB2479C6D9D589ABB7D4F4298605C77B3A7C
                          SHA-256:A45AF0D5477A8134FC1B94A082E66A487A3D3438BE1157AD5F57224DD26EAB23
                          SHA-512:EAAFFBEF4CD4171AE864F0B4DAAE0BF740D72528FF2AC4962754294E32D3A5CC9F70CE157C144CD9D0DCBC86601665B9462067E4EB102D6752338AA71AABED2A
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"2991c4c2-32e8-48b6-b4f8-feb28ebbc13d","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1728517300086,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):287
                          Entropy (8bit):5.296992851416047
                          Encrypted:false
                          SSDEEP:6:YEQXJ2HXFcuVwQdhlzFkF0YGBRVeoAvJf21rPeUkwRe9:YvXKXFcuVHZ5VG+16Ukee9
                          MD5:DF6D7E6E31C620E0337E201784B6F655
                          SHA1:E4AC7E4B3E4872AD7B1536F7D7BD6DC88742E699
                          SHA-256:94C5FBA42682BA5972F653D0C63642DDCCB70076B58FA5DE0790F00C99C5DED3
                          SHA-512:41415F480EF6F5D8B9DF1FEDF015110B6A16D60EAC9D3F4A808D040378946FE987BF591131A02D3614F21C50B4B8BD1A014FAFDF2B8FB287CA91D3BCD5A67B66
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"2991c4c2-32e8-48b6-b4f8-feb28ebbc13d","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1728517300086,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):1054
                          Entropy (8bit):5.669527450917175
                          Encrypted:false
                          SSDEEP:24:Yv6XLZ8amXayLgE6cTg4QSOGtNaqnl0RCmK8czOC/CrfSFvn:YvuZaBgSXQSrOAh8cv6mFvn
                          MD5:FE283D410509B0E787126D25953A79C9
                          SHA1:E518E80BB878F529FA0B2F1108E272DFF6A154F3
                          SHA-256:6A9F4682CC350116D702D8A8C8976F1D743A6C1C4CD4537BAF0B53CBC33A3A40
                          SHA-512:D673802FF71D3C8F4F7704BDC71F33BFCD63CEAEA4BC650E56E65A2CEC7BD6DE345AC941AC1BADAD17FF9694946D72D4100BED0BAADAADC9660A9C2055456CE9
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"2991c4c2-32e8-48b6-b4f8-feb28ebbc13d","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1728517300086,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"89628_281075ActionBlock_1","campaignId":89628,"containerId":"1","controlGroupId":"","treatmentId":"7fe39695-394c-4706-9b50-651e7499d428","variationId":"281075"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6IlJHUzAzNTEtRU5VLUNoYWxsZW5nZXIyIn0=","dataType":"application\/json","encodingScheme":tru

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):286
                          Entropy (8bit):5.272752689220401
                          Encrypted:false
                          SSDEEP:6:YEQXJ2HXFcuVwQdhlzFkF0YGBRVeoAvJfshHHrPeUkwRe9:YvXKXFcuVHZ5VGUUUkee9
                          MD5:4B291318278CCB8C6DEBF18A9A0E0089
                          SHA1:AF81202795FB4CDC885EF8E1F78630ADD00BDA04
                          SHA-256:71F039DE928148CE57621500B8C06FD24CC15EF47B70E230F10EE1F63D58D7C6
                          SHA-512:6C61FB52E6D0A21520C5591CADA0B8F8D4718102DB792A857A712B4D0C2B2BF9401618775110CB26D42E3E1DCE5DEC9A5E056E7B482310C81584375EC26FEDFA
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"2991c4c2-32e8-48b6-b4f8-feb28ebbc13d","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1728517300086,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):782
                          Entropy (8bit):5.3719004118715095
                          Encrypted:false
                          SSDEEP:12:YvXKXFcuVHZ5VGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWEvn:Yv6XLZj168CgEXX5kcIfANhFvn
                          MD5:DC4416A35696D37F78C47A1A849541B9
                          SHA1:10A28141107FCCEA58FC628D2CE8EAF5AC279FD4
                          SHA-256:03B7A6D9325106CA857F888314DC6C7EA40FD0A7A03F8C3E2F151A022347CDBD
                          SHA-512:F30FF2888069AAE2DB716141CB8EB5E4712F6EBC7F4B7B8D63E7F5E45CF6585E5D7A2CDF30BC64AB4F6A6E4ACEAAB229A9A4A15A512D04F20FAA39DB4641F154
                          Malicious:false
                          Preview:{"analyticsData":{"responseGUID":"2991c4c2-32e8-48b6-b4f8-feb28ebbc13d","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1728517300086,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1728339595122}}}}

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:data
                          Category:dropped
                          Size (bytes):4
                          Entropy (8bit):0.8112781244591328
                          Encrypted:false
                          SSDEEP:3:e:e
                          MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                          SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                          SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                          SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                          Malicious:false
                          Preview:....

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:JSON data
                          Category:dropped
                          Size (bytes):2818
                          Entropy (8bit):5.147609289803391
                          Encrypted:false
                          SSDEEP:48:Y8AX5B9yOOHfTQYSSr9xywNNR5iO0PAAQryf+3upaAGLon9YpLjt:GX5BQOOHLXJr9xywNNRkO0oRrh3HAHYn
                          MD5:F49216D523C63E6BE516D5BF06CB20F4
                          SHA1:29AC02FA51AB1699D996BECD2F8E2C0EAE974186
                          SHA-256:A3E392D02D7B15763499E6CA34DC760DA01034B8792A6CEC2F5DE90F44524C7A
                          SHA-512:1581BB43FA8EEAC5B5E4CA6BA22DC900816FDFCC2DC4CEBE92628F1889794E067C18B59BD035DF7E1D38E63A47AE45FF44787C0B7CE5186E1304E422C94B1336
                          Malicious:false
                          Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e86fc72a7035bd7244e6fb03aaa8a543","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1050,"ts":1728339594000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"54b0af713428a1ff395df22094f6f280","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1728339594000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"856a03df2861670520842a72c86496f2","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1054,"ts":1728339594000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"998a0c76d557971f7abe293cebe0348a","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1091,"ts":1728339594000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"ac901f7bc9d51c6f96ab16590fbfbb0e","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1098,"ts":1728339594000},{"id":"Edit_InApp_Aug2020","info":{"dg":"90fbd4981d619ab482f48fe095c7e25a","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":17

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
                          Category:dropped
                          Size (bytes):12288
                          Entropy (8bit):1.364969006803957
                          Encrypted:false
                          SSDEEP:48:Tll2GL7msMF6gU9rtPth0Ob1lSvp25WKNZI:fVmsMF6v9rtPth0Ob1l0gBc
                          MD5:CF5D2CB5474449222B9A4FE5FE719FDA
                          SHA1:BCCD9F671FABD695AF8AE174A70EA1B1D0EBE9E5
                          SHA-256:7D24EC371E166421C86BA0703C8FAC4957A537B54E9F5A3B295FB07D1FDDA857
                          SHA-512:15E96151D16F9FEE852F435EA54BDD0E4EAF91840E1C099D52D834A2B125F98E3FE6CCE72DCA6C0381A738AF383DCC5077A61DB063E46326997ACC0DA8E37E73
                          Malicious:false
                          Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:SQLite Rollback Journal
                          Category:dropped
                          Size (bytes):8720
                          Entropy (8bit):1.8411298819615394
                          Encrypted:false
                          SSDEEP:48:7MMF6gU9rtPth0Ob1lSvp25/KNqFqGufl2GL7ms5:7hF6v9rtPth0Ob1l0gQEFKNVms5
                          MD5:7E0A8EE7FF9A2276882FA6511CD50410
                          SHA1:93B9247C02A41DB2010FCDACFC7C62AD0C680DB8
                          SHA-256:F251B83B31B7153CC22F374EB6C7E277E084F23C8B642D2CBDD97DD86CD13ADD
                          SHA-512:D167A9198B51397513F346DCC2E9A856A2D58271754CEE004725F7BC163507A5490A883E1BCD08FBD2AE6DB1EA64B6A37F2623CA8392A6D0680EA2337862867B
                          Malicious:false
                          Preview:.... .c.....z$............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

                          C:\Users\user\AppData\Local\Temp\MSI6db29.LOG

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                          Category:dropped
                          Size (bytes):246
                          Entropy (8bit):3.5263912796263748
                          Encrypted:false
                          SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8yQRqFGlMH:Qw946cPbiOxDlbYnuRKTA2H
                          MD5:05122187F5D2A456CBAFC47D4D11EF17
                          SHA1:BD9B91EF1ADDDF4A003D5BA11177691BE805E653
                          SHA-256:B2963C9286F8BF7069F41F3A4A4517C06D342ACC26D89A2B3E5B9307734A96E8
                          SHA-512:3EE94502EAC47A21FD36E7DE50B0B42809FE66CCACD2CC444F7FF139A901C72CAFE952B8B00FA6A9CB0659DB6B643013C03A09474C8CF45E063437FBED040EBA
                          Malicious:false
                          Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .0.7./.1.0./.2.0.2.4. . .1.8.:.1.9.:.5.7. .=.=.=.....

                          C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-07 18-19-51-434.log

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:ASCII text, with very long lines (393)
                          Category:dropped
                          Size (bytes):16525
                          Entropy (8bit):5.325555449275219
                          Encrypted:false
                          SSDEEP:384:JekpMW7ujsO+Z3k/V1WPGHEQRmpvtV7C36g2OwfBhBUtBX66p0o6V6xG4W7wtNF2:nO2
                          MD5:39628FA3AE1A78F558A4947A4847C830
                          SHA1:083A80F18FBEA378E9944FF9B6B74FE68CD56D92
                          SHA-256:E634D52BBCA86894E6CF9CA673A8FA4035AD705990F27198651E88F969FE73AC
                          SHA-512:F488D486C5DA8E071B212070005D5F91E4D06CD8D6E65BBBA1D8D5CE9FE929C8935841A93180297EE8B4F50069F06455850DAFAB1525B2F33797248BEDBF0A69
                          Malicious:false
                          Preview:SessionID=ee10203f-55ea-443a-a3fb-eaf6336a26b5.1696508793278 Timestamp=2023-10-05T14:26:33:278+0200 ThreadID=5108 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=ee10203f-55ea-443a-a3fb-eaf6336a26b5.1696508793278 Timestamp=2023-10-05T14:26:33:279+0200 ThreadID=5108 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=ee10203f-55ea-443a-a3fb-eaf6336a26b5.1696508793278 Timestamp=2023-10-05T14:26:33:279+0200 ThreadID=5108 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=ee10203f-55ea-443a-a3fb-eaf6336a26b5.1696508793278 Timestamp=2023-10-05T14:26:33:279+0200 ThreadID=5108 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=ee10203f-55ea-443a-a3fb-eaf6336a26b5.1696508793278 Timestamp=2023-10-05T14:26:33:279+0200 ThreadID=5108 Component=ngl-lib_NglAppLib Description="SetConfig:

                          C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:ASCII text, with very long lines (393), with CRLF line terminators
                          Category:dropped
                          Size (bytes):15114
                          Entropy (8bit):5.335794511398785
                          Encrypted:false
                          SSDEEP:384:WvlfgWZ/6RyzNyZ4CZ8Szw6L+qNYrFht9PwL6NbztXz6YsOlUF1OTOr4rCj3R3zY:mZb
                          MD5:7EEE6A344E2B04F84E70FCEC83DE2952
                          SHA1:91D322F7F52FA0B26399FD53F196D5D776C318E1
                          SHA-256:CD533B596DFDA50906DA8C12989206106257E0834DC2E1F76D82B632DFD18B1F
                          SHA-512:F4A3F99097A14BAF27DC20A531A2780B438F4FB574BDC9D9B1396C7D5459DD384B60AFCB46AFF9A792B634B98083861ADF47B60D5958ECAA42AF8B60438339FD
                          Malicious:false
                          Preview:SessionID=8ee1f0fe-43ec-4c7c-a4d4-3e14e62c7c6b.1728339591478 Timestamp=2024-10-07T18:19:51:478-0400 ThreadID=7492 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=8ee1f0fe-43ec-4c7c-a4d4-3e14e62c7c6b.1728339591478 Timestamp=2024-10-07T18:19:51:500-0400 ThreadID=7492 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=8ee1f0fe-43ec-4c7c-a4d4-3e14e62c7c6b.1728339591478 Timestamp=2024-10-07T18:19:51:500-0400 ThreadID=7492 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=8ee1f0fe-43ec-4c7c-a4d4-3e14e62c7c6b.1728339591478 Timestamp=2024-10-07T18:19:51:501-0400 ThreadID=7492 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=8ee1f0fe-43ec-4c7c-a4d4-3e14e62c7c6b.1728339591478 Timestamp=2024-10-07T18:19:51:501-0400 ThreadID=7492 Component=ngl-lib_NglAppLib Description="SetConf

                          C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          File Type:ASCII text, with CRLF line terminators
                          Category:dropped
                          Size (bytes):29752
                          Entropy (8bit):5.4081636272292455
                          Encrypted:false
                          SSDEEP:768:SllhexEhcIWcsRoUh39w7P/t8k+yyUXhSP:SllhexEhcIWcsRoUh39w7P/t8k+yyUXc
                          MD5:B274030C4863EDCDEFF2F32209933D04
                          SHA1:3C099E7CD72AF644585039583CD3C47ADDD64AE2
                          SHA-256:6F91929161B87CCA3B4EB710A35BBA3726E291C846B6CA905007F5B1652670C5
                          SHA-512:F76CB491F870067A204B3B18C81613FA178B2BE9613362A95834379EA6BBD524EC84E21BC84A5BF0368B5D2060359EDC3261A6EA61217AE480284B1FC73B20E5
                          Malicious:false
                          Preview:05-10-2023 02:07:19:.---2---..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : ***************************************..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : ***************************************..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 02:07:19:.Closing File..05-10-

                          C:\Users\user\AppData\Local\Temp\acrocef_low\318cf416-ae50-4137-b6fd-3811948a1d7d.tmp

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                          Category:dropped
                          Size (bytes):1419751
                          Entropy (8bit):7.976496077007677
                          Encrypted:false
                          SSDEEP:24576:/6ZwYIGNPgeWL07oXGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:CZwZG/WLxXGZN3mlind9i4ufFXpAXkru
                          MD5:59456AEBFE40D51DCD738AF1B2D65A03
                          SHA1:953094EDE30485AB6E071F8A0BF64D9BC1C34227
                          SHA-256:1C21F3042C5972DE59996ED10C08D9072E9F2643F65ED69355CD5B2E7735067D
                          SHA-512:CB3AF6D15DC5F111D80FD5B4599E204721ABEC89AD44D7C0A41C19E515E01F2541CE38C673628640A24DFCBA5D5AF242D95203FEBD1E9ADAE787F13419644E9D
                          Malicious:false
                          Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                          C:\Users\user\AppData\Local\Temp\acrocef_low\801c2e00-bbe6-4ce9-b6c5-1154db712dcc.tmp

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                          Category:dropped
                          Size (bytes):1407294
                          Entropy (8bit):7.97605879016224
                          Encrypted:false
                          SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDYYIGNPpe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZQ
                          MD5:E139E6D53A958755742760CD4A4456CB
                          SHA1:C259B619917152498BF74F65E11D03B50E4F80F1
                          SHA-256:542A482DF531973AFE108199E6DF1200DB2590E2E2F7B73C5CD428066EF9138E
                          SHA-512:36222C1C5AD31244D808331760A7BEA22C20F3664709D0786260B538578CA184EF2634E844D682B92DEA9ACDEF3EA700B1C7C4972BE97B8C80ADF3945A92858B
                          Malicious:false
                          Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                          C:\Users\user\AppData\Local\Temp\acrocef_low\db004f45-d2a5-4736-866f-57b672b3fe76.tmp

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                          Category:dropped
                          Size (bytes):758601
                          Entropy (8bit):7.98639316555857
                          Encrypted:false
                          SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                          MD5:3A49135134665364308390AC398006F1
                          SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                          SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                          SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                          Malicious:false
                          Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                          C:\Users\user\AppData\Local\Temp\acrocef_low\de611fa4-3222-4ae0-8539-bd0d1300e015.tmp

                          Download File
                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                          Category:dropped
                          Size (bytes):386528
                          Entropy (8bit):7.9736851559892425
                          Encrypted:false
                          SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                          MD5:5C48B0AD2FEF800949466AE872E1F1E2
                          SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                          SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                          SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                          Malicious:false
                          Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                          Static File Info

                          General

                          File type:PDF document, version 1.7
                          Entropy (8bit):7.987974165761141
                          TrID:
                          • Adobe Portable Document Format (5005/1) 100.00%
                          File name:Usc credit Union Bank Letter- copy.pdf
                          File size:416'762 bytes
                          MD5:b0c27a59f6b7246a6ccd99bd675d66f6
                          SHA1:478c5f6502d7e529e13a5a6c902eb00765dd594a
                          SHA256:93235fca9fbe77a4dc06e55dbc89b657a852a19045d1c04b7d7df7f09c6adb36
                          SHA512:640a28944b65183f9018ff703f2d5f9f615af4b96846b5c5210afd1a184f1305710eba2f52a1797c711e9fe455e373ec655303cef2b5d8a3a5efd422ed04a44f
                          SSDEEP:12288:iOZjFngPuDIdCHsRWBVoaG+EBS6bo1BSXBSeYpOFyDkiH:bnMuDIdCHsRWBV3G+uIN/DhH
                          TLSH:83941243DA5689DFD84197B0BE091B9BCBCCDB650A4031FB143D1BAB3698E204E5A4FD
                          File Content Preview:%PDF-1.7.%.....2 0 obj.<<./Pages 4 0 R./Type /Catalog./AcroForm 5 0 R.>>.endobj.8 0 obj.<<./Filter /FlateDecode./Length 10.>>.stream..x.+......|..endstream.endobj.9 0 obj.<<./Filter /FlateDecode./Length 10.>>.stream..x.+......|..endstream.endobj.10 0 obj.

                          File Icon

                          Icon Hash:62cc8caeb29e8ae0

                          Static PDF Info

                          General

                          Header:%PDF-1.7
                          Total Entropy:7.987974
                          Total Bytes:416762
                          Stream Entropy:7.991167
                          Stream Bytes:407325
                          Entropy outside Streams:4.886480
                          Bytes outside Streams:9437
                          Number of EOF found:1
                          Bytes after EOF:

                          Keywords Statistics

                          NameCount
                          obj107
                          endobj107
                          stream104
                          endstream104
                          xref0
                          trailer0
                          startxref1
                          /Page0
                          /Encrypt0
                          /ObjStm2
                          /URI0
                          /JS0
                          /JavaScript0
                          /AA0
                          /OpenAction0
                          /AcroForm1
                          /JBIG2Decode0
                          /RichMedia0
                          /Launch0
                          /EmbeddedFile0

                          Image Streams

                          IDDHASHMD5Preview
                          871240732b6b560040a69d0532bc2c05c78b5a907d596f2413
                          88da1a783c8591b455067b5c17fe3011308ed150711a0eb128
                          890034f8ccca9a9000c961636c7d02846f250bc2b4cbdc0c3e
                          1530000000000000000dc27b7d5aa6ff1e9defa5414c01c8366
                          15500000000000000004747d3ac4b98c57c7d68249f67758a9c

                          Network Behavior

                          Network Port Distribution

                          TCP Packets

                          TimestampSource PortDest PortSource IPDest IP
                          Oct 8, 2024 00:20:01.807955980 CEST49730443192.168.2.1223.56.162.185
                          Oct 8, 2024 00:20:01.807987928 CEST4434973023.56.162.185192.168.2.12
                          Oct 8, 2024 00:20:01.808044910 CEST49730443192.168.2.1223.56.162.185
                          Oct 8, 2024 00:20:01.808232069 CEST49730443192.168.2.1223.56.162.185
                          Oct 8, 2024 00:20:01.808243990 CEST4434973023.56.162.185192.168.2.12
                          Oct 8, 2024 00:20:02.342066050 CEST4434973023.56.162.185192.168.2.12
                          Oct 8, 2024 00:20:02.342427969 CEST49730443192.168.2.1223.56.162.185
                          Oct 8, 2024 00:20:02.342442989 CEST4434973023.56.162.185192.168.2.12
                          Oct 8, 2024 00:20:02.344110966 CEST4434973023.56.162.185192.168.2.12
                          Oct 8, 2024 00:20:02.344237089 CEST49730443192.168.2.1223.56.162.185
                          Oct 8, 2024 00:20:02.371263027 CEST49730443192.168.2.1223.56.162.185
                          Oct 8, 2024 00:20:02.371499062 CEST4434973023.56.162.185192.168.2.12
                          Oct 8, 2024 00:20:02.372339010 CEST49730443192.168.2.1223.56.162.185
                          Oct 8, 2024 00:20:02.372354984 CEST4434973023.56.162.185192.168.2.12
                          Oct 8, 2024 00:20:02.420464993 CEST49730443192.168.2.1223.56.162.185
                          Oct 8, 2024 00:20:02.491539001 CEST4434973023.56.162.185192.168.2.12
                          Oct 8, 2024 00:20:02.491900921 CEST4434973023.56.162.185192.168.2.12
                          Oct 8, 2024 00:20:02.491986036 CEST49730443192.168.2.1223.56.162.185
                          Oct 8, 2024 00:20:02.492153883 CEST49730443192.168.2.1223.56.162.185
                          Oct 8, 2024 00:20:02.492153883 CEST49730443192.168.2.1223.56.162.185
                          Oct 8, 2024 00:20:02.492170095 CEST4434973023.56.162.185192.168.2.12
                          Oct 8, 2024 00:20:02.492249966 CEST49730443192.168.2.1223.56.162.185

                          UDP Packets

                          TimestampSource PortDest PortSource IPDest IP
                          Oct 8, 2024 00:20:01.395227909 CEST4992853192.168.2.121.1.1.1

                          DNS Queries

                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                          Oct 8, 2024 00:20:01.395227909 CEST192.168.2.121.1.1.10xd24eStandard query (0)x1.i.lencr.orgA (IP address)IN (0x0001)false

                          DNS Answers

                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                          Oct 8, 2024 00:20:01.403366089 CEST1.1.1.1192.168.2.120xd24eNo error (0)x1.i.lencr.orgcrl.root-x1.letsencrypt.org.edgekey.netCNAME (Canonical name)IN (0x0001)false

                          HTTP Request Dependency Graph

                          • armmf.adobe.com

                          HTTPS Proxied Packets

                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                          0192.168.2.124973023.56.162.1854434140C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          TimestampBytes transferredDirectionData
                          2024-10-07 22:20:02 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
                          Host: armmf.adobe.com
                          Connection: keep-alive
                          Accept-Language: en-US,en;q=0.9
                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
                          Sec-Fetch-Site: same-origin
                          Sec-Fetch-Mode: no-cors
                          Sec-Fetch-Dest: empty
                          Accept-Encoding: gzip, deflate, br
                          If-None-Match: "78-5faa31cce96da"
                          If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
                          2024-10-07 22:20:02 UTC198INHTTP/1.1 304 Not Modified
                          Content-Type: text/plain; charset=UTF-8
                          Last-Modified: Mon, 01 May 2023 15:02:33 GMT
                          ETag: "78-5faa31cce96da"
                          Date: Mon, 07 Oct 2024 22:20:02 GMT
                          Connection: close


                          Statistics

                          CPU Usage

                          Click to jump to process

                          Memory Usage

                          Click to jump to process

                          High Level Behavior Distribution

                          Click to dive into process behavior distribution

                          Behavior

                          Click to jump to process

                          System Behavior

                          General

                          Target ID:0
                          Start time:18:19:47
                          Start date:07/10/2024
                          Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                          Wow64 process (32bit):false
                          Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Usc credit Union Bank Letter- copy.pdf"
                          Imagebase:0x7ff77b230000
                          File size:5'641'176 bytes
                          MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Reputation:high
                          Has exited:true

                          General

                          Target ID:2
                          Start time:18:19:48
                          Start date:07/10/2024
                          Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          Wow64 process (32bit):false
                          Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                          Imagebase:0x7ff763240000
                          File size:3'581'912 bytes
                          MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Reputation:high
                          Has exited:true

                          General

                          Target ID:4
                          Start time:18:19:48
                          Start date:07/10/2024
                          Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                          Wow64 process (32bit):false
                          Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1556,i,8437841704339123093,10600651356444801376,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                          Imagebase:0x7ff763240000
                          File size:3'581'912 bytes
                          MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Reputation:high
                          Has exited:true

                          Disassembly

                          ⊘No disassembly