Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
0260719760_9057987504_20241014041558.PDF

Overview

General Information

Sample name:0260719760_9057987504_20241014041558.PDF
Analysis ID:1533058
MD5:91f21cd7cf5808b061c4dc014e1ebec1
SHA1:5d494095492db13c0bc90dfbe91fe2ee848d2b33
SHA256:dec493278736e87e3d6a2acd329b86f79c7a7f92b63480abf0bed4baddba47d6
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 5264 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\0260719760_9057987504_20241014041558.PDF" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 404 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 7248 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1536,i,8389459400494429931,13337519352966136629,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficDNS query: name: x1.i.lencr.org
Source: global trafficTCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global trafficTCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global trafficTCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global trafficTCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global trafficTCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global trafficTCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global trafficTCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global trafficTCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global trafficTCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global trafficTCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global trafficTCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global trafficTCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global trafficTCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global trafficTCP traffic: 104.77.220.172:443 -> 192.168.2.4:49747
Source: global trafficTCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global trafficTCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global trafficTCP traffic: 104.77.220.172:443 -> 192.168.2.4:49747
Source: global trafficTCP traffic: 104.77.220.172:443 -> 192.168.2.4:49747
Source: global trafficTCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global trafficTCP traffic: 104.77.220.172:443 -> 192.168.2.4:49747
Source: global trafficTCP traffic: 104.77.220.172:443 -> 192.168.2.4:49747
Source: global trafficTCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global trafficTCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global trafficTCP traffic: 104.77.220.172:443 -> 192.168.2.4:49747
Source: global trafficTCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global trafficTCP traffic: 104.77.220.172:443 -> 192.168.2.4:49747
Source: global trafficTCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global trafficTCP traffic: 104.77.220.172:443 -> 192.168.2.4:49747
Source: global trafficTCP traffic: 104.77.220.172:443 -> 192.168.2.4:49747
Source: global trafficTCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global trafficTCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global trafficTCP traffic: 104.77.220.172:443 -> 192.168.2.4:49747
Source: global trafficTCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: global trafficTCP traffic: 192.168.2.4:49747 -> 104.77.220.172:443
Source: Joe Sandbox ViewIP Address: 104.77.220.172 104.77.220.172
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknownTCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknownTCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknownTCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknownTCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknownTCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknownTCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknownTCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknownTCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknownTCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknownTCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknownTCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global trafficDNS traffic detected: DNS query: x1.i.lencr.org
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.drString found in binary or memory: http://x1.i.lencr.org/
Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
Source: classification engineClassification label: clean2.winPDF@14/45@1/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2132Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-14 05-33-58-650.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\0260719760_9057987504_20241014041558.PDF"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1536,i,8389459400494429931,13337519352966136629,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1536,i,8389459400494429931,13337519352966136629,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: 0260719760_9057987504_20241014041558.PDFInitial sample: PDF keyword /JS count = 0
Source: 0260719760_9057987504_20241014041558.PDFInitial sample: PDF keyword /JavaScript count = 0
Source: 0260719760_9057987504_20241014041558.PDFInitial sample: PDF keyword /EmbeddedFile count = 0
Source: 0260719760_9057987504_20241014041558.PDFInitial sample: PDF keyword /ObjStm count = 6
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts3
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media2
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive13
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1533058 Sample: 0260719760_9057987504_20241... Startdate: 14/10/2024 Architecture: WINDOWS Score: 2 14 x1.i.lencr.org 2->14 7 Acrobat.exe 20 72 2->7         started        process3 process4 9 AcroCEF.exe 107 7->9         started        process5 11 AcroCEF.exe 2 9->11         started        dnsIp6 16 104.77.220.172, 443, 49747 AKAMAI-ASUS United States 11->16

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

SourceDetectionScannerLabelLink
x1.i.lencr.org0%VirustotalBrowse

URLs

SourceDetectionScannerLabelLink
http://x1.i.lencr.org/0%URL Reputationsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
x1.i.lencr.org
unknown
unknownfalseunknown

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http://x1.i.lencr.org/2D85F72862B55C4EADD9E66E06947F3D0.1.drfalse
  • URL Reputation: safe
unknown

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
104.77.220.172
unknownUnited States
16625AKAMAI-ASUSfalse

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1533058
Start date and time:2024-10-14 11:32:58 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 8s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultwindowspdfcookbook.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:11
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:0260719760_9057987504_20241014041558.PDF
Detection:CLEAN
Classification:clean2.winPDF@14/45@1/1
EGA Information:Failed
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 0
  • Number of non-executed functions: 0
Cookbook Comments:
  • Found application associated with file extension: .PDF
  • Found PDF document
  • Close Viewer

Warnings

  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.19.126.143, 2.19.126.149, 18.207.85.246, 107.22.247.231, 54.144.73.197, 34.193.227.236, 172.64.41.3, 162.159.61.3, 2.23.197.184
  • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com, crl.root-x1.letsencrypt.org.edgekey.net
  • Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

TimeTypeDescription
05:34:10API Interceptor1x Sleep call for process: AcroCEF.exe modified

LLM Input / Output

InputOutput
URL: PDF document Model: jbxai
{
"brands":["HP"],
"text":"Invoice Copy of original",
"contains_trigger_text":false,
"trigger_text":"",
"prominent_button_name":"unknown",
"text_input_field_labels":"unknown",
"pdf_icon_visible":true,
"has_visible_captcha":false,
"has_urgent_text":false,
"has_visible_qrcode":false}

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
104.77.220.172Fact-2024-10.pdfGet hashmaliciousUnknownBrowse
    Farahexperiences.com_Report_87018.pdfGet hashmaliciousUnknownBrowse
      Farahexperiences.com_Report_52288.pdfGet hashmaliciousUnknownBrowse
        Tonincasa Updated Employee sheet .pdfGet hashmaliciousHTMLPhisherBrowse
          Contract_Agreement_Wednesday September 2024.pdfGet hashmaliciousUnknownBrowse
            Contract_Agreement_Tuesday September 2024.pdfGet hashmaliciousUnknownBrowse
              c1.pdfGet hashmaliciousHTMLPhisherBrowse
                https://dl.dropboxusercontent.com/scl/fi/0cbpht7ar66yi7ybardu3/Satander_Zahlungsbest-tigung-von-19092024.zip?rlkey=pq1myegofnqggcdva93jeac5a&st=nce3sth9&dl=0Get hashmaliciousUnknownBrowse
                  Inv_Doc_18#908.pdfGet hashmaliciousUnknownBrowse
                    WOT0089836_Electrical_Single_Line_diagram%2C_lighting__RR_docx_3461849704.pdfGet hashmaliciousUnknownBrowse

                      Domains

                      ⊘No context

                      ASNs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      AKAMAI-ASUSfile.exeGet hashmaliciousLummaCBrowse
                      • 104.102.49.254
                      na.elfGet hashmaliciousMirai, OkiruBrowse
                      • 104.108.49.254
                      na.elfGet hashmaliciousMirai, OkiruBrowse
                      • 23.197.217.29
                      loader.exeGet hashmaliciousLummaCBrowse
                      • 104.102.49.254
                      file.exeGet hashmaliciousLummaCBrowse
                      • 104.102.49.254
                      Verus.exeGet hashmaliciousLummaCBrowse
                      • 104.102.49.254
                      file.exeGet hashmaliciousLummaCBrowse
                      • 104.102.49.254
                      file.exeGet hashmaliciousLummaCBrowse
                      • 104.102.49.254
                      Solara.exeGet hashmaliciousLummaCBrowse
                      • 104.102.49.254
                      file.exeGet hashmaliciousLummaCBrowse
                      • 104.102.49.254

                      JA3 Fingerprints

                      ⊘No context

                      Dropped Files

                      ⊘No context

                      Created / dropped Files

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.180150354115958
                      Encrypted:false
                      SSDEEP:6:LQHQRFIq2Pwkn2nKuAl9OmbnIFUt8iQHQoXZmw+iQHQoFkwOwkn2nKuAl9OmbjLJ:kSFIvYfHAahFUt8zt/+zf5JfHAaSJ
                      MD5:0EA6CCFC82DFC6CAA134AA1D27B87CA5
                      SHA1:2FB4254896E78E768829421987D2D4CBA32A3CFD
                      SHA-256:C33DD14B4D36F7809541A6BB33C84E3DB42DF8F9FF37FE3ABC3FA44301EAC404
                      SHA-512:AE40491917893CCB84D9FEBA8527BF7F6D4DD5C315CC922C15B2FFC4E4462A53EB0FA58071E94EBB9CBEE9ADD98D4CB6C43F142AC49C1A5709E2B17A322C5277
                      Malicious:false
                      Reputation:low
                      Preview:2024/10/14-05:33:56.321 1c34 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/14-05:33:56.324 1c34 Recovering log #3.2024/10/14-05:33:56.324 1c34 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.180150354115958
                      Encrypted:false
                      SSDEEP:6:LQHQRFIq2Pwkn2nKuAl9OmbnIFUt8iQHQoXZmw+iQHQoFkwOwkn2nKuAl9OmbjLJ:kSFIvYfHAahFUt8zt/+zf5JfHAaSJ
                      MD5:0EA6CCFC82DFC6CAA134AA1D27B87CA5
                      SHA1:2FB4254896E78E768829421987D2D4CBA32A3CFD
                      SHA-256:C33DD14B4D36F7809541A6BB33C84E3DB42DF8F9FF37FE3ABC3FA44301EAC404
                      SHA-512:AE40491917893CCB84D9FEBA8527BF7F6D4DD5C315CC922C15B2FFC4E4462A53EB0FA58071E94EBB9CBEE9ADD98D4CB6C43F142AC49C1A5709E2B17A322C5277
                      Malicious:false
                      Reputation:low
                      Preview:2024/10/14-05:33:56.321 1c34 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/14-05:33:56.324 1c34 Recovering log #3.2024/10/14-05:33:56.324 1c34 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):336
                      Entropy (8bit):5.16347452127232
                      Encrypted:false
                      SSDEEP:6:LQH5Rq2Pwkn2nKuAl9Ombzo2jMGIFUt8iQHvuQvZZmw+iQHQkwOwkn2nKuAl9OmT:k7vYfHAa8uFUt8z2gZ/+zw5JfHAa8RJ
                      MD5:B71F982FD8A804ECD0670BB3808D393B
                      SHA1:5CFA302F68EDAAFA5EE1E5FE168D75CD84333694
                      SHA-256:517F4A961346800417178C2F81C239C676B3EEBE7A5B8971105AD094BA0D2835
                      SHA-512:1AC2E1183C412135E689F7A8F5BB1DC99C72705C5E370226C212E537CB52612F5742D239C7EB9030D0DC5D1D19D02880CC8A1809A17CEA6D74CC2A05C064260A
                      Malicious:false
                      Reputation:low
                      Preview:2024/10/14-05:33:56.603 1cb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/14-05:33:56.604 1cb0 Recovering log #3.2024/10/14-05:33:56.612 1cb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):336
                      Entropy (8bit):5.16347452127232
                      Encrypted:false
                      SSDEEP:6:LQH5Rq2Pwkn2nKuAl9Ombzo2jMGIFUt8iQHvuQvZZmw+iQHQkwOwkn2nKuAl9OmT:k7vYfHAa8uFUt8z2gZ/+zw5JfHAa8RJ
                      MD5:B71F982FD8A804ECD0670BB3808D393B
                      SHA1:5CFA302F68EDAAFA5EE1E5FE168D75CD84333694
                      SHA-256:517F4A961346800417178C2F81C239C676B3EEBE7A5B8971105AD094BA0D2835
                      SHA-512:1AC2E1183C412135E689F7A8F5BB1DC99C72705C5E370226C212E537CB52612F5742D239C7EB9030D0DC5D1D19D02880CC8A1809A17CEA6D74CC2A05C064260A
                      Malicious:false
                      Reputation:low
                      Preview:2024/10/14-05:33:56.603 1cb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/14-05:33:56.604 1cb0 Recovering log #3.2024/10/14-05:33:56.612 1cb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1048533b-f509-4d56-a6fe-d5e01c38f8b1.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:modified
                      Size (bytes):475
                      Entropy (8bit):4.95774050953709
                      Encrypted:false
                      SSDEEP:12:YH/um3RA8sqyHsBdOg2Hccaq3QYiubInP7E4T3y:Y2sRdsWdMHf3QYhbG7nby
                      MD5:C5EB356AF4D7BD50BADD50EF33C520A1
                      SHA1:0EFD0B7AE77385927526E3BDF8E7BD00394C55B0
                      SHA-256:89EABD79394EA3214B7DD092CAF5B3167E82FEC285F0665BE2198714763ABEDB
                      SHA-512:D7F346A4C702A8E27BFF9664FEADBB681C73E1B7E1A2E503ABE6997B1649E413B9B7A8D4820A467BC696D46B177EECA573FBF164B5B8C1FEB1B025B649CD2D89
                      Malicious:false
                      Reputation:low
                      Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13373458448915485","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126289},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):475
                      Entropy (8bit):4.95774050953709
                      Encrypted:false
                      SSDEEP:12:YH/um3RA8sqyHsBdOg2Hccaq3QYiubInP7E4T3y:Y2sRdsWdMHf3QYhbG7nby
                      MD5:C5EB356AF4D7BD50BADD50EF33C520A1
                      SHA1:0EFD0B7AE77385927526E3BDF8E7BD00394C55B0
                      SHA-256:89EABD79394EA3214B7DD092CAF5B3167E82FEC285F0665BE2198714763ABEDB
                      SHA-512:D7F346A4C702A8E27BFF9664FEADBB681C73E1B7E1A2E503ABE6997B1649E413B9B7A8D4820A467BC696D46B177EECA573FBF164B5B8C1FEB1B025B649CD2D89
                      Malicious:false
                      Reputation:low
                      Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13373458448915485","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126289},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):4730
                      Entropy (8bit):5.251898506493011
                      Encrypted:false
                      SSDEEP:96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7a4ukpvZ:etJCV4FiN/jTN/2r8Mta02fEhgO73goX
                      MD5:D8A5D5AD260D0FFDFFAF5387768BABB6
                      SHA1:A71D2B0291F8FB02C650EE40F35B3E53D88C811A
                      SHA-256:378E24276FA90E327B5BFBE14DC21BE81DAD59811BDB637B6812C7CA576EC1F1
                      SHA-512:C11B070BC887A2C0E40C0B82FF51372FD7FA3A3A4FADA39F50BF341B7FA51433D17265ABFD982B5AB3B6D74C0806E8171E770ED7BBD2F654284E5FEE87915946
                      Malicious:false
                      Reputation:low
                      Preview:*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):324
                      Entropy (8bit):5.222569473134444
                      Encrypted:false
                      SSDEEP:6:LQSk0Iq2Pwkn2nKuAl9OmbzNMxIFUt8iQSfugZZmw+iQSrbkwOwkn2nKuAl9Ombg:kzvYfHAa8jFUt8zzgZ/+zgb5JfHAa84J
                      MD5:57E6D253490EFFAD35745568AE0DFBEA
                      SHA1:D7CE92FACF8B2A9F3AF5DC12E08F54EBCA2F04C1
                      SHA-256:9F91731695CCCF628E2B3E63ADBA048101034BF7F67AB6970593C9630033088B
                      SHA-512:7A23980DD25F4837E000540D7556AB6916F114351CB15DDDC34899A2746D59709B3F7963527E67E12F49C795718019A432C86402B4413B43DD2B1548CE8A4D82
                      Malicious:false
                      Reputation:low
                      Preview:2024/10/14-05:33:57.549 1cb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/14-05:33:57.666 1cb0 Recovering log #3.2024/10/14-05:33:57.677 1cb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):324
                      Entropy (8bit):5.222569473134444
                      Encrypted:false
                      SSDEEP:6:LQSk0Iq2Pwkn2nKuAl9OmbzNMxIFUt8iQSfugZZmw+iQSrbkwOwkn2nKuAl9Ombg:kzvYfHAa8jFUt8zzgZ/+zgb5JfHAa84J
                      MD5:57E6D253490EFFAD35745568AE0DFBEA
                      SHA1:D7CE92FACF8B2A9F3AF5DC12E08F54EBCA2F04C1
                      SHA-256:9F91731695CCCF628E2B3E63ADBA048101034BF7F67AB6970593C9630033088B
                      SHA-512:7A23980DD25F4837E000540D7556AB6916F114351CB15DDDC34899A2746D59709B3F7963527E67E12F49C795718019A432C86402B4413B43DD2B1548CE8A4D82
                      Malicious:false
                      Reputation:low
                      Preview:2024/10/14-05:33:57.549 1cb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/14-05:33:57.666 1cb0 Recovering log #3.2024/10/14-05:33:57.677 1cb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241014093400Z-165.bmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
                      Category:dropped
                      Size (bytes):65110
                      Entropy (8bit):0.9098239416016416
                      Encrypted:false
                      SSDEEP:48:D7dowEj5WE9LEksdf399ecEkSu1qOtM5RFV5yR1TtspNKZe/nMtkMMtNritFthM4:DxrEoHJeOTyM2MMeHTMMdMMM4m8
                      MD5:69E1571B9E1852E3B7EECA46FDE63BD5
                      SHA1:D58F1A075265DAC6C933E847BB9BC72F1A995334
                      SHA-256:DD9BC66C59F3E6A03434A27EC7A4260B05B555B1412ACDE94595BCA751CC0F2C
                      SHA-512:2008DF91716F000D6A16F8B0E0A0FAA1D191845A34B8C37442DE1E0133395C5D643F3D25ADF6367F6296DA12A8350A30DFAEF1636723C4E10E93CDE08ECAAD66
                      Malicious:false
                      Preview:BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
                      Category:dropped
                      Size (bytes):86016
                      Entropy (8bit):4.445152927795014
                      Encrypted:false
                      SSDEEP:384:yezci5tsiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rLs3OazzU89UTTgUL
                      MD5:E911AB6384A275050E01CE9678E66865
                      SHA1:55051C3B73D5A41C792EA9B731CDC73AC9C647C3
                      SHA-256:56D171B5518DD17BD8F13AFF027792977079EE323AAB0FEE0A52740BAEB99B5A
                      SHA-512:9FE17C2A08DFC8AC51F7254275A89BF463D059EB3444FB30C4595059499A41FCB3FD716CD24A0E731FE82B1DDBFDBC770EFCD2BB12E3E4E551C1B2BC14B3187F
                      Malicious:false
                      Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite Rollback Journal
                      Category:dropped
                      Size (bytes):8720
                      Entropy (8bit):3.7734506764900058
                      Encrypted:false
                      SSDEEP:48:7M3p/E2ioyVMioy9oWoy1Cwoy1gKOioy1noy1AYoy1Wioy1hioybioyqoy1noy1R:78pjuMFfXKQXGb9IVXEBodRBkG
                      MD5:7F313771A09068976F92FF260F0A3946
                      SHA1:46210AC172345F4409B9DF66D8504B68A636B0DF
                      SHA-256:25378D61ECDB322C44B7E036DA1C92CB857B9D3FAF4B7E3216F0239BD6BFFA04
                      SHA-512:C29782DD6D525B1DE372A64B2E281FD01750FB3F74351FC927CBC30FF32D943F001594BA804564174F7C622DC2C1EA09F148FDD6B68DCFF7403015092F9147B3
                      Malicious:false
                      Preview:.... .c......V&,...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:Certificate, Version=3
                      Category:dropped
                      Size (bytes):1391
                      Entropy (8bit):7.705940075877404
                      Encrypted:false
                      SSDEEP:24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
                      MD5:0CD2F9E0DA1773E9ED864DA5E370E74E
                      SHA1:CABD2A79A1076A31F21D253635CB039D4329A5E8
                      SHA-256:96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
                      SHA-512:3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
                      Malicious:false
                      Preview:0..k0..S............@.YDc.c...0...*.H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0...*.H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I.....*.A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.|C.t..t.....0.[q6....00\H..;..}`...).........A.......|.;F.H*..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..|o..;.....'...}~.."......

                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):192
                      Entropy (8bit):2.779094196322516
                      Encrypted:false
                      SSDEEP:3:kkFklwtDNl1fllXlE/HT8kkkhvNNX8RolJuRdxLlGB9lQRYwpDdt:kKpXl2T8QhVNMa8RdWBwRd
                      MD5:DA6DCF4AA849EEB0C909CE49608F0756
                      SHA1:D957E493611D50CAE8548B169F5142D567043149
                      SHA-256:219AEC938CA4D4372117465F48937318698F5E8CD9E1C64627CA519087867AB8
                      SHA-512:486C9347CD2A8CF18490AF11BAE142AE9A8926B01848EF3D09B89FF76F7A200F6B00E7E6D659DA446307551A0B0B055740D2FFBD6E02DB3A8A9E591B457418AA
                      Malicious:false
                      Preview:p...... ........C$.8....(....................................................... ..........W.....F..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2132

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PostScript document text
                      Category:dropped
                      Size (bytes):185099
                      Entropy (8bit):5.182478651346149
                      Encrypted:false
                      SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                      MD5:94185C5850C26B3C6FC24ABC385CDA58
                      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                      Malicious:false
                      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PostScript document text
                      Category:dropped
                      Size (bytes):185099
                      Entropy (8bit):5.182478651346149
                      Encrypted:false
                      SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                      MD5:94185C5850C26B3C6FC24ABC385CDA58
                      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                      Malicious:false
                      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):243196
                      Entropy (8bit):3.3450692389394283
                      Encrypted:false
                      SSDEEP:1536:vKPCPiyzDtrh1cK3XEivK7VK/3AYvYwgqErRo+RQn:yPClJ/3AYvYwghFo+RQn
                      MD5:F5567C4FF4AB049B696D3BE0DD72A793
                      SHA1:EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916
                      SHA-256:D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
                      SHA-512:E769735991E5B1331E259608854D00CDA4F3E92285FDC500158CBD09CBCCEAD8A387F78256A43919B13EBE70C995D19242377C315B0CCBBD4F813251608C1D56
                      Malicious:false
                      Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):295
                      Entropy (8bit):5.360577286967606
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXlPQnHgjzHb1VoZcg1vRcR0YTEeoAvJM3g98kUwPeUkwRe9:YvXKXl4Hg4Zc0vHGMbLUkee9
                      MD5:47C23A19FF3DADF1EEFA4F1D2F59AA49
                      SHA1:883C2E8FDD2741C11B0B5C6DD01ED234A4408DCD
                      SHA-256:DAEE8E6232BF2337C78FB308EC5DE413BC820114AB9A8245651B2CBDD28EE49F
                      SHA-512:999C7044917C9BE3B81642D3878C7534E314827E923EEE3DE4F8512C995F2BED2F53831D580922F9A66D631E020EF254F5B4C69A88C5F9035ACC499D92DCDFDB
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7516e634-b5f9-4bbb-8754-62a573124e2a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729076103444,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.311273841070856
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXlPQnHgjzHb1VoZcg1vRcR0YTEeoAvJfBoTfXpnrPeUkwRe9:YvXKXl4Hg4Zc0vHGWTfXcUkee9
                      MD5:C05A45EB9DE9EF1607518BC411A806DE
                      SHA1:334804B018671524C31C6C2F345269D56A0889E5
                      SHA-256:349A2B1850D66C3A54D207766BC5B9336AB8CAEAA1AF99C8C9E8B2CB8BA3A49A
                      SHA-512:92B33CDE68BFBF79BAFD884AB519D6E0A55D9F3915A186F1189C1562EA86D7436ECF2D2F777BCD00D12B9DB40E525BF2A462F0DB41E7D134438A090B4025E043
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7516e634-b5f9-4bbb-8754-62a573124e2a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729076103444,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.290760410208258
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXlPQnHgjzHb1VoZcg1vRcR0YTEeoAvJfBD2G6UpnrPeUkwRe9:YvXKXl4Hg4Zc0vHGR22cUkee9
                      MD5:9B3FF898957AB6E6673AE2ABB396E7A5
                      SHA1:BB1433B5EBD50350549D4C07A6573751DCADAB95
                      SHA-256:3A3039E4A761C4962CB99E228EFE7AAD1694601858418751C4DE1A1EBB517C20
                      SHA-512:D14A25B7E50A7AF0EE08841AA5E6BC3A13FFF8E958AEE66FC3419B66FF2AAD06D49CD89EAED88F345B6093EBBAC8858227DA1C21ED1F7101F99844E0855335E2
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7516e634-b5f9-4bbb-8754-62a573124e2a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729076103444,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):285
                      Entropy (8bit):5.347490035290851
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXlPQnHgjzHb1VoZcg1vRcR0YTEeoAvJfPmwrPeUkwRe9:YvXKXl4Hg4Zc0vHGH56Ukee9
                      MD5:DF1A1636C6685C56E50450BA3308F47F
                      SHA1:F92AF7A3AD96E011E4AB67C9DE38027232A64347
                      SHA-256:AC8849922C9635320E15AC2F707DD46980A7EB16E57469CAC221FD5CCF6A3940
                      SHA-512:9BE6108233EFCF3339C69B88F94A7195BF2638F4F86D3709BD2F0E8B46B4129053EF0371BC19841BCAA4369049DC6494681447E49F792F863A339E821D453A7F
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7516e634-b5f9-4bbb-8754-62a573124e2a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729076103444,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1091
                      Entropy (8bit):5.694381466759124
                      Encrypted:false
                      SSDEEP:24:Yv6Xl4A4zvMpLgE7cgD6SOGtnnl0RCmK8czOCYvSL:YvqGEhgs6SraAh8cvYKL
                      MD5:29530580A9518AADAA6B8DD05CB4E11D
                      SHA1:9089A7E4D0359E62B95A55673C984EE31C901AFE
                      SHA-256:69BF174A5DEE9D182D72ED85554777F53CF1C6D358530E38D22B2ADF5AF1BA85
                      SHA-512:25D3A1E1EEA96FA32856EB299178D2E3FD92C5588EE362411CDA07335640D5417AE463A6E933913165DF07484CAFECFC9CD72B476706E384D440A10268262BED
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7516e634-b5f9-4bbb-8754-62a573124e2a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729076103444,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"89628_281075ActionBlock_2","campaignId":89628,"containerId":"1","controlGroupId":"","treatmentId":"67a3a874-888f-4d96-9f3d-26e70c3e0be1","variationId":"281075"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQgUERGIGZpbGVzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNhdElkIjoiUkdTMDM1MS1FTlUtQ2hhbGxlbmdlcjIifQ==","dataType":"ap

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1050
                      Entropy (8bit):5.655179419689647
                      Encrypted:false
                      SSDEEP:24:Yv6Xl4A4zvmVLgEF0c7sbnl0RCmK8czOCYHflEpwiVS:YvqGeFg6sGAh8cvYHWpwL
                      MD5:F7BCCD9F7A415FE4CE6AEDFDBCD6C7C2
                      SHA1:8900462ACAB3F67F9B1206B5FF7CF38EC7455F6D
                      SHA-256:3A1AB6EF3CF5FE06F18A5ED3A5EE4EC258227FB9AAACB40E289A9770F516AFD2
                      SHA-512:CB6BD43694658CF1D6BA7B32CE71C349427D1D6FFF6D760365C5A56B7686E45B2782932C12685933CF3C6DF143E82335CB07D27BEEC234F118C6549FC0C3B02D
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7516e634-b5f9-4bbb-8754-62a573124e2a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729076103444,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_0","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"0924134e-3c59-4f53-b731-add558c56fec","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuZm9ybXMgJiBhZ3JlZW1lbnRzLiJ9LCJ0Y2F0SWQiOm51bGx9","dataType":"application\/json","encodingScheme":true},"

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.301219270912943
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXlPQnHgjzHb1VoZcg1vRcR0YTEeoAvJfQ1rPeUkwRe9:YvXKXl4Hg4Zc0vHGY16Ukee9
                      MD5:1BEB333CB3E03A9B1FD7AB49EC2B178B
                      SHA1:8188376D9A219630AA35F338A7D3A4F69E113310
                      SHA-256:2C43F4DDBF542756C7269541BE6D9E5A0B6554A590F2221EA04C9B7029D89FC2
                      SHA-512:F523DB3FE292D8172A776AFE8604C4B369C38454C0EB0A59D489D1BF4259CEB03FE9CB22C2C742801D87AEF7E63CC30E5307AB49910910455DF65EB187A28FDB
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7516e634-b5f9-4bbb-8754-62a573124e2a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729076103444,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1098
                      Entropy (8bit):5.692520626275647
                      Encrypted:false
                      SSDEEP:24:Yv6Xl4A4zvT2LgEFcs2SOGt0nl0RCmK8czOCUaBtCrfSL:YvqGrogq2SrhAh8cvUgEmL
                      MD5:168963991A62F0257C6923DA2B53AF75
                      SHA1:330C33ECFEEC682CA9D9118B70482C9CF39866C2
                      SHA-256:76F8A9E86C00437CD31059F6DB5E97CCC0E44A420C9B34D785ED0AC9411331A4
                      SHA-512:E0FE9C906E25192F50711DA6265EA2B47B37A283979832D495756A8E7E48794CC3DAF262D14789E28219E9AA2FF9CE5AED8A2626BBCCD1478E181425F7B81BD9
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7516e634-b5f9-4bbb-8754-62a573124e2a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729076103444,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"89628_281075ActionBlock_0","campaignId":89628,"containerId":"1","controlGroupId":"","treatmentId":"abdf1d9d-2114-4953-95a6-4eed783b9872","variationId":"281075"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IlR1cm4gc2Nhbm5lZCBwYXBlciBkb2N1bWVudHNcbmludG8gaW5zdGFudGx5IGVkaXRhYmxlIFBERnMuIn0sInRjYXRJZCI6IlJHUzAzNTEtRU5VLUNoYWxsZW5nZXIyIn0=","dataTy

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1164
                      Entropy (8bit):5.701495000822059
                      Encrypted:false
                      SSDEEP:24:Yv6Xl4A4zvfKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK5S:YvqGnEgqprtrS5OZjSlwTmAfSKQ
                      MD5:E2A6D96694A190513AECD0F4DDDF063A
                      SHA1:F5600D55927C0B0D3FC592DBEB8FB23AB3116753
                      SHA-256:4A004D5ED6B7D43797C2792C10EBAA641D3F4A6C44A31EC9C29CF96D099BA6B6
                      SHA-512:5E4A6ECA56EEA038764503738C8318F0D896502FC1902F307193452A0F8830D879E7F6D9D4B19AEFEE6BEB50B7C2422AD6AD38A2D75E4E92709758B06924386D
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7516e634-b5f9-4bbb-8754-62a573124e2a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729076103444,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.302525627798151
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXlPQnHgjzHb1VoZcg1vRcR0YTEeoAvJfYdPeUkwRe9:YvXKXl4Hg4Zc0vHGg8Ukee9
                      MD5:EB470EFB97715092DE1F121FF2071534
                      SHA1:E9798E2DE7C6A58BEAE48B6DC53777947856A69C
                      SHA-256:5ADC424236377B90EE88888BDF948F5A8FF3B6FAF200EE748FDD69049812137D
                      SHA-512:1DDA04AA1DC1BB0914DF5D327668D6214F23EE77B294CA6F89CC2F5BA24323CEE0BE05BACDB532018D0E7F5091DBDEA8C07F50E90B9EEC8286F0EDEF4D7B4ED9
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7516e634-b5f9-4bbb-8754-62a573124e2a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729076103444,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1395
                      Entropy (8bit):5.781401910590408
                      Encrypted:false
                      SSDEEP:24:Yv6Xl4A4zvirLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJN6:YvqG6HgDv3W2aYQfgB5OUupHrQ9FJQ
                      MD5:8BE8696D8D24E44EEA94355F2F8F983C
                      SHA1:3677EF8DDDA41EC27494473414FE08EEA9ECE4FA
                      SHA-256:A1FF1082823D2CABF32E7740F671A93BB5F94DD26B5A59D388B4DD743A5E7E45
                      SHA-512:FF5DEE06376373702BFB2AEA370EBDE6DAA96E79BA1CC33132BFF075700049ECDA2495952321D128C4E3C5A1DCB267D539A22E9431E5547C57316C788D1090E6
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7516e634-b5f9-4bbb-8754-62a573124e2a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729076103444,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):291
                      Entropy (8bit):5.2860553672053605
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXlPQnHgjzHb1VoZcg1vRcR0YTEeoAvJfbPtdPeUkwRe9:YvXKXl4Hg4Zc0vHGDV8Ukee9
                      MD5:66BB0958B6AEC6BB93DADE6E34D06E6A
                      SHA1:0939979970081F334A7B3E8841E9FF32A77C0144
                      SHA-256:562884D8C8904B0EF74DD398097F8C5A49030465328EB72DEFFFA948DD6F2779
                      SHA-512:A1B46707CD6C1595BC4966BE407B7692CD3FD4C0936722C125E8EF9918E5E598986579AFDA524FD5A88BDD482B3FFA5DFF17BF62BBF7CAF345D113D4A5F3D687
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7516e634-b5f9-4bbb-8754-62a573124e2a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729076103444,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):287
                      Entropy (8bit):5.290741778301954
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXlPQnHgjzHb1VoZcg1vRcR0YTEeoAvJf21rPeUkwRe9:YvXKXl4Hg4Zc0vHG+16Ukee9
                      MD5:81DB483C2C0F6F888D80002F72E21D51
                      SHA1:31505DF241D88E885C236B7AD72175322817E7EC
                      SHA-256:1F30244611970A765E613C7339AD38533451F866F2B804BEB71F391F2750A412
                      SHA-512:C64EC63A1C1B954641FC90C00617C484EB7FD42597EEB0AB1C6383DFC1855BC85AE2C0F8DFB090806A6714E9B356E7DC61D866B073F60FAD5A53BC916C8E692D
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7516e634-b5f9-4bbb-8754-62a573124e2a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729076103444,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1054
                      Entropy (8bit):5.6707566031958105
                      Encrypted:false
                      SSDEEP:24:Yv6Xl4A4zv4amXayLgE6cTg4QSOGtNaqnl0RCmK8czOC/CrfSL:YvqGmBgSXQSrOAh8cv6mL
                      MD5:C81ECB2E1ADAE7031F63566CE773F2E5
                      SHA1:9D82AB0D26AF0246CBDF4356254989DE8560BD4B
                      SHA-256:9BDD7F11C8515F77B424B5FA4B55BDE9763743809C0734A40E88FBEE71C5F0CE
                      SHA-512:C1D0799214861BE41BA4E63D9ED87937FD21C8B52A2594BBC0EA01F41791BAA39DDEF8BA6CEDAC08A05B8579BAA3F087E0309C6A7384CD0C011B8533E2F71E4A
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7516e634-b5f9-4bbb-8754-62a573124e2a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729076103444,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"89628_281075ActionBlock_1","campaignId":89628,"containerId":"1","controlGroupId":"","treatmentId":"7fe39695-394c-4706-9b50-651e7499d428","variationId":"281075"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6IlJHUzAzNTEtRU5VLUNoYWxsZW5nZXIyIn0=","dataType":"application\/json","encodingScheme":tru

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):286
                      Entropy (8bit):5.268682303513408
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXlPQnHgjzHb1VoZcg1vRcR0YTEeoAvJfshHHrPeUkwRe9:YvXKXl4Hg4Zc0vHGUUUkee9
                      MD5:2ADA1DAFDE7D5F3EF9042C085A241100
                      SHA1:41310BF876FF71CD48BDE0860E3636C2FEB03067
                      SHA-256:FB7D103702360D2E78E02DABC9681CD39768480FC80FBF2C80E0944125C05D9B
                      SHA-512:0192F3766B2BE7E14087113C3D6CFD8096D5FF586B7E3E4423644329C6F95C2DC135E31233A0828E4AB701EB2FCB388053DD2C258829CA8A632BC792E399AF22
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7516e634-b5f9-4bbb-8754-62a573124e2a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729076103444,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):782
                      Entropy (8bit):5.377197600956636
                      Encrypted:false
                      SSDEEP:12:YvXKXl4Hg4Zc0vHGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWG:Yv6Xl4A4zvH168CgEXX5kcIfANhL
                      MD5:C5D0442B2710F4878FA2806B8B6B3AA3
                      SHA1:1748AC297D32398E9DF2B4880993372C49B01BFE
                      SHA-256:CB6FDD9ECFD479059CF6AB66AAA657842E2F6245D8B3B2E8BBF5E057048D98D7
                      SHA-512:412FFC151998AC35339736112A7AE8695503C2931CFDA2000E187E63BB13CB0FBE6A2DB0CBA742C0DFA6516FE8C576AD901591C18814F03405C7C439DF793EBA
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"7516e634-b5f9-4bbb-8754-62a573124e2a","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729076103444,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1728898443502}}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):4
                      Entropy (8bit):0.8112781244591328
                      Encrypted:false
                      SSDEEP:3:e:e
                      MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                      SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                      SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                      SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                      Malicious:false
                      Preview:....

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):2818
                      Entropy (8bit):5.127441407038573
                      Encrypted:false
                      SSDEEP:24:YuvkyoOaG22Caykft8VCouFUQEfbWVUO6g1BVY4fjHDezgj0SxhJ12H2LSTu6i5f:YA/P2LtuFUbu6kQoHDeO/GNu6iC49Fz
                      MD5:96C163C277220FE2995CBD98AB3E66F8
                      SHA1:6684410C4B44F876F4DC9B802DAF3E9595E09373
                      SHA-256:BEFCA691110140774247DD94CC57A4F2DCEBC61C8459B22187DF14B93CD63093
                      SHA-512:2419495918B36CF55FB33EABC763CC93F4AE92A8C3BF4A6E06384C0DCF5CCBA9849BF746D5E410D5BF05FCB30B1E01B4B921BA6E75174A459B5AD70B58FE830B
                      Malicious:false
                      Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"df2bf746d78edbd62618de0bf11ef138","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1050,"ts":1728898443000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"3de543d3af9c9406f3b7bd323e0a0d60","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1728898443000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"5bb108db0eb38077ae1aea06c0d27ad7","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1054,"ts":1728898443000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"327c2c45a3691b36eff4343041c78429","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1091,"ts":1728898443000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"c0e92c3bf2f8e057293da2c555465c10","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1098,"ts":1728898443000},{"id":"Edit_InApp_Aug2020","info":{"dg":"b37fb599334812d0213d14dde66f309f","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":17

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
                      Category:dropped
                      Size (bytes):12288
                      Entropy (8bit):1.1886294939331588
                      Encrypted:false
                      SSDEEP:48:TGufl2GL7msEHUUUUUUUUFSvR9H9vxFGiDIAEkGVvp9:lNVmswUUUUUUUUF+FGSItx
                      MD5:1297DB09A5BDD7ADF55D72750B3D555A
                      SHA1:5BA4692A26A2BC4663BFB42147DC658DBA77C3F0
                      SHA-256:76018E43C1A08F6CF5B9BC358D99CE7A895DA99F1D10925BEA48F5DA89475C29
                      SHA-512:5167218B68CB0966D13987048D6693CF7584FFD389068E1A89409AAD0CB47D17307C33F133BCDEB677B7A19F52887039C94503F3E2877C34BC15A4AD47EA6822
                      Malicious:false
                      Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite Rollback Journal
                      Category:dropped
                      Size (bytes):8720
                      Entropy (8bit):1.6090575944838563
                      Encrypted:false
                      SSDEEP:48:7MVKUUUUUUUUUUdvR9H9vxFGiDIAEkGVvpqFl2GL7msQ:7DUUUUUUUUUUZFGSItTKVmsQ
                      MD5:72A7B9023552B3C69344C502D3C086E0
                      SHA1:D7A58B609BD832389CA00DE73238920D175D4681
                      SHA-256:0DBF3680907B5E042F18AEDA1AAC0DE74C06C6A209EBC90391E32A156CD6D351
                      SHA-512:9D5EB8D1A060BE04BDCD3FB206A2C8288CB6718A441922422C3FA195656BA029BF3F231FE315B61868D62024806E2D9AE04BFF4A597DA6B457615DDA24481D1A
                      Malicious:false
                      Preview:.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Temp\MSI711ea.LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):246
                      Entropy (8bit):3.5197430193686525
                      Encrypted:false
                      SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K84CWfWREwCH:Qw946cPbiOxDlbYnuRKpW+l
                      MD5:368B69CD3A99E4AE9C1D82CC1A436105
                      SHA1:1CCA210C7EA35CF007A92566F07063B8BD505C88
                      SHA-256:DDEC6F8C4EBCFA8030568194574C4679381F9A0E00C3D0E5CFBF134B4D51EBF3
                      SHA-512:25BADF565385216860112D5278AF70F8A71D01B35FDD312F939D7D274387F195EECA243B3D5F6986676A43AD33AED5822786C037AEBD3FE450F121E435AF276F
                      Malicious:false
                      Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.4./.1.0./.2.0.2.4. . .0.5.:.3.4.:.0.3. .=.=.=.....

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-14 05-33-58-650.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393)
                      Category:dropped
                      Size (bytes):16525
                      Entropy (8bit):5.345946398610936
                      Encrypted:false
                      SSDEEP:384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
                      MD5:8947C10F5AB6CFFFAE64BCA79B5A0BE3
                      SHA1:70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
                      SHA-256:4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
                      SHA-512:B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
                      Malicious:false
                      Preview:SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393), with CRLF line terminators
                      Category:dropped
                      Size (bytes):15114
                      Entropy (8bit):5.366265690073228
                      Encrypted:false
                      SSDEEP:384:tg2RO0LD0Te4urclDYaCmQLKGpgHGOKeh2ACkwi8mvWB/OWDrY/0FWFsdEyjJOe/:5vJ
                      MD5:E1B89BCCE9D40DD42E242B58BF694886
                      SHA1:2B4743EEB1ABE8289E41638DF19319678C41790D
                      SHA-256:AB727CD62B7C1050FD2DD295BB397B391F1C356767569394A993C2AFE691A35C
                      SHA-512:0E1727FB3F67E0F0DDB602D9D2B0349E20B808F20661C180226D89DFC4EABCF43422F20B6078A8AB20EE2C958CE79832542EC07B754B932AF5D725094AFBEAD8
                      Malicious:false
                      Preview:SessionID=ee640f92-e95c-47b0-b169-9a0feaddad2c.1728898438677 Timestamp=2024-10-14T05:33:58:677-0400 ThreadID=5076 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=ee640f92-e95c-47b0-b169-9a0feaddad2c.1728898438677 Timestamp=2024-10-14T05:33:58:682-0400 ThreadID=5076 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=ee640f92-e95c-47b0-b169-9a0feaddad2c.1728898438677 Timestamp=2024-10-14T05:33:58:682-0400 ThreadID=5076 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=ee640f92-e95c-47b0-b169-9a0feaddad2c.1728898438677 Timestamp=2024-10-14T05:33:58:682-0400 ThreadID=5076 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=ee640f92-e95c-47b0-b169-9a0feaddad2c.1728898438677 Timestamp=2024-10-14T05:33:58:682-0400 ThreadID=5076 Component=ngl-lib_NglAppLib Description="SetConf

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):29752
                      Entropy (8bit):5.391507548832574
                      Encrypted:false
                      SSDEEP:768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rB:1
                      MD5:925506B218D4DF3BAABD4141933DF5FF
                      SHA1:7A8DDC99903AF309EB2E0B4D6C8A636BE5E18BB1
                      SHA-256:2F8B3F2F2EC8039E288371F5B21F0C9374EAF5DB76C36CF594331305EADC6CE6
                      SHA-512:527E4C49FE223CC0669ED16733FAE42DB5759EEF72E06FAC9C422D264D65F01EE621ABB86753AB61331EA170F44ACACC0491BE9DF70C0C4BD76E40030D13B001
                      Malicious:false
                      Preview:03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

                      C:\Users\user\AppData\Local\Temp\acrocef_low\0419b4e6-2a51-48cb-bbc9-49803013987a.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                      Category:dropped
                      Size (bytes):1407294
                      Entropy (8bit):7.97605879016224
                      Encrypted:false
                      SSDEEP:24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
                      MD5:716C2C392DCD15C95BBD760EEBABFCD0
                      SHA1:4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
                      SHA-256:DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
                      SHA-512:E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
                      Malicious:false
                      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                      C:\Users\user\AppData\Local\Temp\acrocef_low\58a9816b-85f4-48f5-aba6-606d94b97768.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                      Category:dropped
                      Size (bytes):758601
                      Entropy (8bit):7.98639316555857
                      Encrypted:false
                      SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                      MD5:3A49135134665364308390AC398006F1
                      SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                      SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                      SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                      Malicious:false
                      Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                      C:\Users\user\AppData\Local\Temp\acrocef_low\666385fa-bcc7-4ffb-9e2d-eb654cf1f1bd.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                      Category:dropped
                      Size (bytes):1419751
                      Entropy (8bit):7.976496077007677
                      Encrypted:false
                      SSDEEP:24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
                      MD5:18E3D04537AF72FDBEB3760B2D10C80E
                      SHA1:B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
                      SHA-256:BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
                      SHA-512:2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
                      Malicious:false
                      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                      C:\Users\user\AppData\Local\Temp\acrocef_low\e63c19fd-bd5c-4e9d-8077-4cdb278c9591.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                      Category:dropped
                      Size (bytes):386528
                      Entropy (8bit):7.9736851559892425
                      Encrypted:false
                      SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                      MD5:5C48B0AD2FEF800949466AE872E1F1E2
                      SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                      SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                      SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                      Malicious:false
                      Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                      Static File Info

                      General

                      File type:PDF document, version 1.6 (zip deflate encoded)
                      Entropy (8bit):7.8389271656471
                      TrID:
                      • Adobe Portable Document Format (5005/1) 100.00%
                      File name:0260719760_9057987504_20241014041558.PDF
                      File size:57'344 bytes
                      MD5:91f21cd7cf5808b061c4dc014e1ebec1
                      SHA1:5d494095492db13c0bc90dfbe91fe2ee848d2b33
                      SHA256:dec493278736e87e3d6a2acd329b86f79c7a7f92b63480abf0bed4baddba47d6
                      SHA512:ec434545207d23dd1580a2f5a668bf9b1b82750f9ec29da5db8a4c24fa59b3c97376842ec168db0fe6eabbfa3e8a8df4c4e8323c99ac758d382e1ba915d2fedb
                      SSDEEP:1536:iD25BmjN2oeTDcyOmNd6tcNxg98lCKsG4+FXVFtr:h5Bmyzd6mNxgRuFZ
                      TLSH:8643E149DD01BC29C852757BE84979914AA395AE48DC2C117EAC4ECF2741E8330CAEFE
                      File Content Preview:%PDF-1.6.%......610 0 obj.<</Filter/FlateDecode/First 1728/Length 2812/N 200/Type/ObjStm>>stream..h..Y.n.7...>:..u.N .0.....V.{.m,.Zg.. [.=^$..sH...i......U.S..ENP..*.......6.D..^.Vf.J....3....QV...Z..)........\...(?.i....).5.^.|.CP..X.*$....vxj.=.E....Q%

                      File Icon

                      Icon Hash:62cc8caeb29e8ae0

                      Static PDF Info

                      General

                      Header:%PDF-1.6
                      Total Entropy:7.838927
                      Total Bytes:57344
                      Stream Entropy:7.876421
                      Stream Bytes:52545
                      Entropy outside Streams:5.417217
                      Bytes outside Streams:4799
                      Number of EOF found:1
                      Bytes after EOF:

                      Keywords Statistics

                      NameCount
                      obj33
                      endobj33
                      stream16
                      endstream16
                      xref0
                      trailer0
                      startxref1
                      /Page1
                      /Encrypt0
                      /ObjStm6
                      /URI0
                      /JS0
                      /JavaScript0
                      /AA0
                      /OpenAction0
                      /AcroForm0
                      /JBIG2Decode0
                      /RichMedia0
                      /Launch0
                      /EmbeddedFile0

                      Image Streams

                      IDDHASHMD5Preview
                      5880000000000000000e8a2862558d287ea1126ebb98a66f337

                      Network Behavior

                      Network Port Distribution

                      TCP Packets

                      TimestampSource PortDest PortSource IPDest IP
                      Oct 14, 2024 11:34:09.498008013 CEST49747443192.168.2.4104.77.220.172
                      Oct 14, 2024 11:34:09.498073101 CEST44349747104.77.220.172192.168.2.4
                      Oct 14, 2024 11:34:09.498148918 CEST49747443192.168.2.4104.77.220.172
                      Oct 14, 2024 11:34:09.498358965 CEST49747443192.168.2.4104.77.220.172
                      Oct 14, 2024 11:34:09.498389959 CEST44349747104.77.220.172192.168.2.4
                      Oct 14, 2024 11:34:11.013309956 CEST44349747104.77.220.172192.168.2.4
                      Oct 14, 2024 11:34:11.013564110 CEST49747443192.168.2.4104.77.220.172
                      Oct 14, 2024 11:34:11.013624907 CEST44349747104.77.220.172192.168.2.4
                      Oct 14, 2024 11:34:11.015086889 CEST44349747104.77.220.172192.168.2.4
                      Oct 14, 2024 11:34:11.015147924 CEST49747443192.168.2.4104.77.220.172
                      Oct 14, 2024 11:34:11.055035114 CEST49747443192.168.2.4104.77.220.172
                      Oct 14, 2024 11:34:11.055155039 CEST44349747104.77.220.172192.168.2.4
                      Oct 14, 2024 11:34:11.055248022 CEST49747443192.168.2.4104.77.220.172
                      Oct 14, 2024 11:34:11.055280924 CEST44349747104.77.220.172192.168.2.4
                      Oct 14, 2024 11:34:11.106137037 CEST49747443192.168.2.4104.77.220.172
                      Oct 14, 2024 11:34:11.403918982 CEST44349747104.77.220.172192.168.2.4
                      Oct 14, 2024 11:34:11.404084921 CEST44349747104.77.220.172192.168.2.4
                      Oct 14, 2024 11:34:11.404151917 CEST49747443192.168.2.4104.77.220.172
                      Oct 14, 2024 11:34:11.404769897 CEST49747443192.168.2.4104.77.220.172
                      Oct 14, 2024 11:34:11.404808998 CEST44349747104.77.220.172192.168.2.4
                      Oct 14, 2024 11:34:11.404834032 CEST49747443192.168.2.4104.77.220.172
                      Oct 14, 2024 11:34:11.404855013 CEST49747443192.168.2.4104.77.220.172

                      UDP Packets

                      TimestampSource PortDest PortSource IPDest IP
                      Oct 14, 2024 11:34:09.065536976 CEST5969453192.168.2.41.1.1.1

                      DNS Queries

                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                      Oct 14, 2024 11:34:09.065536976 CEST192.168.2.41.1.1.10x140fStandard query (0)x1.i.lencr.orgA (IP address)IN (0x0001)false

                      DNS Answers

                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                      Oct 14, 2024 11:34:09.072755098 CEST1.1.1.1192.168.2.40x140fNo error (0)x1.i.lencr.orgcrl.root-x1.letsencrypt.org.edgekey.netCNAME (Canonical name)IN (0x0001)false

                      HTTP Request Dependency Graph

                      • armmf.adobe.com

                      HTTPS Proxied Packets

                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      0192.168.2.449747104.77.220.1724437248C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      TimestampBytes transferredDirectionData
                      2024-10-14 09:34:11 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
                      Host: armmf.adobe.com
                      Connection: keep-alive
                      Accept-Language: en-US,en;q=0.9
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
                      Sec-Fetch-Site: same-origin
                      Sec-Fetch-Mode: no-cors
                      Sec-Fetch-Dest: empty
                      Accept-Encoding: gzip, deflate, br
                      If-None-Match: "78-5faa31cce96da"
                      If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
                      2024-10-14 09:34:11 UTC198INHTTP/1.1 304 Not Modified
                      Content-Type: text/plain; charset=UTF-8
                      Last-Modified: Mon, 01 May 2023 15:02:33 GMT
                      ETag: "78-5faa31cce96da"
                      Date: Mon, 14 Oct 2024 09:34:11 GMT
                      Connection: close


                      Statistics

                      CPU Usage

                      Click to jump to process

                      Memory Usage

                      Click to jump to process

                      High Level Behavior Distribution

                      Click to dive into process behavior distribution

                      Behavior

                      Click to jump to process

                      System Behavior

                      General

                      Target ID:0
                      Start time:05:33:55
                      Start date:14/10/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\0260719760_9057987504_20241014041558.PDF"
                      Imagebase:0x7ff6bc1b0000
                      File size:5'641'176 bytes
                      MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:high
                      Has exited:true

                      General

                      Target ID:1
                      Start time:05:33:56
                      Start date:14/10/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                      Imagebase:0x7ff7699e0000
                      File size:3'581'912 bytes
                      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:high
                      Has exited:true

                      General

                      Target ID:3
                      Start time:05:33:56
                      Start date:14/10/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1536,i,8389459400494429931,13337519352966136629,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                      Imagebase:0x7ff74bb60000
                      File size:3'581'912 bytes
                      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:high
                      Has exited:true

                      Disassembly

                      ⊘No disassembly