Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
User Manual.pdf

Overview

General Information

Sample name:User Manual.pdf
Analysis ID:1417300
MD5:4e5167220439be2577e98d0d0e0f1b10
SHA1:6ba9cee542a830ae2f1f8e246b6b0a4e1f5b9514
SHA256:0dd816a9b2c428509e3bf91e66ed601e65d93b5d96180427ea121258225926eb
Infos:

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 5080 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\User Manual.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 7236 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 7424 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1572,i,7330846989784507453,3868889862558952675,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global trafficTCP traffic: 23.223.252.145:443 -> 192.168.2.5:49715
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global trafficTCP traffic: 23.223.252.145:443 -> 192.168.2.5:49715
Source: global trafficTCP traffic: 23.223.252.145:443 -> 192.168.2.5:49715
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global trafficTCP traffic: 23.223.252.145:443 -> 192.168.2.5:49715
Source: global trafficTCP traffic: 23.223.252.145:443 -> 192.168.2.5:49715
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global trafficTCP traffic: 23.223.252.145:443 -> 192.168.2.5:49715
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global trafficTCP traffic: 23.223.252.145:443 -> 192.168.2.5:49715
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global trafficTCP traffic: 23.223.252.145:443 -> 192.168.2.5:49715
Source: global trafficTCP traffic: 23.223.252.145:443 -> 192.168.2.5:49715
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.223.252.145:443
Source: global trafficTCP traffic: 23.223.252.145:443 -> 192.168.2.5:49715
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 23.223.252.145
Source: unknownTCP traffic detected without corresponding DNS query: 23.223.252.145
Source: unknownTCP traffic detected without corresponding DNS query: 23.223.252.145
Source: unknownTCP traffic detected without corresponding DNS query: 23.223.252.145
Source: unknownTCP traffic detected without corresponding DNS query: 23.223.252.145
Source: unknownTCP traffic detected without corresponding DNS query: 23.223.252.145
Source: unknownTCP traffic detected without corresponding DNS query: 23.223.252.145
Source: unknownTCP traffic detected without corresponding DNS query: 23.223.252.145
Source: unknownTCP traffic detected without corresponding DNS query: 23.223.252.145
Source: unknownTCP traffic detected without corresponding DNS query: 23.223.252.145
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: User Manual.pdfString found in binary or memory: http://hddscan.com/)
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: classification engineClassification label: clean1.winPDF@14/45@0/1
Source: User Manual.pdfInitial sample: http://hddscan.com/
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6776Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-03-28 22-23-53-758.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\User Manual.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1572,i,7330846989784507453,3868889862558952675,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1572,i,7330846989784507453,3868889862558952675,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: User Manual.pdfInitial sample: PDF keyword /JS count = 0
Source: User Manual.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: User Manual.pdfInitial sample: PDF keyword /Page count = 24
Source: User Manual.pdfInitial sample: PDF keyword stream count = 49
Source: User Manual.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: User Manual.pdfInitial sample: PDF keyword obj count = 98
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire Infrastructure1
Spearphishing Link		2
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive12
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1417300 Sample: User Manual.pdf Startdate: 28/03/2024 Architecture: WINDOWS Score: 1 6 Acrobat.exe 20 66 2->6         started        process3 8 AcroCEF.exe 106 6->8         started        process4 10 AcroCEF.exe 2 8->10         started        dnsIp5 13 23.223.252.145, 443, 49715 AKAMAI-ASUS United States 10->13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
User Manual.pdf0%ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http://hddscan.com/)User Manual.pdffalse
    		high

    World Map of Contacted IPs

    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs

    Public IPs

    IPDomainCountryFlagASNASN NameMalicious
    23.223.252.145
    		unknownUnited States
    		16625AKAMAI-ASUSfalse

    General Information

    Joe Sandbox version:40.0.0 Tourmaline
    Analysis ID:1417300
    Start date and time:2024-03-28 22:23:03 +01:00
    Joe Sandbox product:CloudBasic
    Overall analysis duration:0h 3m 55s
    Hypervisor based Inspection enabled:false
    Report type:full
    Cookbook file name:defaultwindowspdfcookbook.jbs
    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
    Number of analysed new started processes analysed:9
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • HCA enabled
    • EGA enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:Timeout
    Sample name:User Manual.pdf
    Detection:CLEAN
    Classification:clean1.winPDF@14/45@0/1
    Cookbook Comments:
    • Found application associated with file extension: .pdf
    • Found PDF document
    • Close Viewer

    Warnings

    • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
    • Excluded IPs from analysis (whitelisted): 23.51.56.185, 18.213.11.84, 34.237.241.83, 54.224.241.105, 50.16.47.176, 162.159.61.3, 172.64.41.3, 23.40.179.136, 23.40.179.182, 23.40.179.141, 23.40.179.192, 23.53.35.208, 23.53.35.200, 23.40.179.21, 23.40.179.9, 23.40.179.17, 23.40.179.19, 23.40.179.8, 23.40.179.5, 23.40.179.4, 23.40.179.11, 23.40.179.14
    • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com
    • VT rate limit hit for: User Manual.pdf

    Simulations

    Behavior and APIs

    ⊘No simulations

    Joe Sandbox View / Context

    IPs

    ⊘No context

    Domains

    ⊘No context

    ASNs

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    AKAMAI-ASUSfile.exeGet hashmaliciousVidarBrowse
    • 104.105.90.131
    https://ckydb04.na1.hubspotlinks.com/Ctc/OP+113/cKydB04/VW9bQw4skpv3N4QMDhk6pMpJW5g6HvJ5ccjQdN61zzVd3qn9gW7lCdLW6lZ3m-VBhZqP2fNwFyN40GRrrMQlZ-N2TdQmJ13Y6QW10XVPX3kbMHcN4L237-7KHZ5W1zLF7f8GbdtBW2ZKqmb4N84ZcW3QDpzS6S7KJJW5X7x_l7b4v9TW2F362D3Hh1s9W54lklM4T0vLxN7h7S8FNlcHjW20Y8Mn2bFBzVW9hqyrD48FY07W1SGLwZ5DF_9-W40HntB7qL0THW1mF8BY3vVj3gW2n5NX74XPrGTW45qZ3V6l-BrTN7CsbcvdfdyCW5951f94y1-HGN8ZFSwmVlSf3W5fSXSN3-n9KQW8hNdv46-Q6rkf7QDZST04Get hashmaliciousUnknownBrowse
    • 104.105.46.200
    BuThoFHNNK.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, Glupteba, LummaC Stealer, SmokeLoaderBrowse
    • 104.71.182.190
    6uVlPQSJ4e.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, Glupteba, LummaC Stealer, SmokeLoaderBrowse
    • 104.105.90.131
    p8F35SRiO8.elfGet hashmaliciousMiraiBrowse
    • 23.192.2.176
    Kie7OQsnAC.elfGet hashmaliciousMiraiBrowse
    • 23.74.215.167
    file.exeGet hashmaliciousVidarBrowse
    • 104.102.129.112
    securedoc_20240328T081124.htmlGet hashmaliciousUnknownBrowse
    • 23.215.0.47
    https://airispharma1-my.sharepoint.com/:o:/g/personal/anagaraj_airispharma_com/EvmEpKGsyxtGnlrgsjVRxi4BOj2g3uhzHgNY6tXqx6wp5g?e=JtdJfIGet hashmaliciousHTMLPhisherBrowse
    • 23.215.0.235
    Quarantined Messages (12).zipGet hashmaliciousUnknownBrowse
    • 23.54.46.90

    JA3 Fingerprints

    ⊘No context

    Dropped Files

    ⊘No context

    Created / dropped Files

    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):294
    Entropy (8bit):5.223938216977274
    Encrypted:false
    SSDEEP:6:FZfmfdH39+q2P92nKuAl9OmbnIFUt88ZfmfGTXJZmw+8ZfmfGTX9VkwO92nKuAlz:8H34v4HAahFUt8yTXJ/+yTXD5LHAaSJ
    MD5:2E8FBD4AF70A3EB7CF9AF12536ED6565
    SHA1:DC712183D855B6430F431ED1A9188B28F95C3D8A
    SHA-256:313AC78EEF3E3C368A076D2E6CAD564717E47189784C3A9157A2B96CDC476A43
    SHA-512:FAF9024ABD3AE44E4FC71397CB4CD0B152ED5A06B4050C3AB2402AB250DC7B1835A3616590447A0BA456949E91127EA5E426AB997145EE47EB09B380BB48C767
    Malicious:false
    Reputation:low
    Preview:2024/03/28-22:23:51.666 1c68 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/03/28-22:23:51.667 1c68 Recovering log #3.2024/03/28-22:23:51.667 1c68 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):294
    Entropy (8bit):5.223938216977274
    Encrypted:false
    SSDEEP:6:FZfmfdH39+q2P92nKuAl9OmbnIFUt88ZfmfGTXJZmw+8ZfmfGTX9VkwO92nKuAlz:8H34v4HAahFUt8yTXJ/+yTXD5LHAaSJ
    MD5:2E8FBD4AF70A3EB7CF9AF12536ED6565
    SHA1:DC712183D855B6430F431ED1A9188B28F95C3D8A
    SHA-256:313AC78EEF3E3C368A076D2E6CAD564717E47189784C3A9157A2B96CDC476A43
    SHA-512:FAF9024ABD3AE44E4FC71397CB4CD0B152ED5A06B4050C3AB2402AB250DC7B1835A3616590447A0BA456949E91127EA5E426AB997145EE47EB09B380BB48C767
    Malicious:false
    Reputation:low
    Preview:2024/03/28-22:23:51.666 1c68 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/03/28-22:23:51.667 1c68 Recovering log #3.2024/03/28-22:23:51.667 1c68 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):338
    Entropy (8bit):5.155523156710773
    Encrypted:false
    SSDEEP:6:FZfm039+q2P92nKuAl9Ombzo2jMGIFUt88ZfmMBC3JZmw+8ZfmpN9VkwO92nKuAv:f+v4HAa8uFUt87Z/+FV5LHAa8RJ
    MD5:065698984CB088A1D98BD9A8093098F1
    SHA1:3CE1E48F4EECAEF239092E52F2151932AA21F671
    SHA-256:F0C43B12A6B39CF5088FAB456F53EACB1DB40A9505C8797870A93A819370ECCF
    SHA-512:E46B64E0DE64734642EF6D571F1512B8102250B0D82BB301037C1688F5F33C838D86A3B36882F693177ED5ABDE969BBB2D06FF9D92F318854AF09B1D427492F2
    Malicious:false
    Reputation:low
    Preview:2024/03/28-22:23:51.722 1d2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/03/28-22:23:51.725 1d2c Recovering log #3.2024/03/28-22:23:51.729 1d2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):338
    Entropy (8bit):5.155523156710773
    Encrypted:false
    SSDEEP:6:FZfm039+q2P92nKuAl9Ombzo2jMGIFUt88ZfmMBC3JZmw+8ZfmpN9VkwO92nKuAv:f+v4HAa8uFUt87Z/+FV5LHAa8RJ
    MD5:065698984CB088A1D98BD9A8093098F1
    SHA1:3CE1E48F4EECAEF239092E52F2151932AA21F671
    SHA-256:F0C43B12A6B39CF5088FAB456F53EACB1DB40A9505C8797870A93A819370ECCF
    SHA-512:E46B64E0DE64734642EF6D571F1512B8102250B0D82BB301037C1688F5F33C838D86A3B36882F693177ED5ABDE969BBB2D06FF9D92F318854AF09B1D427492F2
    Malicious:false
    Reputation:low
    Preview:2024/03/28-22:23:51.722 1d2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/03/28-22:23:51.725 1d2c Recovering log #3.2024/03/28-22:23:51.729 1d2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):507
    Entropy (8bit):5.047725111930163
    Encrypted:false
    SSDEEP:12:YH/um3RA8sqZlHWsBdOg2H9Acaq3QYiubxnP7E4T3OF+:Y2sRds+dMH9r3QYhbxP7nbI+
    MD5:C99380396BB412BE5355ECDADD7B48CB
    SHA1:12C608E8FFA5B66E37FDBB0C47D0A648AC474FDB
    SHA-256:273530BB25D40B0969823291060FBA7EB394692DFF9D685B1C1AB0CC4F9BE572
    SHA-512:3C7E6E1EF81856383EBBC5CA4B5E3D77F5CD911D8A2453008E7C202F61ED267B25B54F5E70D37444BEC9DCA154C8F5919196DDABFAE07BB680B22C26F1A6A873
    Malicious:false
    Reputation:low
    Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13356221043465982","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":96265},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f69e8f6a-aad8-4114-b43f-63e734951d0b.tmp

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:JSON data
    Category:modified
    Size (bytes):507
    Entropy (8bit):5.047725111930163
    Encrypted:false
    SSDEEP:12:YH/um3RA8sqZlHWsBdOg2H9Acaq3QYiubxnP7E4T3OF+:Y2sRds+dMH9r3QYhbxP7nbI+
    MD5:C99380396BB412BE5355ECDADD7B48CB
    SHA1:12C608E8FFA5B66E37FDBB0C47D0A648AC474FDB
    SHA-256:273530BB25D40B0969823291060FBA7EB394692DFF9D685B1C1AB0CC4F9BE572
    SHA-512:3C7E6E1EF81856383EBBC5CA4B5E3D77F5CD911D8A2453008E7C202F61ED267B25B54F5E70D37444BEC9DCA154C8F5919196DDABFAE07BB680B22C26F1A6A873
    Malicious:false
    Reputation:low
    Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13356221043465982","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":96265},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:data
    Category:dropped
    Size (bytes):4509
    Entropy (8bit):5.23922659411318
    Encrypted:false
    SSDEEP:96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUK54QlImyWmT/lZ:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLW
    MD5:2175739EA0A4AFB5C2EE0116F8AB575B
    SHA1:3C83293147FCB136BAA726B5E644D2BE75C9B26A
    SHA-256:A7C5ED83A13EEBA23E46D077F434D539756363EB1BBBD14575F3448FC6936B9A
    SHA-512:4082F526426900593D1ADA76424C337728459B4E627E63AEFFAF7610591B5B79373A21777CEAE3E3735290111AC4D80DA55A2E82EF7AB792926B236B2AD57753
    Malicious:false
    Reputation:low
    Preview:*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):326
    Entropy (8bit):5.112065671795597
    Encrypted:false
    SSDEEP:6:FZfl39+q2P92nKuAl9OmbzNMxIFUt88ZfcC3JZmw+8ZfBi9VkwO92nKuAl9OmbzE:/+v4HAa8jFUt8G/+BV5LHAa84J
    MD5:50E9DCB68CFE16183926723AC21987A1
    SHA1:6A98C969E47AC588249D5C4A979D9856812EA0CF
    SHA-256:CCAC87EAC54D347728AC4BA2854191D5339EF35DED2570841AA46093D7B7BA29
    SHA-512:A53C54D42FD2B07A689B45F1D9F21147A41A3E762C0F0572B6F7CEDF7DF72E4DE6AC9BCE6BF34E401828F69F1E957A6DD0DFE878D835994744CB0DEEF964B7EF
    Malicious:false
    Reputation:low
    Preview:2024/03/28-22:23:52.080 1d2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/03/28-22:23:52.082 1d2c Recovering log #3.2024/03/28-22:23:52.083 1d2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):326
    Entropy (8bit):5.112065671795597
    Encrypted:false
    SSDEEP:6:FZfl39+q2P92nKuAl9OmbzNMxIFUt88ZfcC3JZmw+8ZfBi9VkwO92nKuAl9OmbzE:/+v4HAa8jFUt8G/+BV5LHAa84J
    MD5:50E9DCB68CFE16183926723AC21987A1
    SHA1:6A98C969E47AC588249D5C4A979D9856812EA0CF
    SHA-256:CCAC87EAC54D347728AC4BA2854191D5339EF35DED2570841AA46093D7B7BA29
    SHA-512:A53C54D42FD2B07A689B45F1D9F21147A41A3E762C0F0572B6F7CEDF7DF72E4DE6AC9BCE6BF34E401828F69F1E957A6DD0DFE878D835994744CB0DEEF964B7EF
    Malicious:false
    Reputation:low
    Preview:2024/03/28-22:23:52.080 1d2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/03/28-22:23:52.082 1d2c Recovering log #3.2024/03/28-22:23:52.083 1d2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

    C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240328212355Z-148.bmp

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
    Category:dropped
    Size (bytes):71190
    Entropy (8bit):0.100662448604734
    Encrypted:false
    SSDEEP:6:ujlhyYyRC+H6rFUexa0WnaOhHKX2RikPHCFRnGq/G+HpzkoJsiSp5ZVJQKbuaCaJ:yyYa6iBnaOZqR0WRGr+Hpgov6/R
    MD5:59F43ED39BDC6BDC175D0B5FCBD6BFEB
    SHA1:ED07F723EB6ACEC01A72DEB3BDCB3CE8439778D8
    SHA-256:585DA6234D1C73FE27FC8CD0F1AEAC87BA49182275D4EA4BD2550D08DC3B5A75
    SHA-512:C12638D0845ACC342510B3FD4F4F07501F1B094DF7A4F88A32FF675CF8803D23A5CCF178B82A06F24B409CA634B8CD20C58D7FF470C084F768F3D863A233BDCD
    Malicious:false
    Reputation:low
    Preview:BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:PostScript document text
    Category:dropped
    Size (bytes):1233
    Entropy (8bit):5.233980037532449
    Encrypted:false
    SSDEEP:24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
    MD5:8BA9D8BEBA42C23A5DB405994B54903F
    SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
    SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
    SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
    Malicious:false
    Reputation:moderate, very likely benign file
    Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6776

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:PostScript document text
    Category:dropped
    Size (bytes):1233
    Entropy (8bit):5.233980037532449
    Encrypted:false
    SSDEEP:24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
    MD5:8BA9D8BEBA42C23A5DB405994B54903F
    SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
    SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
    SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
    Malicious:false
    Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:PostScript document text
    Category:dropped
    Size (bytes):1233
    Entropy (8bit):5.233980037532449
    Encrypted:false
    SSDEEP:24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
    MD5:8BA9D8BEBA42C23A5DB405994B54903F
    SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
    SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
    SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
    Malicious:false
    Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:PostScript document text
    Category:dropped
    Size (bytes):10880
    Entropy (8bit):5.214360287289079
    Encrypted:false
    SSDEEP:192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
    MD5:B60EE534029885BD6DECA42D1263BDC0
    SHA1:4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
    SHA-256:B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
    SHA-512:52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
    Malicious:false
    Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6776

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:PostScript document text
    Category:dropped
    Size (bytes):10880
    Entropy (8bit):5.214360287289079
    Encrypted:false
    SSDEEP:192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
    MD5:B60EE534029885BD6DECA42D1263BDC0
    SHA1:4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
    SHA-256:B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
    SHA-512:52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
    Malicious:false
    Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:data
    Category:dropped
    Size (bytes):227002
    Entropy (8bit):3.392780893644728
    Encrypted:false
    SSDEEP:1536:WKPC4iyzDtrh1cK3XEivK7VK/3AYvYwgF/rRoL+sn:DPCaJ/3AYvYwglFoL+sn
    MD5:87EDBEE38F56C20298F25D5D3D4D1B5C
    SHA1:7F904E9615AC3186A87472EF366DD8202855B0B7
    SHA-256:A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
    SHA-512:BBEBC1FCD5BC9AE042DD5782425BA8C47BF3EAC283B2487FC4E3FF6BF8101306DAB081E5135594165D4DC1AC120FF125AADBC5B3FFE7C646183C04DF77865E0D
    Malicious:false
    Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):295
    Entropy (8bit):5.363092285159866
    Encrypted:false
    SSDEEP:6:YEQXJ2HXINR1x+FIbRI6XVW7+0YrcoAvJM3g98kUwPeUkwRe9:YvXKXINR1UYpW7YvGMbLUkee9
    MD5:370C70B9BF88FE99DBEBEFC1249794A0
    SHA1:4A87E5C03E5FE84BAF1ADE11361CD65C65F30AC8
    SHA-256:63423E92E3DC3A545FA2268B1417AA268B88EE2FAF669D09CC9B93A683AD10E0
    SHA-512:7C4EBDBC4F230EAD85B2D99C3B352EA53167312F43496F62F4000621301B668E56880906E0D2B92BF6EFE615D8E37B249BFFBEBE3B1FAA2A1CED2523CD329D6A
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"157b46c3-952a-4c64-9b68-9f242499789d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711835171998,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):294
    Entropy (8bit):5.304759249764442
    Encrypted:false
    SSDEEP:6:YEQXJ2HXINR1x+FIbRI6XVW7+0YrcoAvJfBoTfXpnrPeUkwRe9:YvXKXINR1UYpW7YvGWTfXcUkee9
    MD5:3F0B906D873A2051D9C006319D45A5FE
    SHA1:F39FB1968B37544F6E61114EC9DB86F95ADC5F78
    SHA-256:168529D6FF34D4BE129CA6FAF0C7D040E5B7095ED2A4B79B28738C909906EB77
    SHA-512:E7CC79966CA437E9C881C7D190195D0345B59317C6D2115CDF2F1A46DB9548F65D89C06EC578AE579BF73ABAAAC3313B828259239F79B22E60BFC674C10CACBB
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"157b46c3-952a-4c64-9b68-9f242499789d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711835171998,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):294
    Entropy (8bit):5.2827118497638015
    Encrypted:false
    SSDEEP:6:YEQXJ2HXINR1x+FIbRI6XVW7+0YrcoAvJfBD2G6UpnrPeUkwRe9:YvXKXINR1UYpW7YvGR22cUkee9
    MD5:0BB821F4BCF5DF0F04D41D8597D75FA3
    SHA1:4775E688BD95349DBA5DBDB7EA5847F1272E3AE2
    SHA-256:71B42DB6AEAD6742A03C752FEC34CB157456CCE4D2388AD0C381F625D0522FBB
    SHA-512:F21F17FBBD4E731915E421591FB233B1ADE34C672A7B5B31E3FEC5840EE5CEE75C33D3E9548AF0EEF9F2632029F231A4BCE7B43B672BC9A58C5BBBB8B52E223E
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"157b46c3-952a-4c64-9b68-9f242499789d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711835171998,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):285
    Entropy (8bit):5.341975650492493
    Encrypted:false
    SSDEEP:6:YEQXJ2HXINR1x+FIbRI6XVW7+0YrcoAvJfPmwrPeUkwRe9:YvXKXINR1UYpW7YvGH56Ukee9
    MD5:641A6A9EDB319BFB1F19910CA6701B1C
    SHA1:A2AF35F66BC4DA4E6907CC65C8E419DEC56ADC3F
    SHA-256:27B30F056F725B7860B28177A45E6B1E15B122E83B730F28749FB4B0F791A98B
    SHA-512:6D0D92DE1DC20CCD0093DAF71646A51E58FB0262B5BE76C16679DA12033FFEBF756ECA0CCC7A86325FBD70CCEE9F07E27E41F0E2709416F49A9836BC0C782E9F
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"157b46c3-952a-4c64-9b68-9f242499789d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711835171998,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):292
    Entropy (8bit):5.3044035486163725
    Encrypted:false
    SSDEEP:6:YEQXJ2HXINR1x+FIbRI6XVW7+0YrcoAvJfJWCtMdPeUkwRe9:YvXKXINR1UYpW7YvGBS8Ukee9
    MD5:11925D38C9FBB9E60B6375F72446D74D
    SHA1:9817074CFEBBA49FAAB956CBD13313EF1A79C89C
    SHA-256:75306C577073EAEB5EA26FBA3E81FAF902F9F42B4ED21A3EC81CECD3521B3969
    SHA-512:639F0B1946411E995981F25EF7DDD5931E93B734673D6A1063D4F726CC85B4BE658C3D152C14AB4722C82F8112C9CC3767E730591C8222990F8F7122A18D8F4A
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"157b46c3-952a-4c64-9b68-9f242499789d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711835171998,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):289
    Entropy (8bit):5.289949532535632
    Encrypted:false
    SSDEEP:6:YEQXJ2HXINR1x+FIbRI6XVW7+0YrcoAvJf8dPeUkwRe9:YvXKXINR1UYpW7YvGU8Ukee9
    MD5:77FFE61339A67CAA738613D289E18648
    SHA1:822F870556A3C5762ED3886E97884F19E1C15E52
    SHA-256:666F64BD59D2B0C3F9C1B512F5EFCAC01115712A51096DC3816AD8574F8197DA
    SHA-512:E30C1CE6B839927327CF26B494B350C3D34309ECAD88094CB97EA6190A8580998EE355D97996E765C853C90DFFA3E1F47B384ACC696D672CF01008732A0C7CFE
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"157b46c3-952a-4c64-9b68-9f242499789d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711835171998,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):292
    Entropy (8bit):5.291316989576302
    Encrypted:false
    SSDEEP:6:YEQXJ2HXINR1x+FIbRI6XVW7+0YrcoAvJfQ1rPeUkwRe9:YvXKXINR1UYpW7YvGY16Ukee9
    MD5:B226F6FD4D602D78B638461A0FC4DB14
    SHA1:48DF769F68BC3D96FF8E6A1CEB01D18D66111E16
    SHA-256:90132348D9E0EA9C8DF6BA7F6533EE31B050CEDA1E6D74223B2CEE5625CBADA9
    SHA-512:B0BFFCF9F30CE38A9B980E5A9F27DBA78FD9BAD52712CF0BC5601A6313E7247216F0F4727383B5D876478439620F8910BE281E92C7B6E173A73FDE445791BC3C
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"157b46c3-952a-4c64-9b68-9f242499789d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711835171998,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):289
    Entropy (8bit):5.311471761465557
    Encrypted:false
    SSDEEP:6:YEQXJ2HXINR1x+FIbRI6XVW7+0YrcoAvJfFldPeUkwRe9:YvXKXINR1UYpW7YvGz8Ukee9
    MD5:3A4F28E1CE7550DD5096A7CB8B8640A1
    SHA1:0F5F4EE73A180D4892B62386C3CA5E53541BB2AA
    SHA-256:CCFD90EF79AB8050740074F3D59D95EA5CA6F6A635520E3B7062A367B806E5BF
    SHA-512:715DA8A00607AFDC4EE9C548FA00EA1FC9F7AD7AC957B9BC241E4340D2574BA6C1F4807393D6D6DA7A6BECE37BB4164371C94A7050E17559D197F595C5359F19
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"157b46c3-952a-4c64-9b68-9f242499789d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711835171998,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):295
    Entropy (8bit):5.318201922481645
    Encrypted:false
    SSDEEP:6:YEQXJ2HXINR1x+FIbRI6XVW7+0YrcoAvJfzdPeUkwRe9:YvXKXINR1UYpW7YvGb8Ukee9
    MD5:AD47717272D9237A98F2A34369FFB89A
    SHA1:8A9846015E1F373FBEEC957EEFAAE21AD9356E1E
    SHA-256:42B0651310BCAF06CE7F42E6B7C8420D80C3DB79E5A43DBC8EAC37E04797CF09
    SHA-512:CC3E54DF4F1060FFF31B16EC0DEFF9AAB78A57CEF96F8EAB6C50912BB448907364073BA80DB642985F3477A395EDF3207D0A5A19FAF1486B0E4C589355BDE0AA
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"157b46c3-952a-4c64-9b68-9f242499789d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711835171998,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):289
    Entropy (8bit):5.298527728874461
    Encrypted:false
    SSDEEP:6:YEQXJ2HXINR1x+FIbRI6XVW7+0YrcoAvJfYdPeUkwRe9:YvXKXINR1UYpW7YvGg8Ukee9
    MD5:B323AFAF3EFD30D1C4ED2C6C56EB5F23
    SHA1:1C9B0D80BD490031739FBB5D3455514B167BC736
    SHA-256:07B93D6AEAA460CCD844A1F95BB8A0B5EA772BAA761DDB6915C01F378AD1643F
    SHA-512:F9D1AC032A17F5B77DD7A0BBAF3869D64D2DF11D4E63C1B024433D1023AB4CF0530F7359E304BF613D4C69B45ACFE5F21F45655028D79AF34AD05669F01CA5E4
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"157b46c3-952a-4c64-9b68-9f242499789d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711835171998,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):1395
    Entropy (8bit):5.775732846429488
    Encrypted:false
    SSDEEP:24:Yv6XYBiYKrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNqO:YvrYYKHgDv3W2aYQfgB5OUupHrQ9FJN
    MD5:77D64719292B1502FF87EA65CE802F2B
    SHA1:469BD833AE981D639F51A80B15A712FD8BB236BB
    SHA-256:55019AAEC59C93F5971C118845E0F3677BE3D67C0637E893036A4EC170E92170
    SHA-512:693243948C9DF357D4E905CDD923458693F5F131D2D7FCF0BD9FF5F5D129801F481C499840CD4271C54D84D770C8475F7404F733CA21D069B928472B598886D3
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"157b46c3-952a-4c64-9b68-9f242499789d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711835171998,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):291
    Entropy (8bit):5.282084945250218
    Encrypted:false
    SSDEEP:6:YEQXJ2HXINR1x+FIbRI6XVW7+0YrcoAvJfbPtdPeUkwRe9:YvXKXINR1UYpW7YvGDV8Ukee9
    MD5:E2A5255A397C1B5EC23AD1A0E3661B78
    SHA1:9E8AF0B32625B4570F3CEB7FFA86147308719AC1
    SHA-256:93F9E03187295D3B6598B41A6E05EF1E43525BD1984B4AB30A0FF9F0644A8E77
    SHA-512:FAEC362E0D0D34A2C17FC4A105383637F831153EB83791F810C85C3EF92EE933E9BF294F388C7527C2C5E9DD1AB36B2EA648BD93CC688483D7D90EFFE141D395
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"157b46c3-952a-4c64-9b68-9f242499789d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711835171998,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):287
    Entropy (8bit):5.28342340549149
    Encrypted:false
    SSDEEP:6:YEQXJ2HXINR1x+FIbRI6XVW7+0YrcoAvJf21rPeUkwRe9:YvXKXINR1UYpW7YvG+16Ukee9
    MD5:8D4787BEFAD2EAA45E80C584B3A2B5BB
    SHA1:6A51215654AEA4A1078E3924837A73DC46E98C9B
    SHA-256:B7B6DC9A4926FCE528B635985396A6263E0492FFECD636C1BEFAC5D6F6CFDA2F
    SHA-512:0FCB1D45DE5314FBCDF54A8A155CCBBE21655F180612969BA25D8CD6DD81210810C08AA3929323E219B2FD19A818F7195148353EE9CD263B245198527F93BF50
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"157b46c3-952a-4c64-9b68-9f242499789d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711835171998,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):289
    Entropy (8bit):5.304756834591663
    Encrypted:false
    SSDEEP:6:YEQXJ2HXINR1x+FIbRI6XVW7+0YrcoAvJfbpatdPeUkwRe9:YvXKXINR1UYpW7YvGVat8Ukee9
    MD5:60432BCEAA334C7A4195D0EF935E9041
    SHA1:D63F9CB1958D28225DEAE82BD95A848D90535982
    SHA-256:D7428A55531777B319F67B82FE794DC633A62DD77528251BE01DF6CEA95D97DD
    SHA-512:6EA90CE2ABF68D77F3123A1DB3BC740F14D4A9E62A9128B6FE77FD441AAACF1C38526A916A5450B2170AD759DD79BC88CC26CA99EABC56761B4B63EA353AF998
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"157b46c3-952a-4c64-9b68-9f242499789d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711835171998,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):286
    Entropy (8bit):5.2587511550794686
    Encrypted:false
    SSDEEP:6:YEQXJ2HXINR1x+FIbRI6XVW7+0YrcoAvJfshHHrPeUkwRe9:YvXKXINR1UYpW7YvGUUUkee9
    MD5:F9D968FBADD3E1D13D55899887F51DA8
    SHA1:E1AAD5E75F13A9B5E7E9AAE735720734829096F9
    SHA-256:8BA8391157C6CAC951943966B15AA3550B70789B2D86F09C416EEA3029D975DC
    SHA-512:0C18272958E2026FA4DE46F02F7062EEC81AAA14A245C6B99C669EFCFF77E8B954B220A735C47241C68417FCC381B14AF3E77E3996DEE6C7A5AD14230A021CF0
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"157b46c3-952a-4c64-9b68-9f242499789d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711835171998,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):782
    Entropy (8bit):5.367420207002249
    Encrypted:false
    SSDEEP:12:YvXKXINR1UYpW7YvGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhW+O:Yv6XYBiYf168CgEXX5kcIfANhHO
    MD5:F1E093B8145BEDC883ED4E971AEF39BB
    SHA1:2493B5E1CA05679DA30642F5842708B4E9F3FE0E
    SHA-256:23CCEDE5ED2E481D77E083B0BAD89EC5D1645B326849669E200C5D6962AE0DA4
    SHA-512:13158DDDF98BF87DB92DBC1D398EDCAD3A2EE113E15C960806DC96C91F410E05E22949FFC88A10F5825380775BE2730ACB1843D47D35FD9D43C4D4BEA28FCEAD
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"157b46c3-952a-4c64-9b68-9f242499789d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1711835171998,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1711661037032}}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:data
    Category:dropped
    Size (bytes):4
    Entropy (8bit):0.8112781244591328
    Encrypted:false
    SSDEEP:3:e:e
    MD5:DC84B0D741E5BEAE8070013ADDCC8C28
    SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
    SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
    SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
    Malicious:false
    Preview:....

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):2813
    Entropy (8bit):5.139242674805198
    Encrypted:false
    SSDEEP:48:YKggj8qlM56tmhYrPN44V7kwC4MzqU9ptLX4:p/jlE6HTN44rC4MHph4
    MD5:88ABE94345434523D6E2F645455DD322
    SHA1:632B5F2927DF5841D3524D7A690D1F323ABC784F
    SHA-256:7C3182AAB23512C9D4952F81EAFFAD454AEB5D899B40FF89D7FE7B7136B59CA5
    SHA-512:44C516630748FA2B2EC976D7115772399315DAA8604941415C6B020295D1C568FFD739AEC7429630F5C526C3EBD5CCCB6DDB719A84A70BD67B4CA62BC7681B8B
    Malicious:false
    Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"03737f0552ddab495b9579ac29e4732c","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1711661036000},{"id":"Edit_InApp_Aug2020","info":{"dg":"41d33136a0b18ba71a85939b9550405c","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1711661036000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"4262a781d197677868acd417d24baf7d","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1711661036000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"e7b6f442dcd3c45427a88bb424d97c2c","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1711661036000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"798df309d5628f71338e3840d9117415","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1711661036000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"79198f28989b3bc0b32aadf4fdb9867d","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1711661036000},{

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
    Category:dropped
    Size (bytes):12288
    Entropy (8bit):0.9856810695853779
    Encrypted:false
    SSDEEP:48:TVl2GL7ms6ggOVpWBYiXzutYtp6PMBYiA:vVmsCOVpGYzaZYJ
    MD5:6A5AABE911A18FA57F29D7DE187F4425
    SHA1:8E49DD14483108BDA5E01D83C12A78CF4A70BC7F
    SHA-256:6745114848B727346347288D5DC3A647436EEC9D4DA6BA0331F725B318309A80
    SHA-512:2AC5305D0A4876B69EA03F4BC10FEE5C852AD2C2E7E1A753891AA9E73434125FE911ED3E3DFD1E1C6C41CCC887DFCB6025254705CD06CF8A100BA301C4A51F35
    Malicious:false
    Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:SQLite Rollback Journal
    Category:dropped
    Size (bytes):8720
    Entropy (8bit):1.3373706995359946
    Encrypted:false
    SSDEEP:48:7MtGgOVpWBYiQzutYtp6PMlpqll2GL7msi:7AOVpGY+aBqVmsi
    MD5:607A5E1E2CD5764F6F59D12B31D33468
    SHA1:5982565B6C1CF439C933A9EC5EC7C2419F3DF25C
    SHA-256:FBF83B60B4844E1B319530C383B44FB6F6D87C1B5BAC3B45AA4954D50A18A4DD
    SHA-512:4FDC2EAF534C4882548D239DE457B44CA5558AD48B8CB671AA514E4A4BBE83301935AD7219A14734C1CAB1E23E2E70A39583F4DC0758B745761FB64D575AD5B7
    Malicious:false
    Preview:.... .c.....c{@.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:data
    Category:dropped
    Size (bytes):66726
    Entropy (8bit):5.392739213842091
    Encrypted:false
    SSDEEP:768:RNOpblrU6TBH44ADKZEgsHABqY+lOSuM3QDSoWZS67bmVFYyu:6a6TZ44ADEsH2aOSuMgAziK
    MD5:6CFCF9E42F45436710A640C78E7C13D9
    SHA1:5FE2D3EFFF66719227D98E78F688DD77334F8354
    SHA-256:063E92B05D17831D4B35E29B9018227B82916EAA153B5973E694F74A9F67957C
    SHA-512:FEEF9FB638891BA61EEB57FFE15C567DE98E606560B11B9E5E3D70783479D4C78E3BCD68035500AC166DB5D94D606CBB81856C55194049FCC99145D8010EBC34
    Malicious:false
    Preview:4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

    C:\Users\user\AppData\Local\Temp\MSIc4b6c.LOG

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
    Category:dropped
    Size (bytes):246
    Entropy (8bit):3.5191669646935457
    Encrypted:false
    SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8rVw:Qw946cPbiOxDlbYnuRKCVw
    MD5:B30680B5C144D30D9F0EA009983236A5
    SHA1:60125BD18AA7A49045C1A417BFD268EAFC5747D9
    SHA-256:781BAAAD262A4AE4E8E28C03B1603341C29E85F6129789DEEAA071E7AA22C98C
    SHA-512:0DA79A5B1A01EF16FA8494EE0B40BE39A0A804C6E22139638CAFB10654FBE77CDF85C2CCC7FAAD62C05DFC7A3642CA975338804CDDFA053AE7BB57E96320BE67
    Malicious:false
    Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.8./.0.3./.2.0.2.4. . .2.2.:.2.3.:.5.8. .=.=.=.....

    C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-03-28 22-23-53-758.log

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:ASCII text, with very long lines (393)
    Category:dropped
    Size (bytes):16525
    Entropy (8bit):5.376360055978702
    Encrypted:false
    SSDEEP:384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
    MD5:1336667A75083BF81E2632FABAA88B67
    SHA1:46E40800B27D95DAED0DBB830E0D0BA85C031D40
    SHA-256:F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
    SHA-512:D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
    Malicious:false
    Preview:SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

    C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:ASCII text, with very long lines (393), with CRLF line terminators
    Category:dropped
    Size (bytes):16603
    Entropy (8bit):5.385484385043163
    Encrypted:false
    SSDEEP:384:RzfuXbHyDMMnpnR4WWdftyv3IrCRTl+1ZwknNXOKot0tZoZ5Ch8HkHar6IPn80wS:aev
    MD5:84B10B5A1AD583A623DAF4A90F7A5942
    SHA1:61A007A6635AA232FAD4801EE9013E30841729B5
    SHA-256:B508131A111D12D6DA36D74167A60287F939E2CD44CB4DF8C3192135E6D0EE06
    SHA-512:047266F0E1F1742EEEAFF98362FBB715FF71FD9A0BB0A9032E3FF0D2B30303EF552DCF68CB948F988C259A6BFC04969A4003DADC76716E9D9CECA927B0B2E937
    Malicious:false
    Preview:SessionID=65d15d3b-fd3a-41b2-b409-da4498f00a0c.1711661033769 Timestamp=2024-03-28T22:23:53:769+0100 ThreadID=7992 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=65d15d3b-fd3a-41b2-b409-da4498f00a0c.1711661033769 Timestamp=2024-03-28T22:23:53:770+0100 ThreadID=7992 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=65d15d3b-fd3a-41b2-b409-da4498f00a0c.1711661033769 Timestamp=2024-03-28T22:23:53:770+0100 ThreadID=7992 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=65d15d3b-fd3a-41b2-b409-da4498f00a0c.1711661033769 Timestamp=2024-03-28T22:23:53:770+0100 ThreadID=7992 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=65d15d3b-fd3a-41b2-b409-da4498f00a0c.1711661033769 Timestamp=2024-03-28T22:23:53:770+0100 ThreadID=7992 Component=ngl-lib_NglAppLib Description="SetConf

    C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):29845
    Entropy (8bit):5.394441365016077
    Encrypted:false
    SSDEEP:768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbk:g
    MD5:7503CB28A4A852A2AE59BA6E1CA5E494
    SHA1:6E1A76E77B3FBAC08CD7AA3C335E4A4FB51553C7
    SHA-256:B70DF5F6B583B1FDEC9C5AF254EDFB940EA7EC3EF55BF37DDF27115483E44A1A
    SHA-512:B9758C501ACF02A92D2E2A05F94B0A55818B47CF60E731DD7410944D37E15054423262F33D172FCDC0ECC6698492A50007F27BB9C6F04AE2EB2F3301931C8D8D
    Malicious:false
    Preview:04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

    C:\Users\user\AppData\Local\Temp\acrocef_low\2602cabf-04e7-45de-a3e9-46de3da8bb25.tmp

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
    Category:dropped
    Size (bytes):758601
    Entropy (8bit):7.98639316555857
    Encrypted:false
    SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
    MD5:3A49135134665364308390AC398006F1
    SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
    SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
    SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
    Malicious:false
    Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

    C:\Users\user\AppData\Local\Temp\acrocef_low\3cbaa7ac-6889-4821-b50d-2448e3d65828.tmp

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
    Category:dropped
    Size (bytes):1419751
    Entropy (8bit):7.976496077007677
    Encrypted:false
    SSDEEP:24576:/xA7owWLkwYIGNPZGZTodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGzGZ83mlind9i4ufFXpAXkru
    MD5:AB9AB7524370F33FCB9DC48C196C6192
    SHA1:C0EB3BBE2884C9D081F2D09310D71F381818DDFD
    SHA-256:BBE7F54A87E89788FA9E2DEB351A34B8DD5D2F4789EF86D13FE5B0C7450F8213
    SHA-512:6532803EF05D96E197EEFC9AC1DCCC6C37B568F679379289220F84300C429410BE03C4E6A225589C774522097F61FDEBE8F5336B4165CD7CF9472DBD484FA3A3
    Malicious:false
    Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

    C:\Users\user\AppData\Local\Temp\acrocef_low\b7b086a4-96bf-4323-800d-46c1cceca49d.tmp

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
    Category:dropped
    Size (bytes):386528
    Entropy (8bit):7.9736851559892425
    Encrypted:false
    SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
    MD5:5C48B0AD2FEF800949466AE872E1F1E2
    SHA1:337D617AE142815EDDACB48484628C1F16692A2F
    SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
    SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
    Malicious:false
    Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

    C:\Users\user\AppData\Local\Temp\acrocef_low\e7eb40e7-4557-47b6-af19-66f76afb60ab.tmp

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
    Category:dropped
    Size (bytes):1407294
    Entropy (8bit):7.97605879016224
    Encrypted:false
    SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLcGZtwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLcGZa
    MD5:22B260CB8C51C0D68C6550E4B061E25A
    SHA1:DF9A5999C58A8D5ADBB3F8D1111EAB9E4778637E
    SHA-256:DAB1231CC22DAB591EBB91C853E3EE41C10D3DA85D2EFAB67E9A52CCB3A3A5A0
    SHA-512:503218D83C511A7F7CEA8BC171921D1435664B964F01A8C77DC0F4D0196DD2815D9444DA98278E1369552D004E9B091DD9B89663209F0C52ACB97FCE6AFFE7A9
    Malicious:false
    Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

    Static File Info

    General

    File type:PDF document, version 1.5, 24 pages
    Entropy (8bit):7.843353941193948
    TrID:
    • Adobe Portable Document Format (5005/1) 100.00%
    File name:User Manual.pdf
    File size:774'023 bytes
    MD5:4e5167220439be2577e98d0d0e0f1b10
    SHA1:6ba9cee542a830ae2f1f8e246b6b0a4e1f5b9514
    SHA256:0dd816a9b2c428509e3bf91e66ed601e65d93b5d96180427ea121258225926eb
    SHA512:e9ea479b9de832b17dd79b219a0e525a1b1a293c600685bff0505669de05c7f5436a4fb86bea3e855e30d55a7dd856e5905225270e9732739ae7f6b4052174f3
    SSDEEP:12288:r20bGYJoXZN30F5ocYLfmEoxoFoLoKojKeiwSfhcCnflq3q30cFlTtOImsq09:JbGYJoJdI2roxoFoLoKojxiwSfhcCflV
    TLSH:F6F4CF174808ADC6D70D47D1BE0F3CAD3A493A90F1D62EE60268CF8676A1BB65D4B41F
    File Content Preview:%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en-US) /StructTreeRoot 87 0 R/MarkInfo<</Marked true>>>>..endobj..2 0 obj..<</Type/Pages/Count 24/Kids[ 3 0 R 7 0 R 12 0 R 26 0 R 29 0 R 32 0 R 35 0 R 38 0 R 40 0 R 43 0 R 46 0 R 49 0 R 52 0 R 55

    File Icon

    Icon Hash:62cc8caeb29e8ae0

    Static PDF Info

    General

    Header:%PDF-1.5
    Total Entropy:7.843354
    Total Bytes:774023
    Stream Entropy:7.849571
    Stream Bytes:736884
    Entropy outside Streams:4.644950
    Bytes outside Streams:37139
    Number of EOF found:2
    Bytes after EOF:

    Keywords Statistics

    NameCount
    obj98
    endobj98
    stream49
    endstream49
    xref2
    trailer2
    startxref2
    /Page24
    /Encrypt0
    /ObjStm2
    /URI2
    /JS0
    /JavaScript0
    /AA0
    /OpenAction0
    /AcroForm0
    /JBIG2Decode0
    /RichMedia0
    /Launch0
    /EmbeddedFile0

    Image Streams

    IDDHASHMD5Preview
    28e4ecb2b692159c9011d04974789d717e69f5605ec829c2d8
    31f4ecb2b292d09c9061aeba41f2fc60380764a5e5bb6db9e7
    34e4ecb6b696a09cd0408beefdcc9f0d7a75f14fb1f8d07835
    37e6c4313939063170df7d63dbf3043e080e8cb65ebe68d2b4
    426a52582626065959089a9f48a842a1f6b03b9409c9421233

    Network Behavior

    Network Port Distribution

    TCP Packets

    TimestampSource PortDest PortSource IPDest IP
    Mar 28, 2024 22:24:04.631020069 CET49715443192.168.2.523.223.252.145
    Mar 28, 2024 22:24:04.631042957 CET4434971523.223.252.145192.168.2.5
    Mar 28, 2024 22:24:04.631115913 CET49715443192.168.2.523.223.252.145
    Mar 28, 2024 22:24:04.631294966 CET49715443192.168.2.523.223.252.145
    Mar 28, 2024 22:24:04.631308079 CET4434971523.223.252.145192.168.2.5
    Mar 28, 2024 22:24:05.106607914 CET4434971523.223.252.145192.168.2.5
    Mar 28, 2024 22:24:05.107064009 CET49715443192.168.2.523.223.252.145
    Mar 28, 2024 22:24:05.107075930 CET4434971523.223.252.145192.168.2.5
    Mar 28, 2024 22:24:05.108174086 CET4434971523.223.252.145192.168.2.5
    Mar 28, 2024 22:24:05.108232021 CET49715443192.168.2.523.223.252.145
    Mar 28, 2024 22:24:05.110639095 CET49715443192.168.2.523.223.252.145
    Mar 28, 2024 22:24:05.110712051 CET4434971523.223.252.145192.168.2.5
    Mar 28, 2024 22:24:05.110980988 CET49715443192.168.2.523.223.252.145
    Mar 28, 2024 22:24:05.110990047 CET4434971523.223.252.145192.168.2.5
    Mar 28, 2024 22:24:05.155674934 CET49715443192.168.2.523.223.252.145
    Mar 28, 2024 22:24:05.267805099 CET4434971523.223.252.145192.168.2.5
    Mar 28, 2024 22:24:05.267931938 CET4434971523.223.252.145192.168.2.5
    Mar 28, 2024 22:24:05.268095016 CET49715443192.168.2.523.223.252.145
    Mar 28, 2024 22:24:05.268474102 CET49715443192.168.2.523.223.252.145
    Mar 28, 2024 22:24:05.268482924 CET4434971523.223.252.145192.168.2.5

    HTTP Request Dependency Graph

    • armmf.adobe.com

    HTTPS Proxied Packets

    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
    0192.168.2.54971523.223.252.1454437424C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    TimestampBytes transferredDirectionData
    2024-03-28 21:24:05 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
    Host: armmf.adobe.com
    Connection: keep-alive
    Accept-Language: en-US,en;q=0.9
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
    Sec-Fetch-Site: same-origin
    Sec-Fetch-Mode: no-cors
    Sec-Fetch-Dest: empty
    Accept-Encoding: gzip, deflate, br
    If-None-Match: "78-5faa31cce96da"
    If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
    2024-03-28 21:24:05 UTC198INHTTP/1.1 304 Not Modified
    Content-Type: text/plain; charset=UTF-8
    Last-Modified: Mon, 01 May 2023 15:02:33 GMT
    ETag: "78-5faa31cce96da"
    Date: Thu, 28 Mar 2024 21:24:05 GMT
    Connection: close


    Statistics

    CPU Usage

    Click to jump to process

    Memory Usage

    Click to jump to process

    High Level Behavior Distribution

    Click to dive into process behavior distribution

    Behavior

    Click to jump to process

    System Behavior

    General

    Target ID:0
    Start time:22:23:50
    Start date:28/03/2024
    Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    Wow64 process (32bit):false
    Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\User Manual.pdf"
    Imagebase:0x7ff686a00000
    File size:5'641'176 bytes
    MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:moderate
    Has exited:true

    General

    Target ID:2
    Start time:22:23:51
    Start date:28/03/2024
    Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    Wow64 process (32bit):false
    Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
    Imagebase:0x7ff6413e0000
    File size:3'581'912 bytes
    MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:moderate
    Has exited:true

    General

    Target ID:4
    Start time:22:23:51
    Start date:28/03/2024
    Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    Wow64 process (32bit):false
    Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1572,i,7330846989784507453,3868889862558952675,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
    Imagebase:0x7ff6413e0000
    File size:3'581'912 bytes
    MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:moderate
    Has exited:true

    Disassembly

    ⊘No disassembly