Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
FDrive ).pdf

Overview

General Information

Sample name:FDrive ).pdf
renamed because original name is a hash value
Original sample name:The Difference Maker Making Your Attitude Your Greatest Asset - PDFDrive.com - The Difference Maker Making Your Attitude Your Greatest Asset ( PDFDrive ).pdf
Analysis ID:1411155
MD5:410213409ab017ba5acff390f4d8beab
SHA1:012f7ca37a6b276dca0431b0b327f2e42a4c1c5d
SHA256:af4c8a610a96b0d868ca651bf600ffbec8a016745596d667bc138c070fbe5b3b
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 5448 cmdline: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\FDrive ).pdf MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 6196 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 6044 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2072 --field-trial-handle=1576,i,13669524516722668851,15775429148942468690,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficTCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.6:49709
Source: global trafficTCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.6:49709
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.6:49709
Source: global trafficTCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.6:49709
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.6:49709
Source: global trafficTCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.6:49709
Source: global trafficTCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.6:49709
Source: global trafficTCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.6:49709
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.6:49709
Source: global trafficTCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.6:49709
Source: global trafficTCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: Joe Sandbox ViewIP Address: 23.47.168.24 23.47.168.24
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
Source: classification engineClassification label: clean2.winPDF@14/46@0/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4084Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-03-18 17-04-47-681.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\FDrive ).pdf
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2072 --field-trial-handle=1576,i,13669524516722668851,15775429148942468690,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2072 --field-trial-handle=1576,i,13669524516722668851,15775429148942468690,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: FDrive ).pdfInitial sample: PDF keyword /JS count = 0
Source: FDrive ).pdfInitial sample: PDF keyword /JavaScript count = 0
Source: FDrive ).pdfInitial sample: PDF keyword stream count = 518
Source: FDrive ).pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: FDrive ).pdfInitial sample: PDF keyword /ObjStm count = 155
Source: FDrive ).pdfInitial sample: PDF keyword endobj count = 1351
Source: FDrive ).pdfInitial sample: PDF keyword endstream count = 518
Source: FDrive ).pdfInitial sample: PDF keyword obj count = 1351
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: FDrive ).pdfBinary or memory string: OptrfnInZrBllBV^A~QeMu

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
Security Software Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS Memory1
System Information Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive12
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1411155 Sample: FDrive ).pdf Startdate: 18/03/2024 Architecture: WINDOWS Score: 2 6 Acrobat.exe 18 77 2->6         started        process3 8 AcroCEF.exe 105 6->8         started        process4 10 AcroCEF.exe 2 8->10         started        dnsIp5 13 23.47.168.24, 443, 49709 AKAMAI-ASUS United States 10->13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
23.47.168.24
unknownUnited States
16625AKAMAI-ASUSfalse

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1411155
Start date and time:2024-03-18 17:03:57 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 22s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultwindowspdfcookbook.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:11
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:FDrive ).pdf
renamed because original name is a hash value
Original Sample Name:The Difference Maker Making Your Attitude Your Greatest Asset - PDFDrive.com - The Difference Maker Making Your Attitude Your Greatest Asset ( PDFDrive ).pdf
Detection:CLEAN
Classification:clean2.winPDF@14/46@0/1
EGA Information:Failed
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 0
  • Number of non-executed functions: 0
Cookbook Comments:
  • Found application associated with file extension: .pdf
  • Found PDF document
  • Close Viewer

Warnings

  • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 23.199.48.153, 52.6.155.20, 52.22.41.97, 3.233.129.217, 3.219.243.226, 162.159.61.3, 172.64.41.3, 23.40.179.35, 23.40.179.19, 23.55.243.210, 23.55.243.199, 23.54.161.82, 23.55.235.248, 23.54.161.98, 23.55.235.250, 23.54.161.105, 23.54.161.81, 23.54.161.91, 23.54.161.104, 23.54.161.97
  • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com
  • VT rate limit hit for: FDrive ).pdf

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
23.47.168.24qqeng.pdf.lnkGet hashmaliciousRHADAMANTHYSBrowse
    D21 .pdf.exeGet hashmaliciousUnknownBrowse
      D21 .pdf.exeGet hashmaliciousUnknownBrowse
        PURCHASE ORDER.xlsGet hashmaliciousUnknownBrowse
          J-JeremieKarg-78462.jsGet hashmaliciousUnknownBrowse
            J-JeremieKarg-78462.jsGet hashmaliciousUnknownBrowse
              I_ CDE Awb_ 8995067407.msgGet hashmaliciousDBatLoaderBrowse
                http://trafign.cluster029.hosting.ovh.net/fuelcartpo/vurte/Get hashmaliciousUnknownBrowse
                  ARCHIVO100403950049000901.pdfGet hashmaliciousUnknownBrowse
                    STAFF HOME LOAN ELIGIBILITY CALCULATOR APRIL-2023.xlsGet hashmaliciousUnknownBrowse

                      Domains

                      ⊘No context

                      ASNs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      AKAMAI-ASUShttps://cloudflare-ipfs.com/ipfs/bafkreif2klim7glbgcsrfe6lm7wfd2scwmhee5i6dglyggzgvjgl53zw2i/#a2J1cnJAaG9tZWFpZC5vcmc=Get hashmaliciousUnknownBrowse
                      • 23.47.169.232
                      yzIY5KFJSu.elfGet hashmaliciousMiraiBrowse
                      • 184.50.136.72
                      7InjeWQVHC.elfGet hashmaliciousUnknownBrowse
                      • 104.83.56.253
                      7yboxvX8mm.elfGet hashmaliciousUnknownBrowse
                      • 23.211.235.98
                      file.exeGet hashmaliciousPureLog Stealer, VidarBrowse
                      • 104.105.90.131
                      https://www.vegausering.comGet hashmaliciousUnknownBrowse
                      • 23.203.176.161
                      WdwgE9p1kA.elfGet hashmaliciousMiraiBrowse
                      • 184.30.137.101
                      RpjE7NostK.elfGet hashmaliciousMiraiBrowse
                      • 23.9.137.171
                      BraveBrowserSetup-BRV010.exeGet hashmaliciousUnknownBrowse
                      • 69.192.109.165
                      BraveBrowserSetup-BRV010.exeGet hashmaliciousUnknownBrowse
                      • 23.203.189.24

                      JA3 Fingerprints

                      ⊘No context

                      Dropped Files

                      ⊘No context

                      Created / dropped Files

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):295
                      Entropy (8bit):5.2236236676462555
                      Encrypted:false
                      SSDEEP:6:F0PPsNAVq2PN72nKuAl9OmbnIFUt880PPkHgZmw+80PPkHIkwON72nKuAl9Ombjd:WuAVvVaHAahFUt8nUHg/+nUHI5OaHAae
                      MD5:F416B565790C3AFC626863C8F2817BFD
                      SHA1:57DD63D4B396AD380198017614B1E711DBF147F3
                      SHA-256:8BB834DD361FC14497C730AD1A8059AA06D1D8B9F1302B36ED8A19376E2AE06B
                      SHA-512:D0D5319A8A3C9F2FC8011672EFBDB80310FA053C7372C6DAA310F741145179A8904F0C0C891F68C0F12AB57FE7773BCBD8708F9910DDAE5E9D036BC1C4170CCF
                      Malicious:false
                      Reputation:low
                      Preview:2024/03/18-17:04:45.588 854 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/03/18-17:04:45.590 854 Recovering log #3.2024/03/18-17:04:45.590 854 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):295
                      Entropy (8bit):5.2236236676462555
                      Encrypted:false
                      SSDEEP:6:F0PPsNAVq2PN72nKuAl9OmbnIFUt880PPkHgZmw+80PPkHIkwON72nKuAl9Ombjd:WuAVvVaHAahFUt8nUHg/+nUHI5OaHAae
                      MD5:F416B565790C3AFC626863C8F2817BFD
                      SHA1:57DD63D4B396AD380198017614B1E711DBF147F3
                      SHA-256:8BB834DD361FC14497C730AD1A8059AA06D1D8B9F1302B36ED8A19376E2AE06B
                      SHA-512:D0D5319A8A3C9F2FC8011672EFBDB80310FA053C7372C6DAA310F741145179A8904F0C0C891F68C0F12AB57FE7773BCBD8708F9910DDAE5E9D036BC1C4170CCF
                      Malicious:false
                      Reputation:low
                      Preview:2024/03/18-17:04:45.588 854 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/03/18-17:04:45.590 854 Recovering log #3.2024/03/18-17:04:45.590 854 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):339
                      Entropy (8bit):5.188284200233661
                      Encrypted:false
                      SSDEEP:6:F0PQhAROq2PN72nKuAl9Ombzo2jMGIFUt880PQ+JZmw+80PzVkwON72nKuAl9OmT:WpMvVaHAa8uFUt8nB/+nh5OaHAa8RJ
                      MD5:1A55DEA9593621D772D43A0609913B9C
                      SHA1:5948104118BB4BF9D1A22AC9CE0A0673A3C8EDFB
                      SHA-256:1C3278DB24D2902D0794F8A575865167079E69F12EADE922014BAF9811A09DEE
                      SHA-512:9CD8D7321DCB4C578D4532267ADF816F00C31CDA4E2A061590506A7F4300E4F4987F44F060BD5988D28843515B575B5FD3385020A5EBEAFE4ED1DEDE145A85E2
                      Malicious:false
                      Reputation:low
                      Preview:2024/03/18-17:04:45.647 ce4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/03/18-17:04:45.649 ce4 Recovering log #3.2024/03/18-17:04:45.650 ce4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):339
                      Entropy (8bit):5.188284200233661
                      Encrypted:false
                      SSDEEP:6:F0PQhAROq2PN72nKuAl9Ombzo2jMGIFUt880PQ+JZmw+80PzVkwON72nKuAl9OmT:WpMvVaHAa8uFUt8nB/+nh5OaHAa8RJ
                      MD5:1A55DEA9593621D772D43A0609913B9C
                      SHA1:5948104118BB4BF9D1A22AC9CE0A0673A3C8EDFB
                      SHA-256:1C3278DB24D2902D0794F8A575865167079E69F12EADE922014BAF9811A09DEE
                      SHA-512:9CD8D7321DCB4C578D4532267ADF816F00C31CDA4E2A061590506A7F4300E4F4987F44F060BD5988D28843515B575B5FD3385020A5EBEAFE4ED1DEDE145A85E2
                      Malicious:false
                      Reputation:low
                      Preview:2024/03/18-17:04:45.647 ce4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/03/18-17:04:45.649 ce4 Recovering log #3.2024/03/18-17:04:45.650 ce4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\839bb9f4-61e2-4ced-8770-d5d19a3b1243.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:modified
                      Size (bytes):474
                      Entropy (8bit):4.971158482009928
                      Encrypted:false
                      SSDEEP:12:YH/um3RA8sqZQkcnWhsBdOg2Hu2caq3QYiubcP7E4T3y:Y2sRds5VWydMHM3QYhbA7nby
                      MD5:8812F7B613079C4FA56CAFD3C51B5338
                      SHA1:76FB1CE3F8ACA16AC2BCEBABF1D0A2AFD29C45D5
                      SHA-256:6B2FEB23CAFFD55B054FD9FF041D012EDFA43FEE4C1D3A4FF27BF0F0B5831087
                      SHA-512:73A8AEE0765C1E571A90477C9BBCF801D51948484268A0F37368CBD1F2723768C43A1D1EEDBE68BBB803A09A70121F3A07FCFF4EB1C4D28F43312E8BFD128A68
                      Malicious:false
                      Reputation:low
                      Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13355337897192296","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":90178},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):474
                      Entropy (8bit):4.971158482009928
                      Encrypted:false
                      SSDEEP:12:YH/um3RA8sqZQkcnWhsBdOg2Hu2caq3QYiubcP7E4T3y:Y2sRds5VWydMHM3QYhbA7nby
                      MD5:8812F7B613079C4FA56CAFD3C51B5338
                      SHA1:76FB1CE3F8ACA16AC2BCEBABF1D0A2AFD29C45D5
                      SHA-256:6B2FEB23CAFFD55B054FD9FF041D012EDFA43FEE4C1D3A4FF27BF0F0B5831087
                      SHA-512:73A8AEE0765C1E571A90477C9BBCF801D51948484268A0F37368CBD1F2723768C43A1D1EEDBE68BBB803A09A70121F3A07FCFF4EB1C4D28F43312E8BFD128A68
                      Malicious:false
                      Reputation:low
                      Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13355337897192296","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":90178},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):5859
                      Entropy (8bit):5.256518429319815
                      Encrypted:false
                      SSDEEP:96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7RQRrZ:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhg
                      MD5:11334BE567DB7AF64652B6680D7DD742
                      SHA1:12025C39CDBB7905D3106317E77E2BD538C2C9CE
                      SHA-256:E681316E31345E83E55FA71788FC7AD346DDAF6C13E37D709C94F7940852C826
                      SHA-512:C48C27C67F3E38DF4A99B3DD0564CCA8A1A66DACE872311384091F728FAD4F9987993CE439723B66577827FF3001B79C43A20E44C5507001F333FEC2E77068D5
                      Malicious:false
                      Reputation:low
                      Preview:*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):327
                      Entropy (8bit):5.138939671032326
                      Encrypted:false
                      SSDEEP:6:F0PLq2PN72nKuAl9OmbzNMxIFUt880PGZmw+80PHFkwON72nKuAl9OmbzNMFLJ:WzvVaHAa8jFUt8nu/+nPF5OaHAa84J
                      MD5:CFC30BC717B1B0809D214EC4E237BF1A
                      SHA1:49D0696644A795DF389C20340E0B865F7F38128A
                      SHA-256:F8D0BF7777AB6FB4E451C02B9BD38BDDD63ED0C810929CAFD5C503237BB13F77
                      SHA-512:4CDB25B40C76439083B68C9E61ABC2CC3042D8BC79DB9E2F5A2B0A0E0D62B035CA427D8062B0016D6FD63C0A3D530CB295B32A9034734D09D4A30A361850DB23
                      Malicious:false
                      Reputation:low
                      Preview:2024/03/18-17:04:46.007 ce4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/03/18-17:04:46.018 ce4 Recovering log #3.2024/03/18-17:04:46.020 ce4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):327
                      Entropy (8bit):5.138939671032326
                      Encrypted:false
                      SSDEEP:6:F0PLq2PN72nKuAl9OmbzNMxIFUt880PGZmw+80PHFkwON72nKuAl9OmbzNMFLJ:WzvVaHAa8jFUt8nu/+nPF5OaHAa84J
                      MD5:CFC30BC717B1B0809D214EC4E237BF1A
                      SHA1:49D0696644A795DF389C20340E0B865F7F38128A
                      SHA-256:F8D0BF7777AB6FB4E451C02B9BD38BDDD63ED0C810929CAFD5C503237BB13F77
                      SHA-512:4CDB25B40C76439083B68C9E61ABC2CC3042D8BC79DB9E2F5A2B0A0E0D62B035CA427D8062B0016D6FD63C0A3D530CB295B32A9034734D09D4A30A361850DB23
                      Malicious:false
                      Reputation:low
                      Preview:2024/03/18-17:04:46.007 ce4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/03/18-17:04:46.018 ce4 Recovering log #3.2024/03/18-17:04:46.020 ce4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240318160450Z-198.bmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
                      Category:dropped
                      Size (bytes):71190
                      Entropy (8bit):6.1003152892229915
                      Encrypted:false
                      SSDEEP:768:MvyRZShtAxNuW6rmRLS9h4rnnn+4UqAtxozrAopFhmacNNyc+OI5QAZnjwEu:KuoKioRm0WSzr78acNZb
                      MD5:D61FF0FA9396DA339CC72190B08ADBE6
                      SHA1:1AEC844F453DFD33915F7BF78382DCBA8CF42D3D
                      SHA-256:6A77367BABC2C7A761FB977A6860D5B2082D8822AABFBA4A28718D047529D1EC
                      SHA-512:BA2E2D4FB12175E3B59DC8AA0661D5B1AFA64B2CFF73CD11017C8D5D9DD052C309181049F66915C537616B4023BD8B90B27D6C557185166DD3E680115171B753
                      Malicious:false
                      Reputation:low
                      Preview:BM........6...(...u...h..... .........................G;..G;..H<..H<..G;..J=..M?..N?..OA..PB..QD..RD..TD..ZG.._G.._H.._I..`L..bN..dN..hQ..iR..jU..kW..nX..s[..u\..y^..{`..{`..}b...d...f...h...j...l...m...p...r...s...t...v...w...y...z...{...|.......................................................................................................}...|...|...z...y...v...u...t...r...o...o...m...k...i...h...f...d..{a..}`..|_..v\..u\..rZ..nU..kS..iS..iQ..fP..bN.._L..`K.._I..^G..^G..XD..RE..RE..QC..RB..OA..O@..N?..M>..G;..G;..F:..G;..H<..H<..G;..J=..M?..N?..OA..PB..QD..RD..TD..ZG.._G.._H.._I..`L..bN..dN..gP..iR..jU..kW..nX..s[..u\..y^..{`..{`..}b...e...g...h...j...l...m...p...r...s...t...v...w...y...z...{...|...~...................................................................................................}...|...|...z...y...v...u...t...r...o...o...m...k...i...h...f...d..{a..}`..{^..v\..u\..rZ..nU..kS..iS..iQ..fO..bN..^K..`K..^H..^G..^F..XD..RE..RE..QC..RB..OA..N?..N?..L>..G;..G;..F:..H<..H<

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
                      Category:dropped
                      Size (bytes):86016
                      Entropy (8bit):4.444922753979987
                      Encrypted:false
                      SSDEEP:384:ye6ci5thiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mys3OazzU89UTTgUL
                      MD5:4984B73774B40D765C3D80210751C581
                      SHA1:CDB17D90B926DED7A79D31C226202D858B427C61
                      SHA-256:96C74137ED8592A9EC5DB025F6C13B5E1301BB9544EDB488241A97E66418DBE7
                      SHA-512:650D55F15CEE59A936FA0CC1C7B6D33DA00AE9F5CD12622A9ED2008D49F2A81B61B578F5BBD34BE0883D63A46ACE0D5D2511CB8364E5C4278F4A7F188F752D49
                      Malicious:false
                      Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite Rollback Journal
                      Category:dropped
                      Size (bytes):8720
                      Entropy (8bit):3.7700350430640155
                      Encrypted:false
                      SSDEEP:48:7MhJioyV/3ioyCUoy1C7oy16oy1giKOioy1noy1AYoy1Wioy1oioykioyBoy1noQ:7KJuPVwXjBiYb9IVXEBodRBke
                      MD5:0C628F2E9DA06D2801C9521B89715ABF
                      SHA1:F6A20FF0BAB9C36482FB3A16F9905D75F45F095F
                      SHA-256:38A158139661115E5117E068DE7EB412FA97209B2A30606F52A5126F570F4BFE
                      SHA-512:3FE81202D3853E24966D11948193516E5818BC9EC67C186307C3696611496807ED3ED1C5F8B3065E8B4359C0EB6D2BAD20AD9FD37470E760E2D3A1427F82EC51
                      Malicious:false
                      Preview:.... .c........a...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PostScript document text
                      Category:dropped
                      Size (bytes):1233
                      Entropy (8bit):5.233980037532449
                      Encrypted:false
                      SSDEEP:24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
                      MD5:8BA9D8BEBA42C23A5DB405994B54903F
                      SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
                      SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
                      SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
                      Malicious:false
                      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4084

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PostScript document text
                      Category:dropped
                      Size (bytes):1233
                      Entropy (8bit):5.233980037532449
                      Encrypted:false
                      SSDEEP:24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
                      MD5:8BA9D8BEBA42C23A5DB405994B54903F
                      SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
                      SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
                      SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
                      Malicious:false
                      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PostScript document text
                      Category:dropped
                      Size (bytes):10880
                      Entropy (8bit):5.214360287289079
                      Encrypted:false
                      SSDEEP:192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
                      MD5:B60EE534029885BD6DECA42D1263BDC0
                      SHA1:4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
                      SHA-256:B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
                      SHA-512:52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
                      Malicious:false
                      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4084

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PostScript document text
                      Category:dropped
                      Size (bytes):10880
                      Entropy (8bit):5.214360287289079
                      Encrypted:false
                      SSDEEP:192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
                      MD5:B60EE534029885BD6DECA42D1263BDC0
                      SHA1:4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
                      SHA-256:B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
                      SHA-512:52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
                      Malicious:false
                      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):227002
                      Entropy (8bit):3.392780893644728
                      Encrypted:false
                      SSDEEP:1536:qKPC4iyzDtrh1cK3XEivK7VK/3AYvYwgF/rRoL+sn:XPCaJ/3AYvYwglFoL+sn
                      MD5:265E3E1166312A864FB63291EA661C6A
                      SHA1:80DFF3187FF929596EB22E1DB9021BAD6F97178C
                      SHA-256:C13E08B1887A4E44DC39609D7234E8D732A6BC11313B55D6F4ECFB060CD87728
                      SHA-512:48776A2BFE8F25E5601DCC0137F7AB103D5684517334B806E3ACF61683DD9B283828475FC85CE0CBE4E8AF88E6F8B25EED0A77640E2CFFF2CC73708726519AFA
                      Malicious:false
                      Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):295
                      Entropy (8bit):5.3693956912280285
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXZsY27GJ0nZiQ0YARWDoAvJM3g98kUwPeUkwRe9:YvXKX2Y2qJ0cJWsGMbLUkee9
                      MD5:624A964FB6129D30796846CCC39BB1D8
                      SHA1:C7FC76AD5A8A71EACE46F416210E9F9478751086
                      SHA-256:3D3C36C4AF87D37E15E9738B746EB37FC5FB24DAD09E177EFD924AFE9A894606
                      SHA-512:A3769116990BCEC028E30A6EF0E0D43CA43D912903B9655EEBD40D6C45C75BCBE749B2558DBE929567DA8973B1C0B21CE14BACC3F0AC07F86C368180715A946D
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"790c7073-4a79-4d2d-9768-bfbdaf1fcb04","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1710956091388,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.322961074118742
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXZsY27GJ0nZiQ0YARWDoAvJfBoTfXpnrPeUkwRe9:YvXKX2Y2qJ0cJWsGWTfXcUkee9
                      MD5:D68EB7FD5A44A07819FFB40590DF32B8
                      SHA1:3035031ABEC2485F3D18D70510D03707273BC90A
                      SHA-256:615860E8E8E3D5CB17E5113DBFDF6C8006C03632067409B6CA5CCCE89A4C272E
                      SHA-512:F1B6D602CC092423DC0AD43D9DFE7D0BACA1B3970934410F3EF63DD2D17FE4AB888E4AB2FB4D5233983C7DF377D05F749CBE4582214EC59F2F9FE311DAB821E6
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"790c7073-4a79-4d2d-9768-bfbdaf1fcb04","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1710956091388,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.300913674118101
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXZsY27GJ0nZiQ0YARWDoAvJfBD2G6UpnrPeUkwRe9:YvXKX2Y2qJ0cJWsGR22cUkee9
                      MD5:657A7196ED9F01351F7B722B95D37626
                      SHA1:5705F798C321525AA3E6738B955739211A1895EC
                      SHA-256:4603EE7E3852C0C0A180101AC86FE0D89CA1DCC7B610D8165A7CF6502A9CEC65
                      SHA-512:5C025D680B70D9F25EAB05F54063DECA2F814CEDFE24C83BB8F92EC0ECE00F93C969E4806DD062CECA1038B19C44D60ECA7C8F3F11123E8AF80BD4948BF9D5FE
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"790c7073-4a79-4d2d-9768-bfbdaf1fcb04","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1710956091388,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):285
                      Entropy (8bit):5.3496299267133995
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXZsY27GJ0nZiQ0YARWDoAvJfPmwrPeUkwRe9:YvXKX2Y2qJ0cJWsGH56Ukee9
                      MD5:A51BBC9F9F4CB2FDF08946D29A56EA65
                      SHA1:2E647072796A91199519445B52CFA23A38862329
                      SHA-256:C532AEEFF5B82A3373F4D6FB2305167B56BB4F9C7479419F96002E9C185BED51
                      SHA-512:706933A106FD5EA008254A82263F7F038B35C84C6041264FB453895F9E7D51660B09E4B8C5AA6B27BA29DC46D141AACDB00D5E8FCFF9DC4A8DBB0AB8F9A4E68F
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"790c7073-4a79-4d2d-9768-bfbdaf1fcb04","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1710956091388,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.315715031851807
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXZsY27GJ0nZiQ0YARWDoAvJfJWCtMdPeUkwRe9:YvXKX2Y2qJ0cJWsGBS8Ukee9
                      MD5:6074EE8B7575454D5259DC5D71BF1223
                      SHA1:A68A9DA4BC698634ADE625C3787AAF569183BF81
                      SHA-256:11CE0ACDC1385D7F9E71185A3596D9A4CDD118DABB11A769DD17916BFC7716A1
                      SHA-512:4164C4163996F56415EA26B239EC3553225CC35F82736ECFD5A2D857C194E3D1EA6216032A8E3543C986B7810C169737C6A4F7BA05579ED082D521BFF9A4A3EB
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"790c7073-4a79-4d2d-9768-bfbdaf1fcb04","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1710956091388,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.299611961576938
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXZsY27GJ0nZiQ0YARWDoAvJf8dPeUkwRe9:YvXKX2Y2qJ0cJWsGU8Ukee9
                      MD5:159A7817DBEC881D9832D0CD15BE320B
                      SHA1:2B5FE364D1170984B64379D3A7BB3CAC0F104105
                      SHA-256:4A2C3DC3277EC00D4BC53D65C3C31A3C10EFCA17C5F1EEE7266580977F13207D
                      SHA-512:15C877017C2DEB9B52C680F86F696C3BA7C1AEE982DDD9BFA0DD2EC96195990204512C8143433431D27BFBFDC5C0C2DE5BD86FF689E26CDC2C7B2AC932D07389
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"790c7073-4a79-4d2d-9768-bfbdaf1fcb04","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1710956091388,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.30286799719272
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXZsY27GJ0nZiQ0YARWDoAvJfQ1rPeUkwRe9:YvXKX2Y2qJ0cJWsGY16Ukee9
                      MD5:9C9F529EA8970E450A0672E751A9E843
                      SHA1:16FE671E4B6711F20F1A6FA6F3B7228FF428626A
                      SHA-256:6C88079742199DF98C3CADAB5C4EE2D4455FAE2E2FBC401005B1F9BF06D42A9E
                      SHA-512:108919664F0B488AAC2D802837287697D48E3F089AA52652FDBAC85842F78CB4F1A1012548494198F186018937BBEE609A7ACFD93C8056EB47D1F1F1E7EC2784
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"790c7073-4a79-4d2d-9768-bfbdaf1fcb04","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1710956091388,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.309260600894244
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXZsY27GJ0nZiQ0YARWDoAvJfFldPeUkwRe9:YvXKX2Y2qJ0cJWsGz8Ukee9
                      MD5:36DC62C2C99B5D26A1847012B121F576
                      SHA1:650569B0BB027D34745FE6A84DD94481D6C1F4B9
                      SHA-256:500AFC14CB291D6DB2268C488F8A70A93640C893BF1F6DB0D9D4B855AF165672
                      SHA-512:2DA93D309D5BE98BF152902D01D0721FE55E55E41EFBAF9DF7EE87CD35B58A20321B132ACF770BB583658A297BFFFAF48792D6ECC7BD4328957D28E0B4C04AF4
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"790c7073-4a79-4d2d-9768-bfbdaf1fcb04","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1710956091388,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):295
                      Entropy (8bit):5.326890117902809
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXZsY27GJ0nZiQ0YARWDoAvJfzdPeUkwRe9:YvXKX2Y2qJ0cJWsGb8Ukee9
                      MD5:73C43F787495F442899E9B32EC234C8E
                      SHA1:8BAC6719EBACA3BB086B42AA83C9C184DC6D7B7B
                      SHA-256:B3ECDDABF76566066A57EE03D41DE27957411253D2F9A7AA3E7224B756B2F966
                      SHA-512:179E02A2D9E1EF13F3B9DFDD54C50DF9DBFC8E0D93A5EBF32B5DBB1BF9B13D8224C32574FFAD2E49FF13E33CE50DCA2CED2B2163D2A52DAF49FE4E174257CCCE
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"790c7073-4a79-4d2d-9768-bfbdaf1fcb04","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1710956091388,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.307690120129456
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXZsY27GJ0nZiQ0YARWDoAvJfYdPeUkwRe9:YvXKX2Y2qJ0cJWsGg8Ukee9
                      MD5:565E16A9676F2D9FF7F86362A7D284BE
                      SHA1:AAF1ECD53871A5B418F1E1912D908830FF3E0FA8
                      SHA-256:A2D8730331501D7863A7278EF905055924EBA7DCB4CD09F7845860BA4BCB3111
                      SHA-512:CA4183A7467289D3322085A8BA3531FE04C90C39988B4B0C5E2D7AE3CCEA3963B56707345D3818936743C90B23BB3057FC6F0686C61263C9CF7BD916CC93052E
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"790c7073-4a79-4d2d-9768-bfbdaf1fcb04","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1710956091388,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1395
                      Entropy (8bit):5.774569178770522
                      Encrypted:false
                      SSDEEP:24:Yv6X2Y2WJW7rLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNrb:Yvx0W7HgDv3W2aYQfgB5OUupHrQ9FJZ
                      MD5:49B5BEDB2F1054EAF1E2B866DA553506
                      SHA1:F6F10D7A19901F1708E1789C395B62773A09A8A7
                      SHA-256:B5114DB4BDAF32299B02837EB4226D09D2E7356122D476F2EDF9A6A05009A804
                      SHA-512:59FACC39B8D45F988FFDA4E45AF8D4295C249440C813460479ADD26C9661DD25F4251FBE7F9099B2AB208716D4E09AE08F84289E910A5528F45E349D4E14CAAD
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"790c7073-4a79-4d2d-9768-bfbdaf1fcb04","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1710956091388,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):291
                      Entropy (8bit):5.2911843647440095
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXZsY27GJ0nZiQ0YARWDoAvJfbPtdPeUkwRe9:YvXKX2Y2qJ0cJWsGDV8Ukee9
                      MD5:535C86C802C5A446FCD921E4B9E66BCF
                      SHA1:80636B91495B25A4BBC0B357BF531F7058C0CFD3
                      SHA-256:159FFB576BFCCDA71C1C17A7A2A8F95900F27903485657DA90DA1062BB66398F
                      SHA-512:95FEE94B5BD4E103366568B96E2290356CB6F7F92D7E53DF54B0705B014B52D59835BE21A1E96AC997EB7C2D906E472EC5A10D90D6FA17698B7DE4EF4033A507
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"790c7073-4a79-4d2d-9768-bfbdaf1fcb04","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1710956091388,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):287
                      Entropy (8bit):5.294672127804208
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXZsY27GJ0nZiQ0YARWDoAvJf21rPeUkwRe9:YvXKX2Y2qJ0cJWsG+16Ukee9
                      MD5:17926103687FD8AD81A01B1A8CD8C190
                      SHA1:EBA418A2203F5FCAB2156F323EE171C349D2434D
                      SHA-256:A0F8DD68D9AD408AB064CE455B3F9A170145A2A55883B7FAEE8C7FDC67F182A7
                      SHA-512:DB3CB45F806360886A055185CDD1CC2C078F24DE198C47333BD052B4E343BEB39E0F8B1A7D9157D48F1454D0A2055985FBE329F6C280573AAB5D4B321D93AD13
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"790c7073-4a79-4d2d-9768-bfbdaf1fcb04","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1710956091388,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.313919225846657
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXZsY27GJ0nZiQ0YARWDoAvJfbpatdPeUkwRe9:YvXKX2Y2qJ0cJWsGVat8Ukee9
                      MD5:8BA78A9D21087F3C564D924BE763E06A
                      SHA1:B78C727FE614CC52DC436EA3067104C47DA44D65
                      SHA-256:29E913031C85FD3A3A88F8D34DA20397BA6CE70934DEF40F11451743DB89C34C
                      SHA-512:BE088C844980BC9B27FC06288F0A6978F6F908ECE86A214B859DE5CBB1294A1B6C7E53439859DFDA57EEB18EDFBF2CDD90A284E406968A88F975333E96EABB26
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"790c7073-4a79-4d2d-9768-bfbdaf1fcb04","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1710956091388,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):286
                      Entropy (8bit):5.270153634536743
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXZsY27GJ0nZiQ0YARWDoAvJfshHHrPeUkwRe9:YvXKX2Y2qJ0cJWsGUUUkee9
                      MD5:D761952E27224C47E46E085FD437BFD9
                      SHA1:36B9969486378393BA28BEB2D2013DFE7BB9259A
                      SHA-256:A9EFBA72CDC7A899AC59E417E83775E33D247EDE810FAE4D84E55ABD93A70E98
                      SHA-512:B5939440EC1BDD3F428803543B27C8B49CE3BFCEC44DFA429E0CB0C458DE59B82D6806C6E6921702BF9E21F7A8A3CA398960AFBE1035A9D7690E64ABDB4DC566
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"790c7073-4a79-4d2d-9768-bfbdaf1fcb04","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1710956091388,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):782
                      Entropy (8bit):5.359200512118868
                      Encrypted:false
                      SSDEEP:12:YvXKX2Y2qJ0cJWsGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhW/b:Yv6X2Y2WJWC168CgEXX5kcIfANh8b
                      MD5:B0615FF32C550FB3333EE8B117366C62
                      SHA1:1E7B8C6172FFE68580E5BBEA822831E73D755855
                      SHA-256:185DB6A88043F3D37A45A5D5B76E969B0DAC931B9F47C684CD7FD31B5D2C71C2
                      SHA-512:18074B95C8514D24E5F71CDE56C3DB80B9A8BCEB4D7C63260603B46B70FDEFC675479349162DEB03096A366918A7B1170D250A3D560F36C54D5AA6A1D7C67FAA
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"790c7073-4a79-4d2d-9768-bfbdaf1fcb04","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1710956091388,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1710777891417}}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):4
                      Entropy (8bit):0.8112781244591328
                      Encrypted:false
                      SSDEEP:3:e:e
                      MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                      SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                      SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                      SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                      Malicious:false
                      Preview:....

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):2813
                      Entropy (8bit):5.126760157922926
                      Encrypted:false
                      SSDEEP:24:YkT3TynhCGeTnqA7IU2loVByqBHGuhnaEBYayyrNOkmyiwP5cj3Qvj0SzSNG/2Cb:Ykkhle7qNCDBmulIg7lsGdTRMVc98AF
                      MD5:8C341A874736C0EAA088DD9B6393E081
                      SHA1:F8D1F419D4FA040F54F66533DA3D95E98D39C8A8
                      SHA-256:0F26A7F6FD004001308DD377965C011AA196B8FB95289C3C37C80A78E1E6C56F
                      SHA-512:B955764DD28CDC39145C93A150E0A040AEBC94EB0FADADF6E7DC61093C076E8371F1D348BFA62EAF991170D2981BC21F301EC82AD598A48CA7EE0E6EC103B153
                      Malicious:false
                      Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"ccd356153f48f2ef4d0295305c56e5b6","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1710777891000},{"id":"Edit_InApp_Aug2020","info":{"dg":"0058a4dd2d85bb2bab6c1600f9371f31","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1710777891000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"de28b20292a202213815070b05973fbb","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1710777890000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"bb3d118f530a842a487fd867575225d7","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1710777890000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"9d86b1d3c57d2341891ff4eb3bcc3685","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1710777890000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"7d8410d6f091e0ea8426846983df892c","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1710777890000},{

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
                      Category:dropped
                      Size (bytes):12288
                      Entropy (8bit):1.1428846363103677
                      Encrypted:false
                      SSDEEP:24:TLhx/XYKQvGJF7ursYGqfRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUue:TFl2GL7msYGuXc+XcGNFlRYIX2v3khGw
                      MD5:D32BA1DF38515C41F969F210DC74E44A
                      SHA1:490FDF259460AAEECF5821ECD9DFEE5EEBDFCA89
                      SHA-256:F5A1BB96294943C110A7C99329094C652191AEEA148C2BC9C3EF795DFC999ABB
                      SHA-512:333F9879E8979F2FE8B6436B1F2BD2BCD2F74530A460BDA1A11E2F7EFD744EE0F4B7E9F75A7769953682BD26BDB5B4444FB59C6221689BD6B6BA6ACC910A0DC1
                      Malicious:false
                      Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite Rollback Journal
                      Category:dropped
                      Size (bytes):8720
                      Entropy (8bit):1.5499350062539274
                      Encrypted:false
                      SSDEEP:24:7+tXgGqfUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxwqLxx/+:7MQGRXc+XcGNFlRYIX2vtqVl2GL7ms8
                      MD5:36FB6CD692BF3C231ABF0BA59FFEFB0B
                      SHA1:EC023E00B1EDE51FF038827289052B0206AE955C
                      SHA-256:B74F1FC4C015C855B3E2B200BC4A7D920C9F833565F84D54F4F9BC0D5C004D67
                      SHA-512:931470E40AD743890539A17B81EC0AF9A8492FB4B0DDBB4AAE2A0DECDD5D1EED21A4D61FEBC88D94A259603647924A343FD9096BBE925CF33802C4457F9B5621
                      Malicious:false
                      Preview:.... .c.....Z............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):66726
                      Entropy (8bit):5.392739213842091
                      Encrypted:false
                      SSDEEP:768:RNOpblrU6TBH44ADKZEgEBEa9SQYlwcrxc8LO8GmnZTsgYyu:6a6TZ44ADEEBEFrlwe68ZGwbK
                      MD5:406B9DF0882D4F85C6DAC3BDF4686397
                      SHA1:8896B56A63A93D78D0AAA01B88EB296B7D3176DD
                      SHA-256:E25AA1F08BD83ED691E8980429BE2B8C26C4205F4EDE0F805C557DA0936202CE
                      SHA-512:92B0191B2EB1642DC03913478810C54F1E2EED536A97E16B916A92EF42D1629954449B0F2E9DECD82C799936DE6AD2AD721EB2D640C5058C8FB090A2772470F3
                      Malicious:false
                      Preview:4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

                      C:\Users\user\AppData\Local\Temp\MSI5e014.LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):246
                      Entropy (8bit):3.536003181970279
                      Encrypted:false
                      SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8sKUFqH:Qw946cPbiOxDlbYnuRKSUu
                      MD5:483D9935C5A925D27C3BFDFF13D4E163
                      SHA1:C8F57C3F7738CC54135AFFF2B68F7D3DDB452E6D
                      SHA-256:C10B08924FDEBC17DF04B2D1485F94866931DD5A91D94737CEF143DF2803A9F4
                      SHA-512:2B697F1FED759CAEC566E9F139258B74260F7267EF8B39A421FED669BAF38FB6F664A4CFC12E6837C6893AB01B945DB4A6A7A387EAA808814ABB8DBF5504CFAD
                      Malicious:false
                      Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.8./.0.3./.2.0.2.4. . .1.7.:.0.4.:.5.3. .=.=.=.....

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-03-18 17-04-47-681.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393)
                      Category:dropped
                      Size (bytes):16525
                      Entropy (8bit):5.338264912747007
                      Encrypted:false
                      SSDEEP:384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
                      MD5:128A51060103D95314048C2F32A15C66
                      SHA1:EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
                      SHA-256:601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
                      SHA-512:55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
                      Malicious:false
                      Preview:SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393), with CRLF line terminators
                      Category:dropped
                      Size (bytes):16601
                      Entropy (8bit):5.333431100976649
                      Encrypted:false
                      SSDEEP:384:jOMfrh+J2LpuJKPrjP87VMt7tftytRtJR+mADADtP3WAYIxgE0j06bkQ6v6Tums4:jXBtMDCR
                      MD5:E6343FAF705585D2B2D1C4834C0CB48E
                      SHA1:AC4D902574F25B70BE3365A63696B15C8EEA1EAF
                      SHA-256:5A95F32D92D2078CA30EEF4E156C80B037746287A9B32C73D48A2C608DBF78D5
                      SHA-512:4BE3DE2AE74039E3D642D87A6A06B371E45A9CC9B7861A6DBCD6A975A1253652E593E904A705D96D5B1F9D944FDA1DBB399FC736654B704811FCCF91DF466577
                      Malicious:false
                      Preview:SessionID=970144db-1ebd-4829-97d5-76bfd20d2821.1710777887706 Timestamp=2024-03-18T17:04:47:706+0100 ThreadID=7476 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=970144db-1ebd-4829-97d5-76bfd20d2821.1710777887706 Timestamp=2024-03-18T17:04:47:713+0100 ThreadID=7476 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=970144db-1ebd-4829-97d5-76bfd20d2821.1710777887706 Timestamp=2024-03-18T17:04:47:713+0100 ThreadID=7476 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=970144db-1ebd-4829-97d5-76bfd20d2821.1710777887706 Timestamp=2024-03-18T17:04:47:713+0100 ThreadID=7476 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=970144db-1ebd-4829-97d5-76bfd20d2821.1710777887706 Timestamp=2024-03-18T17:04:47:714+0100 ThreadID=7476 Component=ngl-lib_NglAppLib Description="SetConf

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):29845
                      Entropy (8bit):5.394476362690943
                      Encrypted:false
                      SSDEEP:192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbr2ZZtO9Ytw0Wws8cbwIHrVcbE:V3fOCIdJDeEZZtO9Ytw0WwmH1
                      MD5:D8B489174A39D8119D06F290742AE768
                      SHA1:461A61386C04DAA4A235C9D7F782C0DC7252AEC8
                      SHA-256:C2EB0C0E94E047A8845EDE2EFE9AC4031A592681A854ECFFFB4AC816AF103383
                      SHA-512:B45348D0FF9E3B3194AC3E3F9B21B76C6CB90867E24AC8A909DB97CD89CDAA8152A33C5D63721BC1667F13B2B62FE0249C7A63C9271EB6EDCD295930B7AC9462
                      Malicious:false
                      Preview:05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

                      C:\Users\user\AppData\Local\Temp\acrocef_low\5badc54b-c568-4dfe-9397-dc85213b4635.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
                      Category:dropped
                      Size (bytes):1419751
                      Entropy (8bit):7.976496077007677
                      Encrypted:false
                      SSDEEP:24576:/xA7owWLaGZDwYIGNPJxdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07c:JVwWLaGZDwZGV3mlind9i4ufFXpAXkrj
                      MD5:96E2EE6506759519A5E3E5E550F28388
                      SHA1:477522A699526F3EC2270AD0B3D3B8D6609F8BBB
                      SHA-256:D135FEF8231B87D1F758B3D31FC5467BC933321F7E8EACB316F933DBA36474D5
                      SHA-512:C84E93CB72ABC0742C44BF13608472EDD30BE64358C0DA350D9D54C0A88EC45931D48CE1DA823FC527E5134E7277B16AFE0521F2716C067A519FDD390DB315CC
                      Malicious:false
                      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                      C:\Users\user\AppData\Local\Temp\acrocef_low\b77f236b-545c-4986-a1b2-5e914dd8c6c9.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                      Category:dropped
                      Size (bytes):386528
                      Entropy (8bit):7.9736851559892425
                      Encrypted:false
                      SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                      MD5:5C48B0AD2FEF800949466AE872E1F1E2
                      SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                      SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                      SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                      Malicious:false
                      Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                      C:\Users\user\AppData\Local\Temp\acrocef_low\cfd2f4e9-6803-4809-9ad1-5f1b3fefc004.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                      Category:dropped
                      Size (bytes):758601
                      Entropy (8bit):7.98639316555857
                      Encrypted:false
                      SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                      MD5:3A49135134665364308390AC398006F1
                      SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                      SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                      SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                      Malicious:false
                      Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                      C:\Users\user\AppData\Local\Temp\acrocef_low\ee9eb599-56c0-4d51-ab6f-b0143c1f3a14.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                      Category:dropped
                      Size (bytes):1407294
                      Entropy (8bit):7.97605879016224
                      Encrypted:false
                      SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLcGZtwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLcGZa
                      MD5:22B260CB8C51C0D68C6550E4B061E25A
                      SHA1:DF9A5999C58A8D5ADBB3F8D1111EAB9E4778637E
                      SHA-256:DAB1231CC22DAB591EBB91C853E3EE41C10D3DA85D2EFAB67E9A52CCB3A3A5A0
                      SHA-512:503218D83C511A7F7CEA8BC171921D1435664B964F01A8C77DC0F4D0196DD2815D9444DA98278E1369552D004E9B091DD9B89663209F0C52ACB97FCE6AFFE7A9
                      Malicious:false
                      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                      Static File Info

                      General

                      File type:PDF document, version 1.5
                      Entropy (8bit):7.991372040083368
                      TrID:
                      • Adobe Portable Document Format (5005/1) 100.00%
                      File name:FDrive ).pdf
                      File size:4'401'065 bytes
                      MD5:410213409ab017ba5acff390f4d8beab
                      SHA1:012f7ca37a6b276dca0431b0b327f2e42a4c1c5d
                      SHA256:af4c8a610a96b0d868ca651bf600ffbec8a016745596d667bc138c070fbe5b3b
                      SHA512:1f2f1b43b0e4f75d2984608908cd80fbafdd3e5a60d82c3de59b30e785f4ea6678a06e67abe592c14d6b578ff56b612827b3138ccfd48e1e2314c415f92d5049
                      SSDEEP:98304:63WesiJlPE+q0ZHHPCW7gfufXaeHjjxi9Jtf98qJ5ivf:63YINLaW7Zy0GJtf983
                      TLSH:EB162364E5F9E45CCCC18AA0AF0F35D8858A40E15F1858B7346CAA463F85CD0FE9D6FA
                      File Content Preview:%PDF-1.5.%.....4 0 obj.<< /Length 5 0 R. /Filter /FlateDecode.>>.stream.x.3T0.B]C ani....U.e...E........\ .f.F`.E..i@%.z&.`.p.P'D..~...K>W ........endstream.endobj.5 0 obj. 74.endobj.3 0 obj.<<. /ExtGState <<. /a0 << /CA 1 /ca 1 >>. >>. /XO

                      File Icon

                      Icon Hash:62cc8caeb29e8ae0

                      Static PDF Info

                      General

                      Header:%PDF-1.5
                      Total Entropy:7.991372
                      Total Bytes:4401065
                      Stream Entropy:7.998984
                      Stream Bytes:4281845
                      Entropy outside Streams:4.703460
                      Bytes outside Streams:119220
                      Number of EOF found:1
                      Bytes after EOF:

                      Keywords Statistics

                      NameCount
                      obj1351
                      endobj1351
                      stream518
                      endstream518
                      xref0
                      trailer0
                      startxref1
                      /Page0
                      /Encrypt0
                      /ObjStm155
                      /URI0
                      /JS0
                      /JavaScript0
                      /AA0
                      /OpenAction0
                      /AcroForm0
                      /JBIG2Decode0
                      /RichMedia0
                      /Launch0
                      /EmbeddedFile0

                      Image Streams

                      IDDHASHMD5Preview
                      10f0f0f0f0e0f0f0f073e8589ee0555b85c38c0a77a1284c29
                      21f0f0f0f0e0f0f0f073e8589ee0555b85c38c0a77a1284c29
                      330014411637371441b1412dbf421e36104b664f58369533e5
                      45030b35353735373b0e3507531e71d08288efea98beca112f
                      740202040913061d72ef45f65470a085011d84c17f0ec36b47

                      Network Behavior

                      Network Port Distribution

                      TCP Packets

                      TimestampSource PortDest PortSource IPDest IP
                      Mar 18, 2024 17:04:57.838972092 CET49709443192.168.2.623.47.168.24
                      Mar 18, 2024 17:04:57.839000940 CET4434970923.47.168.24192.168.2.6
                      Mar 18, 2024 17:04:57.839111090 CET49709443192.168.2.623.47.168.24
                      Mar 18, 2024 17:04:57.839359045 CET49709443192.168.2.623.47.168.24
                      Mar 18, 2024 17:04:57.839375019 CET4434970923.47.168.24192.168.2.6
                      Mar 18, 2024 17:04:58.192114115 CET4434970923.47.168.24192.168.2.6
                      Mar 18, 2024 17:04:58.192568064 CET49709443192.168.2.623.47.168.24
                      Mar 18, 2024 17:04:58.192584038 CET4434970923.47.168.24192.168.2.6
                      Mar 18, 2024 17:04:58.194271088 CET4434970923.47.168.24192.168.2.6
                      Mar 18, 2024 17:04:58.194361925 CET49709443192.168.2.623.47.168.24
                      Mar 18, 2024 17:04:58.196252108 CET49709443192.168.2.623.47.168.24
                      Mar 18, 2024 17:04:58.196369886 CET4434970923.47.168.24192.168.2.6
                      Mar 18, 2024 17:04:58.196451902 CET49709443192.168.2.623.47.168.24
                      Mar 18, 2024 17:04:58.196459055 CET4434970923.47.168.24192.168.2.6
                      Mar 18, 2024 17:04:58.249792099 CET49709443192.168.2.623.47.168.24
                      Mar 18, 2024 17:04:58.286581993 CET4434970923.47.168.24192.168.2.6
                      Mar 18, 2024 17:04:58.286804914 CET4434970923.47.168.24192.168.2.6
                      Mar 18, 2024 17:04:58.286866903 CET49709443192.168.2.623.47.168.24
                      Mar 18, 2024 17:04:58.287708998 CET49709443192.168.2.623.47.168.24
                      Mar 18, 2024 17:04:58.287727118 CET4434970923.47.168.24192.168.2.6
                      Mar 18, 2024 17:04:58.287736893 CET49709443192.168.2.623.47.168.24
                      Mar 18, 2024 17:04:58.287776947 CET49709443192.168.2.623.47.168.24

                      HTTP Request Dependency Graph

                      • armmf.adobe.com

                      HTTPS Proxied Packets

                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      0192.168.2.64970923.47.168.244436044C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      TimestampBytes transferredDirectionData
                      2024-03-18 16:04:58 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
                      Host: armmf.adobe.com
                      Connection: keep-alive
                      Accept-Language: en-US,en;q=0.9
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
                      Sec-Fetch-Site: same-origin
                      Sec-Fetch-Mode: no-cors
                      Sec-Fetch-Dest: empty
                      Accept-Encoding: gzip, deflate, br
                      If-None-Match: "78-5faa31cce96da"
                      If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
                      2024-03-18 16:04:58 UTC198INHTTP/1.1 304 Not Modified
                      Content-Type: text/plain; charset=UTF-8
                      Last-Modified: Mon, 01 May 2023 15:02:33 GMT
                      ETag: "78-5faa31cce96da"
                      Date: Mon, 18 Mar 2024 16:04:58 GMT
                      Connection: close


                      Statistics

                      CPU Usage

                      Click to jump to process

                      Memory Usage

                      Click to jump to process

                      High Level Behavior Distribution

                      Click to dive into process behavior distribution

                      Behavior

                      Click to jump to process

                      System Behavior

                      General

                      Target ID:0
                      Start time:17:04:44
                      Start date:18/03/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      Wow64 process (32bit):false
                      Commandline:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\FDrive ).pdf
                      Imagebase:0x7ff651090000
                      File size:5'641'176 bytes
                      MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      General

                      Target ID:2
                      Start time:17:04:45
                      Start date:18/03/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                      Imagebase:0x7ff70df30000
                      File size:3'581'912 bytes
                      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      General

                      Target ID:4
                      Start time:17:04:45
                      Start date:18/03/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2072 --field-trial-handle=1576,i,13669524516722668851,15775429148942468690,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                      Imagebase:0x7ff70df30000
                      File size:3'581'912 bytes
                      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      Disassembly

                      ⊘No disassembly