Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
U.S. Xpress (1).pdf

Overview

General Information

Sample name:U.S. Xpress (1).pdf
Analysis ID:1426964
MD5:df9fd48d0c89ef5a450f1cc3bc7febfe
SHA1:401b6af770346e5446eee26a1c87878f9f2c0afe
SHA256:5d584b0051274996f4e3e3529edb6cab40317770d44fd2c15129cf6585d990b7
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 412 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\U.S. Xpress (1).pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 4460 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 5052 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1556,i,8927202370515218720,11377247752305104417,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficTCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.5:49714
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.5:49714
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.5:49714
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.5:49714
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.5:49714
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.5:49714
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.5:49714
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.5:49714
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.5:49714
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.5:49714
Source: Joe Sandbox ViewIP Address: 184.25.164.138 184.25.164.138
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
Source: classification engineClassification label: clean2.winPDF@14/41@0/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journalJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-16 20-09-06-176.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\U.S. Xpress (1).pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1556,i,8927202370515218720,11377247752305104417,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1556,i,8927202370515218720,11377247752305104417,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: U.S. Xpress (1).pdfInitial sample: PDF keyword /JS count = 0
Source: U.S. Xpress (1).pdfInitial sample: PDF keyword /JavaScript count = 0
Source: U.S. Xpress (1).pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive12
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1426964 Sample: U.S. Xpress (1).pdf Startdate: 16/04/2024 Architecture: WINDOWS Score: 2 6 Acrobat.exe 18 62 2->6         started        process3 8 AcroCEF.exe 104 6->8         started        process4 10 AcroCEF.exe 2 8->10         started        dnsIp5 13 184.25.164.138, 443, 49714 BBIL-APBHARTIAirtelLtdIN United States 10->13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
184.25.164.138
unknownUnited States
9498BBIL-APBHARTIAirtelLtdINfalse

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1426964
Start date and time:2024-04-16 20:08:16 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 6s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultwindowspdfcookbook.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:9
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:U.S. Xpress (1).pdf
Detection:CLEAN
Classification:clean2.winPDF@14/41@0/1
EGA Information:Failed
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 0
  • Number of non-executed functions: 0
Cookbook Comments:
  • Found application associated with file extension: .pdf
  • Found PDF document
  • Close Viewer

Warnings

  • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 23.201.212.159, 52.5.13.197, 54.227.187.23, 52.202.204.11, 23.22.254.206, 172.64.41.3, 162.159.61.3, 23.209.188.151, 23.209.188.149
  • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com
  • VT rate limit hit for: U.S. Xpress (1).pdf

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
184.25.164.138Re_ Medina County Kitchen.emlGet hashmaliciousUnknownBrowse
    oiDDogdK9A.exeGet hashmaliciousLokibot, PureLog Stealer, zgRATBrowse
      New_Order.xlsGet hashmaliciousUnknownBrowse
        https://enfoldindia.org/wp-content/uploads/2019/06/Restorative-Circle-Handbook-for-CCI.pdfGet hashmaliciousUnknownBrowse
          TaxForm.lnkGet hashmaliciousDarkGate, MailPassViewBrowse
            https://ntnusa0-my.sharepoint.com/:f:/g/personal/ajaronik_ntnusa_com/EjzRads0Sf5Ivon47-zBKVABS1TZOI64W6Uv34YFqNQjmQ?e=NuZrjrGet hashmaliciousHTMLPhisher, ReCaptcha PhishBrowse
              SOA.xlsGet hashmaliciousUnknownBrowse
                Document.pdf.lnkGet hashmaliciousUnknownBrowse
                  https://alsic0-my.sharepoint.com/:f:/g/personal/jsilvia_cpstechnologysolutions_com/En-Hgk0yL4VImyHuKwgnw80BmpoigC0QGozVagwfZqj0Aw?e=0RSNMeGet hashmaliciousHTMLPhisher, ReCaptcha PhishBrowse
                    https://hon6yh6idrd.jp.larksuite.com/file/XL9ZbeTkuoHibNxn4UrjSfvZpyhGet hashmaliciousUnknownBrowse

                      Domains

                      ⊘No context

                      ASNs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      BBIL-APBHARTIAirtelLtdINUd310iQZnO.elfGet hashmaliciousMiraiBrowse
                      • 182.74.25.30
                      tWpGuzQQoW.elfGet hashmaliciousMiraiBrowse
                      • 122.185.203.209
                      kGbjOmkleq.elfGet hashmaliciousMiraiBrowse
                      • 125.23.195.204
                      iH18gdEj8Y.elfGet hashmaliciousMiraiBrowse
                      • 125.19.93.33
                      xmncOD7BwX.elfGet hashmaliciousMiraiBrowse
                      • 122.184.236.50
                      SFTNQEBmOA.elfGet hashmaliciousUnknownBrowse
                      • 182.79.2.232
                      Hays_compiled_documents.ZIP.jsGet hashmaliciousCobaltStrike, DucktailBrowse
                      • 23.45.148.189
                      Gq730kmpiE.elfGet hashmaliciousUnknownBrowse
                      • 122.181.178.15
                      SecuriteInfo.com.Linux.Siggen.9999.31292.16574.elfGet hashmaliciousMiraiBrowse
                      • 125.23.200.173
                      l1sADDB043.elfGet hashmaliciousMiraiBrowse
                      • 125.23.42.169

                      JA3 Fingerprints

                      ⊘No context

                      Dropped Files

                      ⊘No context

                      Created / dropped Files

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.18924097884171
                      Encrypted:false
                      SSDEEP:6:3T9+q2P92nKuAl9OmbnIFUt8gBrNJZmw+gBrN9VkwO92nKuAl9OmbjLJ:D4v4HAahFUt82NJ/+2ND5LHAaSJ
                      MD5:B118117A823B234BFA45A7FECAF6692F
                      SHA1:5A50C8559FD971B6EEA4A20D8687674D4B78075D
                      SHA-256:1079E8471BD9310021EA79D90BD7CF49E44D26DACB43211A8B4850DAFDDD04C3
                      SHA-512:F92DAA39AFBE155EC6379A7DA161ACEC73AD097A996988AAA02C844469704E95F40547960235E94929E2602EE50BEA4AFE71D98554D9148C694AD3D5C5B2B2C2
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/16-20:09:03.939 18f8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/16-20:09:03.940 18f8 Recovering log #3.2024/04/16-20:09:03.940 18f8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.18924097884171
                      Encrypted:false
                      SSDEEP:6:3T9+q2P92nKuAl9OmbnIFUt8gBrNJZmw+gBrN9VkwO92nKuAl9OmbjLJ:D4v4HAahFUt82NJ/+2ND5LHAaSJ
                      MD5:B118117A823B234BFA45A7FECAF6692F
                      SHA1:5A50C8559FD971B6EEA4A20D8687674D4B78075D
                      SHA-256:1079E8471BD9310021EA79D90BD7CF49E44D26DACB43211A8B4850DAFDDD04C3
                      SHA-512:F92DAA39AFBE155EC6379A7DA161ACEC73AD097A996988AAA02C844469704E95F40547960235E94929E2602EE50BEA4AFE71D98554D9148C694AD3D5C5B2B2C2
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/16-20:09:03.939 18f8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/16-20:09:03.940 18f8 Recovering log #3.2024/04/16-20:09:03.940 18f8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):338
                      Entropy (8bit):5.171353870839631
                      Encrypted:false
                      SSDEEP:6:khc+q2P92nKuAl9Ombzo2jMGIFUt89h6Zmw+9j/tVkwO92nKuAl9Ombzo2jMmLJ:kXv4HAa8uFUt89c/+9j/T5LHAa8RJ
                      MD5:DB32017B4463C67BBB279368C94E8F71
                      SHA1:F05E172B6371DA746BBDCBDA63C19BB8DA5533F6
                      SHA-256:1B5A6A4BC7D9CB51E11E388DC8DB7A809A56877E77A7E6BEF77E114BD1913F6B
                      SHA-512:921C20A699317E598C860EFCCFA2E1F58859A5ED52F9843807DDC7B9D0A550752F0C56F80448BEF5A9D96A6345202C68AC8585CA9354E88D97541FC623DE04EA
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/16-20:09:04.054 1568 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/16-20:09:04.056 1568 Recovering log #3.2024/04/16-20:09:04.204 1568 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):338
                      Entropy (8bit):5.171353870839631
                      Encrypted:false
                      SSDEEP:6:khc+q2P92nKuAl9Ombzo2jMGIFUt89h6Zmw+9j/tVkwO92nKuAl9Ombzo2jMmLJ:kXv4HAa8uFUt89c/+9j/T5LHAa8RJ
                      MD5:DB32017B4463C67BBB279368C94E8F71
                      SHA1:F05E172B6371DA746BBDCBDA63C19BB8DA5533F6
                      SHA-256:1B5A6A4BC7D9CB51E11E388DC8DB7A809A56877E77A7E6BEF77E114BD1913F6B
                      SHA-512:921C20A699317E598C860EFCCFA2E1F58859A5ED52F9843807DDC7B9D0A550752F0C56F80448BEF5A9D96A6345202C68AC8585CA9354E88D97541FC623DE04EA
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/16-20:09:04.054 1568 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/16-20:09:04.056 1568 Recovering log #3.2024/04/16-20:09:04.204 1568 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):508
                      Entropy (8bit):5.057418416365483
                      Encrypted:false
                      SSDEEP:12:YH/um3RA8sqZ8xsBdOg2Hqcaq3QYiubxnP7E4T3OF+:Y2sRdsnidMHF3QYhbxP7nbI+
                      MD5:255B08032310A6CC741189EE0100C770
                      SHA1:05392BEDA1253B835FA95FDCEB1744DBDFB218CD
                      SHA-256:3C579B60A2A38FAE34E31A8B20451D5769AB615D41930E363FAE300CD6BE0995
                      SHA-512:4631FDDEFDD874DEBDF35298C8C2020D8F98191C09D31F5C83B70B1B3CE9A5F8D5667A0A5BC20F46DE393F4FE3694F01E039555BA46CC47E17670F8D3776DA75
                      Malicious:false
                      Reputation:low
                      Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13357850955872880","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":105486},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ca64dd55-b7f2-4754-9cf0-a103886c1ad0.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:modified
                      Size (bytes):508
                      Entropy (8bit):5.057418416365483
                      Encrypted:false
                      SSDEEP:12:YH/um3RA8sqZ8xsBdOg2Hqcaq3QYiubxnP7E4T3OF+:Y2sRdsnidMHF3QYhbxP7nbI+
                      MD5:255B08032310A6CC741189EE0100C770
                      SHA1:05392BEDA1253B835FA95FDCEB1744DBDFB218CD
                      SHA-256:3C579B60A2A38FAE34E31A8B20451D5769AB615D41930E363FAE300CD6BE0995
                      SHA-512:4631FDDEFDD874DEBDF35298C8C2020D8F98191C09D31F5C83B70B1B3CE9A5F8D5667A0A5BC20F46DE393F4FE3694F01E039555BA46CC47E17670F8D3776DA75
                      Malicious:false
                      Reputation:low
                      Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13357850955872880","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":105486},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):4509
                      Entropy (8bit):5.234195722497718
                      Encrypted:false
                      SSDEEP:96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUN/S1G1FQqcT/So:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLL
                      MD5:1E0EE1811FB1D74810508413592A4FAB
                      SHA1:E2A35A7FACB36C3155350015488361A156FFF535
                      SHA-256:B8F5FE181AA68C527FA8C8098F3CC1575D6D39A87D2AB4C6AB97E6BBA025E16D
                      SHA-512:17F9DEE7C7D3A97E53F26D89F150B3ACDD43D1B10A0FDB3ECE2ECD75BB4ADED07FB83CB1B8612F92CEAF686695207E8EC1FBEFCDCDC6AB50A5102C250B2B104D
                      Malicious:false
                      Reputation:low
                      Preview:*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):326
                      Entropy (8bit):5.195768498657488
                      Encrypted:false
                      SSDEEP:6:kln+q2P92nKuAl9OmbzNMxIFUt89l0FtZZmw+9l/tVkwO92nKuAl9OmbzNMFLJ:kUv4HAa8jFUt89+Z/+9ZT5LHAa84J
                      MD5:16D3C94D8EAEE0518B1595AB2A3B9880
                      SHA1:0F4AC11C696C5650DE0EE31F080EC6C6B85025C2
                      SHA-256:FC3C1BDCAF92E6C6CB6F659E815DF5B4405ADDFD8A0FEC9C5A78FA6074C36969
                      SHA-512:1256DFE45ADA108CEEEC02E734C3B5457BA7988E657C3CCA2F3920832F16AEBA75A3A480323A5851BBACCB5614778142B23505B10AEA7BFEBBA5105A7E0469AB
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/16-20:09:04.446 1568 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/16-20:09:04.447 1568 Recovering log #3.2024/04/16-20:09:04.448 1568 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):326
                      Entropy (8bit):5.195768498657488
                      Encrypted:false
                      SSDEEP:6:kln+q2P92nKuAl9OmbzNMxIFUt89l0FtZZmw+9l/tVkwO92nKuAl9OmbzNMFLJ:kUv4HAa8jFUt89+Z/+9ZT5LHAa84J
                      MD5:16D3C94D8EAEE0518B1595AB2A3B9880
                      SHA1:0F4AC11C696C5650DE0EE31F080EC6C6B85025C2
                      SHA-256:FC3C1BDCAF92E6C6CB6F659E815DF5B4405ADDFD8A0FEC9C5A78FA6074C36969
                      SHA-512:1256DFE45ADA108CEEEC02E734C3B5457BA7988E657C3CCA2F3920832F16AEBA75A3A480323A5851BBACCB5614778142B23505B10AEA7BFEBBA5105A7E0469AB
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/16-20:09:04.446 1568 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/16-20:09:04.447 1568 Recovering log #3.2024/04/16-20:09:04.448 1568 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240416180908Z-158.bmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PC bitmap, Windows 3.x format, 164 x -136 x 32, cbSize 89270, bits offset 54
                      Category:dropped
                      Size (bytes):89270
                      Entropy (8bit):1.1085013476659502
                      Encrypted:false
                      SSDEEP:192:bodsyJlds6lCLQ3y9dsJ4YJyRI2FdYYKQlOOo/2khSb17M2HBw:sdBds6cj9YJyRLEtd+khSb17LO
                      MD5:20C7AA4C94B7B8EB6EB241E309EFFA95
                      SHA1:373CA9367AC0FCE1F178AB95AC96D5E314817CCF
                      SHA-256:65A30288786E5B35559065D3FCD14A7E24E72267AF316901D0D3D622624287ED
                      SHA-512:B1F29333DD7BCD61FFDA931CBAD823BAC4C09F9DC4ACB7DC14B1F38A9F8BE8FC7CEDB397062BA0537756C66B902CC1651BD1B585F022EB45075A89E2E41BA485
                      Malicious:false
                      Reputation:low
                      Preview:BM.\......6...(.......x..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3276

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PostScript document text
                      Category:dropped
                      Size (bytes):185099
                      Entropy (8bit):5.182478651346149
                      Encrypted:false
                      SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                      MD5:94185C5850C26B3C6FC24ABC385CDA58
                      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                      Malicious:false
                      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PostScript document text
                      Category:dropped
                      Size (bytes):185099
                      Entropy (8bit):5.182478651346149
                      Encrypted:false
                      SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                      MD5:94185C5850C26B3C6FC24ABC385CDA58
                      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                      Malicious:false
                      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):228346
                      Entropy (8bit):3.3890581331110528
                      Encrypted:false
                      SSDEEP:1536:WKPC4iyzDtrh1cK3XEivK7VK/3AYvYwgf/rRoL+sn:DPCaJ/3AYvYwgXFoL+sn
                      MD5:BAE090D23B1C0D4F6DC247F0080D349E
                      SHA1:8A7AAD52A54F9A3CCEF3CE323F6BBD5B2B530461
                      SHA-256:D7D3096317CF32DBEDF75D85390FE89A96170D44C09B2F6D164036064F506AE3
                      SHA-512:208136EBA10544EA5EADA1C32EADFD8066047A9D851FF95BADF9938D40AFA1771003C2725DB8C78991E700C73FA2FC3C9F3CC3712B3332E4CF6F8DDE0E539130
                      Malicious:false
                      Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):295
                      Entropy (8bit):5.322139932626735
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXpt4dMOx+FIbRI6XVW7+0YaKoAvJM3g98kUwPeUkwRe9:YvXKXpt4dMOUYpW7z5GMbLUkee9
                      MD5:0C4D94E53DFDB6B13BDC2DCD4163D1AC
                      SHA1:DE276F260886BBCB092CF9DF743BDDE3C53B1F35
                      SHA-256:D2FCB4B0CBF75C4AEB43B271231875B240EEAC4544678EA6E33E091A22C11303
                      SHA-512:328730AD6E88F73C4441FA94BFEF279DE4F6E2D6818498B6E9BA34EC0C8FA297C436A27E9E79CD97C71FF75135124291063B637C7CAC93CCB1A4B594B6D08D55
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"eb512315-579e-47a1-9954-3b0c502941f6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713470934232,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.26152229669356
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXpt4dMOx+FIbRI6XVW7+0YaKoAvJfBoTfXpnrPeUkwRe9:YvXKXpt4dMOUYpW7z5GWTfXcUkee9
                      MD5:94FABE161365FFA5943107AC3061184E
                      SHA1:961F50387E8DA646E3AA0DD614474DF929B25EA4
                      SHA-256:9EB1F6CCBAE26205990554C711110FC9F32202C203721051D045DA50C8E46B56
                      SHA-512:B1927003E2FA64C69114CA41682185992D1CAB3632E1C0A515E240CE45486B5F059A3F635173AB4D4AFE3CABDA912BED6D1420C181CF8B9A7D0BFA11E188F97E
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"eb512315-579e-47a1-9954-3b0c502941f6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713470934232,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.240517332088635
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXpt4dMOx+FIbRI6XVW7+0YaKoAvJfBD2G6UpnrPeUkwRe9:YvXKXpt4dMOUYpW7z5GR22cUkee9
                      MD5:79928AF755B0047F398F1208BF016AAA
                      SHA1:FDFD90A28B184B108180B8A49ECBC74418AA7162
                      SHA-256:78630CCD71EA852029E14E75C6EC2BC50F23ABAC556E24BAE2C7CA33159B75F5
                      SHA-512:3AFDAE4ADA8D3BE29956798B4698030CEEE735DC3A4167B13A86DCE4041D7A0AF667A42758C5D1A385AA798ECE062A0FEEACF8B8A7D56D7711065203984D3377
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"eb512315-579e-47a1-9954-3b0c502941f6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713470934232,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):285
                      Entropy (8bit):5.299586373309075
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXpt4dMOx+FIbRI6XVW7+0YaKoAvJfPmwrPeUkwRe9:YvXKXpt4dMOUYpW7z5GH56Ukee9
                      MD5:C1893B7A8C7AD67424B6943A7F9D95CA
                      SHA1:F11A75A2D28D9A279F7569F4BAE722117B4C2D39
                      SHA-256:D8FA5262850EB6D4DD6A1E08A28557839AE965AF39E648B15B1C118E015BC8F0
                      SHA-512:3CE857318D172055217A988AB030778F50FE0E92C4F9F04E66DF790F3F8A1D1856695581DACCE8303CF807310D1DD520F193C30AF99B66AC32742EBFC60D55FE
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"eb512315-579e-47a1-9954-3b0c502941f6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713470934232,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.26205440434442
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXpt4dMOx+FIbRI6XVW7+0YaKoAvJfJWCtMdPeUkwRe9:YvXKXpt4dMOUYpW7z5GBS8Ukee9
                      MD5:77C7B99CD7E0FDAE496C29F2CFE76101
                      SHA1:89AC5802A75748AA4754607AAA553BDC1CBC0451
                      SHA-256:CEA624E9F72BB9EDFA95924ABE720974A1D5FEF28BE2C100E143A0E384255D30
                      SHA-512:ADBF66467B9D4F4048E349D3450064EB3955C392D2874EFE2BE22DB04331BE3C694C898798F1A019E458FDA36E9418DFAA248BA54B46B2E814CC0B4BABCF9148
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"eb512315-579e-47a1-9954-3b0c502941f6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713470934232,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.248266838596764
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXpt4dMOx+FIbRI6XVW7+0YaKoAvJf8dPeUkwRe9:YvXKXpt4dMOUYpW7z5GU8Ukee9
                      MD5:30BC535A3D0DB5ECEBB305AA879E7F81
                      SHA1:7B8F41EB2CC132440C8ECBD42055B91EE882B6C2
                      SHA-256:F69A6D254C6014837B3F6D3B5ADD1CAE5B26147598CC9F7EB333A728368A7E0E
                      SHA-512:606348961578960F72FE20EF0924DCCC69FF694D45807205F461C9866C2A2BD41E28F91085B5F06F43370330F64BEADB46E74ED6E6B056249C1E7FB1DEDE4352
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"eb512315-579e-47a1-9954-3b0c502941f6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713470934232,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.249462745716144
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXpt4dMOx+FIbRI6XVW7+0YaKoAvJfQ1rPeUkwRe9:YvXKXpt4dMOUYpW7z5GY16Ukee9
                      MD5:1DB5C4BC793BB257A8B5A194CDA9DF27
                      SHA1:B5F46250338BCF1E865F5BA27427D30B592EE67E
                      SHA-256:397F114B0E5EDEC8D8F476E4328C3CDD3E6E673A9553BA91A6E59EF610AF14CE
                      SHA-512:5A9CC1F5690AB1D9296DAECD2910A883BBA9ADC863210835A13A987B1578E14BC1D800F7D81ED6E2578B30085B1E5C6BF9076CCFA3B95640CC65DBBC9EDFFDF8
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"eb512315-579e-47a1-9954-3b0c502941f6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713470934232,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.270550372219963
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXpt4dMOx+FIbRI6XVW7+0YaKoAvJfFldPeUkwRe9:YvXKXpt4dMOUYpW7z5Gz8Ukee9
                      MD5:34849F67B2E43F3160EDBBFE8B3758D6
                      SHA1:2CAF03001037F872C082B88A7606C4BEB6BA1F85
                      SHA-256:340FE6F80FB04ADE76CCB8F7AE9E644B6F86DEDFFE01F2CAB608E2C7B654CE6D
                      SHA-512:CB8FB3A5FB76FE09A70BB5C3A80787BAF7725D6460D7238847AFC44AFE1563BD13DE6D09C65CE88490DA3E0698A06FF70ACA6FE5B3FCE87AC07F1186536885CB
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"eb512315-579e-47a1-9954-3b0c502941f6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713470934232,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1372
                      Entropy (8bit):5.7350570349494046
                      Encrypted:false
                      SSDEEP:24:Yv6XptKMOFi5KLgENRcbrZbq00iCCBrwJo++ns8ct4mFJNY:Yv495EgigrNt0wSJn+ns8cvFJy
                      MD5:1F8D02FADBCA357697DA3F4FE8E298AF
                      SHA1:9C906607C2B5CFA730A576539A4704B6DEAEA897
                      SHA-256:119E9141DC1E8E1D3CD2F9ABEC6F0107E0C6D1ECBD90F27E259F559D158D8A5B
                      SHA-512:9158F60B53113D008AE5FE5A1C521D990993047BC4E93BAF0A8C17A1346966CFF8C00F88E2390E564BAB075AF29D56B91C53E7BB32FFF350F3DF2A63D56D3559
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"eb512315-579e-47a1-9954-3b0c502941f6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713470934232,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"79887_247329ActionBlock_0","campaignId":79887,"containerId":"1","controlGroupId":"","treatmentId":"acc56846-d570-4500-a26e-7f8cf2b4acad","variationId":"247329"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJUcnkgQWNyb2JhdCBQcm8ifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNSIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTMiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIDctZGF5IHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0byBwcmVtaXVtIFBERiBhbmQgZS1zaWduaW5nIHRvb2xzLiIsImJ

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.255738974108336
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXpt4dMOx+FIbRI6XVW7+0YaKoAvJfYdPeUkwRe9:YvXKXpt4dMOUYpW7z5Gg8Ukee9
                      MD5:90B0C36F9E3AD8342879D917D2BAF88E
                      SHA1:34E3211BE62F21A8A9389D4356A82E85F000F900
                      SHA-256:311FD9892616B169BCC9ADEF654236F5B31E09EF4B9AE5095ABE88F740065C72
                      SHA-512:41EC24B27D735F27A165A29CCFB65CA5BE641884D1DFAA84838CDFFB4B535CAD617128E4F08180AE6B28B4579ACFC03A3783543B196F786ED6572DD42DFE5AF8
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"eb512315-579e-47a1-9954-3b0c502941f6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713470934232,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1395
                      Entropy (8bit):5.76752763662409
                      Encrypted:false
                      SSDEEP:24:Yv6XptKMOFiUrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNw:Yv49UHgDv3W2aYQfgB5OUupHrQ9FJ+
                      MD5:2A5F3EA5EC7F9F408011B7C2FAFC0FE7
                      SHA1:322E48520D0E673ABBDDB262376C9666909F79DE
                      SHA-256:50E73BEA28B122E07062038F28806C6D52FE7913F2A669CECB00B5D4384ED1BE
                      SHA-512:4C4DBF75FB1CD01DD5FD4AC234C74E1ADC3569821D688D4C73BC41A07118A832875F8DE2C1E7105CCC954C494891C909FB8B7F887612ADB7A0D098F9C3C4ED47
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"eb512315-579e-47a1-9954-3b0c502941f6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713470934232,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):291
                      Entropy (8bit):5.239590271272864
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXpt4dMOx+FIbRI6XVW7+0YaKoAvJfbPtdPeUkwRe9:YvXKXpt4dMOUYpW7z5GDV8Ukee9
                      MD5:C1039990FFCB092DAC221DF63B2365BA
                      SHA1:42DA879CE43844CBBB51946E45B0757847100BC7
                      SHA-256:F9F67773BC5D7D35E05BAD208739A4C5099B79FBAC6AA244D7EF71FA9FAF927F
                      SHA-512:D27E22B2BD96E2DDE532F9F02F187808902C6871A1D05B3455B62238F89DF2DAAB5600E733AF9860F6FFBA563E0828694477E8E17D7F2389D6091D018AC4F737
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"eb512315-579e-47a1-9954-3b0c502941f6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713470934232,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):287
                      Entropy (8bit):5.240336471249644
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXpt4dMOx+FIbRI6XVW7+0YaKoAvJf21rPeUkwRe9:YvXKXpt4dMOUYpW7z5G+16Ukee9
                      MD5:59D6639C0A454D8151866D0B3DCC169D
                      SHA1:07E7879D374BB83A02852B7D4FC5609075E84CFF
                      SHA-256:E4719E698C204651E9A9E0389538A5358E746050684767AAB2446FA49B2F36FA
                      SHA-512:0005E5A87084B63D3A2FDA73D758D88C4659B4476C93CD71952247A41AE3A5E0DCB4C1559015E8030D307EAEFE1A67403B2AA10E92BEACAF4F142FAB18252DBF
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"eb512315-579e-47a1-9954-3b0c502941f6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713470934232,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.262574102866483
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXpt4dMOx+FIbRI6XVW7+0YaKoAvJfbpatdPeUkwRe9:YvXKXpt4dMOUYpW7z5GVat8Ukee9
                      MD5:A57C056D58FE51629387EA56EA468FEE
                      SHA1:4771067413503003C1F969FD726B96BCCE770250
                      SHA-256:DC46912E7AF95DFC7C729ABCE0C2A60E781FEAFEB932C9F16946393E8F32213F
                      SHA-512:6811099E95FA231E93520DDE345721C5E812F7F113258892E0D29765CA52444D0A0DBF7EBF822C649F631A598B5A7265737E35364C3A710B6653B7B5D5F5E2E3
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"eb512315-579e-47a1-9954-3b0c502941f6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713470934232,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):286
                      Entropy (8bit):5.217400520492139
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXpt4dMOx+FIbRI6XVW7+0YaKoAvJfshHHrPeUkwRe9:YvXKXpt4dMOUYpW7z5GUUUkee9
                      MD5:059A2B79CA41709C36C90B1252992A5B
                      SHA1:1BF75DD524EE821D5B4F14ACB08E55669BC37DDE
                      SHA-256:508A5202DCF652C96E13DBDEDA70E0AF71839B2B49CAB738CEC01DF8B30B169F
                      SHA-512:32D4594D510C9A5C215C37142B4BE6250EA8906E4E5589E699B6DEC3D01E3D0476CD26F5E811E64C8D76667180367C6581A3ACB8575F480ED54BF416ACA22E1A
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"eb512315-579e-47a1-9954-3b0c502941f6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713470934232,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):782
                      Entropy (8bit):5.35871482314241
                      Encrypted:false
                      SSDEEP:12:YvXKXpt4dMOUYpW7z5GTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWzA:Yv6XptKMOFiJ168CgEXX5kcIfANhZ
                      MD5:1E6B50052EC3C73110CDCD57C4A47884
                      SHA1:B340D1FC58C87EE8FADD77C9A3A12D33E98158F7
                      SHA-256:F2E995D7D4F58916CCB1FA32BEED9B69DA95F308E5FF2DCE2377BAA3BB9DFB9A
                      SHA-512:0911454AD1387AAF1BE6216E5ADFF11B0249FB66FF594CB7572DB63094B9A82590350FA54741A19754B0EFD0C4A7CC0B8AB6253D09858267A39380A6B16D656A
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"eb512315-579e-47a1-9954-3b0c502941f6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713470934232,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1713290949273}}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):4
                      Entropy (8bit):0.8112781244591328
                      Encrypted:false
                      SSDEEP:3:e:e
                      MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                      SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                      SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                      SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                      Malicious:false
                      Preview:....

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):2814
                      Entropy (8bit):5.131128340238874
                      Encrypted:false
                      SSDEEP:24:Y4TxWTJvMC+fQUi3sq6qy+UTnaUcayTxqvn/TVs6cjyBVj0S0Shj8SP/2BhBP2Lc:YoZY36qbyP/aPTV8il6h9I
                      MD5:BD0717CD212A27EDD61E0EB9969A3A4A
                      SHA1:10130EE482D312B9BD7D7F0A7C17FFFEC198350F
                      SHA-256:91D2E98E58FC10AECDF5142C2C85422D41043F706132C0519FCC5EE9C6E68F19
                      SHA-512:593DAB9FC13D6A9EAF911EE115C1249BF85DE5F2163A314E4BE76020EEF5067714E195C350713C3219CA8BDABAA2E8F285AD09F0CA90691EF608BF9FE7A18AB8
                      Malicious:false
                      Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"da1a9a519fd7dfb4e40ab7cf13717aba","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1713290948000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"eedd52142249100f4d6164b97c495938","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1372,"ts":1713290948000},{"id":"Edit_InApp_Aug2020","info":{"dg":"5498003fab51bc1bc86185ab92bfc891","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1713290948000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"e5044b162dace4e1cd4aad7ea89940bf","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1713290948000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"79713a636fe49c07203fe0322d07e07f","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1713290948000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"03fcd58ce95c199dc55fbc7db0abecc1","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1713290948000},

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
                      Category:dropped
                      Size (bytes):12288
                      Entropy (8bit):0.9863635020520919
                      Encrypted:false
                      SSDEEP:24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpSM4zJwtNBwtNbRZ6bRZ4/MF:TVl2GL7ms6ggOVpCzutYtp6PV
                      MD5:6A6970714F06D2CAD1E8067A7A7A6720
                      SHA1:26C3BCBAF1A28735353D93B00CEA3DC107B7797A
                      SHA-256:8CE04E27FF2C01A7B010CEBA85C88EF576E8A772679879D4D774CCA4A0F5DC5A
                      SHA-512:6CE9FD192602DC03CA75E2AE280A60BE213B0F4667ADACF8A4A3C2E8429520DF0410836BAAF9A5D7ACC15B0F719F504323D01C4B4DDBFEE3CA1F91704A23BB27
                      Malicious:false
                      Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite Rollback Journal
                      Category:dropped
                      Size (bytes):8720
                      Entropy (8bit):1.3381216287596978
                      Encrypted:false
                      SSDEEP:24:7+t7AD1RZKHs/Ds/SpSMPzJwtNBwtNbRZ6bRZWf1RZKBJvqLBx/XYKQvGJF7urso:7M7GgOVpZzutYtp6PMOJvqll2GL7ms6T
                      MD5:8BD364809EB8551EB45A1727A44FAB88
                      SHA1:BAEDBB0D03DE4E24FCEEF188291BBEE17B0913B7
                      SHA-256:A49B4BC2A4055251FFC734B6542FFB2A012B4DEA036E1A48FB1463054A816934
                      SHA-512:51A56DCD847802C09588BAE726709BB8A3AEF75B6F53E3B9AE35280E93319543584D00D465CD6878D47515B2C9A8AACC77DB46BBA31FDC43DAFBA5A6B7CFA460
                      Malicious:false
                      Preview:.... .c.......9t......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Temp\MSIe8acd.LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):246
                      Entropy (8bit):3.511206980872271
                      Encrypted:false
                      SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8eeWalHH:Qw946cPbiOxDlbYnuRKhs
                      MD5:49D417CCA784D834D276A73546B246CF
                      SHA1:2610A9F2D140528619DD80D3FACE459B841DC864
                      SHA-256:101A0AF2C10992C740D0DBBA1AD319A3E13E0EDD18E61B93FE9C6700D88A0BE4
                      SHA-512:B2BF18F476C77741E27E4882E4D44FEA8AE9CF6743567D3FCB78DDAB799B3BE68531162747538D856EEFDB824701B8E2E44B8E5983CC8D7356B1D908E3D8FFC6
                      Malicious:false
                      Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.6./.0.4./.2.0.2.4. . .2.0.:.0.9.:.1.1. .=.=.=.....

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-16 20-09-06-176.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393)
                      Category:dropped
                      Size (bytes):16525
                      Entropy (8bit):5.376360055978702
                      Encrypted:false
                      SSDEEP:384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
                      MD5:1336667A75083BF81E2632FABAA88B67
                      SHA1:46E40800B27D95DAED0DBB830E0D0BA85C031D40
                      SHA-256:F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
                      SHA-512:D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
                      Malicious:false
                      Preview:SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393), with CRLF line terminators
                      Category:dropped
                      Size (bytes):16603
                      Entropy (8bit):5.379731144792467
                      Encrypted:false
                      SSDEEP:384:M8yp6Mj8LictMUNuwmLi8YCONUlMnH5o/9RrjzSbakX5n+k6bemCoVYtT1RdIQwl:z8F
                      MD5:AB0216DDABD4C8E9221CCF0D1AD3241A
                      SHA1:5D0C0F26AE13FF2916CAC10EA8FD1FAFD9E8C65E
                      SHA-256:3A2ADE90347743CFF413DA4F10D45203F6D03ADAEA05FD710054408410122E5D
                      SHA-512:00636D42E8F22A39A13DB80508DE6C6CDEE1A04C41EF0C6FA45A1F65FB39873E1F6E2AC72D08CCEC3535FE7474BDD26F8ECB220CA8FDB04A78BB7070613F863F
                      Malicious:false
                      Preview:SessionID=da5df348-29fa-48eb-b1a5-b4564a7d6874.1713290946233 Timestamp=2024-04-16T20:09:06:233+0200 ThreadID=6220 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=da5df348-29fa-48eb-b1a5-b4564a7d6874.1713290946233 Timestamp=2024-04-16T20:09:06:234+0200 ThreadID=6220 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=da5df348-29fa-48eb-b1a5-b4564a7d6874.1713290946233 Timestamp=2024-04-16T20:09:06:234+0200 ThreadID=6220 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=da5df348-29fa-48eb-b1a5-b4564a7d6874.1713290946233 Timestamp=2024-04-16T20:09:06:234+0200 ThreadID=6220 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=da5df348-29fa-48eb-b1a5-b4564a7d6874.1713290946233 Timestamp=2024-04-16T20:09:06:234+0200 ThreadID=6220 Component=ngl-lib_NglAppLib Description="SetConf

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):29845
                      Entropy (8bit):5.403552531121972
                      Encrypted:false
                      SSDEEP:768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbv:T
                      MD5:CB22ABC60C46C5958EB5BA0088C6D66E
                      SHA1:0367D7AC9BE648FC14F3FF6237B1D6FD341B1E45
                      SHA-256:7170DEAFA995656B39EE9EB5EECF5F01EDD08F617CA7D70E9405E0763FE73C59
                      SHA-512:35B7E7307C8FBF8B20866F7D6C02E4AD6208A4C788ACEB828CD009B48A9C2CC4B06215FEF0741F2EE6AF7BC4EA75F1BC13B8B279F4A4C37C7E4D34A02BA8BA59
                      Malicious:false
                      Preview:04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

                      C:\Users\user\AppData\Local\Temp\acrocef_low\0cd51b71-80a9-4e4f-9e20-e8623ba18bad.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                      Category:dropped
                      Size (bytes):758601
                      Entropy (8bit):7.98639316555857
                      Encrypted:false
                      SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                      MD5:3A49135134665364308390AC398006F1
                      SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                      SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                      SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                      Malicious:false
                      Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                      C:\Users\user\AppData\Local\Temp\acrocef_low\190a63f6-a54c-47ba-a0bb-0eefdbab3d6b.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                      Category:dropped
                      Size (bytes):386528
                      Entropy (8bit):7.9736851559892425
                      Encrypted:false
                      SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                      MD5:5C48B0AD2FEF800949466AE872E1F1E2
                      SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                      SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                      SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                      Malicious:false
                      Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                      C:\Users\user\AppData\Local\Temp\acrocef_low\5b8c4a8c-7b0f-4daa-8cb4-9b310240402f.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                      Category:dropped
                      Size (bytes):1419751
                      Entropy (8bit):7.976496077007677
                      Encrypted:false
                      SSDEEP:24576:/M7oMOWLaGZ4ZwYIGNP8dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:RVWLaGZ4ZwZGm3mlind9i4ufFXpAXkru
                      MD5:E787F9888A1628BE8234F19E8EE26D68
                      SHA1:44D5180C06ADBBDAADDBCE350CE4DEC997CD83E5
                      SHA-256:3A09F3799148DA49F039A35AEDD22F368FB35B8D6022C4691C10606F704DAF80
                      SHA-512:EE9B602898706CC0F33AA570E29A79A58ED748E1B738D74DF0C8C8DF193E23421B47AC8C862623ED774289D94FA90662A4CC436B80479D6420433D81752E9CA9
                      Malicious:false
                      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                      C:\Users\user\AppData\Local\Temp\acrocef_low\cd2a7dca-8c5b-4eea-b425-494111bdb459.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                      Category:dropped
                      Size (bytes):1407294
                      Entropy (8bit):7.97605879016224
                      Encrypted:false
                      SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
                      MD5:8B9FA2EC5118087D19CFDB20DA7C4C26
                      SHA1:E32D6A1829B18717EF1455B73E88D36E0410EF93
                      SHA-256:4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
                      SHA-512:662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
                      Malicious:false
                      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                      Static File Info

                      General

                      File type:PDF document, version 1.6 (zip deflate encoded)
                      Entropy (8bit):7.056973331729609
                      TrID:
                      • Adobe Portable Document Format (5005/1) 100.00%
                      File name:U.S. Xpress (1).pdf
                      File size:99'396 bytes
                      MD5:df9fd48d0c89ef5a450f1cc3bc7febfe
                      SHA1:401b6af770346e5446eee26a1c87878f9f2c0afe
                      SHA256:5d584b0051274996f4e3e3529edb6cab40317770d44fd2c15129cf6585d990b7
                      SHA512:6a0e8030b75856256fc6ccfb9febb3e078e871d4ac3cc91740f16adffb4a8ae848a8ca4ff63d1649497144054024f86d0d79b335deab79cc591849036e3fa28e
                      SSDEEP:1536:kPaCyBzClhX2CWQNgpKbyUKjbaYOdC6usmdgYzzyFIi88pTo:kyBClIsgMObaXYJx
                      TLSH:FDA3EA179C48DB43A42482E8BE430E692F5B174DA98236FE702F4DCF6F246610CDE56E
                      File Content Preview:%PDF-1.6.%......7 0 obj.<</Linearized 1/L 95595/O 9/E 91691/N 1/T 95304/H [ 459 145]>>.endobj. ..16 0 obj.<</DecodeParms<</Columns 4/Predictor 12>>/Filter/FlateDecode/ID[<2FEAFE315D046E18E331A483259B11FB><B102A4A1C00F3945A1CF557AA870F04

                      File Icon

                      Icon Hash:62cc8caeb29e8ae0

                      Static PDF Info

                      General

                      Header:%PDF-1.6
                      Total Entropy:7.056973
                      Total Bytes:99396
                      Stream Entropy:7.034013
                      Stream Bytes:97186
                      Entropy outside Streams:5.335407
                      Bytes outside Streams:2210
                      Number of EOF found:3
                      Bytes after EOF:

                      Keywords Statistics

                      NameCount
                      obj18
                      endobj18
                      stream15
                      endstream15
                      xref0
                      trailer0
                      startxref3
                      /Page1
                      /Encrypt0
                      /ObjStm4
                      /URI0
                      /JS0
                      /JavaScript0
                      /AA0
                      /OpenAction0
                      /AcroForm0
                      /JBIG2Decode0
                      /RichMedia0
                      /Launch0
                      /EmbeddedFile0

                      Image Streams

                      IDDHASHMD5Preview
                      150c786b3368480d559cad1f509d952e8e5ef77dcb77f45332

                      Network Behavior

                      Network Port Distribution

                      TCP Packets

                      TimestampSource PortDest PortSource IPDest IP
                      Apr 16, 2024 20:09:16.839879990 CEST49714443192.168.2.5184.25.164.138
                      Apr 16, 2024 20:09:16.839915037 CEST44349714184.25.164.138192.168.2.5
                      Apr 16, 2024 20:09:16.839983940 CEST49714443192.168.2.5184.25.164.138
                      Apr 16, 2024 20:09:16.840255022 CEST49714443192.168.2.5184.25.164.138
                      Apr 16, 2024 20:09:16.840270042 CEST44349714184.25.164.138192.168.2.5
                      Apr 16, 2024 20:09:17.157052040 CEST44349714184.25.164.138192.168.2.5
                      Apr 16, 2024 20:09:17.157542944 CEST49714443192.168.2.5184.25.164.138
                      Apr 16, 2024 20:09:17.157568932 CEST44349714184.25.164.138192.168.2.5
                      Apr 16, 2024 20:09:17.158643961 CEST44349714184.25.164.138192.168.2.5
                      Apr 16, 2024 20:09:17.158708096 CEST49714443192.168.2.5184.25.164.138
                      Apr 16, 2024 20:09:17.160653114 CEST49714443192.168.2.5184.25.164.138
                      Apr 16, 2024 20:09:17.160758972 CEST44349714184.25.164.138192.168.2.5
                      Apr 16, 2024 20:09:17.160984039 CEST49714443192.168.2.5184.25.164.138
                      Apr 16, 2024 20:09:17.160999060 CEST44349714184.25.164.138192.168.2.5
                      Apr 16, 2024 20:09:17.213844061 CEST49714443192.168.2.5184.25.164.138
                      Apr 16, 2024 20:09:17.300591946 CEST44349714184.25.164.138192.168.2.5
                      Apr 16, 2024 20:09:17.300673962 CEST44349714184.25.164.138192.168.2.5
                      Apr 16, 2024 20:09:17.300779104 CEST49714443192.168.2.5184.25.164.138
                      Apr 16, 2024 20:09:17.301512957 CEST49714443192.168.2.5184.25.164.138
                      Apr 16, 2024 20:09:17.301526070 CEST44349714184.25.164.138192.168.2.5

                      HTTP Request Dependency Graph

                      • armmf.adobe.com

                      HTTPS Proxied Packets

                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      0192.168.2.549714184.25.164.1384435052C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      TimestampBytes transferredDirectionData
                      2024-04-16 18:09:17 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
                      Host: armmf.adobe.com
                      Connection: keep-alive
                      Accept-Language: en-US,en;q=0.9
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
                      Sec-Fetch-Site: same-origin
                      Sec-Fetch-Mode: no-cors
                      Sec-Fetch-Dest: empty
                      Accept-Encoding: gzip, deflate, br
                      If-None-Match: "78-5faa31cce96da"
                      If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
                      2024-04-16 18:09:17 UTC198INHTTP/1.1 304 Not Modified
                      Content-Type: text/plain; charset=UTF-8
                      Last-Modified: Mon, 01 May 2023 15:02:33 GMT
                      ETag: "78-5faa31cce96da"
                      Date: Tue, 16 Apr 2024 18:09:17 GMT
                      Connection: close


                      Statistics

                      CPU Usage

                      Click to jump to process

                      Memory Usage

                      Click to jump to process

                      High Level Behavior Distribution

                      Click to dive into process behavior distribution

                      Behavior

                      Click to jump to process

                      System Behavior

                      General

                      Target ID:0
                      Start time:20:09:02
                      Start date:16/04/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\U.S. Xpress (1).pdf"
                      Imagebase:0x7ff686a00000
                      File size:5'641'176 bytes
                      MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      General

                      Target ID:2
                      Start time:20:09:03
                      Start date:16/04/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                      Imagebase:0x7ff6413e0000
                      File size:3'581'912 bytes
                      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      General

                      Target ID:4
                      Start time:20:09:03
                      Start date:16/04/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1556,i,8927202370515218720,11377247752305104417,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                      Imagebase:0x7ff6413e0000
                      File size:3'581'912 bytes
                      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      Disassembly

                      ⊘No disassembly