Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
P&A COFFIDENTIAL - 200 - March2024.pdf

Overview

General Information

Sample name:P&A COFFIDENTIAL - 200 - March2024.pdf
Analysis ID:1416010
MD5:45b0a437ed459fcc350c3b9dbc0782de
SHA1:f9fc110c41f4b2da0dcf0e4c3527b6a046d26008
SHA256:d8f46aa625f15894ee28e6bbcb1ef19ff64fc764dc99aa9f87d80af3513ea8e2
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 7268 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\P&A COFFIDENTIAL - 200 - March2024.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 7468 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 7684 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1728,i,15528783898655642024,13473473242156841925,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficTCP traffic: 192.168.2.4:49739 -> 23.56.8.145:443
Source: global trafficTCP traffic: 192.168.2.4:49739 -> 23.56.8.145:443
Source: global trafficTCP traffic: 192.168.2.4:49739 -> 23.56.8.145:443
Source: global trafficTCP traffic: 192.168.2.4:49739 -> 23.56.8.145:443
Source: global trafficTCP traffic: 192.168.2.4:49739 -> 23.56.8.145:443
Source: global trafficTCP traffic: 192.168.2.4:49739 -> 23.56.8.145:443
Source: global trafficTCP traffic: 192.168.2.4:49739 -> 23.56.8.145:443
Source: global trafficTCP traffic: 192.168.2.4:49739 -> 23.56.8.145:443
Source: global trafficTCP traffic: 192.168.2.4:49739 -> 23.56.8.145:443
Source: global trafficTCP traffic: 192.168.2.4:49739 -> 23.56.8.145:443
Source: global trafficTCP traffic: 192.168.2.4:49739 -> 23.56.8.145:443
Source: global trafficTCP traffic: 192.168.2.4:49739 -> 23.56.8.145:443
Source: global trafficTCP traffic: 23.56.8.145:443 -> 192.168.2.4:49739
Source: global trafficTCP traffic: 192.168.2.4:49739 -> 23.56.8.145:443
Source: global trafficTCP traffic: 192.168.2.4:49739 -> 23.56.8.145:443
Source: global trafficTCP traffic: 23.56.8.145:443 -> 192.168.2.4:49739
Source: global trafficTCP traffic: 23.56.8.145:443 -> 192.168.2.4:49739
Source: global trafficTCP traffic: 192.168.2.4:49739 -> 23.56.8.145:443
Source: global trafficTCP traffic: 23.56.8.145:443 -> 192.168.2.4:49739
Source: global trafficTCP traffic: 23.56.8.145:443 -> 192.168.2.4:49739
Source: global trafficTCP traffic: 192.168.2.4:49739 -> 23.56.8.145:443
Source: global trafficTCP traffic: 192.168.2.4:49739 -> 23.56.8.145:443
Source: global trafficTCP traffic: 23.56.8.145:443 -> 192.168.2.4:49739
Source: global trafficTCP traffic: 192.168.2.4:49739 -> 23.56.8.145:443
Source: global trafficTCP traffic: 23.56.8.145:443 -> 192.168.2.4:49739
Source: global trafficTCP traffic: 192.168.2.4:49739 -> 23.56.8.145:443
Source: global trafficTCP traffic: 23.56.8.145:443 -> 192.168.2.4:49739
Source: global trafficTCP traffic: 192.168.2.4:49739 -> 23.56.8.145:443
Source: global trafficTCP traffic: 23.56.8.145:443 -> 192.168.2.4:49739
Source: global trafficTCP traffic: 23.56.8.145:443 -> 192.168.2.4:49739
Source: global trafficTCP traffic: 192.168.2.4:49739 -> 23.56.8.145:443
Source: global trafficTCP traffic: 192.168.2.4:49739 -> 23.56.8.145:443
Source: global trafficTCP traffic: 23.56.8.145:443 -> 192.168.2.4:49739
Source: Joe Sandbox ViewIP Address: 23.56.8.145 23.56.8.145
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.8.145
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.8.145
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.8.145
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.8.145
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.8.145
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.8.145
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.8.145
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.8.145
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.8.145
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.8.145
Source: unknownTCP traffic detected without corresponding DNS query: 23.56.8.145
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: classification engineClassification label: clean2.winPDF@14/48@0/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journalJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-03-26 15-30-18-401.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\P&A COFFIDENTIAL - 200 - March2024.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1728,i,15528783898655642024,13473473242156841925,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1728,i,15528783898655642024,13473473242156841925,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: P&A COFFIDENTIAL - 200 - March2024.pdfStatic file information: File size 9757161 > 6291456
Source: P&A COFFIDENTIAL - 200 - March2024.pdfInitial sample: PDF keyword /JS count = 0
Source: P&A COFFIDENTIAL - 200 - March2024.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: A91djo308_64wsb6_5og.tmp.0.drInitial sample: PDF keyword /JS count = 0
Source: A91djo308_64wsb6_5og.tmp.0.drInitial sample: PDF keyword /JavaScript count = 0
Source: P&A COFFIDENTIAL - 200 - March2024.pdfInitial sample: PDF keyword stream count = 158
Source: P&A COFFIDENTIAL - 200 - March2024.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: P&A COFFIDENTIAL - 200 - March2024.pdfInitial sample: PDF keyword endstream count = 158
Source: P&A COFFIDENTIAL - 200 - March2024.pdfInitial sample: PDF keyword obj count = 194
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive12
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1416010 Sample: P&A COFFIDENTIAL - 200 - Ma... Startdate: 26/03/2024 Architecture: WINDOWS Score: 2 6 Acrobat.exe 18 79 2->6         started        process3 8 AcroCEF.exe 105 6->8         started        process4 10 AcroCEF.exe 2 8->10         started        dnsIp5 13 23.56.8.145, 443, 49739 AKAMAI-ASUS United States 10->13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
23.56.8.145
unknownUnited States
16625AKAMAI-ASUSfalse

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1416010
Start date and time:2024-03-26 18:29:26 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 22s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultwindowspdfcookbook.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:10
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:P&A COFFIDENTIAL - 200 - March2024.pdf
Detection:CLEAN
Classification:clean2.winPDF@14/48@0/1
Cookbook Comments:
  • Found application associated with file extension: .pdf
  • Found PDF document
  • Close Viewer

Warnings

  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 23.222.192.182, 3.233.129.217, 52.6.155.20, 52.22.41.97, 3.219.243.226, 23.53.35.208, 23.53.35.200, 162.159.61.3, 172.64.41.3, 23.215.0.36, 23.215.0.48
  • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com
  • Not all processes where analyzed, report is missing behavior information
  • Report size exceeded maximum capacity and may have missing behavior information.
  • Report size getting too big, too many NtCreateFile calls found.
  • VT rate limit hit for: P&A COFFIDENTIAL - 200 - March2024.pdf

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
23.56.8.145Quotation.xlsGet hashmaliciousUnknownBrowse
    {D479CBA3-D807-4BAC-8D79-F41CC958C874}.exeGet hashmaliciousUnknownBrowse
      Remittance_slip_0088383.xlsGet hashmaliciousUnknownBrowse
        Invoice.pdf.lnkGet hashmaliciousAgentTeslaBrowse
          http://connect.themvpclub.com/linktrack.aspx?adminId=31C5ED81F145D518&subscriberID=3785893D3CB3227C&newsletterID=908F62A9B0B6BA1E&campaignID=53EA9A3D077DFB7A&bulkID=E0903A33B644167E12A4F5822D0D30EB&listID=EEF47B44CC289EC6&openRate=736CF125D99EB7BE&url=https://vdk0alctujz.larksuite.com/file/Ve7Tby1xBooU0YxbR5VuzS0FsGbGet hashmaliciousUnknownBrowse
            Commissions_open_20231004_Commissions_open_20231004pdf.exeGet hashmaliciousUnknownBrowse

              Domains

              ⊘No context

              ASNs

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              AKAMAI-ASUShttps://38374993729929473939lk-us.de/202444/fresh2024link/schwab.com-fresh-RD588-user-ph-em(detail)/index.htmlGet hashmaliciousUnknownBrowse
              • 104.96.251.185
              https://autode.sk/3PDBl3XGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
              • 23.203.191.157
              9wDlG5DeRK.elfGet hashmaliciousMoobotBrowse
              • 23.77.29.243
              file.exeGet hashmaliciousVidarBrowse
              • 104.112.44.153
              https://www.eit20.com/wp-content/uploads/2023/08/PowerViewIII_5.3.1_x86.exeGet hashmaliciousUnknownBrowse
              • 23.56.9.223
              https://pjts5a.cn/Get hashmaliciousUnknownBrowse
              • 23.54.44.36
              Firstontario_FAX_832.emlGet hashmaliciousHTMLPhisherBrowse
              • 23.215.0.37
              EXTERNAL SUSPECTED SPAM Completed Review and Sign Today Monday-March-2024 2027 PM.msgGet hashmaliciousHTMLPhisherBrowse
              • 23.215.0.37
              file.exeGet hashmaliciousVidarBrowse
              • 104.105.90.131
              phish_alert_sp2_2.0.0.0 (14).emlGet hashmaliciousHTMLPhisherBrowse
              • 23.210.0.138

              JA3 Fingerprints

              ⊘No context

              Dropped Files

              ⊘No context

              Created / dropped Files

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):292
              Entropy (8bit):5.250754727401422
              Encrypted:false
              SSDEEP:6:FQQq8JE+q2Pwkn2nKuAl9OmbnIFUt88QQq8G5Zmw+8QQq8GtVkwOwkn2nKuAl9Oe:2QdvvYfHAahFUt8xQdG5/+xQdGT5JfHi
              MD5:20F4E22A7E6FFDE4BF9D547379C72F36
              SHA1:690841E8237A4F98A6D7DC7E54ADD0E493ABEB48
              SHA-256:D36F2D0448FFC1815B2532E35EE71D2FF500DFED69EA5EA3BC2EB281814C61C6
              SHA-512:502BE5D2BC5BB6C631463A89FE6806882E94070341658756F45B78F937D10792482FA51A7BA1658F77556257ECBB8E68D7905E9A716D4619E99ACB34B4DEB9D9
              Malicious:false
              Reputation:low
              Preview:2024/03/26-15:30:16.278 1d58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/03/26-15:30:16.281 1d58 Recovering log #3.2024/03/26-15:30:16.281 1d58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):292
              Entropy (8bit):5.250754727401422
              Encrypted:false
              SSDEEP:6:FQQq8JE+q2Pwkn2nKuAl9OmbnIFUt88QQq8G5Zmw+8QQq8GtVkwOwkn2nKuAl9Oe:2QdvvYfHAahFUt8xQdG5/+xQdGT5JfHi
              MD5:20F4E22A7E6FFDE4BF9D547379C72F36
              SHA1:690841E8237A4F98A6D7DC7E54ADD0E493ABEB48
              SHA-256:D36F2D0448FFC1815B2532E35EE71D2FF500DFED69EA5EA3BC2EB281814C61C6
              SHA-512:502BE5D2BC5BB6C631463A89FE6806882E94070341658756F45B78F937D10792482FA51A7BA1658F77556257ECBB8E68D7905E9A716D4619E99ACB34B4DEB9D9
              Malicious:false
              Reputation:low
              Preview:2024/03/26-15:30:16.278 1d58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/03/26-15:30:16.281 1d58 Recovering log #3.2024/03/26-15:30:16.281 1d58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):336
              Entropy (8bit):5.19288558075926
              Encrypted:false
              SSDEEP:6:FQQq86oU4q2Pwkn2nKuAl9Ombzo2jMGIFUt88QQq86LTRNJZmw+8QQq86LTRNDk7:2QdbU4vYfHAa8uFUt8xQdudNJ/+xQdug
              MD5:334F71F6614126DDE85E3A68DC044AE4
              SHA1:E3EB3931F718C616B947F77BFA5727DF83C93F6B
              SHA-256:954FF356233403DC9D7F79DF613C985DC50738F7D8F277DDBCDF818803E3E7AE
              SHA-512:B59F621F47902C9A91098E68F15CF51A43A0FCB782A36824F16DAAAB97334E11AD28B166819A474C4434C86C5E81B99847F97B5CBAC116255A9B327B5F95446F
              Malicious:false
              Reputation:low
              Preview:2024/03/26-15:30:16.384 1e64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/03/26-15:30:16.386 1e64 Recovering log #3.2024/03/26-15:30:16.386 1e64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):336
              Entropy (8bit):5.19288558075926
              Encrypted:false
              SSDEEP:6:FQQq86oU4q2Pwkn2nKuAl9Ombzo2jMGIFUt88QQq86LTRNJZmw+8QQq86LTRNDk7:2QdbU4vYfHAa8uFUt8xQdudNJ/+xQdug
              MD5:334F71F6614126DDE85E3A68DC044AE4
              SHA1:E3EB3931F718C616B947F77BFA5727DF83C93F6B
              SHA-256:954FF356233403DC9D7F79DF613C985DC50738F7D8F277DDBCDF818803E3E7AE
              SHA-512:B59F621F47902C9A91098E68F15CF51A43A0FCB782A36824F16DAAAB97334E11AD28B166819A474C4434C86C5E81B99847F97B5CBAC116255A9B327B5F95446F
              Malicious:false
              Reputation:low
              Preview:2024/03/26-15:30:16.384 1e64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/03/26-15:30:16.386 1e64 Recovering log #3.2024/03/26-15:30:16.386 1e64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\891b8254-5774-479f-82d5-6b9582ea3f77.tmp

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:JSON data
              Category:modified
              Size (bytes):474
              Entropy (8bit):4.9693552056971155
              Encrypted:false
              SSDEEP:12:YH/um3RA8sqZKWsBdOg2H7caq3QYiubInP7E4T3y:Y2sRdshdMHC3QYhbG7nby
              MD5:FDA538C3358C35BB6243E471DBA786A5
              SHA1:0668AA655A6ACB69D0B835ECD2AC08C12E4D8D5D
              SHA-256:F78D264AA6898049E763E113B18C4EBA0C8D84549BE8180568DFA42F06321539
              SHA-512:0F26EAFAD495B25B5D5329E8BAD8B3FCD924E6060791421E2473F650AD0EE0BB9E551A996C294AF2624E036D17308BE511DC22202024072BB3E7F0C8E1212FE2
              Malicious:false
              Reputation:low
              Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13356023428062679","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":96952},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):474
              Entropy (8bit):4.9693552056971155
              Encrypted:false
              SSDEEP:12:YH/um3RA8sqZKWsBdOg2H7caq3QYiubInP7E4T3y:Y2sRdshdMHC3QYhbG7nby
              MD5:FDA538C3358C35BB6243E471DBA786A5
              SHA1:0668AA655A6ACB69D0B835ECD2AC08C12E4D8D5D
              SHA-256:F78D264AA6898049E763E113B18C4EBA0C8D84549BE8180568DFA42F06321539
              SHA-512:0F26EAFAD495B25B5D5329E8BAD8B3FCD924E6060791421E2473F650AD0EE0BB9E551A996C294AF2624E036D17308BE511DC22202024072BB3E7F0C8E1212FE2
              Malicious:false
              Reputation:low
              Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13356023428062679","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":96952},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:data
              Category:dropped
              Size (bytes):4730
              Entropy (8bit):5.248932152293095
              Encrypted:false
              SSDEEP:96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7RURjORZ:etJCV4FiN/jTN/2r8Mta02fEhgO73gof
              MD5:20F1592EB74B4AB96FCE52360CDF4BD3
              SHA1:CE64AAD89AAC3C006BDACBD72C5A313E6652AE2B
              SHA-256:BD05E81458FFBFBD8A26FB1B078E7180B0CD7C61E4466B9379E417D43297343B
              SHA-512:6AACAD1320D05E889D60C64C03BB840F37BCC69159A78C43E79BBCDA71E5BB41DE9853EA4E36CC9B806BC35F9BB038CB20A56D5C53A70F9D6AB99787CC667252
              Malicious:false
              Reputation:low
              Preview:*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):324
              Entropy (8bit):5.163818246713197
              Encrypted:false
              SSDEEP:6:FQQq8kXU4q2Pwkn2nKuAl9OmbzNMxIFUt88QQq8/F3JZmw+8QQq8AF3DkwOwkn2v:2QdkE4vYfHAa8jFUt8xQd/NJ/+xQdANf
              MD5:EC7636800989387E339C6B83B1A1123E
              SHA1:F22A6A9CC2FF275461A256CDFE724430FD8A87FA
              SHA-256:07B5080C11598FB63DA66A96E9A232AF69AC33D3841DE18437A6D5A82FE55A7A
              SHA-512:5B4A280DEC3A3F73CA3F0847337514B8651F4D65DF8DA90B4F9DA675490C43DF0CD5C55356347DBDD733F0E6A32FC61AC79B1CF5BC81B5346D066B4CF08A025B
              Malicious:false
              Reputation:low
              Preview:2024/03/26-15:30:16.543 1e64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/03/26-15:30:16.602 1e64 Recovering log #3.2024/03/26-15:30:16.610 1e64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):324
              Entropy (8bit):5.163818246713197
              Encrypted:false
              SSDEEP:6:FQQq8kXU4q2Pwkn2nKuAl9OmbzNMxIFUt88QQq8/F3JZmw+8QQq8AF3DkwOwkn2v:2QdkE4vYfHAa8jFUt8xQd/NJ/+xQdANf
              MD5:EC7636800989387E339C6B83B1A1123E
              SHA1:F22A6A9CC2FF275461A256CDFE724430FD8A87FA
              SHA-256:07B5080C11598FB63DA66A96E9A232AF69AC33D3841DE18437A6D5A82FE55A7A
              SHA-512:5B4A280DEC3A3F73CA3F0847337514B8651F4D65DF8DA90B4F9DA675490C43DF0CD5C55356347DBDD733F0E6A32FC61AC79B1CF5BC81B5346D066B4CF08A025B
              Malicious:false
              Reputation:low
              Preview:2024/03/26-15:30:16.543 1e64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/03/26-15:30:16.602 1e64 Recovering log #3.2024/03/26-15:30:16.610 1e64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

              C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240326143020Z-165.bmp

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
              Category:dropped
              Size (bytes):65110
              Entropy (8bit):4.249578182093631
              Encrypted:false
              SSDEEP:768:HvL+S+l++k3l+h++2V8kpR2n56kF2VC4UnaNL2mdlVP2Jt:P13ekDy6FX/FY
              MD5:D4DC861454BAE6D7A79D27EF9EEA193B
              SHA1:4E58E081311971D1E79FAAA5398612F1BB155120
              SHA-256:34B3AEE6411872E404C7F6670E2B6506E08EA9DF2B0EAAC38C9FB5FF70968002
              SHA-512:72A33A2694218393538218E39CDC7FFF41841758331A651D0BE0DE1EF3EEF621F1DEC5E05C39F11B9F959474DE1271C8019BC911DDA050A5C949634FE64C1037
              Malicious:false
              Reputation:low
              Preview:BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
              Category:dropped
              Size (bytes):86016
              Entropy (8bit):4.44521917177034
              Encrypted:false
              SSDEEP:384:yezci5t2iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:r5s3OazzU89UTTgUL
              MD5:F91072EC6752202A74139D3F556C567D
              SHA1:996DCE375395E94A6AA0CC01EAFFBE0A02EF97D4
              SHA-256:E041AE9AE7DD4D98FDFC38CE72F079FCA85F6F3204C46B053B1513726A35BE35
              SHA-512:47523937D2F6387BBF9FAC7E4FD8CF1B14E4BED4E67547F097C75C8655AB10E4D83E1EA309FC893FB25BC58C9A6C8DDA68D0154CD6A8576CC28ED745FA769A12
              Malicious:false
              Reputation:low
              Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:SQLite Rollback Journal
              Category:dropped
              Size (bytes):8720
              Entropy (8bit):3.7758292739388306
              Encrypted:false
              SSDEEP:48:7Mcp/E2ioyVnioy9oWoy1Cwoy17KOioy1noy1AYoy1Wioy1hioybioy3oy1noy1h:7LpjunF+XKQeob9IVXEBodRBkA
              MD5:8FE59CD3E385E85BD27B9EB75BAE78A4
              SHA1:B1DA1E1C6A180A7095BF13ABC1AD24417F3CA335
              SHA-256:916BDB7AC64446E6F314C6338020B78ADAE64AEE25FF0D9431998B1BD0068CB0
              SHA-512:E90F6683B1EE13C68FCB10BC8197AD455D07A62EC62C05CC1E2277D936A3E70DD221A82146F0B72F6025D1B159D0EAE03488183E09A92732061C5C8BB6DA00D7
              Malicious:false
              Reputation:low
              Preview:.... .c.....'..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:PostScript document text
              Category:dropped
              Size (bytes):1233
              Entropy (8bit):5.233980037532449
              Encrypted:false
              SSDEEP:24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
              MD5:8BA9D8BEBA42C23A5DB405994B54903F
              SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
              SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
              SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
              Malicious:false
              Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7360

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:PostScript document text
              Category:dropped
              Size (bytes):1233
              Entropy (8bit):5.233980037532449
              Encrypted:false
              SSDEEP:24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
              MD5:8BA9D8BEBA42C23A5DB405994B54903F
              SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
              SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
              SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
              Malicious:false
              Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:PostScript document text
              Category:dropped
              Size (bytes):1233
              Entropy (8bit):5.233980037532449
              Encrypted:false
              SSDEEP:24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
              MD5:8BA9D8BEBA42C23A5DB405994B54903F
              SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
              SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
              SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
              Malicious:false
              Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:PostScript document text
              Category:dropped
              Size (bytes):10880
              Entropy (8bit):5.214360287289079
              Encrypted:false
              SSDEEP:192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
              MD5:B60EE534029885BD6DECA42D1263BDC0
              SHA1:4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
              SHA-256:B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
              SHA-512:52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
              Malicious:false
              Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7360

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:PostScript document text
              Category:dropped
              Size (bytes):10880
              Entropy (8bit):5.214360287289079
              Encrypted:false
              SSDEEP:192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
              MD5:B60EE534029885BD6DECA42D1263BDC0
              SHA1:4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
              SHA-256:B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
              SHA-512:52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
              Malicious:false
              Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:data
              Category:dropped
              Size (bytes):243196
              Entropy (8bit):3.3450692389394283
              Encrypted:false
              SSDEEP:1536:vKPCPiyzDtrh1cK3XEivK7VK/3AYvYwgqErRo+RQn:yPClJ/3AYvYwghFo+RQn
              MD5:F5567C4FF4AB049B696D3BE0DD72A793
              SHA1:EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916
              SHA-256:D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
              SHA-512:E769735991E5B1331E259608854D00CDA4F3E92285FDC500158CBD09CBCCEAD8A387F78256A43919B13EBE70C995D19242377C315B0CCBBD4F813251608C1D56
              Malicious:false
              Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):295
              Entropy (8bit):5.368162953907012
              Encrypted:false
              SSDEEP:6:YEQXJ2HXmQhE1HVoZcg1vRcR0YVPeoAvJM3g98kUwPeUkwRe9:YvXKXmN12Zc0v8VGMbLUkee9
              MD5:92D0EAC6F35F7FCA8482A555C348160B
              SHA1:066275E03A0DCB3AFF9BAC403B93980A8B2B2362
              SHA-256:014FF13C09DFA71466431314C667541936ED0628CCA5B92B0FEE9BC43AB9B8DB
              SHA-512:07DA08F761EA98D8260F0001EF895796365A0A3063398FA22D8232ECED5C477BB96BEFB34816641FD2587886A894C0C5E3EADA0D2FE93D9B130715A4DE646781
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"e64efe59-7d5b-4078-93fa-9228e8700401","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1711653112502,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):294
              Entropy (8bit):5.315901895328102
              Encrypted:false
              SSDEEP:6:YEQXJ2HXmQhE1HVoZcg1vRcR0YVPeoAvJfBoTfXpnrPeUkwRe9:YvXKXmN12Zc0v8VGWTfXcUkee9
              MD5:CD1CB844D89CE70E45CCE2D3435EFBC3
              SHA1:490738870B379424387E756594DD91BC883E6354
              SHA-256:A89952FFC3E689958B866C8807940C245BE06547A0EEA005CF7CE55691010F65
              SHA-512:E26979C18EECC111A7438C319F18C8754884B66F4927E8587C414935829D6D1C94F0EBCC5DBC06D14C4E1E633D80223D385B5E7DCE864B08F8EDBB909B9E1158
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"e64efe59-7d5b-4078-93fa-9228e8700401","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1711653112502,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):294
              Entropy (8bit):5.295919612144461
              Encrypted:false
              SSDEEP:6:YEQXJ2HXmQhE1HVoZcg1vRcR0YVPeoAvJfBD2G6UpnrPeUkwRe9:YvXKXmN12Zc0v8VGR22cUkee9
              MD5:CA0665D02B569433E664AAA4E46F20F3
              SHA1:58D0583A9184C991B3ED2F22126AB56A975EB337
              SHA-256:1C18D3608A72FF63AE72DDE0AA48FD66A8D32E40FC5084C5728DD81477B3ABC2
              SHA-512:CFD1147D24CB2C788E9213BE94587E347F5BE4C9B64443169F539ACF0C8663E51DD906D7816F06C3B18F833318B7309CF42B3188B78E3E6367F285BF125798FD
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"e64efe59-7d5b-4078-93fa-9228e8700401","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1711653112502,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):285
              Entropy (8bit):5.355341865982515
              Encrypted:false
              SSDEEP:6:YEQXJ2HXmQhE1HVoZcg1vRcR0YVPeoAvJfPmwrPeUkwRe9:YvXKXmN12Zc0v8VGH56Ukee9
              MD5:9D471E59CD9D30B072E43923336EAE59
              SHA1:2787B24B850565A8D7159B93B662D9B60E3B00D0
              SHA-256:1D9EADC895D810DFDA7940A7B820578812EBED3B41730621E8A7F8B32EE5D88D
              SHA-512:97FB1581EF1965E8A35B490F10A78626E0C46251C09FD44AC2254E122009F43C2014B73E62073E1F1F69F1EFFFE06B698D3F32704C253A8E6A9C63D9DA7EC223
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"e64efe59-7d5b-4078-93fa-9228e8700401","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1711653112502,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):292
              Entropy (8bit):5.313639956462925
              Encrypted:false
              SSDEEP:6:YEQXJ2HXmQhE1HVoZcg1vRcR0YVPeoAvJfJWCtMdPeUkwRe9:YvXKXmN12Zc0v8VGBS8Ukee9
              MD5:822B1BEFE62C1E95EDDCABD93008653E
              SHA1:849188FD3967E988BBB283104C970C7875AFFE81
              SHA-256:7FC76824AE457ED4BEA0CC12F08C1250E8727D2CEFC64926855D008618163902
              SHA-512:9F1ABC76AD4C8EEC6BD5DEA5EB59F4A2E0315599FEB619C73905A4837D4244F87D83591D199B1ACD00AD0F23186A8EB2603E5B12EA6F78E8B96CCF0B84B74E88
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"e64efe59-7d5b-4078-93fa-9228e8700401","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1711653112502,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):289
              Entropy (8bit):5.302160356985054
              Encrypted:false
              SSDEEP:6:YEQXJ2HXmQhE1HVoZcg1vRcR0YVPeoAvJf8dPeUkwRe9:YvXKXmN12Zc0v8VGU8Ukee9
              MD5:BE094F076171FBB94670C3ABE193AFB9
              SHA1:848DF8A25A418B5BABC6E0CF20CAA9E829800E3E
              SHA-256:740ED9E14EB461CBF590735F4EFBD642611C6382FF1CE84A029678382B1D2300
              SHA-512:47DA39C9306B22D0512A33B69832B9B12ECE78A4BF12690CBA9D234873090C0D40E249F5A24C3C4DBCF7440E5E8AC811F0C3815ABE9E60F86A7157D520D9FC8F
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"e64efe59-7d5b-4078-93fa-9228e8700401","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1711653112502,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):292
              Entropy (8bit):5.305195014102704
              Encrypted:false
              SSDEEP:6:YEQXJ2HXmQhE1HVoZcg1vRcR0YVPeoAvJfQ1rPeUkwRe9:YvXKXmN12Zc0v8VGY16Ukee9
              MD5:FD8736E9CEB999DC00AC274CA812CEB0
              SHA1:6E2935D20684EB91CCB72EC54AF9BAD6A36CCCE9
              SHA-256:B9DA378CF5E1ECFC324C20D7169C98B00E72A84B4010DB3EF91C3DDF8E914DB6
              SHA-512:D6D5452C4C55D8EC5BFB5670205360A3C55AE8EE319FCA053F70ACEC35292648C2E1C6FB553F12B1765BB53B50C44BE80AB36AE7EC053C24430AD89EDCBBD908
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"e64efe59-7d5b-4078-93fa-9228e8700401","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1711653112502,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):289
              Entropy (8bit):5.31141275665595
              Encrypted:false
              SSDEEP:6:YEQXJ2HXmQhE1HVoZcg1vRcR0YVPeoAvJfFldPeUkwRe9:YvXKXmN12Zc0v8VGz8Ukee9
              MD5:776F4730C357E22647680938C8C80184
              SHA1:451CBD92E0580217FC0D09FD99053A3CD871D48B
              SHA-256:A10E17C605851C370F4100628D2EDDE47F8375A2205B45B723DF5A6D0ED8ACA0
              SHA-512:2AA6B79B52923C4FFDAB7C04B6495979AEF10BDCBEFB72480ADB6C64516E91A69A529E191B63722EF233B3B033ED4B8578E3C46954D5A00579395E4D5BFDE3A7
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"e64efe59-7d5b-4078-93fa-9228e8700401","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1711653112502,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):295
              Entropy (8bit):5.326359675145172
              Encrypted:false
              SSDEEP:6:YEQXJ2HXmQhE1HVoZcg1vRcR0YVPeoAvJfzdPeUkwRe9:YvXKXmN12Zc0v8VGb8Ukee9
              MD5:3F09A03CA8FDB18C38070FC782C7A87F
              SHA1:71332325C2BE98234E161E4D960207EFE78E6FFB
              SHA-256:4590FB03FA6BFE6CD0AF6D32B027B0A82C6F4F735CFD21B5D8B4222D33294483
              SHA-512:CBC4140E146A94DB89DABC51164AEF659732B623BF98F1AD4F63EA21D931FCBC536043881AFFEFC4913DEA6D9A0C38AEBAE89400748366A708DC0BC3A8037B03
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"e64efe59-7d5b-4078-93fa-9228e8700401","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1711653112502,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):289
              Entropy (8bit):5.306854846645189
              Encrypted:false
              SSDEEP:6:YEQXJ2HXmQhE1HVoZcg1vRcR0YVPeoAvJfYdPeUkwRe9:YvXKXmN12Zc0v8VGg8Ukee9
              MD5:F06E2268F6B272E52B820D12D50A794F
              SHA1:5708F49EDEC8FAF71D5E37316CA0B8CAE7AE9B84
              SHA-256:D6F9AC7C49D654118C3C8C03F40B11F70190DEB49EC89C79B558F245ADD9C292
              SHA-512:58BA23B643B0CC2E2FF38440C6E1CF773B3CE621FDC6A7992E793DD11622184C6BD93CB1246E6EC08BE1654DA48B922B65CCA75BDA225753297B5C8F5FDFA033
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"e64efe59-7d5b-4078-93fa-9228e8700401","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1711653112502,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):1395
              Entropy (8bit):5.777700446385426
              Encrypted:false
              SSDEEP:24:Yv6X612zv8MrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNd:Yvnu7HgDv3W2aYQfgB5OUupHrQ9FJb
              MD5:3ECA763983665BA00BFD2187B33C292C
              SHA1:9AA05563C1832C56D5FD2406F1174814243DE9BE
              SHA-256:EBC2E7E6941D27292CB6B91CC81E0CA1E4A378399DC67786D1DFE2E8F62CCF9E
              SHA-512:E493C10AACCD895D20C955EA254BA66BA30CFC4E6790B8F96B0534602EA65E5F0F160F61E46026C71BE022A6EDD59D26EE245B16882B3071AF2A0008ADC35D2B
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"e64efe59-7d5b-4078-93fa-9228e8700401","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1711653112502,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):291
              Entropy (8bit):5.290354831970975
              Encrypted:false
              SSDEEP:6:YEQXJ2HXmQhE1HVoZcg1vRcR0YVPeoAvJfbPtdPeUkwRe9:YvXKXmN12Zc0v8VGDV8Ukee9
              MD5:351C8FE7F03FDB05450BC9139EF7C0B7
              SHA1:D9CA0D456D90D93774296206860B91FD6706D126
              SHA-256:62DD891A966748C566559AFE177542FEF530EC47C7053E017B4249A0B96A8049
              SHA-512:BDA89B8FA36BD3A021CE0053D2975C82B8F637AD52E44DC59E5FC4C1EACC00A070162E4E7D8D5D740E5A81875ED04F9F866ECBA5DB52A39F5F97C0F9E4CF3FE3
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"e64efe59-7d5b-4078-93fa-9228e8700401","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1711653112502,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):287
              Entropy (8bit):5.294786785310354
              Encrypted:false
              SSDEEP:6:YEQXJ2HXmQhE1HVoZcg1vRcR0YVPeoAvJf21rPeUkwRe9:YvXKXmN12Zc0v8VG+16Ukee9
              MD5:D60E509D793855F0A9FA0BA0CD2E3A6C
              SHA1:69EDA04023B7DE882C5D33A10B28E9CC6BF94E8E
              SHA-256:36CD3C9D99D580816345A0D5D1810DA52F38B50ECF1437F9B0D105D3F6A1FB3B
              SHA-512:65C55750F6F98F5CA05C2BB3C7C3C8A93FE3DA43580A6888F3250CA80222A2016073DC05BAC7F43594DC581CA5FC6D3C4C40296BE6811CE08F000333E429438F
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"e64efe59-7d5b-4078-93fa-9228e8700401","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1711653112502,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):289
              Entropy (8bit):5.314230312488505
              Encrypted:false
              SSDEEP:6:YEQXJ2HXmQhE1HVoZcg1vRcR0YVPeoAvJfbpatdPeUkwRe9:YvXKXmN12Zc0v8VGVat8Ukee9
              MD5:B1467DFF16899A4573A7C4D9A0DD2EFB
              SHA1:5F2D3A5D72AAED3D135B2FC90F79536F096B7351
              SHA-256:B0E578C05AAA5F29BB12492A2C10EFEDF430D6A2ADC47548A8D46975C65885A3
              SHA-512:1D38F70580C68FBE0608CB59D659A27BBBE9723686C7ECDF5518AEFAE04AF610CF0A3C88F68505A76357512B4B13ED547351E0F46460A2ECCE036ABA581F9F9E
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"e64efe59-7d5b-4078-93fa-9228e8700401","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1711653112502,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):286
              Entropy (8bit):5.272328365358888
              Encrypted:false
              SSDEEP:6:YEQXJ2HXmQhE1HVoZcg1vRcR0YVPeoAvJfshHHrPeUkwRe9:YvXKXmN12Zc0v8VGUUUkee9
              MD5:4D19EE6A8A786B3460D89EDABFA07F33
              SHA1:C0F67CF7F6D53F0CAB15D527E843B4A5C7E0DF7A
              SHA-256:973B3C4C4DB5C9F365675CE47E0A2FAEC757F0F55EB55691EEE1B28BFB0993FB
              SHA-512:5B036AEDE303EDD2E6353A4AB7BAD53607CF569061397BEB333C67BE4E7F252219CEF6712A6368B31F2B640353136D2A19CBE548F75BA41E3FD47BCA503B6184
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"e64efe59-7d5b-4078-93fa-9228e8700401","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1711653112502,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):782
              Entropy (8bit):5.3687169520104145
              Encrypted:false
              SSDEEP:12:YvXKXmN12Zc0v8VGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhW5:Yv6X612zv8x168CgEXX5kcIfANhc
              MD5:79B21867142B9171619E84459117AAA1
              SHA1:FCAC224F408EF64CFC38BBFA12C8C43C324D7AB2
              SHA-256:A85B47C3DB74B299B9486AC471C257E92BBA290ACAB41B3CB7A527671C96F194
              SHA-512:7AB14FB89D4E0F13D70B5A8CE6AB2C72A21C1F578D9A41172F58FF4304830B4661B7034C6DE0E1E3FD661E9D0F3DA854B15D1B01D1C3621A6E99F78CDD8A68FC
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"e64efe59-7d5b-4078-93fa-9228e8700401","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1711653112502,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1711474222535}}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:data
              Category:dropped
              Size (bytes):4
              Entropy (8bit):0.8112781244591328
              Encrypted:false
              SSDEEP:3:e:e
              MD5:DC84B0D741E5BEAE8070013ADDCC8C28
              SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
              SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
              SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
              Malicious:false
              Preview:....

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):2813
              Entropy (8bit):5.134818011298555
              Encrypted:false
              SSDEEP:48:YSP1SNcsloQpbPzlSnezLq9G8BqIAuwLaenpE2OV9sqPF:Sz9tblhfqhq9zpu9F
              MD5:15192487F870ECDD16A61777B500D3AF
              SHA1:277371D2312C92ED78C2B66613318670E1EEB171
              SHA-256:382C8B228019C2299CF71345537A36DF5290A5FFEDE337EEAC76E3932A714C59
              SHA-512:64EF143B176B3F391C4CD1941C5F2216789AD1AF47495634022396C4D0F579A3F8359989B2B1A0A9587FC534220167D04161EA12F2CCC99CDCAF35C92E095BE8
              Malicious:false
              Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"88556ec4cb8ab509ac1595df74f47891","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1711463420000},{"id":"Edit_InApp_Aug2020","info":{"dg":"d872f98ccf843d999f54ae167f0ec8ae","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1711463420000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"36be7a674995efc1d82bcdaea79b3dae","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1711463420000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"3a670d03b4a4252c033929185c940fe4","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1711463420000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"d58c6445a7a9fb34b1fc3cc0d24ca079","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1711463420000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"abe7cedf248feb033ef3ab57c217d846","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1711463420000},{

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
              Category:dropped
              Size (bytes):12288
              Entropy (8bit):1.18870714078863
              Encrypted:false
              SSDEEP:48:TGufl2GL7msEHUUUUUUUUySSvR9H9vxFGiDIAEkGVvp2U:lNVmswUUUUUUUUyS+FGSItyU
              MD5:F8D83C9BB12FB0BA473CDD711A880C5F
              SHA1:2B1E4C50D4823AAC27379D99EF7E5D0443FCA150
              SHA-256:775C35CE89557B54F834C641291F31122F68A338C2FD42C127572F5D539DC9C9
              SHA-512:DCEF88CE5BBC91A9ADDE90837735DFE70A4FA3ABCF64879E1B5DB3330DE68EEF682EAC00D32F9DBF5A40E3C95A1F9F9FD978A1DF15C3828DD263CCD6CF5F1D48
              Malicious:false
              Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:SQLite Rollback Journal
              Category:dropped
              Size (bytes):8720
              Entropy (8bit):1.6070371408343163
              Encrypted:false
              SSDEEP:48:7MSKUUUUUUUUUUyAvR9H9vxFGiDIAEkGVvhqFl2GL7msE:7yUUUUUUUUUUy4FGSItrKVmsE
              MD5:E61562C2820EDEF706A58FAD4096A600
              SHA1:5D925886C3062547650274AC2A2B1DC6FEE731EB
              SHA-256:D77F3A93FB5BFDA66E4B0DAC5480F5329D86072AD452C46093A362E2FE7817A1
              SHA-512:294B1001D2E24394E45AEC2B721169F8D76E5472EB4547ECF5B236F1B459215401BA336ED41DCF3D69E1D676DD8FEDC74D08BD9566350BA7E0889575EC3EE2CF
              Malicious:false
              Preview:.... .c.....7..B......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:data
              Category:dropped
              Size (bytes):66726
              Entropy (8bit):5.392739213842091
              Encrypted:false
              SSDEEP:768:RNOpblrU6TBH44ADKZEgRve+QkF3oPHHda9P1u5toqr7y4aCIYyu:6a6TZ44ADEde+QkF3ofdaaLaCIK
              MD5:F5BE592721AE8E71BD2BA2602FADB223
              SHA1:070AF888F7AD78E366930A1837093B0C26843B72
              SHA-256:8AE1733372BB61B96095B386E085F2327D29058BA5DA2FA8D22C5747FF218A8B
              SHA-512:D506807E43228C72F362645ED274A84D1519AC7A6E5B50025509AD3CC678A15164E6A94AF02BA60DC365CA8563483C23F2102EADE6085E7DA04E1F6048AE46E0
              Malicious:false
              Preview:4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

              C:\Users\user\AppData\Local\Temp\MSIf4b02.LOG

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
              Category:dropped
              Size (bytes):246
              Entropy (8bit):3.5263912796263748
              Encrypted:false
              SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8mdUTdDCH:Qw946cPbiOxDlbYnuRKvR
              MD5:444B57B72BFEBBF6CBFE84C8ADCED3FF
              SHA1:53804A38A9D6360638AF2489B883C483862D36C2
              SHA-256:EED2D34AB97BFAFA86764A5C5E037365ACA99D644E4F9A90D6684145F79C1343
              SHA-512:ED73CF73328FB0516365168D3B604B17EFE3417502570C72CF543427AFE8B59F3300D4A9A701E2F31ADF6898408AF94DD557602AA580322D8437F3299CF1F2E2
              Malicious:false
              Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.6./.0.3./.2.0.2.4. . .1.5.:.3.0.:.2.3. .=.=.=.....

              C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91djo308_64wsb6_5og.tmp

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:PDF document, version 1.6, 0 pages
              Category:dropped
              Size (bytes):358
              Entropy (8bit):5.049248978004803
              Encrypted:false
              SSDEEP:6:IngVMrexJzJT0y9VEQIFVmb/eu2g/86S1kxROOSTwpCDCZpTwpCDCZvLCSyAAO:IngVMre9T0HQIDmy9g06JXrtjstRLlX
              MD5:1B21ADC0E77E9F16AB365F9C72A8A173
              SHA1:E54E9BEFF88831A564848909513E41A035CD539B
              SHA-256:AC5BD9952ABAC32DE1062FDF5117FBE3E42A44A9CAFBDCE04EEFADBF54E5EAA2
              SHA-512:EEFF8AC015C40F1620521F7303610861C2D286E9815F283C382B1C12226A90D5FB36BCEA407157AAEC8125A04701904391B0BF25340A6E52CCA34EE33D97EEB8
              Malicious:false
              Preview:%PDF-1.6.%......1 0 obj.<</Pages 2 0 R/Type/Catalog>>.endobj.2 0 obj.<</Count 0/Kids[]/Type/Pages>>.endobj.3 0 obj.<<>>.endobj.xref..0 4..0000000000 65535 f..0000000016 00000 n..0000000061 00000 n..0000000107 00000 n..trailer..<</Size 4/Root 1 0 R/Info 3 0 R/ID[<ADFC2B6D45403F41ACDA4E297F664FA1><ADFC2B6D45403F41ACDA4E297F664FA1>]>>..startxref..127..%%EOF..

              C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-03-26 15-30-18-401.log

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:ASCII text, with very long lines (393)
              Category:dropped
              Size (bytes):16525
              Entropy (8bit):5.345946398610936
              Encrypted:false
              SSDEEP:384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
              MD5:8947C10F5AB6CFFFAE64BCA79B5A0BE3
              SHA1:70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
              SHA-256:4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
              SHA-512:B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
              Malicious:false
              Preview:SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

              C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:ASCII text, with very long lines (393), with CRLF line terminators
              Category:dropped
              Size (bytes):16603
              Entropy (8bit):5.312437990122856
              Encrypted:false
              SSDEEP:384:KQelZPQXY5HwTy+/ORISRA0L3BDJ565K5V5x5m5i5w5O5G5Q5W5bWEWK9nWhtWnK:l2UErXgse4A+wypBmWs17k5kpMpbuu9p
              MD5:96F7D95E8855D4F645FEE370FBA03919
              SHA1:073400204754D7F25B183E001225B2DCDC80FF84
              SHA-256:9D7DC0CCD367377D3A118C568A4028AFF414AE243A971ECFF7B671C17ED2BDCD
              SHA-512:0A53EDFE47B0DB2A899C2860FF04BACFEDC492651C16BB55DBF9610D11E911539A66697A9044FC94863851D755E2B3EEA0B25900AF062BFDECA6573CC79AC68F
              Malicious:false
              Preview:SessionID=35ce03e7-44b7-4714-ad57-e01e422e80c5.1711463418416 Timestamp=2024-03-26T15:30:18:416+0100 ThreadID=7432 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=35ce03e7-44b7-4714-ad57-e01e422e80c5.1711463418416 Timestamp=2024-03-26T15:30:18:417+0100 ThreadID=7432 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=35ce03e7-44b7-4714-ad57-e01e422e80c5.1711463418416 Timestamp=2024-03-26T15:30:18:417+0100 ThreadID=7432 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=35ce03e7-44b7-4714-ad57-e01e422e80c5.1711463418416 Timestamp=2024-03-26T15:30:18:417+0100 ThreadID=7432 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=35ce03e7-44b7-4714-ad57-e01e422e80c5.1711463418416 Timestamp=2024-03-26T15:30:18:418+0100 ThreadID=7432 Component=ngl-lib_NglAppLib Description="SetConf

              C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):29845
              Entropy (8bit):5.393696870655729
              Encrypted:false
              SSDEEP:768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rV:Yw+fHJttuoiGc
              MD5:49A7C9E61C0C039FC78816DF2EFCD586
              SHA1:E907FDF693D547AABE5879DF923673EF27C10BD2
              SHA-256:81DA290778E488C27EAFD0F7FA27B317726E9C70E383277B5830F476010BB2A8
              SHA-512:49E3FF32A38ED5A0EFE3C7D69F1B38A98E8440EA44F3C8FCD6F5B2FC4FAAF8F3C33235E74E301869D26D989C0417473D6CB5639BA7F6167F3D4A8873766EB74A
              Malicious:false
              Preview:03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

              C:\Users\user\AppData\Local\Temp\acrocef_low\0e9e704b-9aa4-4b57-b929-db366a5ff54e.tmp

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
              Category:dropped
              Size (bytes):386528
              Entropy (8bit):7.9736851559892425
              Encrypted:false
              SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
              MD5:5C48B0AD2FEF800949466AE872E1F1E2
              SHA1:337D617AE142815EDDACB48484628C1F16692A2F
              SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
              SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
              Malicious:false
              Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

              C:\Users\user\AppData\Local\Temp\acrocef_low\2dc420b3-daa3-44d7-b225-ca4ff622d8ad.tmp

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
              Category:dropped
              Size (bytes):758601
              Entropy (8bit):7.98639316555857
              Encrypted:false
              SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
              MD5:3A49135134665364308390AC398006F1
              SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
              SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
              SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
              Malicious:false
              Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

              C:\Users\user\AppData\Local\Temp\acrocef_low\2f0dd1f1-8f51-4e2d-b59a-d646331d628d.tmp

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
              Category:dropped
              Size (bytes):1407294
              Entropy (8bit):7.97605879016224
              Encrypted:false
              SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
              MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
              SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
              SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
              SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
              Malicious:false
              Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

              C:\Users\user\AppData\Local\Temp\acrocef_low\f4375432-66f1-440c-8b9e-413571336f6b.tmp

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
              Category:dropped
              Size (bytes):1419751
              Entropy (8bit):7.976496077007677
              Encrypted:false
              SSDEEP:24576:/xA7o+W/aGZ7wYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JV+W/aGZ7wZGk3mlind9i4ufFXpAXkru
              MD5:2E14F72330170415FE766B61E6946D8D
              SHA1:D1BC8D68314F009AADE06BB5E1937677D56E9845
              SHA-256:BEC005490D369FC38BA239FE354BE79B291670C9243342D9121299EFA4C07812
              SHA-512:532F44EF838804E08F6DB7EFECCBBA0659C3595D84C6520AE0423FB4A493003B7F6BC96AFAF260DD3E91B0CD4C734095FD138C870CC0D7B0C53EA06738CB26C7
              Malicious:false
              Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

              Static File Info

              General

              File type:PDF document, version 1.4
              Entropy (8bit):7.997542266237233
              TrID:
              • Adobe Portable Document Format (5005/1) 100.00%
              File name:P&A COFFIDENTIAL - 200 - March2024.pdf
              File size:9'757'161 bytes
              MD5:45b0a437ed459fcc350c3b9dbc0782de
              SHA1:f9fc110c41f4b2da0dcf0e4c3527b6a046d26008
              SHA256:d8f46aa625f15894ee28e6bbcb1ef19ff64fc764dc99aa9f87d80af3513ea8e2
              SHA512:cf280cc4cb57170aa59100ea12b04394209595987ea0ee0073bc412cb86a0bafa7fc5d0aa99b2d4ad79002c7021dfb1a79356569d4b820ca3ed6fff43b6032ed
              SSDEEP:196608:uZD4vyUQ0PaBuPOetU1AVRe/QJtnv6ETqPbuYArd23L0o:JxpbU1AVrtniNP78d234o
              TLSH:30A63365A5619D30E50C493F8F6C64981CA6F4CA9D842D82B33F76CBBF72B76183E508
              File Content Preview:%PDF-1.4.%......41 0 obj.<</Linearized 1/L 9757161/O 43/E 8104362/N 5/T 9756221/H [ 3376 372]>>.endobj. ..xref..41 154..0000000016 00000 n..0000003748 00000 n..0000003811 00000 n..0000004330 00000 n..0000004443 00000 n..0000006348 00000 n..00000

              File Icon

              Icon Hash:62cc8caeb29e8ae0

              Static PDF Info

              General

              Header:%PDF-1.4
              Total Entropy:7.997542
              Total Bytes:9757161
              Stream Entropy:7.997796
              Stream Bytes:9730960
              Entropy outside Streams:5.245447
              Bytes outside Streams:26201
              Number of EOF found:3
              Bytes after EOF:

              Keywords Statistics

              NameCount
              obj194
              endobj194
              stream158
              endstream158
              xref2
              trailer2
              startxref2
              /Page5
              /Encrypt0
              /ObjStm0
              /URI0
              /JS0
              /JavaScript0
              /AA0
              /OpenAction0
              /AcroForm0
              /JBIG2Decode0
              /RichMedia0
              /Launch0
              /EmbeddedFile0

              Image Streams

              IDDHASHMD5Preview
              70c086aaaaaaaa86c08a37a9f20a64a1f4e0729a4ab93ecc42
              710000000000000000aea8a40e8e1efffbfb60a7ed7bbd5b16
              72030f7db4844e97272a13e3be692b6b61007101094ca83483
              215e3698d2921434a471c3b66010d71aa49ce2b55c64d22cfe
              2200d8ccd8d0a080c0620d607b433dce0d15e438347e7fc01f

              Network Behavior

              Network Port Distribution

              TCP Packets

              TimestampSource PortDest PortSource IPDest IP
              Mar 26, 2024 18:30:30.124172926 CET49739443192.168.2.423.56.8.145
              Mar 26, 2024 18:30:30.124212980 CET4434973923.56.8.145192.168.2.4
              Mar 26, 2024 18:30:30.124293089 CET49739443192.168.2.423.56.8.145
              Mar 26, 2024 18:30:30.124619007 CET49739443192.168.2.423.56.8.145
              Mar 26, 2024 18:30:30.124634027 CET4434973923.56.8.145192.168.2.4
              Mar 26, 2024 18:30:30.606182098 CET4434973923.56.8.145192.168.2.4
              Mar 26, 2024 18:30:30.606775045 CET49739443192.168.2.423.56.8.145
              Mar 26, 2024 18:30:30.606802940 CET4434973923.56.8.145192.168.2.4
              Mar 26, 2024 18:30:30.607939959 CET4434973923.56.8.145192.168.2.4
              Mar 26, 2024 18:30:30.608002901 CET49739443192.168.2.423.56.8.145
              Mar 26, 2024 18:30:30.610596895 CET49739443192.168.2.423.56.8.145
              Mar 26, 2024 18:30:30.610698938 CET4434973923.56.8.145192.168.2.4
              Mar 26, 2024 18:30:30.610768080 CET49739443192.168.2.423.56.8.145
              Mar 26, 2024 18:30:30.652245045 CET4434973923.56.8.145192.168.2.4
              Mar 26, 2024 18:30:30.662770033 CET49739443192.168.2.423.56.8.145
              Mar 26, 2024 18:30:30.662790060 CET4434973923.56.8.145192.168.2.4
              Mar 26, 2024 18:30:30.710587978 CET49739443192.168.2.423.56.8.145
              Mar 26, 2024 18:30:30.770324945 CET4434973923.56.8.145192.168.2.4
              Mar 26, 2024 18:30:30.770394087 CET4434973923.56.8.145192.168.2.4
              Mar 26, 2024 18:30:30.770546913 CET49739443192.168.2.423.56.8.145
              Mar 26, 2024 18:30:30.776161909 CET49739443192.168.2.423.56.8.145
              Mar 26, 2024 18:30:30.776190042 CET4434973923.56.8.145192.168.2.4

              HTTP Request Dependency Graph

              • armmf.adobe.com

              HTTPS Proxied Packets

              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              0192.168.2.44973923.56.8.1454437684C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              TimestampBytes transferredDirectionData
              2024-03-26 17:30:30 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
              Host: armmf.adobe.com
              Connection: keep-alive
              Accept-Language: en-US,en;q=0.9
              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
              Sec-Fetch-Site: same-origin
              Sec-Fetch-Mode: no-cors
              Sec-Fetch-Dest: empty
              Accept-Encoding: gzip, deflate, br
              If-None-Match: "78-5faa31cce96da"
              If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
              2024-03-26 17:30:30 UTC198INHTTP/1.1 304 Not Modified
              Content-Type: text/plain; charset=UTF-8
              Last-Modified: Mon, 01 May 2023 15:02:33 GMT
              ETag: "78-5faa31cce96da"
              Date: Tue, 26 Mar 2024 17:30:30 GMT
              Connection: close


              Statistics

              CPU Usage

              Click to jump to process

              Memory Usage

              Click to jump to process

              High Level Behavior Distribution

              Click to dive into process behavior distribution

              Behavior

              Click to jump to process

              System Behavior

              General

              Target ID:0
              Start time:15:30:14
              Start date:26/03/2024
              Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              Wow64 process (32bit):false
              Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\P&A COFFIDENTIAL - 200 - March2024.pdf"
              Imagebase:0x7ff6bc1b0000
              File size:5'641'176 bytes
              MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:moderate
              Has exited:true

              General

              Target ID:1
              Start time:15:30:15
              Start date:26/03/2024
              Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              Wow64 process (32bit):false
              Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
              Imagebase:0x7ff74bb60000
              File size:3'581'912 bytes
              MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:moderate
              Has exited:true

              General

              Target ID:3
              Start time:15:30:16
              Start date:26/03/2024
              Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              Wow64 process (32bit):false
              Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1728,i,15528783898655642024,13473473242156841925,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
              Imagebase:0x7ff74bb60000
              File size:3'581'912 bytes
              MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:moderate
              Has exited:true

              Disassembly

              ⊘No disassembly