Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
FICHE DE GAIN 2024.pdf

Overview

General Information

Sample name:FICHE DE GAIN 2024.pdf
Analysis ID:1427901
MD5:9b71bdfa35a3a3e158eba22b8a3b9c79
SHA1:c4e0a964d16872b36ee0d7f7e3097c0c14541b30
SHA256:744b12b2d5b62e78fdadae33e9da2a635c96e10b3898af252f3fcc66eab5adf0
Infos:

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 4900 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\FICHE DE GAIN 2024.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 7192 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 7372 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1672,i,2245883855589128702,4143463741450360039,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficTCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global trafficTCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global trafficTCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global trafficTCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global trafficTCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global trafficTCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global trafficTCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global trafficTCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global trafficTCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global trafficTCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global trafficTCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global trafficTCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global trafficTCP traffic: 104.123.200.169:443 -> 192.168.2.4:49751
Source: global trafficTCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global trafficTCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global trafficTCP traffic: 104.123.200.169:443 -> 192.168.2.4:49751
Source: global trafficTCP traffic: 104.123.200.169:443 -> 192.168.2.4:49751
Source: global trafficTCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global trafficTCP traffic: 104.123.200.169:443 -> 192.168.2.4:49751
Source: global trafficTCP traffic: 104.123.200.169:443 -> 192.168.2.4:49751
Source: global trafficTCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global trafficTCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global trafficTCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global trafficTCP traffic: 104.123.200.169:443 -> 192.168.2.4:49751
Source: global trafficTCP traffic: 104.123.200.169:443 -> 192.168.2.4:49751
Source: global trafficTCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global trafficTCP traffic: 104.123.200.169:443 -> 192.168.2.4:49751
Source: global trafficTCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global trafficTCP traffic: 104.123.200.169:443 -> 192.168.2.4:49751
Source: global trafficTCP traffic: 104.123.200.169:443 -> 192.168.2.4:49751
Source: global trafficTCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global trafficTCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global trafficTCP traffic: 104.123.200.169:443 -> 192.168.2.4:49751
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 104.123.200.169
Source: unknownTCP traffic detected without corresponding DNS query: 104.123.200.169
Source: unknownTCP traffic detected without corresponding DNS query: 104.123.200.169
Source: unknownTCP traffic detected without corresponding DNS query: 104.123.200.169
Source: unknownTCP traffic detected without corresponding DNS query: 104.123.200.169
Source: unknownTCP traffic detected without corresponding DNS query: 104.123.200.169
Source: unknownTCP traffic detected without corresponding DNS query: 104.123.200.169
Source: unknownTCP traffic detected without corresponding DNS query: 104.123.200.169
Source: unknownTCP traffic detected without corresponding DNS query: 104.123.200.169
Source: unknownTCP traffic detected without corresponding DNS query: 104.123.200.169
Source: unknownTCP traffic detected without corresponding DNS query: 104.123.200.169
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: FICHE DE GAIN 2024.pdfString found in binary or memory: http://neevia.com
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: classification engineClassification label: clean1.winPDF@14/44@0/1
Source: FICHE DE GAIN 2024.pdfInitial sample: http://neevia.com\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journalJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-18 10-13-41-697.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\FICHE DE GAIN 2024.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1672,i,2245883855589128702,4143463741450360039,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1672,i,2245883855589128702,4143463741450360039,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: FICHE DE GAIN 2024.pdfInitial sample: PDF keyword /JS count = 0
Source: FICHE DE GAIN 2024.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: A9134hnii_10z2654_c0.tmp.0.drInitial sample: PDF keyword /JS count = 0
Source: A9134hnii_10z2654_c0.tmp.0.drInitial sample: PDF keyword /JavaScript count = 0
Source: FICHE DE GAIN 2024.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: FICHE DE GAIN 2024.pdfInitial sample: PDF keyword obj count = 50
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire Infrastructure1
Spearphishing Link		2
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive12
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1427901 Sample: FICHE DE GAIN 2024.pdf Startdate: 18/04/2024 Architecture: WINDOWS Score: 1 6 Acrobat.exe 18 73 2->6         started        process3 8 AcroCEF.exe 104 6->8         started        process4 10 AcroCEF.exe 2 8->10         started        dnsIp5 13 104.123.200.169, 443, 49751 AKAMAI-ASUS United States 10->13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
FICHE DE GAIN 2024.pdf0%ReversingLabs
FICHE DE GAIN 2024.pdf0%VirustotalBrowse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http://neevia.comFICHE DE GAIN 2024.pdffalse
    		high

    World Map of Contacted IPs

    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs

    Public IPs

    IPDomainCountryFlagASNASN NameMalicious
    104.123.200.169
    		unknownUnited States
    		16625AKAMAI-ASUSfalse

    General Information

    Joe Sandbox version:40.0.0 Tourmaline
    Analysis ID:1427901
    Start date and time:2024-04-18 10:12:48 +02:00
    Joe Sandbox product:CloudBasic
    Overall analysis duration:0h 4m 12s
    Hypervisor based Inspection enabled:false
    Report type:full
    Cookbook file name:defaultwindowspdfcookbook.jbs
    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
    Number of analysed new started processes analysed:10
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • HCA enabled
    • EGA enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:Timeout
    Sample name:FICHE DE GAIN 2024.pdf
    Detection:CLEAN
    Classification:clean1.winPDF@14/44@0/1
    EGA Information:Failed
    HCA Information:
    • Successful, ratio: 100%
    • Number of executed functions: 0
    • Number of non-executed functions: 0
    Cookbook Comments:
    • Found application associated with file extension: .pdf
    • Found PDF document
    • Close Viewer

    Warnings

    • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
    • Excluded IPs from analysis (whitelisted): 20.42.65.92, 23.55.252.138, 18.207.85.246, 107.22.247.231, 54.144.73.197, 34.193.227.236, 104.76.210.84, 104.76.210.69, 172.64.41.3, 162.159.61.3
    • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, geo2.adobe.com
    • Not all processes where analyzed, report is missing behavior information

    Simulations

    Behavior and APIs

    ⊘No simulations

    Joe Sandbox View / Context

    IPs

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    104.123.200.169Hays_compiled_documents.ZIP.jsGet hashmaliciousUnknownBrowse

      Domains

      ⊘No context

      ASNs

      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      AKAMAI-ASUS3OcPSlVa7n.elfGet hashmaliciousMiraiBrowse
      • 104.102.70.199
      QFR4Qsnm6y.elfGet hashmaliciousMiraiBrowse
      • 104.78.0.8
      0ZL4A1ojq4.elfGet hashmaliciousMiraiBrowse
      • 23.218.112.99
      MY69DoYgp5.elfGet hashmaliciousMiraiBrowse
      • 23.7.233.82
      http://ranchpools.comGet hashmaliciousUnknownBrowse
      • 23.79.56.153
      cx9Nvpe3Cs.elfGet hashmaliciousMiraiBrowse
      • 23.13.196.142
      aga94GHd1L.elfGet hashmaliciousMiraiBrowse
      • 23.196.82.129
      16rBksY5gH.elfGet hashmaliciousMiraiBrowse
      • 184.86.190.40
      KFGhPSUn9z.elfGet hashmaliciousMiraiBrowse
      • 23.8.92.1

      JA3 Fingerprints

      ⊘No context

      Dropped Files

      ⊘No context

      Created / dropped Files

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):292
      Entropy (8bit):5.196251002228508
      Encrypted:false
      SSDEEP:6:sKwjq2Pwkn2nKuAl9OmbnIFUt8zKwWZmw+zKGzkwOwkn2nKuAl9OmbjLJ:DwjvYfHAahFUt8uwW/+uGz5JfHAaSJ
      MD5:82349CA7CFC477C6D8550C5AC88B42AB
      SHA1:39205DCFD8022267CE6E0DB5191857186C9C0565
      SHA-256:DA7AB78D65D2510FD6F88F56074D149A098914ECF83D7D0DCE38895C6D6FE0C6
      SHA-512:2061400E1BE43E495B5D80042C100922CBD5D8702A7428C6EA462C0DF9623F85E85EE63FBD75562C69360D1CAC3218173A7080D338564C1A616A67FD7BDFD0C0
      Malicious:false
      Reputation:low
      Preview:2024/04/18-10:13:39.532 1c34 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/18-10:13:39.532 1c34 Recovering log #3.2024/04/18-10:13:39.533 1c34 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):292
      Entropy (8bit):5.196251002228508
      Encrypted:false
      SSDEEP:6:sKwjq2Pwkn2nKuAl9OmbnIFUt8zKwWZmw+zKGzkwOwkn2nKuAl9OmbjLJ:DwjvYfHAahFUt8uwW/+uGz5JfHAaSJ
      MD5:82349CA7CFC477C6D8550C5AC88B42AB
      SHA1:39205DCFD8022267CE6E0DB5191857186C9C0565
      SHA-256:DA7AB78D65D2510FD6F88F56074D149A098914ECF83D7D0DCE38895C6D6FE0C6
      SHA-512:2061400E1BE43E495B5D80042C100922CBD5D8702A7428C6EA462C0DF9623F85E85EE63FBD75562C69360D1CAC3218173A7080D338564C1A616A67FD7BDFD0C0
      Malicious:false
      Reputation:low
      Preview:2024/04/18-10:13:39.532 1c34 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/18-10:13:39.532 1c34 Recovering log #3.2024/04/18-10:13:39.533 1c34 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):336
      Entropy (8bit):5.222467838951024
      Encrypted:false
      SSDEEP:6:sKaUB9q2Pwkn2nKuAl9Ombzo2jMGIFUt8zKQ5VXZmw+zKQ5VFkwOwkn2nKuAl9OU:DaSvYfHAa8uFUt8ukVX/+ukVF5JfHAaU
      MD5:84E33C1B7234DE04C104F70959CABD56
      SHA1:C509C9A2135CA2143A39EC2874CB963107C070F1
      SHA-256:72A1A846AF63302EC4A9CC8D6367C3E73569F6D5C23963A11E35642863A8B571
      SHA-512:B24FA4E3C7F3933F0717D17FC1908142CE52D1CB17BC9EAFF9758B8857011D87F127ED98EBF97B909C6CE9D8D4FA22D23075A31ED7F0D22F86A48FB428023359
      Malicious:false
      Reputation:low
      Preview:2024/04/18-10:13:39.567 1d10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/18-10:13:39.569 1d10 Recovering log #3.2024/04/18-10:13:39.569 1d10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):336
      Entropy (8bit):5.222467838951024
      Encrypted:false
      SSDEEP:6:sKaUB9q2Pwkn2nKuAl9Ombzo2jMGIFUt8zKQ5VXZmw+zKQ5VFkwOwkn2nKuAl9OU:DaSvYfHAa8uFUt8ukVX/+ukVF5JfHAaU
      MD5:84E33C1B7234DE04C104F70959CABD56
      SHA1:C509C9A2135CA2143A39EC2874CB963107C070F1
      SHA-256:72A1A846AF63302EC4A9CC8D6367C3E73569F6D5C23963A11E35642863A8B571
      SHA-512:B24FA4E3C7F3933F0717D17FC1908142CE52D1CB17BC9EAFF9758B8857011D87F127ED98EBF97B909C6CE9D8D4FA22D23075A31ED7F0D22F86A48FB428023359
      Malicious:false
      Reputation:low
      Preview:2024/04/18-10:13:39.567 1d10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/18-10:13:39.569 1d10 Recovering log #3.2024/04/18-10:13:39.569 1d10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):475
      Entropy (8bit):4.968396423364024
      Encrypted:false
      SSDEEP:12:YH/um3RA8sqZCsBdOg2Hrtcaq3QYiubInP7E4T3y:Y2sRdsEdMHA3QYhbG7nby
      MD5:79FD142CD8A1B42CD780BCC456FBBCEF
      SHA1:702BF4D241CD4769A3A4F512C7FE0895D0EC4FB8
      SHA-256:B3169A52F8CFB3A9EE8FA7C5325718397B623BB6DB02D8614438400E29166D1F
      SHA-512:449CDC2AB7B75FC809AD2DF384711A220D3CABA1CAF6ABFED37107C6991F11C292E5C868BBF61EF4E533E91281B5C7E0365C846B0D923321D2378DF8EECBB2A2
      Malicious:false
      Reputation:low
      Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13357988031447151","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":105904},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e6bac22b-e512-4d78-a913-9b4da19b78ee.tmp

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:JSON data
      Category:modified
      Size (bytes):475
      Entropy (8bit):4.968396423364024
      Encrypted:false
      SSDEEP:12:YH/um3RA8sqZCsBdOg2Hrtcaq3QYiubInP7E4T3y:Y2sRdsEdMHA3QYhbG7nby
      MD5:79FD142CD8A1B42CD780BCC456FBBCEF
      SHA1:702BF4D241CD4769A3A4F512C7FE0895D0EC4FB8
      SHA-256:B3169A52F8CFB3A9EE8FA7C5325718397B623BB6DB02D8614438400E29166D1F
      SHA-512:449CDC2AB7B75FC809AD2DF384711A220D3CABA1CAF6ABFED37107C6991F11C292E5C868BBF61EF4E533E91281B5C7E0365C846B0D923321D2378DF8EECBB2A2
      Malicious:false
      Reputation:low
      Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13357988031447151","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":105904},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:data
      Category:dropped
      Size (bytes):4730
      Entropy (8bit):5.253987311534714
      Encrypted:false
      SSDEEP:96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7MZglvcjZ:etJCV4FiN/jTN/2r8Mta02fEhgO73gow
      MD5:BC79F19DCC577F7F9CABC259E1C2CC78
      SHA1:39DA012BD9D528D192AFFAD8AC0C6AB3B863E44E
      SHA-256:CB54F1EA86E51F301B9AC2B51147DA41A8A9EE01A23B8FFE08E5D32B1C2375AA
      SHA-512:5E5E3E0554386ED616A2FE7465713B13F6678B0F27BBD3C192BEF5D614B16CBF70045621209827F7765085601BA0BE55DEBDFD08A8EC56AF653A9B860581D15D
      Malicious:false
      Reputation:low
      Preview:*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):324
      Entropy (8bit):5.106585080414353
      Encrypted:false
      SSDEEP:6:slLa9q2Pwkn2nKuAl9OmbzNMxIFUt8zlL/Zmw+zlLx2FkwOwkn2nKuAl9OmbzNMT:GIvYfHAa8jFUt8t//+tg5JfHAa84J
      MD5:CF6FC19A31D4E826B47C531C88D01883
      SHA1:782FC1BB406AF12887E8A16D4238435CF87238CF
      SHA-256:480A47E174284E4B8C09277443860F5A1801FC122885A2B33D5FED716FB08A68
      SHA-512:69F51D5E987CAA7E5FAE27F1AE40C9C232B93E4C14DDA8BC89F159D271F1430C7D8055C5BF791853B3BBAD7C352EDFA3487B688AAC755A5D9C8AB582CD6FACC0
      Malicious:false
      Reputation:low
      Preview:2024/04/18-10:13:40.240 1d10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/18-10:13:40.242 1d10 Recovering log #3.2024/04/18-10:13:40.243 1d10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):324
      Entropy (8bit):5.106585080414353
      Encrypted:false
      SSDEEP:6:slLa9q2Pwkn2nKuAl9OmbzNMxIFUt8zlL/Zmw+zlLx2FkwOwkn2nKuAl9OmbzNMT:GIvYfHAa8jFUt8t//+tg5JfHAa84J
      MD5:CF6FC19A31D4E826B47C531C88D01883
      SHA1:782FC1BB406AF12887E8A16D4238435CF87238CF
      SHA-256:480A47E174284E4B8C09277443860F5A1801FC122885A2B33D5FED716FB08A68
      SHA-512:69F51D5E987CAA7E5FAE27F1AE40C9C232B93E4C14DDA8BC89F159D271F1430C7D8055C5BF791853B3BBAD7C352EDFA3487B688AAC755A5D9C8AB582CD6FACC0
      Malicious:false
      Reputation:low
      Preview:2024/04/18-10:13:40.240 1d10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/18-10:13:40.242 1d10 Recovering log #3.2024/04/18-10:13:40.243 1d10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240418081343Z-163.bmp

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
      Category:dropped
      Size (bytes):65110
      Entropy (8bit):3.581216414367434
      Encrypted:false
      SSDEEP:768:wUpwvrwSrsEyQe9933XEXK5ucmIoIXN7S4M1:6PXK5ucmIof1
      MD5:7046622CA00F2C45E5CFADE689354E8C
      SHA1:A17E912B39A2FD0B0C6B20BA84765A230384EC11
      SHA-256:BE1D0EF88A60FBA55830726ADAD04B9DF8464BC7E45B44644E45853FBCD3AAF8
      SHA-512:568089C70007F6BC10CFC73C14ACD449D027D08947F562458FE7F7501953298CE63483334F9EC3575F218B073629E2DB20EA77F9ECE615CB9C483B2C4A7A2115
      Malicious:false
      Reputation:low
      Preview:BMV.......6...(...k...h..... .....................................................................................................................................................................................................................................................................................................................................................................................................................X'..Y&................................................................................................................................................................................................................................................................................................................................................................................................................................G...qA..`...I...............................................................................................................................

      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
      Category:dropped
      Size (bytes):86016
      Entropy (8bit):4.445096566435648
      Encrypted:false
      SSDEEP:384:yezci5tciBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:r7s3OazzU89UTTgUL
      MD5:DB4ADC6235CE6095EFBC350C0D8BCDF1
      SHA1:AB242C90E5335D31E0A3D2DF9B721C7E74121E6D
      SHA-256:3E057667E45C28F4152A5C9FBC75914650D6C3F44E493C2949D6CFBCC4D3B50F
      SHA-512:EC21673BF3C27F7B4FEB308141811B7FA60BB05C699141BE80C67B5006247FCB83888824220FDEE2CA746641855F4C620C8598034B467AFF4ABBF680D4C3E469
      Malicious:false
      Reputation:low
      Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:SQLite Rollback Journal
      Category:dropped
      Size (bytes):8720
      Entropy (8bit):3.774015332645779
      Encrypted:false
      SSDEEP:48:7Mtp/E2ioyVwioy9oWoy1Cwoy1oKOioy1noy1AYoy1Wioy1hioybioyCoy1noy1m:7CpjuwFLXKQr9b9IVXEBodRBkQ
      MD5:800169F7CAA1CA1B44128066AF798A27
      SHA1:3A61C87D28E10E6F900391E37386A0B21E6D8424
      SHA-256:FB9D7224A3D3BFFDE44E61D386FE8D47B819BA9DD576FE15D29C42B75215D490
      SHA-512:C8C1677080721042A4095C2CE8C71E1803A8D9E08154AD7F9C5F8CDA141C4FB180FC25855E3CAC23FE2E41150AB1933E6232D54D615E904A4A2A41B267773391
      Malicious:false
      Reputation:low
      Preview:.... .c.....P.5[...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.432

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:PostScript document text
      Category:dropped
      Size (bytes):185099
      Entropy (8bit):5.182478651346149
      Encrypted:false
      SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
      MD5:94185C5850C26B3C6FC24ABC385CDA58
      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
      Malicious:false
      Reputation:moderate, very likely benign file
      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:PostScript document text
      Category:dropped
      Size (bytes):185099
      Entropy (8bit):5.182478651346149
      Encrypted:false
      SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
      MD5:94185C5850C26B3C6FC24ABC385CDA58
      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
      Malicious:false
      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:data
      Category:dropped
      Size (bytes):243196
      Entropy (8bit):3.3450692389394283
      Encrypted:false
      SSDEEP:1536:vKPCPiyzDtrh1cK3XEivK7VK/3AYvYwgqErRo+RQn:yPClJ/3AYvYwghFo+RQn
      MD5:F5567C4FF4AB049B696D3BE0DD72A793
      SHA1:EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916
      SHA-256:D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
      SHA-512:E769735991E5B1331E259608854D00CDA4F3E92285FDC500158CBD09CBCCEAD8A387F78256A43919B13EBE70C995D19242377C315B0CCBBD4F813251608C1D56
      Malicious:false
      Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):295
      Entropy (8bit):5.362394838091672
      Encrypted:false
      SSDEEP:6:YEQXJ2HXDUhjzqIR5Z9VoZcg1vRcR0YsjoAvJM3g98kUwPeUkwRe9:YvXKXIjzqI3ZEZc0vcGMbLUkee9
      MD5:57D6F3C0DE75700BF1EFDFD1F00A4582
      SHA1:3BCF5E56A2AAC596FEEC6A6DAC2B65A3D3E3DC2D
      SHA-256:DDEF8BF63DEB2F573F1AF1D6689F70B1694F0204E021883BC418858047EBFC5F
      SHA-512:2DE820B097D59FCE1217C31E2D36DAC95885750AB5160506F69607CC1A8BBAE25271484D4D94890A741AC4B4ADB0C7DEB84D60EDE5099147B6160F1228D57A46
      Malicious:false
      Preview:{"analyticsData":{"responseGUID":"412cdf13-d06f-4466-8b6c-4a4027da3ea6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713606719233,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):294
      Entropy (8bit):5.312038615218272
      Encrypted:false
      SSDEEP:6:YEQXJ2HXDUhjzqIR5Z9VoZcg1vRcR0YsjoAvJfBoTfXpnrPeUkwRe9:YvXKXIjzqI3ZEZc0vcGWTfXcUkee9
      MD5:3052F35BC5AF5DE00FC779ACBCA45527
      SHA1:CFC4E2A1F4001C805C0C6C5A3ED971668465884A
      SHA-256:149477E29ADA762013363C27AB972D16F56874E430654EA1AECEFE5A0AC7E63F
      SHA-512:0F508748F4D442612102A49C1773E98FD7DBBD80AE8FCB4D4F3A08DD55009843D18EF5CE16CB108EAC67B2A43BC4D8ADC90A3104CA727529F279662CDE444C7D
      Malicious:false
      Preview:{"analyticsData":{"responseGUID":"412cdf13-d06f-4466-8b6c-4a4027da3ea6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713606719233,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):294
      Entropy (8bit):5.290298110576079
      Encrypted:false
      SSDEEP:6:YEQXJ2HXDUhjzqIR5Z9VoZcg1vRcR0YsjoAvJfBD2G6UpnrPeUkwRe9:YvXKXIjzqI3ZEZc0vcGR22cUkee9
      MD5:258C8432117B137B52DAB970F1C8C248
      SHA1:52745050F7E16A82BB1F77D8A752A6C8B844A92C
      SHA-256:3204D6A66F105012DB01D50A2CC65AEEA31F4975874E738BBC4764E66CA1C3B1
      SHA-512:66D7D4728DD7BE2541710D9433306E7D48A2D84964D43C41D717140F82EDF9841910C8E7FEADD0A34FB636588AE5E0E6C626800FF00803B5FDF388CCAD9B6F04
      Malicious:false
      Preview:{"analyticsData":{"responseGUID":"412cdf13-d06f-4466-8b6c-4a4027da3ea6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713606719233,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):285
      Entropy (8bit):5.349371360138567
      Encrypted:false
      SSDEEP:6:YEQXJ2HXDUhjzqIR5Z9VoZcg1vRcR0YsjoAvJfPmwrPeUkwRe9:YvXKXIjzqI3ZEZc0vcGH56Ukee9
      MD5:E8B11758725D0DF98B4C0D407C8E2D65
      SHA1:15DDFCD90BCF9946971FD2ECCE786623A76F4CC4
      SHA-256:49479F2E8CAD6780E9ED7BC5282B342290FBD531E8F47FD1ED2341789584C8FB
      SHA-512:C71416EAC845350BA1D2D33FD87D4204B50679B815C33079687E0D95D56D70BA407973037987D1CB2153A302B8AE5EA7C4DD0DCD45E6F368388636E39E6E5FEC
      Malicious:false
      Preview:{"analyticsData":{"responseGUID":"412cdf13-d06f-4466-8b6c-4a4027da3ea6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713606719233,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):292
      Entropy (8bit):5.307952198928605
      Encrypted:false
      SSDEEP:6:YEQXJ2HXDUhjzqIR5Z9VoZcg1vRcR0YsjoAvJfJWCtMdPeUkwRe9:YvXKXIjzqI3ZEZc0vcGBS8Ukee9
      MD5:B7CB2D22235DDDCE1F2CEE0BBD55DD19
      SHA1:393AD8ACE0F1931A87C69FABA698D5ADE3E9CDF6
      SHA-256:83E9D2833FC71FDA429C60FCD62D935D42028D4D9DD99A4F9EFFECEEB8318A8A
      SHA-512:F38847AFFAA61DA581809CDE6E0064851398C40D07F9ABC1CFB93D3FFECDFBC559AC37D16A991BCE161F508B4C55EE979A9C7E70136737DDD4A5B6A8AE03694B
      Malicious:false
      Preview:{"analyticsData":{"responseGUID":"412cdf13-d06f-4466-8b6c-4a4027da3ea6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713606719233,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):289
      Entropy (8bit):5.294523547697024
      Encrypted:false
      SSDEEP:6:YEQXJ2HXDUhjzqIR5Z9VoZcg1vRcR0YsjoAvJf8dPeUkwRe9:YvXKXIjzqI3ZEZc0vcGU8Ukee9
      MD5:1E5B8337AEAB07A276A98E1AF81125BE
      SHA1:540CE19BDC5A61B4437EF04E34499D4B2FBAD367
      SHA-256:F554B685FBF6462AC30E8A2B4AA349A54BD28F8A51EE577B37652FFACDA91989
      SHA-512:8257B618ED86676BC8CD63EBC87485FE1B5E20AB2D6343E74038AAE40619975F157339D2929FBD246A3B3DA36C5797716B5EED5309A6B1425A1EB973947B30BB
      Malicious:false
      Preview:{"analyticsData":{"responseGUID":"412cdf13-d06f-4466-8b6c-4a4027da3ea6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713606719233,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):292
      Entropy (8bit):5.299062047033033
      Encrypted:false
      SSDEEP:6:YEQXJ2HXDUhjzqIR5Z9VoZcg1vRcR0YsjoAvJfQ1rPeUkwRe9:YvXKXIjzqI3ZEZc0vcGY16Ukee9
      MD5:2109F9198C1C1E9D6781C3711B38B70E
      SHA1:3FF8F9F19E1C8208316BF874F721CDE9321C9723
      SHA-256:9EF9C3F17CAF4FA90AEB57DABB8C00A8F34E782AD075A416E40BD9D19A533B10
      SHA-512:B2B5CF80453FAAC29E0160BFC9AF691634E09077E3D30F44F4B50C75A7744C63D7A8F50ECE0C24DDFC809A8979FB5BDF72AE667551ABB3E048452A9AE16A320F
      Malicious:false
      Preview:{"analyticsData":{"responseGUID":"412cdf13-d06f-4466-8b6c-4a4027da3ea6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713606719233,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):289
      Entropy (8bit):5.302990732376627
      Encrypted:false
      SSDEEP:6:YEQXJ2HXDUhjzqIR5Z9VoZcg1vRcR0YsjoAvJfFldPeUkwRe9:YvXKXIjzqI3ZEZc0vcGz8Ukee9
      MD5:32E0B18F75A8A3FECDE581571C525B36
      SHA1:F159589BF789E6492052C68F9842D59811016981
      SHA-256:22E44F0F7B74AF62F7809C263C3E181167F430AC7BCEC6C95C8C2CE20E6D931A
      SHA-512:79B1EF7962A5CAAA30A2B6E9DE8C0CFC37B6C5169ECA61DDA42025F322D7A2E37AA3F88DD5C1C5D089D3C62FBC1D34F25B35E5837773A42E44B7CC1C170C0B0A
      Malicious:false
      Preview:{"analyticsData":{"responseGUID":"412cdf13-d06f-4466-8b6c-4a4027da3ea6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713606719233,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):1372
      Entropy (8bit):5.738930656601431
      Encrypted:false
      SSDEEP:24:Yv6XEBEzvEKLgENRcbrZbq00iCCBrwJo++ns8ct4mFJN9:YvYsEgigrNt0wSJn+ns8cvFJ/
      MD5:794C447E820939CE1AA7269DA89B67DE
      SHA1:55BD2214C426AE30E0FC4EC35786CE489016AA33
      SHA-256:8A0EE4A2FE64BF05B50F342B6F8DE8722E545F3E3E0312AADD506EE093267778
      SHA-512:33CD6C40E55624BAD35BAAF2C9834461D7C3D098C4BE5D727315FB5A869D4713ED0738B49BAC301FBB5910AC218F20D980A559EE9188FB49F4FC3A36FB109DE8
      Malicious:false
      Preview:{"analyticsData":{"responseGUID":"412cdf13-d06f-4466-8b6c-4a4027da3ea6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713606719233,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"79887_247329ActionBlock_0","campaignId":79887,"containerId":"1","controlGroupId":"","treatmentId":"acc56846-d570-4500-a26e-7f8cf2b4acad","variationId":"247329"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJUcnkgQWNyb2JhdCBQcm8ifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNSIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTMiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIDctZGF5IHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0byBwcmVtaXVtIFBERiBhbmQgZS1zaWduaW5nIHRvb2xzLiIsImJ

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):289
      Entropy (8bit):5.301108046645115
      Encrypted:false
      SSDEEP:6:YEQXJ2HXDUhjzqIR5Z9VoZcg1vRcR0YsjoAvJfYdPeUkwRe9:YvXKXIjzqI3ZEZc0vcGg8Ukee9
      MD5:12564171DBBC823555259D0315C1E267
      SHA1:470299E3369D3D0E7C8B0C6E47E729E8A2FA3B9D
      SHA-256:7AAF6BE0552E8488C493A13C7AFB75363870594A3A0871E66A92B0872D2F2663
      SHA-512:2F412D27498D2021F184AFCF9F8CB889F66E94214404CA9E886CCD2522456A4E23BA62F407D847DBF3CD9E3736721E2E97E3A6BF862621706E24742A2D10B860
      Malicious:false
      Preview:{"analyticsData":{"responseGUID":"412cdf13-d06f-4466-8b6c-4a4027da3ea6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713606719233,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):1395
      Entropy (8bit):5.777893444228802
      Encrypted:false
      SSDEEP:24:Yv6XEBEzvrrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJN1:YvYjHgDv3W2aYQfgB5OUupHrQ9FJ7
      MD5:A7D31FAB7E07E0D582A56EAE06F80DFC
      SHA1:F7306D8A6D713CB11B7C31154930CA80C1DE0C48
      SHA-256:DC2E5CB30A9A316973F7E7B1EB5044FB99753A0C950FD5B9CF20B825682AD5A1
      SHA-512:A8F909D2A35D959C8BD194C7216B280C20B1DAAEF13A815AEA6ED1800F6EA1A987B050C64FC567EC00BDD1A2E3699EDE4A29931113EDFE3CA89FD23BD7FA3467
      Malicious:false
      Preview:{"analyticsData":{"responseGUID":"412cdf13-d06f-4466-8b6c-4a4027da3ea6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713606719233,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):291
      Entropy (8bit):5.284647528878118
      Encrypted:false
      SSDEEP:6:YEQXJ2HXDUhjzqIR5Z9VoZcg1vRcR0YsjoAvJfbPtdPeUkwRe9:YvXKXIjzqI3ZEZc0vcGDV8Ukee9
      MD5:44CB77CB1128850E0635DC5963C79011
      SHA1:2573A49EA58F52BC177830C1AD297F4C5CE6ABBA
      SHA-256:58CCD3050192AC5A5C1B930CD602FFCF1F8A4CB039BD6E3B00441B84C7E38E19
      SHA-512:9D12194EC1B5F8FE80FBA402EDD7F8011BA523FAC83CF09510AE289EA36A72BC4EFBE820F5E4DD49ADC01D701C39D5442F1C1E946F4D099A348020DD1F9C14B9
      Malicious:false
      Preview:{"analyticsData":{"responseGUID":"412cdf13-d06f-4466-8b6c-4a4027da3ea6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713606719233,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):287
      Entropy (8bit):5.289610184121545
      Encrypted:false
      SSDEEP:6:YEQXJ2HXDUhjzqIR5Z9VoZcg1vRcR0YsjoAvJf21rPeUkwRe9:YvXKXIjzqI3ZEZc0vcG+16Ukee9
      MD5:02C75DD67F24940F9DCEDB2E5C642AF6
      SHA1:1D0F0B6872E73B0C0E7ED8E78BD13F13AD63ADC7
      SHA-256:BF4A82AC121938FB9198AA234032F00C7CE3E538A09D78867186F35A6A6C8616
      SHA-512:23BEF02D8EA3BE4C76310CA51700B24DF5A53B01DC2715F08EA2BAE7807EA177575F8267FE6E5A48871604B3718AB91F4B678D26C2B8111E9879626DAC3FFEA2
      Malicious:false
      Preview:{"analyticsData":{"responseGUID":"412cdf13-d06f-4466-8b6c-4a4027da3ea6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713606719233,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):289
      Entropy (8bit):5.3076493573290415
      Encrypted:false
      SSDEEP:6:YEQXJ2HXDUhjzqIR5Z9VoZcg1vRcR0YsjoAvJfbpatdPeUkwRe9:YvXKXIjzqI3ZEZc0vcGVat8Ukee9
      MD5:D5308AEEED6DAD918000F6A42B5CB08C
      SHA1:DE89B7DA2957FB7B5EA30AC9175CAAA4B21C2729
      SHA-256:E98D1FDCCFE757E732D25A7BBD7711FEDBBB60F9FDD8995D803591394641DD39
      SHA-512:42B7A3AC8AF75E6FBC0F30B721F5B470A3CAF60A4B1FDE3FBC57CA111E9E32787F4647C74018801855D0DDEF7F647EFF52279E097CFED67D7D0ACAA28349BE5E
      Malicious:false
      Preview:{"analyticsData":{"responseGUID":"412cdf13-d06f-4466-8b6c-4a4027da3ea6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713606719233,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):286
      Entropy (8bit):5.263817998167544
      Encrypted:false
      SSDEEP:6:YEQXJ2HXDUhjzqIR5Z9VoZcg1vRcR0YsjoAvJfshHHrPeUkwRe9:YvXKXIjzqI3ZEZc0vcGUUUkee9
      MD5:AC5BF037A8158580BD0F2BE8B8B073E1
      SHA1:5F58EA8CDC19EEACE36D84836524E4EB8AD29200
      SHA-256:5C6FFAAF392D1CB2FDDC043B3BE19313A4A849171A479B7E00363117016528B1
      SHA-512:9E846D2BF674E7AB43E377C902CA862D8C228AA22035E2DFD710F7E7C0D2D92765677E84E356BA7DB02EFA894A8D8E5D8859901B06CEFC703AC1602CF557CF77
      Malicious:false
      Preview:{"analyticsData":{"responseGUID":"412cdf13-d06f-4466-8b6c-4a4027da3ea6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713606719233,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):782
      Entropy (8bit):5.366196954619168
      Encrypted:false
      SSDEEP:12:YvXKXIjzqI3ZEZc0vcGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWZ:Yv6XEBEzvy168CgEXX5kcIfANho
      MD5:821D4C2B3FBD601990EF2ADF10788C1C
      SHA1:9462B43924160AAB864804EF77437EC70B11032F
      SHA-256:49D895D37457FA68372AF2B39D062D7BD41DE99274E27D757D41EE37C2410C23
      SHA-512:96244CDE9CC710BE4ED5585410DECDACF614286CFA9C8FAF64E66589C28928977F9204AFA961B83174B351BA3C751A6C29393603DDD51F8A5B08C1CFABB240E3
      Malicious:false
      Preview:{"analyticsData":{"responseGUID":"412cdf13-d06f-4466-8b6c-4a4027da3ea6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713606719233,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1713428024264}}}}

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:data
      Category:dropped
      Size (bytes):4
      Entropy (8bit):0.8112781244591328
      Encrypted:false
      SSDEEP:3:e:e
      MD5:DC84B0D741E5BEAE8070013ADDCC8C28
      SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
      SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
      SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
      Malicious:false
      Preview:....

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):2814
      Entropy (8bit):5.128920383276001
      Encrypted:false
      SSDEEP:48:Y8m3VpaZcdUSxFq8unObZXD+oT+abZ+B4cMMjHR9U5Q:DexzFJT+uB45dHvF
      MD5:E8FA17D60F671029002752A174876D19
      SHA1:7FDC8F7F957A24CDD28FE5604FCD957DF488BBF6
      SHA-256:859112E2431DD309FBA63E2D7B90AA35229B4E559FD3F21559468C2CC9F35B0A
      SHA-512:9D086FF61A0918FBA3B5FA892E7F505B54772BE8B3A1FB49D53C32D74587A26F5016E704B8DB41DB3609B4C6310D30954C28812AFD5CE31CDCF1AD59226CFC09
      Malicious:false
      Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e474541c3c8c823bb9493d6b0ca4ca1d","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1713428023000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"20213e7eb544aeed3bdad09175f4140e","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1372,"ts":1713428023000},{"id":"Edit_InApp_Aug2020","info":{"dg":"110904ab6163ebf42d776466767b91eb","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1713428023000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"cd9e4fc0a86035643aced6bd8ac94f40","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1713428023000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"e2edf59e2303856872d78e93bfc95a79","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1713428023000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"194c73fa341a4720bdd509bcae90043a","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1713428023000},

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
      Category:dropped
      Size (bytes):12288
      Entropy (8bit):1.1863677753820252
      Encrypted:false
      SSDEEP:48:TGufl2GL7msEHUUUUUUUUMzSvR9H9vxFGiDIAEkGVvpAr:lNVmswUUUUUUUUMz+FGSItMr
      MD5:A0E66063FE0FDB3DA9E48B80E78CC8E5
      SHA1:163E7E10058394B8B5CF81E2F6F5004DC37E5F12
      SHA-256:FFF017BCC40679771AFAAEF6F03D0D351DF66B1D695A45B364687912F231445E
      SHA-512:50599F629CD0F40BE7BCCD82599DC0E2E704CA1766DA8B673299E3B387CD558E6674B256DCD831ED3CEBF2D88A9281F3E5C6EFF03ABB9500541263D9350AA640
      Malicious:false
      Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:SQLite Rollback Journal
      Category:dropped
      Size (bytes):8720
      Entropy (8bit):1.6069153652321457
      Encrypted:false
      SSDEEP:48:7M8KUUUUUUUUUUM3vR9H9vxFGiDIAEkGVvsqFl2GL7msa:7wUUUUUUUUUUMPFGSIt+KVmsa
      MD5:1409BCD702CDB38516C2777985B8B421
      SHA1:F308089A19C303BB1D67547B3C7A40FCF597739E
      SHA-256:AA006F79D62A48566B4C11A0464D06CA6681E69F04A20DF3B675EEC97D6D29FA
      SHA-512:725EC35DDB19A932DFE9D7DD45EF75F54B6B626A5C532A298960C2E7260709CBAB508045D6A6842A781A23442FCFBC9662B250157BEB4CA6467C8C6D02458D74
      Malicious:false
      Preview:.... .c.....*.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

      C:\Users\user\AppData\Local\Temp\MSI95e1a.LOG

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
      Category:dropped
      Size (bytes):246
      Entropy (8bit):3.518261198325562
      Encrypted:false
      SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8sKkadN0:Qw946cPbiOxDlbYnuRKSO
      MD5:A3C14026DF4562E07557D67D0F383045
      SHA1:BF2F0BD0E3CEDDABA850EE72B9379A7DA546A2B3
      SHA-256:3A11733727B399B3358214B7CC482C18816E67D0056AA11A110F1F6EC3998D9F
      SHA-512:855A9804AC73E4D832B7A3F065D8810106551E83FBE6F3797DF33ECA3B16C3121A5BF9B37565A003C93C004F329077400326AC058B1BA41C840117663749265C
      Malicious:false
      Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.8./.0.4./.2.0.2.4. . .1.0.:.1.3.:.4.7. .=.=.=.....

      C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9134hnii_10z2654_c0.tmp

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:PDF document, version 1.6, 0 pages
      Category:dropped
      Size (bytes):358
      Entropy (8bit):5.05100661932404
      Encrypted:false
      SSDEEP:6:IngVMrexJzJT0y9VEQIFVmb/eu2g/86S1kxROOFzTaheXezTaheqbyLCSyAAO:IngVMre9T0HQIDmy9g06JX0eX9eqmlX
      MD5:6ABF384C53C330C9E31247C2EA67476E
      SHA1:1DF7D850EE546BC85C86673E15692CA77EC67BDC
      SHA-256:77E58A44810D574DF240A4FC766C277C62CCF368FA1024305E1F74EF4F4C59FA
      SHA-512:8414F329988E25D342D48B61E5D6634AEF2E7C6B57151165C28B869D0F6AFFC6537B54812ED0870C1DD2AF61A52E55D8C9F45EFAEB86A0CA020655F9964E7308
      Malicious:false
      Preview:%PDF-1.6.%......1 0 obj.<</Pages 2 0 R/Type/Catalog>>.endobj.2 0 obj.<</Count 0/Kids[]/Type/Pages>>.endobj.3 0 obj.<<>>.endobj.xref..0 4..0000000000 65535 f..0000000016 00000 n..0000000061 00000 n..0000000107 00000 n..trailer..<</Size 4/Root 1 0 R/Info 3 0 R/ID[<E12A016EE7F3D44A9BF6DC0DB0351838><E12A016EE7F3D44A9BF6DC0DB0351838>]>>..startxref..127..%%EOF..

      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-18 10-13-41-697.log

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:ASCII text, with very long lines (393)
      Category:dropped
      Size (bytes):16525
      Entropy (8bit):5.345946398610936
      Encrypted:false
      SSDEEP:384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
      MD5:8947C10F5AB6CFFFAE64BCA79B5A0BE3
      SHA1:70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
      SHA-256:4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
      SHA-512:B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
      Malicious:false
      Preview:SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:ASCII text, with very long lines (393), with CRLF line terminators
      Category:dropped
      Size (bytes):16603
      Entropy (8bit):5.333389848606344
      Encrypted:false
      SSDEEP:384:cqL9h9c959n9e939G9ti9o9x9rwuw4wvu7c0c4c+cSDBDND4DPDDlkKkukckCLb2:Q6k+/at
      MD5:5F8C176A7F024D1BB1912A37C1F0BF4B
      SHA1:B620BD58F6DE979F9A74EC9856B98639BEA32A61
      SHA-256:DCB4D3926A6792F2F1B45BEB196C061BDF534C7720124BDB2BAB8B2A30353C35
      SHA-512:15405CA718702784F88DF600CC80A440FB09FDC042635FCE74799C7F3185F2A386037757C249D43795E9DF90D25E30BDB5B5C5B564D57464CDD8A37BA370C6AF
      Malicious:false
      Preview:SessionID=50a108ff-ff36-410e-b166-eaef96bf24b1.1713428021725 Timestamp=2024-04-18T10:13:41:725+0200 ThreadID=7184 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=50a108ff-ff36-410e-b166-eaef96bf24b1.1713428021725 Timestamp=2024-04-18T10:13:41:726+0200 ThreadID=7184 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=50a108ff-ff36-410e-b166-eaef96bf24b1.1713428021725 Timestamp=2024-04-18T10:13:41:726+0200 ThreadID=7184 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=50a108ff-ff36-410e-b166-eaef96bf24b1.1713428021725 Timestamp=2024-04-18T10:13:41:726+0200 ThreadID=7184 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=50a108ff-ff36-410e-b166-eaef96bf24b1.1713428021725 Timestamp=2024-04-18T10:13:41:726+0200 ThreadID=7184 Component=ngl-lib_NglAppLib Description="SetConf

      C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:ASCII text, with CRLF line terminators
      Category:dropped
      Size (bytes):29845
      Entropy (8bit):5.386441418872017
      Encrypted:false
      SSDEEP:768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rF:p
      MD5:E9CAE47F5B8594ED1CED7A81A1C76CCB
      SHA1:CB5AFE8A76255EADEF28A0E664A6680E8F873050
      SHA-256:1698BABD6A2A524CBE603D60FB6134D47989BFAF6E0D8A64D21FAFFDCDA8D053
      SHA-512:03BEB01D6281926A2288769F9E2A617CBD6C9BB519FF4B984A74115BEBDC2770D1BE88D7136E589ED98D3F56F17C04D584029BCE87DCD2C22772EFDFA69B07D1
      Malicious:false
      Preview:03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

      C:\Users\user\AppData\Local\Temp\acrocef_low\00310207-ac81-4d22-9640-dee75aae0360.tmp

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
      Category:dropped
      Size (bytes):1419751
      Entropy (8bit):7.976496077007677
      Encrypted:false
      SSDEEP:24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
      MD5:18E3D04537AF72FDBEB3760B2D10C80E
      SHA1:B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
      SHA-256:BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
      SHA-512:2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
      Malicious:false
      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

      C:\Users\user\AppData\Local\Temp\acrocef_low\3dc66295-831d-4907-892b-2af48af921c9.tmp

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
      Category:dropped
      Size (bytes):758601
      Entropy (8bit):7.98639316555857
      Encrypted:false
      SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
      MD5:3A49135134665364308390AC398006F1
      SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
      SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
      SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
      Malicious:false
      Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

      C:\Users\user\AppData\Local\Temp\acrocef_low\a91a770a-7ad1-4394-8d34-018fa1452276.tmp

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
      Category:dropped
      Size (bytes):1407294
      Entropy (8bit):7.97605879016224
      Encrypted:false
      SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
      MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
      SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
      SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
      SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
      Malicious:false
      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

      C:\Users\user\AppData\Local\Temp\acrocef_low\b7cd88c5-1422-4907-b244-949c501ea5bc.tmp

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
      Category:dropped
      Size (bytes):386528
      Entropy (8bit):7.9736851559892425
      Encrypted:false
      SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
      MD5:5C48B0AD2FEF800949466AE872E1F1E2
      SHA1:337D617AE142815EDDACB48484628C1F16692A2F
      SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
      SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
      Malicious:false
      Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

      Static File Info

      General

      File type:PDF document, version 1.7, 4 pages (zip deflate encoded)
      Entropy (8bit):7.967833919348704
      TrID:
      • Adobe Portable Document Format (5005/1) 100.00%
      File name:FICHE DE GAIN 2024.pdf
      File size:177'255 bytes
      MD5:9b71bdfa35a3a3e158eba22b8a3b9c79
      SHA1:c4e0a964d16872b36ee0d7f7e3097c0c14541b30
      SHA256:744b12b2d5b62e78fdadae33e9da2a635c96e10b3898af252f3fcc66eab5adf0
      SHA512:3ccf292823bac8e4a22fbad17f7a5c1517267fb346babd84d913cd4da24cdc5fd8f75f9734de15a0dd13fd0b4445d8cd7d4ddbfa2f2124a148c9fa4fb6e1c4fd
      SSDEEP:3072:mREIOjUxENHD37THsKCxDWRvEmOJk3JwNklFbLNJt6XtA36nkjijBN56Z0c0Bb:mo/HJCxYvWJk5wOnb5Jt+CKkj6BNTV
      TLSH:D9040202A644D1CCE2201AE17F2A3467DB4D71B779C494B03C7E9A97C6A0F76DD0BA87
      File Content Preview:%PDF-1.7..%......1 0 obj..<</Type/Page/Resources<</XObject<</Image4 2 0 R/Image7 3 0 R/Image9 4 0 R/Image26 5 0 R/Image27 6 0 R/Image30 7 0 R/Image32 8 0 R>>/ExtGState<</GS5 9 0 R/GS13 10 0 R>>/Font<</F1 11 0 R/F2 12 0 R/F3 13 0 R/F4 14 0 R/F5 15 0 R>>/Pr

      File Icon

      Icon Hash:62cc8caeb29e8ae0

      Static PDF Info

      General

      Header:%PDF-1.7
      Total Entropy:7.967834
      Total Bytes:177255
      Stream Entropy:7.989411
      Stream Bytes:167232
      Entropy outside Streams:5.155598
      Bytes outside Streams:10023
      Number of EOF found:1
      Bytes after EOF:

      Keywords Statistics

      NameCount
      obj50
      endobj50
      stream17
      endstream17
      xref1
      trailer1
      startxref1
      /Page1
      /Encrypt0
      /ObjStm0
      /URI0
      /JS0
      /JavaScript0
      /AA0
      /OpenAction0
      /AcroForm0
      /JBIG2Decode0
      /RichMedia0
      /Launch0
      /EmbeddedFile0

      Image Streams

      IDDHASHMD5Preview
      83ca4c6c5a666ec2c087cc04aee95213b718567c0c3729413
      383cb4caca92a2ec04ff3648becfd4ea7d24c7e8792f10cd38
      70e9293e39392920ebb2fddc86c5e83a9cdab0334c4b21103
      390e9292e79392920e839fd04f200f54bbed8eddd9fe3a155e
      6626161616169690156b10b76ca827e7250439c68b3444c4e

      Network Behavior

      Network Port Distribution

      TCP Packets

      TimestampSource PortDest PortSource IPDest IP
      Apr 18, 2024 10:13:52.005047083 CEST49751443192.168.2.4104.123.200.169
      Apr 18, 2024 10:13:52.005078077 CEST44349751104.123.200.169192.168.2.4
      Apr 18, 2024 10:13:52.005409956 CEST49751443192.168.2.4104.123.200.169
      Apr 18, 2024 10:13:52.005676031 CEST49751443192.168.2.4104.123.200.169
      Apr 18, 2024 10:13:52.005688906 CEST44349751104.123.200.169192.168.2.4
      Apr 18, 2024 10:13:52.327172995 CEST44349751104.123.200.169192.168.2.4
      Apr 18, 2024 10:13:52.328005075 CEST49751443192.168.2.4104.123.200.169
      Apr 18, 2024 10:13:52.328036070 CEST44349751104.123.200.169192.168.2.4
      Apr 18, 2024 10:13:52.331614017 CEST44349751104.123.200.169192.168.2.4
      Apr 18, 2024 10:13:52.332123041 CEST49751443192.168.2.4104.123.200.169
      Apr 18, 2024 10:13:52.333765030 CEST49751443192.168.2.4104.123.200.169
      Apr 18, 2024 10:13:52.333765984 CEST49751443192.168.2.4104.123.200.169
      Apr 18, 2024 10:13:52.333784103 CEST44349751104.123.200.169192.168.2.4
      Apr 18, 2024 10:13:52.333848953 CEST44349751104.123.200.169192.168.2.4
      Apr 18, 2024 10:13:52.381752014 CEST49751443192.168.2.4104.123.200.169
      Apr 18, 2024 10:13:52.381776094 CEST44349751104.123.200.169192.168.2.4
      Apr 18, 2024 10:13:52.428899050 CEST49751443192.168.2.4104.123.200.169
      Apr 18, 2024 10:13:52.440726995 CEST44349751104.123.200.169192.168.2.4
      Apr 18, 2024 10:13:52.440826893 CEST44349751104.123.200.169192.168.2.4
      Apr 18, 2024 10:13:52.441323996 CEST49751443192.168.2.4104.123.200.169
      Apr 18, 2024 10:13:52.441796064 CEST49751443192.168.2.4104.123.200.169
      Apr 18, 2024 10:13:52.441807032 CEST44349751104.123.200.169192.168.2.4

      HTTP Request Dependency Graph

      • armmf.adobe.com

      HTTPS Proxied Packets

      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
      0192.168.2.449751104.123.200.1694437372C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      TimestampBytes transferredDirectionData
      2024-04-18 08:13:52 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
      Host: armmf.adobe.com
      Connection: keep-alive
      Accept-Language: en-US,en;q=0.9
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
      Sec-Fetch-Site: same-origin
      Sec-Fetch-Mode: no-cors
      Sec-Fetch-Dest: empty
      Accept-Encoding: gzip, deflate, br
      If-None-Match: "78-5faa31cce96da"
      If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
      2024-04-18 08:13:52 UTC198INHTTP/1.1 304 Not Modified
      Content-Type: text/plain; charset=UTF-8
      Last-Modified: Mon, 01 May 2023 15:02:33 GMT
      ETag: "78-5faa31cce96da"
      Date: Thu, 18 Apr 2024 08:13:52 GMT
      Connection: close


      Statistics

      CPU Usage

      Click to jump to process

      Memory Usage

      Click to jump to process

      High Level Behavior Distribution

      Click to dive into process behavior distribution

      Behavior

      Click to jump to process

      System Behavior

      General

      Target ID:0
      Start time:10:13:38
      Start date:18/04/2024
      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      Wow64 process (32bit):false
      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\FICHE DE GAIN 2024.pdf"
      Imagebase:0x7ff6bc1b0000
      File size:5'641'176 bytes
      MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
      Has elevated privileges:true
      Has administrator privileges:true
      Programmed in:C, C++ or other language
      Reputation:moderate
      Has exited:true

      General

      Target ID:1
      Start time:10:13:39
      Start date:18/04/2024
      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      Wow64 process (32bit):false
      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
      Imagebase:0x7ff74bb60000
      File size:3'581'912 bytes
      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
      Has elevated privileges:true
      Has administrator privileges:true
      Programmed in:C, C++ or other language
      Reputation:moderate
      Has exited:true

      General

      Target ID:3
      Start time:10:13:39
      Start date:18/04/2024
      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      Wow64 process (32bit):false
      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1672,i,2245883855589128702,4143463741450360039,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
      Imagebase:0x7ff74bb60000
      File size:3'581'912 bytes
      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
      Has elevated privileges:true
      Has administrator privileges:true
      Programmed in:C, C++ or other language
      Reputation:moderate
      Has exited:true

      Disassembly

      ⊘No disassembly