Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
CONVOCATION..pdf

Overview

General Information

Sample name:CONVOCATION..pdf
Analysis ID:1415999
MD5:498843deeb487cefc54c5c57b720c6d1
SHA1:12d039b8a98e266919658d27e0adc910de5a8b61
SHA256:dda4d289c48ea04bfe840ea5b96dfdb12200f759ff94aed7806b47500be41de8
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 5736 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\CONVOCATION..pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 4456 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 7216 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1672,i,5388032495680149869,5616572402652665692,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficTCP traffic: 192.168.2.5:49714 -> 23.48.8.182:443
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 23.48.8.182:443
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 23.48.8.182:443
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 23.48.8.182:443
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 23.48.8.182:443
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 23.48.8.182:443
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 23.48.8.182:443
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 23.48.8.182:443
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 23.48.8.182:443
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 23.48.8.182:443
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 23.48.8.182:443
Source: global trafficTCP traffic: 23.48.8.182:443 -> 192.168.2.5:49714
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 23.48.8.182:443
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 23.48.8.182:443
Source: global trafficTCP traffic: 23.48.8.182:443 -> 192.168.2.5:49714
Source: global trafficTCP traffic: 23.48.8.182:443 -> 192.168.2.5:49714
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 23.48.8.182:443
Source: global trafficTCP traffic: 23.48.8.182:443 -> 192.168.2.5:49714
Source: global trafficTCP traffic: 23.48.8.182:443 -> 192.168.2.5:49714
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 23.48.8.182:443
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 23.48.8.182:443
Source: global trafficTCP traffic: 23.48.8.182:443 -> 192.168.2.5:49714
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 23.48.8.182:443
Source: global trafficTCP traffic: 23.48.8.182:443 -> 192.168.2.5:49714
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 23.48.8.182:443
Source: global trafficTCP traffic: 23.48.8.182:443 -> 192.168.2.5:49714
Source: global trafficTCP traffic: 23.48.8.182:443 -> 192.168.2.5:49714
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 23.48.8.182:443
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 23.48.8.182:443
Source: global trafficTCP traffic: 23.48.8.182:443 -> 192.168.2.5:49714
Source: Joe Sandbox ViewIP Address: 23.48.8.182 23.48.8.182
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknownTCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknownTCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknownTCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknownTCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknownTCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknownTCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknownTCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknownTCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknownTCP traffic detected without corresponding DNS query: 23.48.8.182
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
Source: classification engineClassification label: clean2.winPDF@14/45@0/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journalJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-03-26 18-16-34-473.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\CONVOCATION..pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1672,i,5388032495680149869,5616572402652665692,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1672,i,5388032495680149869,5616572402652665692,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: CONVOCATION..pdfInitial sample: PDF keyword /JS count = 0
Source: CONVOCATION..pdfInitial sample: PDF keyword /JavaScript count = 0
Source: CONVOCATION..pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive12
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1415999 Sample: CONVOCATION..pdf Startdate: 26/03/2024 Architecture: WINDOWS Score: 2 6 Acrobat.exe 18 67 2->6         started        process3 8 AcroCEF.exe 104 6->8         started        process4 10 AcroCEF.exe 2 8->10         started        dnsIp5 13 23.48.8.182, 443, 49714 AKAMAI-ASN1EU United States 10->13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
23.48.8.182
unknownUnited States
20940AKAMAI-ASN1EUfalse

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1415999
Start date and time:2024-03-26 18:15:48 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 0s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultwindowspdfcookbook.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:9
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:CONVOCATION..pdf
Detection:CLEAN
Classification:clean2.winPDF@14/45@0/1
EGA Information:Failed
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 0
  • Number of non-executed functions: 0
Cookbook Comments:
  • Found application associated with file extension: .pdf
  • Found PDF document
  • Close Viewer

Warnings

  • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 23.221.240.182, 3.219.243.226, 52.6.155.20, 52.22.41.97, 3.233.129.217, 172.64.41.3, 162.159.61.3, 23.221.227.88, 23.221.227.70, 23.221.227.101, 23.221.227.110, 23.221.227.74, 23.221.227.89, 23.221.227.73, 23.221.227.94, 23.221.227.103, 23.221.227.80, 23.221.227.83, 23.221.227.111, 23.221.227.66, 23.221.227.105, 23.221.227.68
  • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com
  • VT rate limit hit for: CONVOCATION..pdf

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
23.48.8.182http://tand6000.dk/files/files/zizami.pdfGet hashmaliciousPDFPhishBrowse
    https://www.colortrac.com/netapp/Get hashmaliciousUnknownBrowse
      passportscan.htaGet hashmaliciousXWorm, zgRATBrowse
        Commissions_open_20231004_Commissions_open_20231004pdf.exeGet hashmaliciousUnknownBrowse
          PAGAMENTO_COMMISSIONI_MBS_Settembre_MGpdf.exeGet hashmaliciousUnknownBrowse
            Factura_FVR23041255_Factura_FVR23041255pdf.exeGet hashmaliciousUnknownBrowse
              Ordine_Frode_1027797000003171_Ordine_Frode_1027797000003171pdf.exeGet hashmaliciousUnknownBrowse
                Commissions_BEL6_20231004_Commissions_BEL6_20231004pdf.exeGet hashmaliciousUnknownBrowse
                  Certificazione_Partecipazione_Corso_AML_IT15318pdf.exeGet hashmaliciousUnknownBrowse
                    https://rjtlawfirm.sharefile.com/d-9543a8d6e3f84dafGet hashmaliciousHTMLPhisherBrowse

                      Domains

                      ⊘No context

                      ASNs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      AKAMAI-ASN1EUhttps://38374993729929473939lk-us.de/202444/fresh2024link/schwab.com-fresh-RD588-user-ph-em(detail)/index.htmlGet hashmaliciousUnknownBrowse
                      • 96.7.74.24
                      https://new.express.adobe.com/webpage/sAiKE1YBfM7xeGet hashmaliciousHTMLPhisherBrowse
                      • 104.96.220.107
                      Quarantined Messages.zipGet hashmaliciousHTMLPhisherBrowse
                      • 23.221.227.12
                      sample.docGet hashmaliciousUnknownBrowse
                      • 23.48.104.109
                      https://autode.sk/3PDBl3XGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
                      • 23.48.104.109
                      https://flow.page/vihousing.orgGet hashmaliciousHTMLPhisherBrowse
                      • 172.232.208.143
                      https://alu-met.com/downloadsGet hashmaliciousUnknownBrowse
                      • 23.62.230.187
                      mo68mtK9Ap.elfGet hashmaliciousMoobotBrowse
                      • 23.67.244.142
                      https://pjts5a.cn/Get hashmaliciousUnknownBrowse
                      • 23.192.110.56
                      https://arvest-securev2.com/Get hashmaliciousHTMLPhisherBrowse
                      • 104.98.115.153

                      JA3 Fingerprints

                      ⊘No context

                      Dropped Files

                      ⊘No context

                      Created / dropped Files

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.185072087626921
                      Encrypted:false
                      SSDEEP:6:FQt4q2P92nKuAl9OmbnIFUt88QtJZmw+8QoDkwO92nKuAl9OmbjLJ:2uv4HAahFUt8x3/+xG5LHAaSJ
                      MD5:790F3B595556DD41782637B00AFB8182
                      SHA1:95D23A29F41F213AE39CE74BD4B40EC9B8025DAB
                      SHA-256:748975249CD0355C4E93FF7AEA25A05819D88F49F1B1D2BF936AE2F27F6B2AAE
                      SHA-512:44ADE9CE5CAEEC94D12A2A7F3DED607B763AE9FAABF692E18F25AEAD609F16E96C713EF2DA1BB6B9CBB1C64D438D02A61270BEAF5ECF1FB833CF2CD7123E68EC
                      Malicious:false
                      Reputation:low
                      Preview:2024/03/26-18:16:32.287 1600 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/03/26-18:16:32.287 1600 Recovering log #3.2024/03/26-18:16:32.288 1600 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.185072087626921
                      Encrypted:false
                      SSDEEP:6:FQt4q2P92nKuAl9OmbnIFUt88QtJZmw+8QoDkwO92nKuAl9OmbjLJ:2uv4HAahFUt8x3/+xG5LHAaSJ
                      MD5:790F3B595556DD41782637B00AFB8182
                      SHA1:95D23A29F41F213AE39CE74BD4B40EC9B8025DAB
                      SHA-256:748975249CD0355C4E93FF7AEA25A05819D88F49F1B1D2BF936AE2F27F6B2AAE
                      SHA-512:44ADE9CE5CAEEC94D12A2A7F3DED607B763AE9FAABF692E18F25AEAD609F16E96C713EF2DA1BB6B9CBB1C64D438D02A61270BEAF5ECF1FB833CF2CD7123E68EC
                      Malicious:false
                      Reputation:low
                      Preview:2024/03/26-18:16:32.287 1600 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/03/26-18:16:32.287 1600 Recovering log #3.2024/03/26-18:16:32.288 1600 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):338
                      Entropy (8bit):5.188570494128348
                      Encrypted:false
                      SSDEEP:6:FQ+C+q2P92nKuAl9Ombzo2jMGIFUt88QFAWZmw+8QcWJDVkwO92nKuAl9Ombzo23:2+C+v4HAa8uFUt8xOW/+xZV5LHAa8RJ
                      MD5:6144CF29A10EA71ED8CB72923C8711E8
                      SHA1:CAB3F49A377780CA710D2C5CB9864F71615485B0
                      SHA-256:7A63B678D867B720C0498F84AF3B6A2B62257817C7FAD58A5432D22E771F9DA4
                      SHA-512:631A8908B71A789ABEC79FFC5C45C4DA3611E7048E66DDD4B62720106002EF197E6CDD1A693A8FDE48C8EC4E7C921F7775C09B94B954EAD412DAE054447B24EE
                      Malicious:false
                      Reputation:low
                      Preview:2024/03/26-18:16:32.440 1c5c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/03/26-18:16:32.444 1c5c Recovering log #3.2024/03/26-18:16:32.453 1c5c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):338
                      Entropy (8bit):5.188570494128348
                      Encrypted:false
                      SSDEEP:6:FQ+C+q2P92nKuAl9Ombzo2jMGIFUt88QFAWZmw+8QcWJDVkwO92nKuAl9Ombzo23:2+C+v4HAa8uFUt8xOW/+xZV5LHAa8RJ
                      MD5:6144CF29A10EA71ED8CB72923C8711E8
                      SHA1:CAB3F49A377780CA710D2C5CB9864F71615485B0
                      SHA-256:7A63B678D867B720C0498F84AF3B6A2B62257817C7FAD58A5432D22E771F9DA4
                      SHA-512:631A8908B71A789ABEC79FFC5C45C4DA3611E7048E66DDD4B62720106002EF197E6CDD1A693A8FDE48C8EC4E7C921F7775C09B94B954EAD412DAE054447B24EE
                      Malicious:false
                      Reputation:low
                      Preview:2024/03/26-18:16:32.440 1c5c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/03/26-18:16:32.444 1c5c Recovering log #3.2024/03/26-18:16:32.453 1c5c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\933696ab-9a40-46af-a123-a3dcfdfdc978.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:modified
                      Size (bytes):507
                      Entropy (8bit):5.05523866501627
                      Encrypted:false
                      SSDEEP:12:YH/um3RA8sqZohcSiSsBdOg2HItcaq3QYiubxnP7E4T3OF+:Y2sRdsph8dMHIc3QYhbxP7nbI+
                      MD5:08EA1D5136E728A4EA978AAF9E692F8C
                      SHA1:AE4306B889DAFF1B84BEF90A63032920F879B065
                      SHA-256:B9566FCA93B0FA018CF94DFCDB684D24B380059C0375338976E9C143D1F9853D
                      SHA-512:DCFA6483FFA891566FE06961F85E22A7915A72698F72DAFD0874C00B9845FD5E91E79F4EB224E25945D4F83F66384E7B161BFCE63AD247F3A94EB2F43648A36C
                      Malicious:false
                      Reputation:low
                      Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13356033404216973","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":97134},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):507
                      Entropy (8bit):5.05523866501627
                      Encrypted:false
                      SSDEEP:12:YH/um3RA8sqZohcSiSsBdOg2HItcaq3QYiubxnP7E4T3OF+:Y2sRdsph8dMHIc3QYhbxP7nbI+
                      MD5:08EA1D5136E728A4EA978AAF9E692F8C
                      SHA1:AE4306B889DAFF1B84BEF90A63032920F879B065
                      SHA-256:B9566FCA93B0FA018CF94DFCDB684D24B380059C0375338976E9C143D1F9853D
                      SHA-512:DCFA6483FFA891566FE06961F85E22A7915A72698F72DAFD0874C00B9845FD5E91E79F4EB224E25945D4F83F66384E7B161BFCE63AD247F3A94EB2F43648A36C
                      Malicious:false
                      Reputation:low
                      Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13356033404216973","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":97134},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):4509
                      Entropy (8bit):5.238557657172385
                      Encrypted:false
                      SSDEEP:96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUI746/YY3tZ:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLt
                      MD5:143D91F33EB20AEFB72DADD272019297
                      SHA1:59A2CE0214FD57685C894746E086945824FE4FF6
                      SHA-256:B14EA0F4A612CBD7BD1B3607EC50280D92B028F4D66ADB487378BE7E326CFE50
                      SHA-512:149C4A52BB57D80FBF9082DB9509B6D741F22C54AD30A3839878E1E1E933669F30BBB876B6DC1F91F319F385306B7E3D3D3D8AE710FF02A98FB19A22637EA4D2
                      Malicious:false
                      Reputation:low
                      Preview:*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):326
                      Entropy (8bit):5.191390808463111
                      Encrypted:false
                      SSDEEP:6:FQYC+q2P92nKuAl9OmbzNMxIFUt88QmFU3WZmw+8QZVkwO92nKuAl9OmbzNMFLJ:2v+v4HAa8jFUt8xH3W/+xZV5LHAa84J
                      MD5:8224FD49C18773AE3C800129BD445F53
                      SHA1:15EDC8322662724FEEB889DA3406C0769ADA6BB1
                      SHA-256:26E97F1BD3714DD336C52505F3262F05653FE8A47CDED1760A2AE0C36B42F5CA
                      SHA-512:D81C2818362028C4CB3B2E7D8A1D82FC385AF2D04AE9F370EEA3A10E2AAB11A64574D6BF27D9E2ADF5744BA62F9BFE754DADB7A06F7B3CD16D6CBAB2B9A459D4
                      Malicious:false
                      Reputation:low
                      Preview:2024/03/26-18:16:32.503 1c5c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/03/26-18:16:32.504 1c5c Recovering log #3.2024/03/26-18:16:32.505 1c5c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):326
                      Entropy (8bit):5.191390808463111
                      Encrypted:false
                      SSDEEP:6:FQYC+q2P92nKuAl9OmbzNMxIFUt88QmFU3WZmw+8QZVkwO92nKuAl9OmbzNMFLJ:2v+v4HAa8jFUt8xH3W/+xZV5LHAa84J
                      MD5:8224FD49C18773AE3C800129BD445F53
                      SHA1:15EDC8322662724FEEB889DA3406C0769ADA6BB1
                      SHA-256:26E97F1BD3714DD336C52505F3262F05653FE8A47CDED1760A2AE0C36B42F5CA
                      SHA-512:D81C2818362028C4CB3B2E7D8A1D82FC385AF2D04AE9F370EEA3A10E2AAB11A64574D6BF27D9E2ADF5744BA62F9BFE754DADB7A06F7B3CD16D6CBAB2B9A459D4
                      Malicious:false
                      Reputation:low
                      Preview:2024/03/26-18:16:32.503 1c5c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/03/26-18:16:32.504 1c5c Recovering log #3.2024/03/26-18:16:32.505 1c5c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240326171636Z-151.bmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
                      Category:dropped
                      Size (bytes):71190
                      Entropy (8bit):2.0217916237229976
                      Encrypted:false
                      SSDEEP:384:WQ4d/dzAmS4QaCKMKTHAW53o8NDHNh9TMlJZc:WQKymS4Q6M0HAgo8dt/80
                      MD5:EBC62BFF64BD14A0323D62BD23C744CA
                      SHA1:C7DFCC65468E75B3DB40B4DCC65BEB9BDC574D8F
                      SHA-256:79E7F88B52093D58965E36510FC4B0BAC07157150C2D028F8F34A37547782D3B
                      SHA-512:71B70525E88109470F3F634CF4C97BAF4BD9304C2C82EFF1941977CBFA761A6BC1C3942E4C132F9E17E2F7665AE11AFB97A43F506C49BCBA6B08779BC92E2341
                      Malicious:false
                      Reputation:low
                      Preview:BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PostScript document text
                      Category:dropped
                      Size (bytes):1233
                      Entropy (8bit):5.233980037532449
                      Encrypted:false
                      SSDEEP:24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
                      MD5:8BA9D8BEBA42C23A5DB405994B54903F
                      SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
                      SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
                      SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
                      Malicious:false
                      Reputation:moderate, very likely benign file
                      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7104

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PostScript document text
                      Category:dropped
                      Size (bytes):1233
                      Entropy (8bit):5.233980037532449
                      Encrypted:false
                      SSDEEP:24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
                      MD5:8BA9D8BEBA42C23A5DB405994B54903F
                      SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
                      SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
                      SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
                      Malicious:false
                      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PostScript document text
                      Category:dropped
                      Size (bytes):1233
                      Entropy (8bit):5.233980037532449
                      Encrypted:false
                      SSDEEP:24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
                      MD5:8BA9D8BEBA42C23A5DB405994B54903F
                      SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
                      SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
                      SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
                      Malicious:false
                      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PostScript document text
                      Category:dropped
                      Size (bytes):10880
                      Entropy (8bit):5.214360287289079
                      Encrypted:false
                      SSDEEP:192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
                      MD5:B60EE534029885BD6DECA42D1263BDC0
                      SHA1:4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
                      SHA-256:B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
                      SHA-512:52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
                      Malicious:false
                      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7104

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PostScript document text
                      Category:dropped
                      Size (bytes):10880
                      Entropy (8bit):5.214360287289079
                      Encrypted:false
                      SSDEEP:192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
                      MD5:B60EE534029885BD6DECA42D1263BDC0
                      SHA1:4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
                      SHA-256:B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
                      SHA-512:52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
                      Malicious:false
                      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):227002
                      Entropy (8bit):3.392780893644728
                      Encrypted:false
                      SSDEEP:1536:WKPC4iyzDtrh1cK3XEivK7VK/3AYvYwgF/rRoL+sn:DPCaJ/3AYvYwglFoL+sn
                      MD5:87EDBEE38F56C20298F25D5D3D4D1B5C
                      SHA1:7F904E9615AC3186A87472EF366DD8202855B0B7
                      SHA-256:A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
                      SHA-512:BBEBC1FCD5BC9AE042DD5782425BA8C47BF3EAC283B2487FC4E3FF6BF8101306DAB081E5135594165D4DC1AC120FF125AADBC5B3FFE7C646183C04DF77865E0D
                      Malicious:false
                      Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):295
                      Entropy (8bit):5.329674910682748
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXztJCGtXEeOx+FIbRI6XVW7+0Y7u2xoAvJM3g98kUwPeUkwRe9:YvXKXhJd8UYpW7cCGMbLUkee9
                      MD5:DA42AD32B42BD99F67D6AFA19A0783AB
                      SHA1:F09D0149589B5BAF91469576856FACB899D0C90C
                      SHA-256:56B94F05AFDAECBCA685302C9A5AAF31656F6C72670AE877A3C9181AE61C9B6F
                      SHA-512:8AD7BB3EF917B67EB1359311DCF46E9253AEEBED1F77132D6F8B127F55CDBDB5628899CA5D30FA656FCC14C5BED5863F69FB09EE2803FAEEA578B09E27B8784A
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"76133714-cbd1-4d5d-b101-45f0f3a25ffd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711653397573,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.269206563976462
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXztJCGtXEeOx+FIbRI6XVW7+0Y7u2xoAvJfBoTfXpnrPeUkwRe9:YvXKXhJd8UYpW7cCGWTfXcUkee9
                      MD5:F9893FF465A06BE6819CB981CE9EB121
                      SHA1:C437A76E9711924B6B09DAA208FAF0AA00C4B515
                      SHA-256:6C0B858C570BEDABC46ACA7B5A755CA92664F470D067FDB63F23FEFC7B958313
                      SHA-512:0DCB405FDFAB6CD11A4580871B64DFC2CF94C7012248CEBABD9966084FB927BE2A817BDEBD6B8D11D9821224AAC5F83466DDA55C9C864D9070766F9D8E968171
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"76133714-cbd1-4d5d-b101-45f0f3a25ffd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711653397573,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.247605882844892
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXztJCGtXEeOx+FIbRI6XVW7+0Y7u2xoAvJfBD2G6UpnrPeUkwRe9:YvXKXhJd8UYpW7cCGR22cUkee9
                      MD5:63FC1B30705A61271BA9A87485F5889B
                      SHA1:02132179BC593FC29C30EAAF04B1C3047A1D151A
                      SHA-256:701B940DBCAC182EB6F117A387D194820CFA422788C7164595BC6DE124A95763
                      SHA-512:80F8BB414542AC9D64D31AD000C20F8CEDD5EF426A4C594269BE6B529F5F05002AE03292F0E2A9646125CF45EE8137C676F8BD1CFA52A7A794D37B391917E191
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"76133714-cbd1-4d5d-b101-45f0f3a25ffd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711653397573,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):285
                      Entropy (8bit):5.307385736560037
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXztJCGtXEeOx+FIbRI6XVW7+0Y7u2xoAvJfPmwrPeUkwRe9:YvXKXhJd8UYpW7cCGH56Ukee9
                      MD5:A02ADFC524CF8BE72957C27F9FF029FE
                      SHA1:1ED25336E6F9346A123CBC3CC795215EEF439944
                      SHA-256:C6E69C1A287CA6FC3262A5881F295380266627ED5B349B506E40440C97D07A78
                      SHA-512:277C06DA46AA687B3C6BCA236FEC30CBF132B807A5D3D7A4CD398D3F4AF8C786819113DC5EC5B892C810595DE00EE679E6CB449D962246F40F2F4A85F32D4449
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"76133714-cbd1-4d5d-b101-45f0f3a25ffd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711653397573,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.267572307441748
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXztJCGtXEeOx+FIbRI6XVW7+0Y7u2xoAvJfJWCtMdPeUkwRe9:YvXKXhJd8UYpW7cCGBS8Ukee9
                      MD5:32B13D85C1817128848B4B5BD045806F
                      SHA1:3AD826336AB94EA791B6D160D02843407D92AF83
                      SHA-256:472FC5DF9E0920AC86B1911B4F3BD2124F7D8636162F0CC35FC9529175EAAC70
                      SHA-512:DFEBC080C7635121B97B561634E72361AE722C5A589502D1DCFD1533F4CFD417DCD6F7B802CA6A8D555BBE5F174EAD1A00984A6A993ED4790E4474C85DF7B384
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"76133714-cbd1-4d5d-b101-45f0f3a25ffd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711653397573,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.253235997924053
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXztJCGtXEeOx+FIbRI6XVW7+0Y7u2xoAvJf8dPeUkwRe9:YvXKXhJd8UYpW7cCGU8Ukee9
                      MD5:AF4E392FD84FCCC7C9217DAF21B0BFCE
                      SHA1:518EC8B895D5ED04D553FB841E0B9B2B3E9F7AC9
                      SHA-256:23EE73DADE55938FF388E291861DD785C9542D969F3D74342DD072964811180F
                      SHA-512:AA8D53B5313F65A61F4514F38EFCA12BA0D2308E65617F233FD237D29EA2436A7A4BE67B9970A6CF04DF76BD8FBF4E9E732320D4E4DCEB23943D009EEFF9D9C7
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"76133714-cbd1-4d5d-b101-45f0f3a25ffd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711653397573,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.254980648813472
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXztJCGtXEeOx+FIbRI6XVW7+0Y7u2xoAvJfQ1rPeUkwRe9:YvXKXhJd8UYpW7cCGY16Ukee9
                      MD5:AA94C2CB7A3E960CC0A3C84D162681E3
                      SHA1:CBBACCAF939BACCB8D07D22169C41BE4CC51D0F3
                      SHA-256:CE2B5AF17A67D5D96978A67A47E64ACDD8349377990D380083624182F9A26B36
                      SHA-512:34A5D5ABDE69B73C86E33106FC63EB9C4B6B054EB227C32A49F9BE8A4662239F28EEE3DB5CEFD69589966BAC8E651E0D9107841F4928CC273C451C6C2601970D
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"76133714-cbd1-4d5d-b101-45f0f3a25ffd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711653397573,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.271701527921785
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXztJCGtXEeOx+FIbRI6XVW7+0Y7u2xoAvJfFldPeUkwRe9:YvXKXhJd8UYpW7cCGz8Ukee9
                      MD5:CE4E3E3AA252788F6FABB5CBE4D1E64F
                      SHA1:080822E16C35C22217E818E054EC2062F7392D2D
                      SHA-256:60DA62CB9698468C5C5283332A4BFF16F461F8C9E78BC85014CA35EF6CA7BA28
                      SHA-512:DA8F2E3426A9EF3E6697ED1B0E87332559BB583A19EC252A8F99AE3B3F7E3C9E6AC575F6C8426680BFECA7E2DF90FFDFEB23CD7EB68FF80D58F50DFDFDFF85F5
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"76133714-cbd1-4d5d-b101-45f0f3a25ffd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711653397573,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):295
                      Entropy (8bit):5.281745236302019
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXztJCGtXEeOx+FIbRI6XVW7+0Y7u2xoAvJfzdPeUkwRe9:YvXKXhJd8UYpW7cCGb8Ukee9
                      MD5:C6008BE80F783C7EB0F7EBD6F09BBF79
                      SHA1:E908F798E8EFA6906C3778483A69D9F1C325E10C
                      SHA-256:BA45A20558D75CD605ACE2A1D0E8D671CA5AF23E8BF349F07A21BDFFF16A8BB4
                      SHA-512:2198AFBE09EB36F8803BB3815A98403A32FD3F277580EA1F7596B2F37201B6DEDAA2B098E04F480768266BD53C73835767B070B91EEC4EB186C73E6AFF874FCD
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"76133714-cbd1-4d5d-b101-45f0f3a25ffd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711653397573,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.261314156476572
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXztJCGtXEeOx+FIbRI6XVW7+0Y7u2xoAvJfYdPeUkwRe9:YvXKXhJd8UYpW7cCGg8Ukee9
                      MD5:A7B44D2D7335DE747268F1A1BC9099E6
                      SHA1:CC831117F021FD08F4F015A508DB6CF643EDCD46
                      SHA-256:F014E194EBC869F64F7C02BD31AF165F28751D6F285A307A5B5093E04935235D
                      SHA-512:24B780956297AAE4CFF457EA2C8FE25765E5DEA68215AD0C764F97F8CCD53D6F66A1266F86F22E811BA64FB70285ADC7D9DA399279B509D7C3BDFCB63BDBF659
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"76133714-cbd1-4d5d-b101-45f0f3a25ffd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711653397573,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1395
                      Entropy (8bit):5.771094621878696
                      Encrypted:false
                      SSDEEP:24:Yv6XhJmiclrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNAS:YvAJRaHgDv3W2aYQfgB5OUupHrQ9FJSS
                      MD5:213B5C8756F73F137ED538974BC63406
                      SHA1:37173FD93F3714F419141D69DCCB9CBC4597983D
                      SHA-256:08CF7AAC4BECF7D9D4BB4AC100F7BA7D089947951CF37B273187D9060F81FE0C
                      SHA-512:E3AC462EFCC84874619E3AEF886E2DC905E88C41E60CD54FF8C0D3783539F072D2EE0CC16E590ACF0403FC3981CF180233AFA16FF0FCD59BCC1C4FF74AAA61A6
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"76133714-cbd1-4d5d-b101-45f0f3a25ffd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711653397573,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):291
                      Entropy (8bit):5.245127136236508
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXztJCGtXEeOx+FIbRI6XVW7+0Y7u2xoAvJfbPtdPeUkwRe9:YvXKXhJd8UYpW7cCGDV8Ukee9
                      MD5:B66BBEAC5D6009F4A0636CCB31E2B3A6
                      SHA1:F4F8261117352E9A7F89F133AE6B7C315D9CD926
                      SHA-256:E4E620B4D09CF2277C834202A152524DA39F92B5229E05D8E5CB646230B5ADBD
                      SHA-512:7638335C4FDF8ADF9091F2C5B5A8CB2FD12397D49B13418235287609B9719BD135E93C97689F588CFDFDCAF1978112B8EE02D120FBFDD9A48087AC10E71C1905
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"76133714-cbd1-4d5d-b101-45f0f3a25ffd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711653397573,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):287
                      Entropy (8bit):5.245950505062955
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXztJCGtXEeOx+FIbRI6XVW7+0Y7u2xoAvJf21rPeUkwRe9:YvXKXhJd8UYpW7cCG+16Ukee9
                      MD5:4BD6BC96751CD46B3AF51E464552AA9F
                      SHA1:1C3F46369AE3DA93CFD85D045BA6B8926EC69A67
                      SHA-256:6E83814B0E76767862D1F975048E9C7A8D420CD508161E6FB178F49946A6DF26
                      SHA-512:39BCB7CA3F92F85CD05D9F67909EE8FCDF1C7F5B41D40BE1949E8177485F1AC6FDA301D71174A33A5BB67B278B55F6393A521D6D27C48A150506EF87912CA44D
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"76133714-cbd1-4d5d-b101-45f0f3a25ffd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711653397573,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.267543262193772
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXztJCGtXEeOx+FIbRI6XVW7+0Y7u2xoAvJfbpatdPeUkwRe9:YvXKXhJd8UYpW7cCGVat8Ukee9
                      MD5:AF91EDC6473FD899A7A16E4B5F8B00AC
                      SHA1:D4082C153AF81A6482CA54CBA507E6B21420C880
                      SHA-256:B8970F1C1865895B84A5F2CA5F1678644636BB7D760B03FC799F1225D7898575
                      SHA-512:F6730620FE6F8BCE001EC392411DF59086D20984B52AE60B941A2186370CA3FC216954FD0B71A3F8A6E4518F98D1F5D849CDBB6CCE5AC46AF4302754D42A625D
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"76133714-cbd1-4d5d-b101-45f0f3a25ffd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711653397573,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):286
                      Entropy (8bit):5.218563751253769
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXztJCGtXEeOx+FIbRI6XVW7+0Y7u2xoAvJfshHHrPeUkwRe9:YvXKXhJd8UYpW7cCGUUUkee9
                      MD5:DF77B6E80ED993FADE9097C91DB09C6B
                      SHA1:CFE9E3E4E5C458ABCF0B8C28E79B36A79B1FB427
                      SHA-256:C17078FDB79774B4B414EF11E863CBBFE5354CD3F03175B8D080FB37DCCCCD5F
                      SHA-512:CDEFB6214D7E39E17FD8CE56161BEB5EBEE9DEB0429B3C1BD87467E149A888ADAC575E4B71F09C9C7546E36B18F286B42362ED210709EFEFE721070AADC323E6
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"76133714-cbd1-4d5d-b101-45f0f3a25ffd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711653397573,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):782
                      Entropy (8bit):5.3636207008776235
                      Encrypted:false
                      SSDEEP:12:YvXKXhJd8UYpW7cCGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWUS:Yv6XhJmicM168CgEXX5kcIfANhPS
                      MD5:23D1CB94EFB7C1D3EC23726274B9B28F
                      SHA1:7E2AAC062CF5D4FD45A3F06A592F77E798A27A6B
                      SHA-256:34B574982D68C23900E8B5C65CDEE19911A023638F0F12ECA4CE753758451070
                      SHA-512:62925134A79BC4610C0053CE6EDDF831BFFF8E247B82835E1EAE8CCA11024724BF3C344A3B9B7F8D5B3BF14A1917C46728520B4263BB713741044F3E144A0199
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"76133714-cbd1-4d5d-b101-45f0f3a25ffd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711653397573,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1711473397609}}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):4
                      Entropy (8bit):0.8112781244591328
                      Encrypted:false
                      SSDEEP:3:e:e
                      MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                      SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                      SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                      SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                      Malicious:false
                      Preview:....

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):2813
                      Entropy (8bit):5.133618132865071
                      Encrypted:false
                      SSDEEP:24:YLhECTPL3WALJ6r/h4wnBfa3ABayurB3WqJYJ4ZjJg/vj0SLdL2n4pP2LS1lqg5z:YLeKPLFmiwn6N3w+CjN5pP/lqgnh9Fqi
                      MD5:CD1B5CB868EBC0110F9C20B8676FD475
                      SHA1:592B8C23F5362295F1A616CA45859EFE69AB7103
                      SHA-256:5FA979AB2EBFF55AB7D2EC14CC9F53B42BA5A9A7342C57C08A4B7A5E72BBA0DB
                      SHA-512:AD369D91ACE363B9D884398AF8F4D53F2E397FFC6D9AF683F6368E482B0B8D0C75EC094478E59CD3E3E2F103F247F2CC8A0C4DCC1CB1E0EFA3E812CCFC85DE0C
                      Malicious:false
                      Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"7b0258c0f8b78d9a2d5dee2782641e2a","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1711473396000},{"id":"Edit_InApp_Aug2020","info":{"dg":"06eb6d0de249dde85a0be10abddb832f","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1711473396000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"ddace83ae2899c123c38a52c18888d05","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1711473396000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"57a06050d0fd95f13ce09eac06033ce3","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1711473396000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"72aa1f8be8181efbf97ebecf4048f0dc","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1711473396000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"68f99b8df46933b21c2de1af498f2e85","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1711473396000},{

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
                      Category:dropped
                      Size (bytes):12288
                      Entropy (8bit):0.9851032027990193
                      Encrypted:false
                      SSDEEP:24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Sp7w4zJwtNBwtNbRZ6bRZ4ewF:TVl2GL7ms6ggOVp7TzutYtp6PdM
                      MD5:5DDAE51F08039CC8D874A57A62296081
                      SHA1:9ACD9BF17E2699C54F5E50D182D532A34F4383FF
                      SHA-256:6CAD4A98E0BBD491BE97E091050B4D3654B00D0C1983BC1D8EDB5CCCE9C6419D
                      SHA-512:7BED9784AB20784ED1E42A46285474788B658EB88EEAAF7F5DF951A8F502D82301BE508B6B6439C72F4CECDDF8C1B2396D22AC5C80B7C174143EB8BB21661757
                      Malicious:false
                      Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite Rollback Journal
                      Category:dropped
                      Size (bytes):8720
                      Entropy (8bit):1.3389485126153622
                      Encrypted:false
                      SSDEEP:24:7+tpAD1RZKHs/Ds/Sp7wPzJwtNBwtNbRZ6bRZWf1RZK26qLBx/XYKQvGJF7urse:7MpGgOVp7szutYtp6PMcqll2GL7mse
                      MD5:1BF8809FECD0D38ED3557B949FDF06A6
                      SHA1:F9A72EC87ECFFC39E831970053CE58D193DF9880
                      SHA-256:8F3ABE0A5FD25E045CB0DB4F0FBAC9D4A866E85BA19D75DDB9B221093E35426F
                      SHA-512:198183228C8A98B5C008EAAA48243E359D20087168663CEABC4C5FCA1C336CE1C8D07AF439E90589E1CA65B179B2A83EEBD9633D60235019799BACBC800CDEE5
                      Malicious:false
                      Preview:.... .c.....2........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):66726
                      Entropy (8bit):5.392739213842091
                      Encrypted:false
                      SSDEEP:768:RNOpblrU6TBH44ADKZEg0Qo1C/pqr9sXwl08LyKO7xX85arYyu:6a6TZ44ADE9q6wl0DKWX85qK
                      MD5:E9A14165DF90A94A440357A0E385D627
                      SHA1:87AF6AB3E3ADCD02A9175420DDB058AB0BC2CAF2
                      SHA-256:C37C18B0C4691753CB537CFC23ECAB6506A8E68594EBF09A967FB038B8C2D237
                      SHA-512:20EC9D1B7C31219FB009555E162155B0523133A97AEAAACE9110877A2491B5F1FBC43D97ED80A53AC55CE824506B42661991BA6F2EAB3E8740E73509551D8688
                      Malicious:false
                      Preview:4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

                      C:\Users\user\AppData\Local\Temp\MSIbd1ca.LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):246
                      Entropy (8bit):3.5421404787358357
                      Encrypted:false
                      SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8mdUFGljyw:Qw946cPbiOxDlbYnuRKvlRyw
                      MD5:54110B69A4829065C8A2BC1C25933DD5
                      SHA1:777E593BDA4C4B3A84130BEF9D0BD80BD94D1C3C
                      SHA-256:0399814C4FFCE09D169F9F31F41A03B68541ED8792801229738A4258B44FCCA6
                      SHA-512:36B295B33D0DD5F3C382FEAF525263554A61BAD36E5F35D9F7D0F518E94FC12747EA830016EF0E072A1B50CEEA93616655B2B2F29A2DE1F17FFE8AD8D168ECFA
                      Malicious:false
                      Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.6./.0.3./.2.0.2.4. . .1.8.:.1.6.:.3.9. .=.=.=.....

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-03-26 18-16-34-473.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393)
                      Category:dropped
                      Size (bytes):16525
                      Entropy (8bit):5.376360055978702
                      Encrypted:false
                      SSDEEP:384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
                      MD5:1336667A75083BF81E2632FABAA88B67
                      SHA1:46E40800B27D95DAED0DBB830E0D0BA85C031D40
                      SHA-256:F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
                      SHA-512:D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
                      Malicious:false
                      Preview:SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393), with CRLF line terminators
                      Category:dropped
                      Size (bytes):16603
                      Entropy (8bit):5.403970215499996
                      Encrypted:false
                      SSDEEP:384:zpPkXhGJuCsD3ZmLaVthKGvjAhhzv7eahFbRVbdY3yXYe/5hy9sDIDfKiAnYt9ty:/KrbzVZA1J
                      MD5:FFD5EC1AA97864645CD568C78A1A93AA
                      SHA1:C5476EF11AA6B68E667CD387D1A3B058BC2D5B8F
                      SHA-256:A9B5190AC3EC2B75B73365DEEB4BBB379864895C2663B395617B27FD6B0BD8E7
                      SHA-512:B1299F55CD4BBA1F2A04553DC1A4856AB7F33B91716FC73202F126133BF89AB3C33DBE3A63E1D20D88D3BA0F9D5A11BDDA45594327BC1A634250603F9AAE0682
                      Malicious:false
                      Preview:SessionID=ff8898f1-5d57-4d34-b057-727cf84ab85d.1711473394494 Timestamp=2024-03-26T18:16:34:494+0100 ThreadID=7788 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=ff8898f1-5d57-4d34-b057-727cf84ab85d.1711473394494 Timestamp=2024-03-26T18:16:34:495+0100 ThreadID=7788 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=ff8898f1-5d57-4d34-b057-727cf84ab85d.1711473394494 Timestamp=2024-03-26T18:16:34:495+0100 ThreadID=7788 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=ff8898f1-5d57-4d34-b057-727cf84ab85d.1711473394494 Timestamp=2024-03-26T18:16:34:495+0100 ThreadID=7788 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=ff8898f1-5d57-4d34-b057-727cf84ab85d.1711473394494 Timestamp=2024-03-26T18:16:34:495+0100 ThreadID=7788 Component=ngl-lib_NglAppLib Description="SetConf

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):29845
                      Entropy (8bit):5.404654341245064
                      Encrypted:false
                      SSDEEP:768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbl:B
                      MD5:65DA8BD563B15B6800A75FCC0E216E6C
                      SHA1:9D8C6B30C07BF42C2D7D9778A4EEF8A79A5EF746
                      SHA-256:926C97174C4BBD04B76634895805797D92DE1F9A75A5DF0F42E231DC4CDEE3BF
                      SHA-512:7A51AE11CF3C0A71497F36F75F8C5ACC179A521795594D368AEB7F0A3F3721989E54A651C736F7699F7C1A3514D338A72035375C501AFE5CDF88AEAAF438387F
                      Malicious:false
                      Preview:04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

                      C:\Users\user\AppData\Local\Temp\acrocef_low\1c1ec73d-e530-41ef-914f-53d64f27e8dc.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                      Category:dropped
                      Size (bytes):1419751
                      Entropy (8bit):7.976496077007677
                      Encrypted:false
                      SSDEEP:24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
                      MD5:18E3D04537AF72FDBEB3760B2D10C80E
                      SHA1:B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
                      SHA-256:BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
                      SHA-512:2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
                      Malicious:false
                      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                      C:\Users\user\AppData\Local\Temp\acrocef_low\469027de-94fc-4b0c-bc7c-232aa898cb74.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                      Category:dropped
                      Size (bytes):758601
                      Entropy (8bit):7.98639316555857
                      Encrypted:false
                      SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                      MD5:3A49135134665364308390AC398006F1
                      SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                      SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                      SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                      Malicious:false
                      Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                      C:\Users\user\AppData\Local\Temp\acrocef_low\70b35355-bbea-4ab6-88b6-3427d2c71a9b.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                      Category:dropped
                      Size (bytes):1407294
                      Entropy (8bit):7.97605879016224
                      Encrypted:false
                      SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
                      MD5:8B9FA2EC5118087D19CFDB20DA7C4C26
                      SHA1:E32D6A1829B18717EF1455B73E88D36E0410EF93
                      SHA-256:4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
                      SHA-512:662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
                      Malicious:false
                      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                      C:\Users\user\AppData\Local\Temp\acrocef_low\ec080c6f-699f-45e3-b73d-f8e684cd807a.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                      Category:dropped
                      Size (bytes):386528
                      Entropy (8bit):7.9736851559892425
                      Encrypted:false
                      SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                      MD5:5C48B0AD2FEF800949466AE872E1F1E2
                      SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                      SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                      SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                      Malicious:false
                      Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                      Static File Info

                      General

                      File type:PDF document, version 1.5, 1 pages
                      Entropy (8bit):7.991651078890106
                      TrID:
                      • Adobe Portable Document Format (5005/1) 100.00%
                      File name:CONVOCATION..pdf
                      File size:569'943 bytes
                      MD5:498843deeb487cefc54c5c57b720c6d1
                      SHA1:12d039b8a98e266919658d27e0adc910de5a8b61
                      SHA256:dda4d289c48ea04bfe840ea5b96dfdb12200f759ff94aed7806b47500be41de8
                      SHA512:ae8da85a67aeb0890252b0ca7e5bb23cb46362350d13d8245597ad1d8420fcb627b6939248624a94a43f4569ebf5f4a761621d16a2facb686027a08aa54f27a2
                      SSDEEP:12288:W/+QQL54f0CEiK8SJzBNAyY2i6jNQZlFLcqNPN1od+A1LB:r54fWxJ8yY2tIAsPg+A3
                      TLSH:AAC42314E0D0DE18DF2B347479D1EF57AB6B906420E91EACF2AA8000DD4BF195EA6B4D
                      File Content Preview:%PDF-1.5.%.....7 0 obj.<<./Type /FontDescriptor./FontName /Times#20New#20Roman./Flags 32./ItalicAngle 0./Ascent 891./Descent -216./CapHeight 693./AvgWidth 401./MaxWidth 2614./FontWeight 400./XHeight 250./Leading 42./StemV 40./FontBBox [-568 -216 2046 693]

                      File Icon

                      Icon Hash:62cc8caeb29e8ae0

                      Static PDF Info

                      General

                      Header:%PDF-1.5
                      Total Entropy:7.991651
                      Total Bytes:569943
                      Stream Entropy:7.991588
                      Stream Bytes:566350
                      Entropy outside Streams:5.210649
                      Bytes outside Streams:3593
                      Number of EOF found:1
                      Bytes after EOF:

                      Keywords Statistics

                      NameCount
                      obj23
                      endobj23
                      stream3
                      endstream3
                      xref1
                      trailer1
                      startxref1
                      /Page1
                      /Encrypt0
                      /ObjStm0
                      /URI0
                      /JS0
                      /JavaScript0
                      /AA0
                      /OpenAction0
                      /AcroForm0
                      /JBIG2Decode0
                      /RichMedia0
                      /Launch0
                      /EmbeddedFile0

                      Image Streams

                      IDDHASHMD5Preview
                      15370679736e976f4e08f0db5b229e342cd82096e4e519e188

                      Network Behavior

                      Network Port Distribution

                      TCP Packets

                      TimestampSource PortDest PortSource IPDest IP
                      Mar 26, 2024 18:16:45.554977894 CET49714443192.168.2.523.48.8.182
                      Mar 26, 2024 18:16:45.555022955 CET4434971423.48.8.182192.168.2.5
                      Mar 26, 2024 18:16:45.555097103 CET49714443192.168.2.523.48.8.182
                      Mar 26, 2024 18:16:45.555253029 CET49714443192.168.2.523.48.8.182
                      Mar 26, 2024 18:16:45.555274963 CET4434971423.48.8.182192.168.2.5
                      Mar 26, 2024 18:16:45.845649958 CET4434971423.48.8.182192.168.2.5
                      Mar 26, 2024 18:16:45.845938921 CET49714443192.168.2.523.48.8.182
                      Mar 26, 2024 18:16:45.845971107 CET4434971423.48.8.182192.168.2.5
                      Mar 26, 2024 18:16:45.846956015 CET4434971423.48.8.182192.168.2.5
                      Mar 26, 2024 18:16:45.847029924 CET49714443192.168.2.523.48.8.182
                      Mar 26, 2024 18:16:45.848716974 CET49714443192.168.2.523.48.8.182
                      Mar 26, 2024 18:16:45.848784924 CET4434971423.48.8.182192.168.2.5
                      Mar 26, 2024 18:16:45.848893881 CET49714443192.168.2.523.48.8.182
                      Mar 26, 2024 18:16:45.848901987 CET4434971423.48.8.182192.168.2.5
                      Mar 26, 2024 18:16:45.889247894 CET49714443192.168.2.523.48.8.182
                      Mar 26, 2024 18:16:45.944825888 CET4434971423.48.8.182192.168.2.5
                      Mar 26, 2024 18:16:45.944873095 CET4434971423.48.8.182192.168.2.5
                      Mar 26, 2024 18:16:45.944925070 CET49714443192.168.2.523.48.8.182
                      Mar 26, 2024 18:16:45.945422888 CET49714443192.168.2.523.48.8.182
                      Mar 26, 2024 18:16:45.945441961 CET4434971423.48.8.182192.168.2.5

                      HTTP Request Dependency Graph

                      • armmf.adobe.com

                      HTTPS Proxied Packets

                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      0192.168.2.54971423.48.8.1824437216C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      TimestampBytes transferredDirectionData
                      2024-03-26 17:16:45 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
                      Host: armmf.adobe.com
                      Connection: keep-alive
                      Accept-Language: en-US,en;q=0.9
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
                      Sec-Fetch-Site: same-origin
                      Sec-Fetch-Mode: no-cors
                      Sec-Fetch-Dest: empty
                      Accept-Encoding: gzip, deflate, br
                      If-None-Match: "78-5faa31cce96da"
                      If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
                      2024-03-26 17:16:45 UTC198INHTTP/1.1 304 Not Modified
                      Content-Type: text/plain; charset=UTF-8
                      Last-Modified: Mon, 01 May 2023 15:02:33 GMT
                      ETag: "78-5faa31cce96da"
                      Date: Tue, 26 Mar 2024 17:16:45 GMT
                      Connection: close


                      Statistics

                      CPU Usage

                      Click to jump to process

                      Memory Usage

                      Click to jump to process

                      High Level Behavior Distribution

                      Click to dive into process behavior distribution

                      Behavior

                      Click to jump to process

                      System Behavior

                      General

                      Target ID:0
                      Start time:18:16:31
                      Start date:26/03/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\CONVOCATION..pdf"
                      Imagebase:0x7ff686a00000
                      File size:5'641'176 bytes
                      MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      General

                      Target ID:2
                      Start time:18:16:32
                      Start date:26/03/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                      Imagebase:0x7ff6413e0000
                      File size:3'581'912 bytes
                      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      General

                      Target ID:4
                      Start time:18:16:32
                      Start date:26/03/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1672,i,5388032495680149869,5616572402652665692,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                      Imagebase:0x7ff6413e0000
                      File size:3'581'912 bytes
                      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      Disassembly

                      ⊘No disassembly