Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
U.,S. Xpress (2).pdf

Overview

General Information

Sample name:U.,S. Xpress (2).pdf
Analysis ID:1426965
MD5:6cd1de8d036e91c619a7c0b1533e5697
SHA1:53a85d618512ebded13b25e7156c8fc2f8ef0def
SHA256:b78e9ee78f17fe781c7e403d9ab42f39fa303f99526fedb0966cd11ec0a589d4
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 6388 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\U.,S. Xpress (2).pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 812 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 7220 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1628,i,13890688867868232323,6067589906686736016,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficTCP traffic: 192.168.2.7:49712 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.7:49712
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.7:49712
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.7:49712
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.7:49712
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.7:49712
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.7:49712
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.7:49712
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.7:49712
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.7:49712
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.7:49712
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.7:49712
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 184.25.164.138:443
Source: Joe Sandbox ViewIP Address: 184.25.164.138 184.25.164.138
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: ReaderMessages.0.drString found in binary or memory: https://www.adobe.co
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: classification engineClassification label: clean2.winPDF@14/44@0/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4220Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-16 20-09-29-384.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\U.,S. Xpress (2).pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1628,i,13890688867868232323,6067589906686736016,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1628,i,13890688867868232323,6067589906686736016,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: U.,S. Xpress (2).pdfInitial sample: PDF keyword /JS count = 0
Source: U.,S. Xpress (2).pdfInitial sample: PDF keyword /JavaScript count = 0
Source: U.,S. Xpress (2).pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive12
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1426965 Sample: U.,S. Xpress (2).pdf Startdate: 16/04/2024 Architecture: WINDOWS Score: 2 6 Acrobat.exe 18 71 2->6         started        process3 8 AcroCEF.exe 106 6->8         started        process4 10 AcroCEF.exe 4 8->10         started        dnsIp5 13 184.25.164.138, 443, 49712 BBIL-APBHARTIAirtelLtdIN United States 10->13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://www.adobe.co0%URL Reputationsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://www.adobe.coReaderMessages.0.drfalse
  • URL Reputation: safe
unknown

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
184.25.164.138
unknownUnited States
9498BBIL-APBHARTIAirtelLtdINfalse

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1426965
Start date and time:2024-04-16 20:08:31 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 19s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultwindowspdfcookbook.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:24
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:U.,S. Xpress (2).pdf
Detection:CLEAN
Classification:clean2.winPDF@14/44@0/1
EGA Information:Failed
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 0
  • Number of non-executed functions: 0
Cookbook Comments:
  • Found application associated with file extension: .pdf
  • Found PDF document
  • Close Viewer

Warnings

  • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, ShellExperienceHost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 23.201.212.159, 23.22.254.206, 52.202.204.11, 54.227.187.23, 52.5.13.197, 162.159.61.3, 172.64.41.3, 23.209.188.151, 23.209.188.149
  • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com
  • Not all processes where analyzed, report is missing behavior information
  • VT rate limit hit for: U.,S. Xpress (2).pdf

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
184.25.164.138Re_ Medina County Kitchen.emlGet hashmaliciousUnknownBrowse
    oiDDogdK9A.exeGet hashmaliciousLokibot, PureLog Stealer, zgRATBrowse
      New_Order.xlsGet hashmaliciousUnknownBrowse
        https://enfoldindia.org/wp-content/uploads/2019/06/Restorative-Circle-Handbook-for-CCI.pdfGet hashmaliciousUnknownBrowse
          TaxForm.lnkGet hashmaliciousDarkGate, MailPassViewBrowse
            https://ntnusa0-my.sharepoint.com/:f:/g/personal/ajaronik_ntnusa_com/EjzRads0Sf5Ivon47-zBKVABS1TZOI64W6Uv34YFqNQjmQ?e=NuZrjrGet hashmaliciousHTMLPhisher, ReCaptcha PhishBrowse
              SOA.xlsGet hashmaliciousUnknownBrowse
                Document.pdf.lnkGet hashmaliciousUnknownBrowse
                  https://alsic0-my.sharepoint.com/:f:/g/personal/jsilvia_cpstechnologysolutions_com/En-Hgk0yL4VImyHuKwgnw80BmpoigC0QGozVagwfZqj0Aw?e=0RSNMeGet hashmaliciousHTMLPhisher, ReCaptcha PhishBrowse
                    https://hon6yh6idrd.jp.larksuite.com/file/XL9ZbeTkuoHibNxn4UrjSfvZpyhGet hashmaliciousUnknownBrowse

                      Domains

                      ⊘No context

                      ASNs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      BBIL-APBHARTIAirtelLtdINUd310iQZnO.elfGet hashmaliciousMiraiBrowse
                      • 182.74.25.30
                      tWpGuzQQoW.elfGet hashmaliciousMiraiBrowse
                      • 122.185.203.209
                      kGbjOmkleq.elfGet hashmaliciousMiraiBrowse
                      • 125.23.195.204
                      iH18gdEj8Y.elfGet hashmaliciousMiraiBrowse
                      • 125.19.93.33
                      xmncOD7BwX.elfGet hashmaliciousMiraiBrowse
                      • 122.184.236.50
                      SFTNQEBmOA.elfGet hashmaliciousUnknownBrowse
                      • 182.79.2.232
                      Hays_compiled_documents.ZIP.jsGet hashmaliciousCobaltStrike, DucktailBrowse
                      • 23.45.148.189
                      Gq730kmpiE.elfGet hashmaliciousUnknownBrowse
                      • 122.181.178.15
                      SecuriteInfo.com.Linux.Siggen.9999.31292.16574.elfGet hashmaliciousMiraiBrowse
                      • 125.23.200.173
                      l1sADDB043.elfGet hashmaliciousMiraiBrowse
                      • 125.23.42.169

                      JA3 Fingerprints

                      ⊘No context

                      Dropped Files

                      ⊘No context

                      Created / dropped Files

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):300
                      Entropy (8bit):5.240511335296561
                      Encrypted:false
                      SSDEEP:6:AjUpyq2PcNwi2nKuAl9OmbnIFUt8V5jz1Zmw+V5jlRkwOcNwi2nKuAl9OmbjLJ:AoMvLZHAahFUt8V5jz1/+V5jz54ZHAae
                      MD5:7375115B234115EECAA0AD80F0B64445
                      SHA1:7AAAEAD7492E0B897188DA021932DF33B6751D96
                      SHA-256:6E8D757D5406EFE02CC030968EBA18C5A0D883257D66FD55010FD05E1F6DAC11
                      SHA-512:6307085C39E86B34C358971CF2FC8ED0C0A632B689BCEE49B1672D69F84A6A200BB2B4F2A49EA1547278C56E4AD22CA01D951A78896E111990C62C5FC6E0E296
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/16-20:09:26.974 1c14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/16-20:09:26.975 1c14 Recovering log #3.2024/04/16-20:09:26.975 1c14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):300
                      Entropy (8bit):5.240511335296561
                      Encrypted:false
                      SSDEEP:6:AjUpyq2PcNwi2nKuAl9OmbnIFUt8V5jz1Zmw+V5jlRkwOcNwi2nKuAl9OmbjLJ:AoMvLZHAahFUt8V5jz1/+V5jz54ZHAae
                      MD5:7375115B234115EECAA0AD80F0B64445
                      SHA1:7AAAEAD7492E0B897188DA021932DF33B6751D96
                      SHA-256:6E8D757D5406EFE02CC030968EBA18C5A0D883257D66FD55010FD05E1F6DAC11
                      SHA-512:6307085C39E86B34C358971CF2FC8ED0C0A632B689BCEE49B1672D69F84A6A200BB2B4F2A49EA1547278C56E4AD22CA01D951A78896E111990C62C5FC6E0E296
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/16-20:09:26.974 1c14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/16-20:09:26.975 1c14 Recovering log #3.2024/04/16-20:09:26.975 1c14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):344
                      Entropy (8bit):5.205320285124879
                      Encrypted:false
                      SSDEEP:6:3POq2PcNwi2nKuAl9Ombzo2jMGIFUt8mYZmw+mmFbFzkwOcNwi2nKuAl9Ombzo23:fOvLZHAa8uFUt8z/+9hz54ZHAa8RJ
                      MD5:F5103CA421408135F8DE3A2DE30B8FBA
                      SHA1:029FC5C04FFBEA9037A937FAAE34222AD51E607C
                      SHA-256:26C691CBDCDBF0E41E5F33EDB3253727100DCE745DAE61FDE88899B29C154CFB
                      SHA-512:7A666047854ECD26751AE69D095362D71021BFED1FCC996987A0A504D1DB59D03EFFE4793AE22E60E2467A36167454B58325A5EBE7E1D14D34D28957C8692772
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/16-20:09:27.068 1c84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/16-20:09:27.069 1c84 Recovering log #3.2024/04/16-20:09:27.070 1c84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):344
                      Entropy (8bit):5.205320285124879
                      Encrypted:false
                      SSDEEP:6:3POq2PcNwi2nKuAl9Ombzo2jMGIFUt8mYZmw+mmFbFzkwOcNwi2nKuAl9Ombzo23:fOvLZHAa8uFUt8z/+9hz54ZHAa8RJ
                      MD5:F5103CA421408135F8DE3A2DE30B8FBA
                      SHA1:029FC5C04FFBEA9037A937FAAE34222AD51E607C
                      SHA-256:26C691CBDCDBF0E41E5F33EDB3253727100DCE745DAE61FDE88899B29C154CFB
                      SHA-512:7A666047854ECD26751AE69D095362D71021BFED1FCC996987A0A504D1DB59D03EFFE4793AE22E60E2467A36167454B58325A5EBE7E1D14D34D28957C8692772
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/16-20:09:27.068 1c84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/16-20:09:27.069 1c84 Recovering log #3.2024/04/16-20:09:27.070 1c84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9f63504e-c2fc-4409-9fb4-591020d6aae2.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:modified
                      Size (bytes):475
                      Entropy (8bit):4.969340035861989
                      Encrypted:false
                      SSDEEP:12:YH/um3RA8sqZE2sBdOg2H7Acaq3QYiubSpDyP7E4TX:Y2sRdsDbdMH7r3QYhbSpDa7n7
                      MD5:1BB0F7713A58F7B5E7ACFB20A5374AB1
                      SHA1:B4625E6441BCDF592B6DE4FE4367E2BE3A19E376
                      SHA-256:F24B74E7924D539B4BB1691DCC5EA7DD06BDD6D93A198F9C6323C272BB78C4A9
                      SHA-512:93643C94C5C1D62AD4A09F3D9D102F07FE0F43C556BBA29701D55E5960EEA1F69C578D7A345038E841EFC1B9D84D2DB79B46EF576F80CAB3AC78577A4F062CFC
                      Malicious:false
                      Reputation:low
                      Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13357850978943793","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":105318},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):475
                      Entropy (8bit):4.969340035861989
                      Encrypted:false
                      SSDEEP:12:YH/um3RA8sqZE2sBdOg2H7Acaq3QYiubSpDyP7E4TX:Y2sRdsDbdMH7r3QYhbSpDa7n7
                      MD5:1BB0F7713A58F7B5E7ACFB20A5374AB1
                      SHA1:B4625E6441BCDF592B6DE4FE4367E2BE3A19E376
                      SHA-256:F24B74E7924D539B4BB1691DCC5EA7DD06BDD6D93A198F9C6323C272BB78C4A9
                      SHA-512:93643C94C5C1D62AD4A09F3D9D102F07FE0F43C556BBA29701D55E5960EEA1F69C578D7A345038E841EFC1B9D84D2DB79B46EF576F80CAB3AC78577A4F062CFC
                      Malicious:false
                      Reputation:low
                      Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13357850978943793","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":105318},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):4509
                      Entropy (8bit):5.23917136861796
                      Encrypted:false
                      SSDEEP:96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPAWBUOpZ:CwNw1GHqPySfkcigoO3h28ytPAWBUOpZ
                      MD5:6C3F6B119EA65F8B376E3B005F7E5873
                      SHA1:65A2809FB119CA659AB03F2092B3EF79DA3099B5
                      SHA-256:369E8F65FCAAA6B92FCB039F8313DA34B77810B6E592EC5A1C2118F757B9D33B
                      SHA-512:929E5035510FA3283CCF0948A38B09C4A1371122A68F007BE4AAB0F26768F57BA86CA480172241901DA43D2B83031AE7062AAF44D788D40D2DDD685C6E63D962
                      Malicious:false
                      Reputation:low
                      Preview:*...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3*.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):332
                      Entropy (8bit):5.237351947155392
                      Encrypted:false
                      SSDEEP:6:xpq2PcNwi2nKuAl9OmbzNMxIFUt8gU5Zmw+gCHzkwOcNwi2nKuAl9OmbzNMFLJ:xpvLZHAa8jFUt8gU5/+gCz54ZHAa84J
                      MD5:4D5E7C4FECC80447CAA86BEF37583ED5
                      SHA1:5A9D6E0C286EA67F26CEB436FE00D775567918E6
                      SHA-256:692FB8E0B54686A4E048867B9C2AB750FAFAEB7A265761553B29674A448C34EA
                      SHA-512:E2B3D3C262CC8F5563E0FAE3C3A6DC9EC5DB7E9D78A4BE23CFE6FDABCBCE916ABEEDFB9EDC29D9AF1C536960CC5D7908EF38A50A52E01C8962AC0A3099784DA4
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/16-20:09:27.603 1c84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/16-20:09:27.636 1c84 Recovering log #3.2024/04/16-20:09:27.652 1c84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):332
                      Entropy (8bit):5.237351947155392
                      Encrypted:false
                      SSDEEP:6:xpq2PcNwi2nKuAl9OmbzNMxIFUt8gU5Zmw+gCHzkwOcNwi2nKuAl9OmbzNMFLJ:xpvLZHAa8jFUt8gU5/+gCz54ZHAa84J
                      MD5:4D5E7C4FECC80447CAA86BEF37583ED5
                      SHA1:5A9D6E0C286EA67F26CEB436FE00D775567918E6
                      SHA-256:692FB8E0B54686A4E048867B9C2AB750FAFAEB7A265761553B29674A448C34EA
                      SHA-512:E2B3D3C262CC8F5563E0FAE3C3A6DC9EC5DB7E9D78A4BE23CFE6FDABCBCE916ABEEDFB9EDC29D9AF1C536960CC5D7908EF38A50A52E01C8962AC0A3099784DA4
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/16-20:09:27.603 1c84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/16-20:09:27.636 1c84 Recovering log #3.2024/04/16-20:09:27.652 1c84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240416180931Z-176.bmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PC bitmap, Windows 3.x format, 164 x -135 x 32, cbSize 88614, bits offset 54
                      Category:dropped
                      Size (bytes):88614
                      Entropy (8bit):1.11103756881555
                      Encrypted:false
                      SSDEEP:384:ZnSyneUnG0sDTJzEtJMYHW4ed74hmtlbz8:ZleUn3GR4JpNed74Mrv8
                      MD5:AD078D0C90B7984CE7A65EAAEBA78E9F
                      SHA1:3423FAFD15D52863A883EB72214AFAB8E9E3D78F
                      SHA-256:64DFC93102C42545A7CAA004C70D954D2BDA6531ABB5C9B2CDD9767CE17558E4
                      SHA-512:9AC532E8A9697A790781BD6C030A05A83774180EF9FF24AF90280AB05DF6BEC18ED71B3F1153F97332580D8AA1DF59146334121957211E15CA7056CF627E6262
                      Malicious:false
                      Reputation:low
                      Preview:BM&Z......6...(.......y..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
                      Category:dropped
                      Size (bytes):86016
                      Entropy (8bit):4.439062262927321
                      Encrypted:false
                      SSDEEP:384:yeaci5GUiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1YurVgazUpUTTGt
                      MD5:9C274E1ADA4B738C144DE2CC9A5F4733
                      SHA1:CF2F0F12EA6AD53BBAA032B779695615DAD7F3E2
                      SHA-256:E26587BF5B5F12E9EC17199CBA8662B5EA6EC51FC3BA849EE0ED9D699C6478F1
                      SHA-512:AC8781BE4A3AADFD78FEFF8E7188D50282A08814E9CC675FC3C5DC82E6B91E8F026D499AD1ED88A4F91A08ABF2C950F0FD2DE2133BB6A54BD280A501DC5BED42
                      Malicious:false
                      Reputation:low
                      Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite Rollback Journal
                      Category:dropped
                      Size (bytes):8720
                      Entropy (8bit):3.777405565544913
                      Encrypted:false
                      SSDEEP:48:7MTp/E2ioyVTioy3DoWoy1CABoy1LKOioy1noy1AYoy1Wioy1hioybioyLoy1noI:7IpjuT0iANXKQibb9IVXEBodRBkT
                      MD5:A1B56F586C5775DF6C8D7A033997ACE0
                      SHA1:31247C77D7FFF313006776A71E523EB79436B41C
                      SHA-256:B0296723A6F12F64DDEFC427354A1F93290E7024887BB7647FB9E87E5FCAA660
                      SHA-512:C2FEC444512EE6579FFEB6412DC64594CFC3DB0C20EA4D091D71C5C22CB7F0B59BFD33B64D723F9958624387075670F235B25B7B73AB2B35ED039B9E16BDE977
                      Malicious:false
                      Preview:.... .c......[.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4220

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PostScript document text
                      Category:dropped
                      Size (bytes):185099
                      Entropy (8bit):5.182478651346149
                      Encrypted:false
                      SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                      MD5:94185C5850C26B3C6FC24ABC385CDA58
                      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                      Malicious:false
                      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PostScript document text
                      Category:dropped
                      Size (bytes):185099
                      Entropy (8bit):5.182478651346149
                      Encrypted:false
                      SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                      MD5:94185C5850C26B3C6FC24ABC385CDA58
                      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                      Malicious:false
                      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):228346
                      Entropy (8bit):3.3890581331110528
                      Encrypted:false
                      SSDEEP:1536:qMKP+iyzDtrh1cK3XEivK7VK/3AYvYwgf/rRoL+sn:FKPoJ/3AYvYwgXFoL+sn
                      MD5:2F8A4655789D955BD1CC67B790AF3179
                      SHA1:E9F56CC175D0D792B1CD57A2210DD955F0739BAC
                      SHA-256:09958248E59EC060D4345471BA55CD61481D6EA52A04AEC4B46B8B4826C3ED4F
                      SHA-512:32755A4320EB0F05CD71280765424E9752F817E931C8E582BE93C589FAD3AFB48987DCF6D43768298D3A66D685297E82BD07AB2F604D43B9FF40C11F0391A66C
                      Malicious:false
                      Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):295
                      Entropy (8bit):5.385239567515789
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXIrvQcVEU9MO4WsGiIPEeOF0YKqqoAvJM3g98kUwPeUkwRe9:YvXKXIR3MObsdTeOBZGMbLUkee9
                      MD5:D5BFB9D89AA788BACA96BE95F9F7B984
                      SHA1:A8255E48ED9A8271671CED252C8F86E5DC4165DC
                      SHA-256:9C720796DB3EF1051B202726E8C754A337928E592CCC68EEC8D301DB34BBE303
                      SHA-512:064D5A260CD689814B0751912954904F9D84357C85EA7BDE5E898EB2A1725115D8D400F947B0E88768D3F9329287CEA9E2783FC101D364F7CE068B990A36174D
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"755b0ff3-6c21-4536-b16b-1782a189ba66","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1713464253274,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.323364745449629
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXIrvQcVEU9MO4WsGiIPEeOF0YKqqoAvJfBoTfXpnrPeUkwRe9:YvXKXIR3MObsdTeOBZGWTfXcUkee9
                      MD5:1D1E7D3C3CEDC676EC1992B0989E7B82
                      SHA1:9C4E4257B36F396462E0672419029E6BE6C808D2
                      SHA-256:AE4A9739794CAB6CA388C8F083DBBCFA4F1301416C7E7253CA2757120BE868B4
                      SHA-512:2D328B638712AE53C10BE4364943F24D6DF841CE59D361FA2070CE2841C839E8468A7C694387C2C539DAAEADA200ADECF9570EE9EC9BF6A0FD3888E6E0ED207E
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"755b0ff3-6c21-4536-b16b-1782a189ba66","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1713464253274,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.30176406431806
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXIrvQcVEU9MO4WsGiIPEeOF0YKqqoAvJfBD2G6UpnrPeUkwRe9:YvXKXIR3MObsdTeOBZGR22cUkee9
                      MD5:B8DEAE677BDA92BE55FAF5190EFF4E5C
                      SHA1:547ACEA7253DBA58E5113EDECA633835AEFB1B4C
                      SHA-256:C8D7F2AC90E514BCD04A9CA2FA0D94111A5D1851BE9F128688BECC5B4411B7B9
                      SHA-512:615E97156AE462391109389027346B98721BF2D07693443B55C68E57C7E1FF16C168C19EB28AD122977E9A2524EE474B2A0ACC146A8F97D6C660D89392D33A17
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"755b0ff3-6c21-4536-b16b-1782a189ba66","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1713464253274,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):285
                      Entropy (8bit):5.372885455975819
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXIrvQcVEU9MO4WsGiIPEeOF0YKqqoAvJfPmwrPeUkwRe9:YvXKXIR3MObsdTeOBZGH56Ukee9
                      MD5:310D2BD7AEC791A3385B88E9B85811D6
                      SHA1:BE8B50917EE6CBD1F882712EFA89763CE78A6A18
                      SHA-256:E0D6E649996DD2F306C138691B70E539C1CF713E7C34C706571469EB620D1E05
                      SHA-512:FFACC663FC8279DA72272AEBFE68F0FE74E8EF337144B5467C3DFA695C314D10A40012C103F8E5449899D7C6653ECF0134A0898C62524275BBB193158117AE16
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"755b0ff3-6c21-4536-b16b-1782a189ba66","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1713464253274,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.327337967136785
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXIrvQcVEU9MO4WsGiIPEeOF0YKqqoAvJfJWCtMdPeUkwRe9:YvXKXIR3MObsdTeOBZGBS8Ukee9
                      MD5:992F33FBF6FC862C665084637850B027
                      SHA1:C92EB5E47DF99F19307FF3F5921B251E09F8CC8A
                      SHA-256:A76D206336E7D85F6695F686413C31302CF54850D1C102072A86AFB7573AD5A0
                      SHA-512:F290B1A416E0355E6BBB457B591BD0226F5E8A7E045DA09910EE80F1310BDEDC6E5B9320313294E1B10B2DA44919A63280131A09F720C33348B791500E10993A
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"755b0ff3-6c21-4536-b16b-1782a189ba66","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1713464253274,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.313672746777524
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXIrvQcVEU9MO4WsGiIPEeOF0YKqqoAvJf8dPeUkwRe9:YvXKXIR3MObsdTeOBZGU8Ukee9
                      MD5:58428DE6D453468521B7B3DABFA6ADAA
                      SHA1:44607CC56D24215D8487B41EB6C3EEDE2C78E53A
                      SHA-256:5429132632FD27650EF0448324A8F4AD7DBAACC77230403546D74AC24C32625D
                      SHA-512:E8A88A450A6DC5DEB66EA4756A1C78BCD5FDA43D3AC8CE6D4568D25C6C3660CF4685F59ED745365702783D56D3099629A1500F2B7760285A99F548CF3063790F
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"755b0ff3-6c21-4536-b16b-1782a189ba66","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1713464253274,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.318032705752891
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXIrvQcVEU9MO4WsGiIPEeOF0YKqqoAvJfQ1rPeUkwRe9:YvXKXIR3MObsdTeOBZGY16Ukee9
                      MD5:CFC3F477AA40589B4B4A074380B3E2A4
                      SHA1:084CF816079B6A098339B2128B453DA72E9F015A
                      SHA-256:C045D4F2543EF68FF309038A6FFDA189165C33796F8E4873725CAFC4C9AC820D
                      SHA-512:CE9255AD8EEEB29C3909E05D5E345F88E0743D85D597D14B3FE4A6200791D4658A334AF829085D350270F978758D649C1425FE30BC4D2CAED4B1B2D9F9EE8620
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"755b0ff3-6c21-4536-b16b-1782a189ba66","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1713464253274,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.334900426272156
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXIrvQcVEU9MO4WsGiIPEeOF0YKqqoAvJfFldPeUkwRe9:YvXKXIR3MObsdTeOBZGz8Ukee9
                      MD5:19E6B9CFACDD1BDE743ADB9EE1F9B648
                      SHA1:3955EC8E9E96B2D3BC1A8102EDAA3D3246663D5A
                      SHA-256:F7BD9AA0747AF85157704B698DFFB7C6DC30BC883C57A3659EE4B3DC6CD01113
                      SHA-512:5993D93C848C46BA896C32729BF6929D13B578FAC4C70F645D430D7E2083C32C52E87E98CE73273F44CC211A823EBCCF90C54F1CBE7750D9F719AE97475A1F4F
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"755b0ff3-6c21-4536-b16b-1782a189ba66","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1713464253274,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1372
                      Entropy (8bit):5.7430820777762595
                      Encrypted:false
                      SSDEEP:24:Yv6X08ObmeOHKLgENRcbrZbq00iCCBrwJo++ns8ct4mFJN+:YvzweKEgigrNt0wSJn+ns8cvFJM
                      MD5:39D195731C96D05985BB9917ACA8F4FA
                      SHA1:927F45BC0F4F1973023872E6FC4B132343FD8FE7
                      SHA-256:6AF385F08F650CAF9468B832A11E9585E0C19AE3075F020BDF237C43263D63CB
                      SHA-512:083564D8C4A6A9F005FCCB6EAE989282E97F53C6A957DA546E4BBB2C8A6CE8C077B13C799C74554E705BDE23E6499BB979188C7DE4BFD1E7F42763854A2E8D9F
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"755b0ff3-6c21-4536-b16b-1782a189ba66","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1713464253274,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"79887_247329ActionBlock_0","campaignId":79887,"containerId":"1","controlGroupId":"","treatmentId":"acc56846-d570-4500-a26e-7f8cf2b4acad","variationId":"247329"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJUcnkgQWNyb2JhdCBQcm8ifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNSIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTMiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIDctZGF5IHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0byBwcmVtaXVtIFBERiBhbmQgZS1zaWduaW5nIHRvb2xzLiIsImJ

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.320695051201476
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXIrvQcVEU9MO4WsGiIPEeOF0YKqqoAvJfYdPeUkwRe9:YvXKXIR3MObsdTeOBZGg8Ukee9
                      MD5:F9AB1D6D8121E307D186F93A3F8D9791
                      SHA1:F28814851749436CF91A04E0CB48DF8048D3E549
                      SHA-256:5D33330AB3B562490468C85048D1A3EBE7835BC909907E1C2389503BC9195CDE
                      SHA-512:76E236C5BAB4887D987D0B3CD093F0B40813AB7BAFF1A69F013C4F0B8C51B290260C8B13796C58A31790AABB78441A318B36F0AA96A667432AA2BAF9002F9A0C
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"755b0ff3-6c21-4536-b16b-1782a189ba66","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1713464253274,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1395
                      Entropy (8bit):5.777477987856341
                      Encrypted:false
                      SSDEEP:24:Yv6X08ObmeOarLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNG:Yvzwe5HgDv3W2aYQfgB5OUupHrQ9FJQ
                      MD5:F16C8F71C0CD3579EAFFF220CE1FF263
                      SHA1:508A5E410E0D225AB7949F1CBAAA877A8BE16CE4
                      SHA-256:E9C981E4732C6244365183B97AFCB575A78339BF33B6BA0954C2C8E2E27186C9
                      SHA-512:63FAD18A2B306F4B425A367B5D2AD376D5E9ADC97595EBA5F177F27FC218816639E78E4897031C6822936EE57CFFB7D5155E00EB6F70A528238E5E9DA929CB71
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"755b0ff3-6c21-4536-b16b-1782a189ba66","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1713464253274,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):291
                      Entropy (8bit):5.304099914846463
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXIrvQcVEU9MO4WsGiIPEeOF0YKqqoAvJfbPtdPeUkwRe9:YvXKXIR3MObsdTeOBZGDV8Ukee9
                      MD5:BF2811D5A3ECD4F9A04D4AEF88B2E9DA
                      SHA1:D989F630094D593AC867C2E68B66B4D2DA6D621E
                      SHA-256:45675BA7C75CD5943C76753AEFDA3BD734783362466A25BA418463876E99240C
                      SHA-512:50D56A9B871F368B1595813C5ADA7F42ACA3E4A5E3B4E0FFA1434FB44C8677515713B2BBCFDE93F5951A82CD8A9D38E4A06F1A3D645029ED88E047854D42B12C
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"755b0ff3-6c21-4536-b16b-1782a189ba66","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1713464253274,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):287
                      Entropy (8bit):5.309037817896244
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXIrvQcVEU9MO4WsGiIPEeOF0YKqqoAvJf21rPeUkwRe9:YvXKXIR3MObsdTeOBZG+16Ukee9
                      MD5:7C8B162468026F8A46DE2BA7EF85A4CE
                      SHA1:B9C529D3006137102F58FA56444D6CBAC3D95BAE
                      SHA-256:C027B6BFB4D927878CC99CEDD3A2C28650645B589285868252B35363B621904E
                      SHA-512:1360B334FA491B1F1486ACFBED31D2AC399F9AB5E480C2623C1C6A63BAF7A778EC30705879220BF4612BEF401FEAF8D4677D1C9F9E10C791F4DFE5A6619A8E2F
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"755b0ff3-6c21-4536-b16b-1782a189ba66","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1713464253274,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.326924156918676
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXIrvQcVEU9MO4WsGiIPEeOF0YKqqoAvJfbpatdPeUkwRe9:YvXKXIR3MObsdTeOBZGVat8Ukee9
                      MD5:C3F467D5DE6A5CAA0E744B2D5149C8CF
                      SHA1:ABDD84B688EBD964A19CC29330C9AC060FC5AB42
                      SHA-256:074A2EE67D11D36122173BBEEAE5F3A9D853680E04D2E4E81E3326702A12AEA5
                      SHA-512:807891B6ADA7F8FB39A8571C2B0A08C31F663D0272FCA4D61C97B3D1D9F8262AB1992DA5B95EC03BDAB6406603D27348A69A22BDC72B73CC498B5ABEEFD4B486
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"755b0ff3-6c21-4536-b16b-1782a189ba66","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1713464253274,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):286
                      Entropy (8bit):5.28642993534812
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXIrvQcVEU9MO4WsGiIPEeOF0YKqqoAvJfshHHrPeUkwRe9:YvXKXIR3MObsdTeOBZGUUUkee9
                      MD5:7F6083000488A5558ED508E9C7982FDC
                      SHA1:3BB402A9529DAEC139EB0ECB3510651FABF94F37
                      SHA-256:FB351ABCD7DE08B576E837CD25BC511F4538C7A09D7E4DC089767822A53BF3B7
                      SHA-512:82C4FBC37F22F01C62C304EDF2CF4F472ADD75FEA39FB71113814AB4D3FE341602D47EBCC52D92CFD86AD2193B326CD5A4101376860951FADD82D51044BAC8F1
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"755b0ff3-6c21-4536-b16b-1782a189ba66","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1713464253274,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):782
                      Entropy (8bit):5.382319420724993
                      Encrypted:false
                      SSDEEP:12:YvXKXIR3MObsdTeOBZGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWi:Yv6X08ObmeOv168CgEXX5kcIfANhH
                      MD5:346C93E735F4C42A985552E9A3B432CF
                      SHA1:947D7C8FAFDB5CBC59000D1C5F5CFAE298A3A32F
                      SHA-256:ABE0C00EBEBCD8E7D0E48164FF5A03D2D354E5A37CD4C576ED9E23A4B69CEFAB
                      SHA-512:E5F59E858DE8C2DFDAB13961905439C2F3F2FCE1B27C5F5853C0339B2E1BA5C0E3E7E59E45966E3F2F2AA529430EC7AA455DCCC62EF106AE0335D1FF5CC7CB34
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"755b0ff3-6c21-4536-b16b-1782a189ba66","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1713464253274,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1713290973313}}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):4
                      Entropy (8bit):0.8112781244591328
                      Encrypted:false
                      SSDEEP:3:e:e
                      MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                      SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                      SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                      SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                      Malicious:false
                      Preview:....

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):2814
                      Entropy (8bit):5.125269218386058
                      Encrypted:false
                      SSDEEP:24:YIQCGdzCCDR8OKhrwx1msBBtaJfayfWcZ1WCO7jITtj0Sdud2l2LSatQA3eT5Q98:YEwqdK1n+XZ1QIN4QktQAOT+9uh
                      MD5:773EF9AB58A3DAA32AF3E06179387899
                      SHA1:90AE98E460C7AF56127367A50369BC1ED9E256C9
                      SHA-256:FE87E8D2D91F7363FFBA8974077F5F3C9F6BDFE20FEC55F5B26389195D8234BD
                      SHA-512:C471CA832C6CCEABF48F0E1DA167397AD61EC1B7E0AD7D4C5C0CEAB83E4605B26785AF77B46622B856487E76C9EF84AAAC6EF625F61FFABF3DC7D188E9A3F0DD
                      Malicious:false
                      Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"9cc571f9ee3f80b2212809671e338f68","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1713290973000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"2f1b236d4e19b0b28ee59791a542a419","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1372,"ts":1713290973000},{"id":"Edit_InApp_Aug2020","info":{"dg":"64bed0fdaade9ee9c7f48e8791dfde41","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1713290973000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"93038c9abadebc120c0607588d2bcaca","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1713290973000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"ccbd369a9295b28b90091ff0c1efdbf6","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1713290973000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"6d45f3b07c183d10384fa6354e8f3aae","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1713290973000},

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
                      Category:dropped
                      Size (bytes):12288
                      Entropy (8bit):1.4523270422970698
                      Encrypted:false
                      SSDEEP:48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsm/lAj:lNVmsw3SHtbDbPe0K3+fDZdo
                      MD5:DD693D2AC5064599A36E421D04378199
                      SHA1:2B4AC7FAEAC52F6815FC27A2818BC9F74F604B75
                      SHA-256:CA233EF2C1499AD163ACE63F080477C493C6542F823D80FCAB155D053509BB0B
                      SHA-512:372EC7874D17834F2C16F1E8E34B9F9A125A779A0C13E8A9D37E0CBFD1DE2952F45F1F9826B243788DE97D9C88D58501071332FC8DA5C9C54E0652E91FDBA258
                      Malicious:false
                      Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite Rollback Journal
                      Category:dropped
                      Size (bytes):8720
                      Entropy (8bit):1.9571143390967567
                      Encrypted:false
                      SSDEEP:48:7MUSrvrBd6dHtbGIbPe0K3+fDy2dsm27qFl2GL7msQ:7W3SHtbDbPe0K3+fDZd6KVmsQ
                      MD5:423DECC3A8E7CD42C2E45729A3E71283
                      SHA1:1470EEE3FAEF2E6E167B21C7C12D66505BE439B6
                      SHA-256:2AEEC783CC152254B980E68421CEA15DDF4683C733A28C2BC67EBEA2F4065686
                      SHA-512:7F589723672FAA6B57BA90194F620D9ED7BB930DF5F8177CDA4705EF298EB43828A9074BEF95DAFCDB879D8449E362CA49D480F5B9B2890CAAC4806EAF7BB60D
                      Malicious:false
                      Preview:.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Temp\MSIa99ea.LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):246
                      Entropy (8bit):3.5278731006694652
                      Encrypted:false
                      SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8eeWalwl:Qw946cPbiOxDlbYnuRKhZ
                      MD5:DE5134CBEBB56C3EAD6AF024FADE2E66
                      SHA1:6CF80672900B599B168F756DFE041B46E488BFDF
                      SHA-256:7504FFBA273E48D7B47560B3187E0EB5B8199B916533C469FE9DEEC3206EE67D
                      SHA-512:746FB23707DD078ACC6B09FD49C5C5D10A8431E725574400707977A5C825294ED0B52F1AC7BB99A27E1588FEB65CD3A2F1F94D57ACB75CBF2855F0590865294A
                      Malicious:false
                      Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.6./.0.4./.2.0.2.4. . .2.0.:.0.9.:.3.4. .=.=.=.....

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-16 20-09-29-384.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393)
                      Category:dropped
                      Size (bytes):16525
                      Entropy (8bit):5.386483451061953
                      Encrypted:false
                      SSDEEP:384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
                      MD5:F49CA270724D610D1589E217EA78D6D1
                      SHA1:22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
                      SHA-256:D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
                      SHA-512:181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
                      Malicious:false
                      Preview:SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-16 22-04-02-785.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393)
                      Category:dropped
                      Size (bytes):15280
                      Entropy (8bit):5.336208401586583
                      Encrypted:false
                      SSDEEP:384:mEiRQRxRYRmR7R+6T6vz676o6D6aHDHlH+8R8N8T8vJQJUJtJeivonKnSnEkIm1t:m9WLOw9IY8zEdCljFe860q6eLkJKSEFm
                      MD5:4017F71F028C0CF6BE824B7CE734AE2F
                      SHA1:FF8E788B352F2175F2FAA25A4E6A5C4C7FA4BA7B
                      SHA-256:B8A252D8DFFF074D1DE21D478BBFB853AFE17CA10217F417236CB9AF40E485E2
                      SHA-512:E027DB72B405EEB2624BA176DEF63F81034D866BE0C68B7A5ABCD56ACFBC3AAB08D379C48B13AB790E41C327F39D45CB0121862B01653297F51C8BD43FCC2721
                      Malicious:false
                      Preview:SessionID=8a19411e-2303-4640-9b5a-958c42d76b07.1713290969396 Timestamp=2024-04-16T20:09:29:396+0200 ThreadID=6244 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=8a19411e-2303-4640-9b5a-958c42d76b07.1713290969396 Timestamp=2024-04-16T20:09:29:397+0200 ThreadID=6244 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=8a19411e-2303-4640-9b5a-958c42d76b07.1713290969396 Timestamp=2024-04-16T20:09:29:397+0200 ThreadID=6244 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=8a19411e-2303-4640-9b5a-958c42d76b07.1713290969396 Timestamp=2024-04-16T20:09:29:397+0200 ThreadID=6244 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=8a19411e-2303-4640-9b5a-958c42d76b07.1713290969396 Timestamp=2024-04-16T20:09:29:397+0200 ThreadID=6244 Component=ngl-lib_NglAppLib Description="SetConfig:

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):1255
                      Entropy (8bit):5.233160702589139
                      Encrypted:false
                      SSDEEP:24:mGtbkqsGWvZOFPGtbkqsGWN82jGtbkqs1hoGtbkqs1AcGtbkqs1ZwLGtbkqs1Y8R:mebDsBvOebDsBN82ebDs16ebDs1xebDv
                      MD5:C5B3BF151F61BC4749ECC4525C5648E4
                      SHA1:1F7467BA5E9321A318FD8143B576BAE1C93A0AF9
                      SHA-256:98E4D7150BCD646CFE08EC7DAFA7534CAB04A0A3784E277E44FFEDF15891941A
                      SHA-512:B2C1A6DA0096B40B66058BBC5326622A9068DB13C54250ECE2DABA5BDE79A4BDA819D265C284EDD264B6DCACB648D1F6846FD3020FD849C75A2A47AAEA68595F
                      Malicious:false
                      Preview:SessionID=8a19411e-2303-4640-9b5a-958c42d76b07.1713290969396 Timestamp=2024-04-16T22:04:02:809+0200 ThreadID=4532 Component=ngl-lib_ NglIngestManager Description="ProcessSpecialEventBeforeClose : Ingest - Checking & Processing for Special Events"..SessionID=8a19411e-2303-4640-9b5a-958c42d76b07.1713290969396 Timestamp=2024-04-16T22:04:02:809+0200 ThreadID=4532 Component=ngl-lib_ NglIngestManager Description="ProcessNglIngestEvents : Ingest Process - Finished"..SessionID=8a19411e-2303-4640-9b5a-958c42d76b07.1713290969396 Timestamp=2024-04-16T22:04:02:809+0200 ThreadID=2404 Component=ngl-lib_ NglIngestManager Description="CleanEventQ : Cleared Ingest Event"..SessionID=8a19411e-2303-4640-9b5a-958c42d76b07.1713290969396 Timestamp=2024-04-16T22:04:02:809+0200 ThreadID=2404 Component=ngl-lib_ NglIngestManager Description="Shutdown : Ingest manager shutdown."..SessionID=8a19411e-2303-4640-9b5a-958c42d76b07.1713290969396 Timestamp=2024-04-16T22:04:02:809+0200 ThreadID=2404 Component=ngl-lib_Ht

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):35814
                      Entropy (8bit):5.418028384274923
                      Encrypted:false
                      SSDEEP:768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRo:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gR6
                      MD5:B44DB6E505F82D0DDFC5E89D1A62EE1C
                      SHA1:8751276FEADCB51544460F6BAD57D72AF4335615
                      SHA-256:5F4BEA11AF28E4504977D507AFAB0038ED305F2086161B98CFB92A559FA56EED
                      SHA-512:9911921DC01E297D2B8A68CA6B4108E27199863BE68DF940E74045AC6E541028574E29187A9E2C4E3BC7A1F1ACA2A9D0B4AE6A5A99654EABADB71B3BF91AD211
                      Malicious:false
                      Preview:05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

                      C:\Users\user\AppData\Local\Temp\acrocef_low\184987cd-bee8-4f72-83c4-4d6726a1ae88.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                      Category:dropped
                      Size (bytes):1407294
                      Entropy (8bit):7.97605879016224
                      Encrypted:false
                      SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLlGZGwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLlGZT
                      MD5:B3CBE54294848B03EB7291C644515EE9
                      SHA1:DE3DC0B90804AD050E7E8BD42B2C02DE33B71574
                      SHA-256:A087D5F27629D6EA2AA70EBD0BF7D7049D25F3A759441717C4789418BB948666
                      SHA-512:79D6722E404A26EA36C643C8047C543195F637FD888B2A3D16B0377DF640562CC4C74C4B80DD8BBA2E46B4CF7E9525CCA96F0292E34989FA24D089E1CBF3F385
                      Malicious:false
                      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                      C:\Users\user\AppData\Local\Temp\acrocef_low\421e3a8b-98e0-43e1-8a2f-bec7369480c8.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                      Category:dropped
                      Size (bytes):386528
                      Entropy (8bit):7.9736851559892425
                      Encrypted:false
                      SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                      MD5:5C48B0AD2FEF800949466AE872E1F1E2
                      SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                      SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                      SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                      Malicious:false
                      Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                      C:\Users\user\AppData\Local\Temp\acrocef_low\bbc0fbf1-787f-4709-a079-3e0b90980e5f.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                      Category:dropped
                      Size (bytes):758601
                      Entropy (8bit):7.98639316555857
                      Encrypted:false
                      SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                      MD5:3A49135134665364308390AC398006F1
                      SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                      SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                      SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                      Malicious:false
                      Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                      C:\Users\user\AppData\Local\Temp\acrocef_low\f3530d77-0309-47bb-a642-e92d627fb764.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                      Category:dropped
                      Size (bytes):1419751
                      Entropy (8bit):7.976496077007677
                      Encrypted:false
                      SSDEEP:24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
                      MD5:18E3D04537AF72FDBEB3760B2D10C80E
                      SHA1:B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
                      SHA-256:BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
                      SHA-512:2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
                      Malicious:false
                      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                      Static File Info

                      General

                      File type:PDF document, version 1.6 (zip deflate encoded)
                      Entropy (8bit):7.038771023046547
                      TrID:
                      • Adobe Portable Document Format (5005/1) 100.00%
                      File name:U.,S. Xpress (2).pdf
                      File size:90'010 bytes
                      MD5:6cd1de8d036e91c619a7c0b1533e5697
                      SHA1:53a85d618512ebded13b25e7156c8fc2f8ef0def
                      SHA256:b78e9ee78f17fe781c7e403d9ab42f39fa303f99526fedb0966cd11ec0a589d4
                      SHA512:bb110119f52877489edb31ae0d9ad2be31aecfd805040d28c53511432be7cdac169e84a059379b23b5964ae06c661e20f3973b84c20f6ef2ccd357f6f6aac09a
                      SSDEEP:1536:Oz6wmJcD9g2ksxCsIBMyOlzNs+8/GLBFPs:i6NJka2ksxCscLOlWd/G1Fk
                      TLSH:EE93DD135914CB82A56982E8BE071E985F0B6B0DE5C23AEF301F0A8B7F647364DCD56D
                      File Content Preview:%PDF-1.6.%......7 0 obj.<</Linearized 1/L 90010/O 9/E 86117/N 1/T 89719/H [ 435 134]>>.endobj. ..12 0 obj.<</DecodeParms<</Columns 3/Predictor 12>>/Filter/FlateDecode/ID[<C864B63F1FEAEE48A2F36C1DD2EFD63F><ACD746F0C53C2F409ED5708AF218029

                      File Icon

                      Icon Hash:62cc8caeb29e8ae0

                      Static PDF Info

                      General

                      Header:%PDF-1.6
                      Total Entropy:7.038771
                      Total Bytes:90010
                      Stream Entropy:7.020146
                      Stream Bytes:88609
                      Entropy outside Streams:5.351640
                      Bytes outside Streams:1401
                      Number of EOF found:2
                      Bytes after EOF:

                      Keywords Statistics

                      NameCount
                      obj11
                      endobj11
                      stream8
                      endstream8
                      xref0
                      trailer0
                      startxref2
                      /Page1
                      /Encrypt0
                      /ObjStm2
                      /URI0
                      /JS0
                      /JavaScript0
                      /AA0
                      /OpenAction0
                      /AcroForm0
                      /JBIG2Decode0
                      /RichMedia0
                      /Launch0
                      /EmbeddedFile0

                      Image Streams

                      IDDHASHMD5Preview
                      110c7c633368480d550dead377f9f3477b5b25a673a6d9b4fa

                      Network Behavior

                      Network Port Distribution

                      TCP Packets

                      TimestampSource PortDest PortSource IPDest IP
                      Apr 16, 2024 20:09:39.458899975 CEST49712443192.168.2.7184.25.164.138
                      Apr 16, 2024 20:09:39.458930969 CEST44349712184.25.164.138192.168.2.7
                      Apr 16, 2024 20:09:39.459011078 CEST49712443192.168.2.7184.25.164.138
                      Apr 16, 2024 20:09:39.459229946 CEST49712443192.168.2.7184.25.164.138
                      Apr 16, 2024 20:09:39.459238052 CEST44349712184.25.164.138192.168.2.7
                      Apr 16, 2024 20:09:39.792392969 CEST44349712184.25.164.138192.168.2.7
                      Apr 16, 2024 20:09:39.792912006 CEST49712443192.168.2.7184.25.164.138
                      Apr 16, 2024 20:09:39.792933941 CEST44349712184.25.164.138192.168.2.7
                      Apr 16, 2024 20:09:39.796566010 CEST44349712184.25.164.138192.168.2.7
                      Apr 16, 2024 20:09:39.796638966 CEST49712443192.168.2.7184.25.164.138
                      Apr 16, 2024 20:09:39.798404932 CEST49712443192.168.2.7184.25.164.138
                      Apr 16, 2024 20:09:39.798602104 CEST44349712184.25.164.138192.168.2.7
                      Apr 16, 2024 20:09:39.798608065 CEST49712443192.168.2.7184.25.164.138
                      Apr 16, 2024 20:09:39.844114065 CEST44349712184.25.164.138192.168.2.7
                      Apr 16, 2024 20:09:39.852140903 CEST49712443192.168.2.7184.25.164.138
                      Apr 16, 2024 20:09:39.852153063 CEST44349712184.25.164.138192.168.2.7
                      Apr 16, 2024 20:09:39.899029016 CEST49712443192.168.2.7184.25.164.138
                      Apr 16, 2024 20:09:39.904227018 CEST44349712184.25.164.138192.168.2.7
                      Apr 16, 2024 20:09:39.904412985 CEST44349712184.25.164.138192.168.2.7
                      Apr 16, 2024 20:09:39.904468060 CEST49712443192.168.2.7184.25.164.138
                      Apr 16, 2024 20:09:39.905004978 CEST49712443192.168.2.7184.25.164.138
                      Apr 16, 2024 20:09:39.905023098 CEST44349712184.25.164.138192.168.2.7
                      Apr 16, 2024 20:09:39.905061007 CEST49712443192.168.2.7184.25.164.138
                      Apr 16, 2024 20:09:39.905092955 CEST49712443192.168.2.7184.25.164.138

                      HTTP Request Dependency Graph

                      • armmf.adobe.com

                      HTTPS Proxied Packets

                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      0192.168.2.749712184.25.164.1384437220C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      TimestampBytes transferredDirectionData
                      2024-04-16 18:09:39 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
                      Host: armmf.adobe.com
                      Connection: keep-alive
                      Accept-Language: en-US,en;q=0.9
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
                      Sec-Fetch-Site: same-origin
                      Sec-Fetch-Mode: no-cors
                      Sec-Fetch-Dest: empty
                      Accept-Encoding: gzip, deflate, br
                      If-None-Match: "78-5faa31cce96da"
                      If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
                      2024-04-16 18:09:39 UTC198INHTTP/1.1 304 Not Modified
                      Content-Type: text/plain; charset=UTF-8
                      Last-Modified: Mon, 01 May 2023 15:02:33 GMT
                      ETag: "78-5faa31cce96da"
                      Date: Tue, 16 Apr 2024 18:09:39 GMT
                      Connection: close


                      Statistics

                      CPU Usage

                      Click to jump to process

                      Memory Usage

                      Click to jump to process

                      High Level Behavior Distribution

                      Click to dive into process behavior distribution

                      Behavior

                      Click to jump to process

                      System Behavior

                      General

                      Target ID:0
                      Start time:20:09:26
                      Start date:16/04/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\U.,S. Xpress (2).pdf"
                      Imagebase:0x7ff702560000
                      File size:5'641'176 bytes
                      MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      General

                      Target ID:3
                      Start time:20:09:26
                      Start date:16/04/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                      Imagebase:0x7ff6c3ff0000
                      File size:3'581'912 bytes
                      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      General

                      Target ID:7
                      Start time:20:09:27
                      Start date:16/04/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1628,i,13890688867868232323,6067589906686736016,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                      Imagebase:0x7ff6c3ff0000
                      File size:3'581'912 bytes
                      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      Disassembly

                      ⊘No disassembly