Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Mental Health Services Provider Cover RFP 2024013- CC Family.pdf

Overview

General Information

Sample name:Mental Health Services Provider Cover RFP 2024013- CC Family.pdf
Analysis ID:1428425
MD5:1f1c94dc25e8dacecaecc125de1706ba
SHA1:64d97b4c81e249d87350ee1f4508c901422705c0
SHA256:d43ead01155de2720b57ec936661612de86794a375ec0dc379d41fb39a7f3c1f
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 7304 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Mental Health Services Provider Cover RFP 2024013- CC Family.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 7488 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 7680 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1596,i,17097383006528070282,10288752137020408786,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.46.240.131:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.46.240.131:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.46.240.131:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.46.240.131:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.46.240.131:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.46.240.131:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.46.240.131:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.46.240.131:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.46.240.131:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.46.240.131:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.46.240.131:443
Source: global trafficTCP traffic: 23.46.240.131:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.46.240.131:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.46.240.131:443
Source: global trafficTCP traffic: 23.46.240.131:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 23.46.240.131:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.46.240.131:443
Source: global trafficTCP traffic: 23.46.240.131:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 23.46.240.131:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.46.240.131:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.46.240.131:443
Source: global trafficTCP traffic: 23.46.240.131:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.46.240.131:443
Source: global trafficTCP traffic: 23.46.240.131:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.46.240.131:443
Source: global trafficTCP traffic: 23.46.240.131:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 23.46.240.131:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.46.240.131:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.46.240.131:443
Source: global trafficTCP traffic: 23.46.240.131:443 -> 192.168.2.4:49740
Source: Joe Sandbox ViewIP Address: 23.46.240.131 23.46.240.131
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.240.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.240.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.240.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.240.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.240.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.240.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.240.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.240.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.240.131
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.240.131
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: classification engineClassification label: clean2.winPDF@14/43@0/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journalJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-18 22-54-58-052.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Mental Health Services Provider Cover RFP 2024013- CC Family.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1596,i,17097383006528070282,10288752137020408786,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1596,i,17097383006528070282,10288752137020408786,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: Mental Health Services Provider Cover RFP 2024013- CC Family.pdfInitial sample: PDF keyword /JS count = 0
Source: Mental Health Services Provider Cover RFP 2024013- CC Family.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: Mental Health Services Provider Cover RFP 2024013- CC Family.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive12
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1428425 Sample: Mental Health Services Prov... Startdate: 18/04/2024 Architecture: WINDOWS Score: 2 6 Acrobat.exe 18 72 2->6         started        process3 8 AcroCEF.exe 104 6->8         started        process4 10 AcroCEF.exe 2 8->10         started        dnsIp5 13 23.46.240.131, 443, 49740 AKAMAI-ASUS United States 10->13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
23.46.240.131
unknownUnited States
16625AKAMAI-ASUSfalse

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1428425
Start date and time:2024-04-18 22:54:06 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 3m 58s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultwindowspdfcookbook.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:10
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:Mental Health Services Provider Cover RFP 2024013- CC Family.pdf
Detection:CLEAN
Classification:clean2.winPDF@14/43@0/1
Cookbook Comments:
  • Found application associated with file extension: .pdf
  • Found PDF document
  • Close Viewer

Warnings

  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 184.31.60.185, 107.22.247.231, 54.144.73.197, 18.207.85.246, 34.193.227.236, 96.7.224.9, 96.7.224.59, 162.159.61.3, 172.64.41.3, 23.209.188.149, 23.209.188.151
  • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com
  • Not all processes where analyzed, report is missing behavior information
  • VT rate limit hit for: Mental Health Services Provider Cover RFP 2024013- CC Family.pdf

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
23.46.240.131RFQ.xlsGet hashmaliciousUnknownBrowse
    p5.htaGet hashmaliciousXWormBrowse
      doxx.lnkGet hashmaliciousPureCrypter, PureLog Stealer, RedLineBrowse
        PO008475638473.xlsGet hashmaliciousUnknownBrowse
          https://frenchinstitute-my.sharepoint.com/:f:/g/personal/claire_goller_institut-francais_org_uk/EufbV0KyKXlHkna5NPTykO4BcMWBnoPWI_IrwXx-Bdwjjw?e=uKXt6RGet hashmaliciousUnknownBrowse
            account_pdf.zipGet hashmaliciousSugarGhostBrowse
              DHL_DOC19001-3671.xla.xlsxGet hashmaliciousUnknownBrowse
                https://listerbeaupre-my.sharepoint.com/:b:/g/personal/amy_listerlawyers_com/EbhWOKfE49REtrfKirj6ZQUB5fSlwdbL6JjW_pn7rshZ2w?e=4%3a3hIjCn&at=9Get hashmaliciousUnknownBrowse
                  Air-Vibes-Wireless-Earbuds-Instructions.7zGet hashmaliciousJupyterBrowse

                    Domains

                    ⊘No context

                    ASNs

                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                    AKAMAI-ASUSBzmhHwFpCV.elfGet hashmaliciousMiraiBrowse
                    • 172.225.191.4
                    dPFRrhKTeG.elfGet hashmaliciousUnknownBrowse
                    • 88.221.207.232
                    0001.docGet hashmaliciousDynamerBrowse
                    • 23.44.104.130
                    PO_983888123.xlsGet hashmaliciousUnknownBrowse
                    • 23.36.68.10
                    SA162.pdf.download.lnkGet hashmaliciousUnknownBrowse
                    • 23.63.158.36
                    SA161.pdf.lnkGet hashmaliciousRHADAMANTHYSBrowse
                    • 23.46.201.17
                    Factura_SA161.pdf.lnkGet hashmaliciousRHADAMANTHYSBrowse
                    • 184.31.60.185
                    E3kpuuuOfy.elfGet hashmaliciousMiraiBrowse
                    • 104.114.141.6
                    3OcPSlVa7n.elfGet hashmaliciousMiraiBrowse
                    • 104.102.70.199
                    QFR4Qsnm6y.elfGet hashmaliciousMiraiBrowse
                    • 104.78.0.8

                    JA3 Fingerprints

                    ⊘No context

                    Dropped Files

                    ⊘No context

                    Created / dropped Files

                    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:ASCII text
                    Category:dropped
                    Size (bytes):292
                    Entropy (8bit):5.248398902319459
                    Encrypted:false
                    SSDEEP:6:P1QL+q2Pwkn2nKuAl9OmbnIFUt8iLO3G1Zmw+iLO3QLVkwOwkn2nKuAl9OmbjLJ:PayvYfHAahFUt8iLOQ/+iLOgR5JfHAae
                    MD5:6059B0E5C6E96F8C0CC6F5469E2A6BF5
                    SHA1:7D8687C0DC2B018F7A71BF1E89751B29605A0A12
                    SHA-256:FFEB46BC1918C7AFE9F45227D5B86A07C8361BADB7121958DFE538A868DC0A27
                    SHA-512:A40750CC5753D2DD38316A399AE454343B04F1656C8411456AB299F591A2B0995919917E98AACDEA50D65439BA61E54B6FCBDA8080729823E4D35FA1D76066ED
                    Malicious:false
                    Reputation:low
                    Preview:2024/04/18-22:54:55.772 1da8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/18-22:54:55.773 1da8 Recovering log #3.2024/04/18-22:54:55.773 1da8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:ASCII text
                    Category:dropped
                    Size (bytes):292
                    Entropy (8bit):5.248398902319459
                    Encrypted:false
                    SSDEEP:6:P1QL+q2Pwkn2nKuAl9OmbnIFUt8iLO3G1Zmw+iLO3QLVkwOwkn2nKuAl9OmbjLJ:PayvYfHAahFUt8iLOQ/+iLOgR5JfHAae
                    MD5:6059B0E5C6E96F8C0CC6F5469E2A6BF5
                    SHA1:7D8687C0DC2B018F7A71BF1E89751B29605A0A12
                    SHA-256:FFEB46BC1918C7AFE9F45227D5B86A07C8361BADB7121958DFE538A868DC0A27
                    SHA-512:A40750CC5753D2DD38316A399AE454343B04F1656C8411456AB299F591A2B0995919917E98AACDEA50D65439BA61E54B6FCBDA8080729823E4D35FA1D76066ED
                    Malicious:false
                    Reputation:low
                    Preview:2024/04/18-22:54:55.772 1da8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/18-22:54:55.773 1da8 Recovering log #3.2024/04/18-22:54:55.773 1da8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:ASCII text
                    Category:dropped
                    Size (bytes):336
                    Entropy (8bit):5.169481030526052
                    Encrypted:false
                    SSDEEP:6:PKL4q2Pwkn2nKuAl9Ombzo2jMGIFUt8iKcZZmw+iKczkwOwkn2nKuAl9Ombzo2jz:PKL4vYfHAa8uFUt8iKw/+iK45JfHAa8z
                    MD5:66ADEBF8F20F5054B0545FC777325127
                    SHA1:513BD1105A7D78D04AE1465391D3BB75F99A0773
                    SHA-256:71EFBD646DC34549C772C2676452197158CC8A0A1483C86CD8A51E6D29DA5A30
                    SHA-512:1F101AF4B56CAAD05642CE50EFD466251804D0FBB8BB746EFF68C5012198F910E13FDB6912975EF88AAA652EB4490BAB2FC899DF45ACB206BAE4F05CC712E874
                    Malicious:false
                    Reputation:low
                    Preview:2024/04/18-22:54:55.817 1e20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/18-22:54:55.818 1e20 Recovering log #3.2024/04/18-22:54:55.818 1e20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:ASCII text
                    Category:dropped
                    Size (bytes):336
                    Entropy (8bit):5.169481030526052
                    Encrypted:false
                    SSDEEP:6:PKL4q2Pwkn2nKuAl9Ombzo2jMGIFUt8iKcZZmw+iKczkwOwkn2nKuAl9Ombzo2jz:PKL4vYfHAa8uFUt8iKw/+iK45JfHAa8z
                    MD5:66ADEBF8F20F5054B0545FC777325127
                    SHA1:513BD1105A7D78D04AE1465391D3BB75F99A0773
                    SHA-256:71EFBD646DC34549C772C2676452197158CC8A0A1483C86CD8A51E6D29DA5A30
                    SHA-512:1F101AF4B56CAAD05642CE50EFD466251804D0FBB8BB746EFF68C5012198F910E13FDB6912975EF88AAA652EB4490BAB2FC899DF45ACB206BAE4F05CC712E874
                    Malicious:false
                    Reputation:low
                    Preview:2024/04/18-22:54:55.817 1e20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/18-22:54:55.818 1e20 Recovering log #3.2024/04/18-22:54:55.818 1e20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):475
                    Entropy (8bit):4.971873232741717
                    Encrypted:false
                    SSDEEP:12:YH/um3RA8sqZkusBdOg2Hicaq3QYiubInP7E4T3y:Y2sRdsFdMHt3QYhbG7nby
                    MD5:B851B982354890E84C813A2437D7747E
                    SHA1:52D94BEC30C0E14B62C61DA00AF82D51E1C5B0BE
                    SHA-256:AC6A342978590EA49703DA2EF61885C0EFBF2FAD505EE4C1FBE2F1E7B2FABFC8
                    SHA-512:D8C67CE31CC28F1552F7F386B3E89538A3651F1E0AA6C1381BC2CFEEFB765E573F4D3CE91B2363E437754527DA0683CC73F1234DEB243AB341846F15BC3D6389
                    Malicious:false
                    Reputation:low
                    Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13358033707796078","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":107444},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\be32c16e-fe30-4718-a094-0fecee59a6d5.tmp

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:JSON data
                    Category:modified
                    Size (bytes):475
                    Entropy (8bit):4.971873232741717
                    Encrypted:false
                    SSDEEP:12:YH/um3RA8sqZkusBdOg2Hicaq3QYiubInP7E4T3y:Y2sRdsFdMHt3QYhbG7nby
                    MD5:B851B982354890E84C813A2437D7747E
                    SHA1:52D94BEC30C0E14B62C61DA00AF82D51E1C5B0BE
                    SHA-256:AC6A342978590EA49703DA2EF61885C0EFBF2FAD505EE4C1FBE2F1E7B2FABFC8
                    SHA-512:D8C67CE31CC28F1552F7F386B3E89538A3651F1E0AA6C1381BC2CFEEFB765E573F4D3CE91B2363E437754527DA0683CC73F1234DEB243AB341846F15BC3D6389
                    Malicious:false
                    Reputation:low
                    Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13358033707796078","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":107444},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):4730
                    Entropy (8bit):5.250348356524762
                    Encrypted:false
                    SSDEEP:96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo74Uz4GIzZ:etJCV4FiN/jTN/2r8Mta02fEhgO73go+
                    MD5:09228C1371C72DF230C92891B6488DF0
                    SHA1:75AAEAB3AFB913774FF4D3429D59D343D5A87787
                    SHA-256:874BF4A015504C0AF8E04D716D06C8BE357B33666FC4AA432969FC6A4C79D253
                    SHA-512:DA7CDF759A5926C8D637CF1285A87D31A82C3DD303337489E205F14A87128D1A821AA7DA24C82D8D4F7BCBB5E0EAB42E946A6B06FEB46777F2159D0A9E865675
                    Malicious:false
                    Reputation:low
                    Preview:*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

                    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:ASCII text
                    Category:dropped
                    Size (bytes):324
                    Entropy (8bit):5.211638707462796
                    Encrypted:false
                    SSDEEP:6:P7bAq2Pwkn2nKuAl9OmbzNMxIFUt8i7hrZmw+i7WDkwOwkn2nKuAl9OmbzNMFLJ:P7bAvYfHAa8jFUt8i7t/+i7q5JfHAa8E
                    MD5:07F865BBAB87A7327A7B3940EF5244AE
                    SHA1:067119B00A48A0B56DBB3AC71B440742CDB7F8A5
                    SHA-256:9B319DA484A570F08EDF018B0B9AFE55ED06C9571A11CB9CB7E9F21D0AACF46E
                    SHA-512:04A4BA9A68C9C48E6D3B012E7932EA692065EF329D0F82B4B2F660B81555E5C981DC642B10CA597FFE6089496ED96341AE10C97D8263E66950E5B45E141E6586
                    Malicious:false
                    Reputation:low
                    Preview:2024/04/18-22:54:56.327 1e20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/18-22:54:56.334 1e20 Recovering log #3.2024/04/18-22:54:56.339 1e20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:ASCII text
                    Category:dropped
                    Size (bytes):324
                    Entropy (8bit):5.211638707462796
                    Encrypted:false
                    SSDEEP:6:P7bAq2Pwkn2nKuAl9OmbzNMxIFUt8i7hrZmw+i7WDkwOwkn2nKuAl9OmbzNMFLJ:P7bAvYfHAa8jFUt8i7t/+i7q5JfHAa8E
                    MD5:07F865BBAB87A7327A7B3940EF5244AE
                    SHA1:067119B00A48A0B56DBB3AC71B440742CDB7F8A5
                    SHA-256:9B319DA484A570F08EDF018B0B9AFE55ED06C9571A11CB9CB7E9F21D0AACF46E
                    SHA-512:04A4BA9A68C9C48E6D3B012E7932EA692065EF329D0F82B4B2F660B81555E5C981DC642B10CA597FFE6089496ED96341AE10C97D8263E66950E5B45E141E6586
                    Malicious:false
                    Reputation:low
                    Preview:2024/04/18-22:54:56.327 1e20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/18-22:54:56.334 1e20 Recovering log #3.2024/04/18-22:54:56.339 1e20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                    C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240418205500Z-153.bmp

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
                    Category:dropped
                    Size (bytes):71190
                    Entropy (8bit):1.982378618783049
                    Encrypted:false
                    SSDEEP:192:RF1ASHsomWAKKQXcYjhKgeMODcjRRZD0BrKL9:RFxMqxdJRRZD0BrW9
                    MD5:AA5D29D4DAC0DAEF0B6232C51F21E111
                    SHA1:C0777BCFE3E2845573FAA1033959AA0C77931960
                    SHA-256:C465865F3CD1AF91B656B2EFF69852A2BB4480FBF59FC74B1EB8501D61CBEFBC
                    SHA-512:FA5293A09A4AE7E579C2232F53777D7663B6699A1076D6BCDF280063ADAC359A42E252B040A4494626D33EA549560830852DA7006CCF645EFFA6C1122F53EDD3
                    Malicious:false
                    Reputation:low
                    Preview:BM........6...(...u...h..... ..........................],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..],..]

                    C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
                    Category:dropped
                    Size (bytes):86016
                    Entropy (8bit):4.445191040298815
                    Encrypted:false
                    SSDEEP:384:yezci5tciBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:r7s3OazzU89UTTgUL
                    MD5:F3FC615D3141AF9B514306DA69F9C0C8
                    SHA1:BF7C4ABDF8B48974BE3B187198DAFDA9974413CD
                    SHA-256:475F76B6E48584B1545970D9F77BE41FB7469D295E0FB6DD22D4C323DCC1F94E
                    SHA-512:0FED1A4B01CA1984795C34A9581A2A01138CAF275B82B864BC488D3C0FFAC7C2EA9A70755C56DF0F9192122B57224DB7FD257919191C4808EEF1163E0D509889
                    Malicious:false
                    Reputation:low
                    Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:SQLite Rollback Journal
                    Category:dropped
                    Size (bytes):8720
                    Entropy (8bit):3.7754524609555022
                    Encrypted:false
                    SSDEEP:48:7M7p/E2ioyVwioy9oWoy1Cwoy1oKOioy1noy1AYoy1Wioy1hioybioyCoy1noy1T:7opjuwFLXKQbtb9IVXEBodRBkZ
                    MD5:8E9EAADDB8BF0B1F71A3B7CA3DCA2B03
                    SHA1:09A5B99954EB497D0BC398C5B514C4657BA55853
                    SHA-256:8C069D901F20A246D48EAE3D46DD943367517C004B91648CFC25A0973E9EE667
                    SHA-512:A6294E54598F93A58C94BF81629327D527D4EEBB60804CD73BB8DDBEA40A74743A954F95EF973590480078A6AA8BEAB945EF839EE00B4607D8F6C454FAC1BD77
                    Malicious:false
                    Reputation:low
                    Preview:.... .c.....x."................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7372

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:PostScript document text
                    Category:dropped
                    Size (bytes):185099
                    Entropy (8bit):5.182478651346149
                    Encrypted:false
                    SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                    MD5:94185C5850C26B3C6FC24ABC385CDA58
                    SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                    SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                    SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                    Malicious:false
                    Reputation:moderate, very likely benign file
                    Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:PostScript document text
                    Category:dropped
                    Size (bytes):185099
                    Entropy (8bit):5.182478651346149
                    Encrypted:false
                    SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                    MD5:94185C5850C26B3C6FC24ABC385CDA58
                    SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                    SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                    SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                    Malicious:false
                    Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):243196
                    Entropy (8bit):3.3450692389394283
                    Encrypted:false
                    SSDEEP:1536:vKPCPiyzDtrh1cK3XEivK7VK/3AYvYwgqErRo+RQn:yPClJ/3AYvYwghFo+RQn
                    MD5:F5567C4FF4AB049B696D3BE0DD72A793
                    SHA1:EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916
                    SHA-256:D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
                    SHA-512:E769735991E5B1331E259608854D00CDA4F3E92285FDC500158CBD09CBCCEAD8A387F78256A43919B13EBE70C995D19242377C315B0CCBBD4F813251608C1D56
                    Malicious:false
                    Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):295
                    Entropy (8bit):5.362268201625423
                    Encrypted:false
                    SSDEEP:6:YEQXJ2HXSdjyeTc9VoZcg1vRcR0YlXXYREeoAvJM3g98kUwPeUkwRe9:YvXKXSdjyeTcEZc0vgHYiVGMbLUkee9
                    MD5:0D8467F66855E11A75E250467067C7E0
                    SHA1:3DC41EDD6A014134DCEB268A7A10BD9B6B00A00D
                    SHA-256:4C6951DEC14BF204624214DC6BCA91F58CBBDCEEE94399FF1851BE32EF4E9D5B
                    SHA-512:F7EF9BA0BDD9755779E5A2F255950B50F227390C6EC52057F153E84E65AE163404858CEF95810A14D6153005BE246588DA972D61148CE779F33CBF15F9ACDE35
                    Malicious:false
                    Preview:{"analyticsData":{"responseGUID":"dd4d58ec-5ec3-47da-9b44-79f506b6cefc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652815602,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):294
                    Entropy (8bit):5.309219938998778
                    Encrypted:false
                    SSDEEP:6:YEQXJ2HXSdjyeTc9VoZcg1vRcR0YlXXYREeoAvJfBoTfXpnrPeUkwRe9:YvXKXSdjyeTcEZc0vgHYiVGWTfXcUke6
                    MD5:E908E9905EA46E7602E5FAC4D440A32E
                    SHA1:96D5CD56F492C90A8F4D3E976B0EE8ACBB1345F3
                    SHA-256:F4A18565DAC49140C7BE4A303B499780D531B931B510E159DD396CB8E64F6CDA
                    SHA-512:23D2017AA3ED8D03E8F81FF7B5C9E2845050659AAE6B98099A2B8F73F2E8F7E6D46CE34C8D5FD8CB17226E34AE16A3B4930988E673215525E8ABA36DD1FE1329
                    Malicious:false
                    Preview:{"analyticsData":{"responseGUID":"dd4d58ec-5ec3-47da-9b44-79f506b6cefc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652815602,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):294
                    Entropy (8bit):5.287253767890197
                    Encrypted:false
                    SSDEEP:6:YEQXJ2HXSdjyeTc9VoZcg1vRcR0YlXXYREeoAvJfBD2G6UpnrPeUkwRe9:YvXKXSdjyeTcEZc0vgHYiVGR22cUkee9
                    MD5:E9369BB1E78154CDCAC6D80872D576B8
                    SHA1:CCA94F154FF49D64E580C35D77149353B8A217DB
                    SHA-256:85990CD4361B91EFFD3DC2924C4889083458D35BA9717CC4ED5241297245FDDB
                    SHA-512:53ED0C748AA7D5709A9DFE0DB66F006E7449679A3A17526B959DA016BD684008501E4924F68C34CC67D698187120C9BCC54A9A4200CE9DDCD6C503333E0FC45E
                    Malicious:false
                    Preview:{"analyticsData":{"responseGUID":"dd4d58ec-5ec3-47da-9b44-79f506b6cefc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652815602,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):285
                    Entropy (8bit):5.349240280287538
                    Encrypted:false
                    SSDEEP:6:YEQXJ2HXSdjyeTc9VoZcg1vRcR0YlXXYREeoAvJfPmwrPeUkwRe9:YvXKXSdjyeTcEZc0vgHYiVGH56Ukee9
                    MD5:141E298960A0AE56AD04535167D10D3C
                    SHA1:C37AF89AC758EBCB8BEBAD8F3C456F7632AA04FE
                    SHA-256:68DFE8518BD8D5A6D10E8E951CDB159B234F5C4626C6952EE4D245DB00C5C35B
                    SHA-512:33BEB866796472993CA117BCC9EDF32D5E1E85DEA1100124316B38EEFC7EFA5F3BD923D9B5823AF27EEB5B0DB43C9D25479E804FB6310284F2E601FF2E440AED
                    Malicious:false
                    Preview:{"analyticsData":{"responseGUID":"dd4d58ec-5ec3-47da-9b44-79f506b6cefc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652815602,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):292
                    Entropy (8bit):5.30574868660381
                    Encrypted:false
                    SSDEEP:6:YEQXJ2HXSdjyeTc9VoZcg1vRcR0YlXXYREeoAvJfJWCtMdPeUkwRe9:YvXKXSdjyeTcEZc0vgHYiVGBS8Ukee9
                    MD5:904C3B1C319D7850960372D989026DDB
                    SHA1:6160C732F5115CC1920E2D6D0610387D61CE71E9
                    SHA-256:FCF5F02B8FA251F85C8E3F438189EBC4DE5F3FA646234B7E88CF8D98251FCD05
                    SHA-512:F5B711ABC491E008256E9E01FEBF88AA81E823D92626D052D330838565D5B27B9911E2FC4E247A45B0DE090EE642F793079244F659351FF8D8C1DB9EE2BEBB59
                    Malicious:false
                    Preview:{"analyticsData":{"responseGUID":"dd4d58ec-5ec3-47da-9b44-79f506b6cefc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652815602,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):289
                    Entropy (8bit):5.291997524715456
                    Encrypted:false
                    SSDEEP:6:YEQXJ2HXSdjyeTc9VoZcg1vRcR0YlXXYREeoAvJf8dPeUkwRe9:YvXKXSdjyeTcEZc0vgHYiVGU8Ukee9
                    MD5:094D44FEB29704E4B7980C852602DBCB
                    SHA1:E76BAB5B7366BB14B8E669235DD2A7B0FD43F573
                    SHA-256:8A92B7BEE4B9F21C5AFB94ED28E37877DB12F57C1E49331F64D04F5902985A76
                    SHA-512:B1EFA50C8531F76D91DE2837603192FA97A2DB04A7F02B08145D71468DD50A9BE21386F53A08524C018EC2D6C5ADAD4B329AF41DD5A3709F0DAA1F001620FEFC
                    Malicious:false
                    Preview:{"analyticsData":{"responseGUID":"dd4d58ec-5ec3-47da-9b44-79f506b6cefc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652815602,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):292
                    Entropy (8bit):5.295396753441535
                    Encrypted:false
                    SSDEEP:6:YEQXJ2HXSdjyeTc9VoZcg1vRcR0YlXXYREeoAvJfQ1rPeUkwRe9:YvXKXSdjyeTcEZc0vgHYiVGY16Ukee9
                    MD5:39C2BE42B027809141AC41E174CA4BD9
                    SHA1:E2C1F83937D4AB1C0172013BAC83E6F96681A392
                    SHA-256:97C2357598DF094F9DE459D7ECE78E46C7211C4615ECA12AADF33A096DA6AF70
                    SHA-512:BC2A729904C4C6702AB30AA3648DF44318513F4190A8568FC17955C6D09B5E2343FE28D6FBB9BB6EA01B1D96D4372D0D11FAC675F182D5A3CADF43B83925A84B
                    Malicious:false
                    Preview:{"analyticsData":{"responseGUID":"dd4d58ec-5ec3-47da-9b44-79f506b6cefc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652815602,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):289
                    Entropy (8bit):5.300620049794794
                    Encrypted:false
                    SSDEEP:6:YEQXJ2HXSdjyeTc9VoZcg1vRcR0YlXXYREeoAvJfFldPeUkwRe9:YvXKXSdjyeTcEZc0vgHYiVGz8Ukee9
                    MD5:DA733C745A213F56CD1E166C30F79AC4
                    SHA1:FAA0A8B2878CD26DB23A3EB6A2E2A1D0C3AC9262
                    SHA-256:02C80E7F0EEAEA03705D1909CF19DE8D0C0179CC23D22D86997C7449CF314F8C
                    SHA-512:C712E3413A6D45714F5E488E2A78B2BFE3BFAE13CAAAFC2832AD70AB051E450F8CC4E46FAAFD686CAFFAC9DFA82AD2DA091E1B51CB7D00EF4C2B6B32F37DE941
                    Malicious:false
                    Preview:{"analyticsData":{"responseGUID":"dd4d58ec-5ec3-47da-9b44-79f506b6cefc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652815602,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):1372
                    Entropy (8bit):5.736573911797398
                    Encrypted:false
                    SSDEEP:24:Yv6XSdPLzvgHYiBKLgENRcbrZbq00iCCBrwJo++ns8ct4mFJNd:YvXF3oH/EgigrNt0wSJn+ns8cvFJ/
                    MD5:832044FBE504779C425C96BAEE4569E6
                    SHA1:15B783FCBD67C0A6589A2E388AF46EAAA5375E54
                    SHA-256:ECE4F20C9A57821F32C656B044DC3D0D4DF1C703EF7DD38058344983767BDCB6
                    SHA-512:C9AF006DE7359EB03DBEF757014512EE08D1FACFAB38B12A7207BF44C055BB280E49F3E85A053A204612441A695374FB9B99D364296007CBEC566DC47FD2BD6A
                    Malicious:false
                    Preview:{"analyticsData":{"responseGUID":"dd4d58ec-5ec3-47da-9b44-79f506b6cefc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652815602,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"79887_247329ActionBlock_0","campaignId":79887,"containerId":"1","controlGroupId":"","treatmentId":"acc56846-d570-4500-a26e-7f8cf2b4acad","variationId":"247329"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJUcnkgQWNyb2JhdCBQcm8ifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNSIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTMiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIDctZGF5IHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0byBwcmVtaXVtIFBERiBhbmQgZS1zaWduaW5nIHRvb2xzLiIsImJ

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):289
                    Entropy (8bit):5.2988816604899585
                    Encrypted:false
                    SSDEEP:6:YEQXJ2HXSdjyeTc9VoZcg1vRcR0YlXXYREeoAvJfYdPeUkwRe9:YvXKXSdjyeTcEZc0vgHYiVGg8Ukee9
                    MD5:E872ABD42BF3624EDDEB49C673813516
                    SHA1:DFE1951DAC17F9DFD0555783C18DC2450068F0C6
                    SHA-256:B6EC1A2529399967FA7049D5443A991F2575004688E251C7DAF5289E381E8064
                    SHA-512:46602B32ECBEAD95FC98F8D33CC6C70EAC7581552A2C9F5FA4660893D0A52C3656D5D545FAC123176E361B11550FD3B15021ED025704D10B02078AF298EA880F
                    Malicious:false
                    Preview:{"analyticsData":{"responseGUID":"dd4d58ec-5ec3-47da-9b44-79f506b6cefc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652815602,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):1395
                    Entropy (8bit):5.775298066534486
                    Encrypted:false
                    SSDEEP:24:Yv6XSdPLzvgHYiMrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNF:YvXF3oHCHgDv3W2aYQfgB5OUupHrQ9Fd
                    MD5:65D60E51A29350E9C41A6420A21450B5
                    SHA1:DB6622A2532072D3314968E3000881BAF733053E
                    SHA-256:F349D382D6F69A6EE623A3FD528759CE04CE92DF1655CD44650130E6313FE691
                    SHA-512:B28C2FAA60E0326D114F4CD826E8EEDA07CBA24E4D57A8541EA248CA328312A3CCD9E0047F68E67D22180A2DBD6A31E02C6693E774BEAE98A3ECE6B582E42FA7
                    Malicious:false
                    Preview:{"analyticsData":{"responseGUID":"dd4d58ec-5ec3-47da-9b44-79f506b6cefc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652815602,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):291
                    Entropy (8bit):5.282436444346022
                    Encrypted:false
                    SSDEEP:6:YEQXJ2HXSdjyeTc9VoZcg1vRcR0YlXXYREeoAvJfbPtdPeUkwRe9:YvXKXSdjyeTcEZc0vgHYiVGDV8Ukee9
                    MD5:FA95A6495080758C80055862461B2112
                    SHA1:A5091ADE64107F5DCA4F156CC045CA5EC4216182
                    SHA-256:18C39AC0F0E4A1161737FA5078CD521C5E257FD2F788F2C45C72AF130EFD29FE
                    SHA-512:187846D38F9673C0AA0102573C81CBF2FCED1774374CFD614B49B7EE9D43F13F52413275A5338C2388CB0CE58C83F471585DCC38A1AAE5B37D26EBD35FF1A53B
                    Malicious:false
                    Preview:{"analyticsData":{"responseGUID":"dd4d58ec-5ec3-47da-9b44-79f506b6cefc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652815602,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):287
                    Entropy (8bit):5.286758036882264
                    Encrypted:false
                    SSDEEP:6:YEQXJ2HXSdjyeTc9VoZcg1vRcR0YlXXYREeoAvJf21rPeUkwRe9:YvXKXSdjyeTcEZc0vgHYiVG+16Ukee9
                    MD5:894E84009DF87FC402E94359D7A4E333
                    SHA1:F3E5C835A710804FA13F0A0BA653894489183A1E
                    SHA-256:48A408BD1B3C6F21B36906FA921BA76D4E50AE0CFB1B14A78DBA58F8FFBFFFCD
                    SHA-512:B4C551DB49DC2588B00EE8797D165AF8DB7463205FB11BEEDDCF28CCAB7A0E774A1C3FCD737F9274A12057550DF180CCFA4C873185F27280C325EFBA2FC61BAC
                    Malicious:false
                    Preview:{"analyticsData":{"responseGUID":"dd4d58ec-5ec3-47da-9b44-79f506b6cefc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652815602,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):289
                    Entropy (8bit):5.30599426677323
                    Encrypted:false
                    SSDEEP:6:YEQXJ2HXSdjyeTc9VoZcg1vRcR0YlXXYREeoAvJfbpatdPeUkwRe9:YvXKXSdjyeTcEZc0vgHYiVGVat8Ukee9
                    MD5:3148755843FA35B0F1BDFF6983174AD3
                    SHA1:968923D3EACA7F451A6F647A809114A192F2FA5C
                    SHA-256:B2AC820264D2A191EE639B07E9FBA0CCAB7EF7606AEA60350E1B5434830A76D9
                    SHA-512:5AFB8AAE0E030D67866A3E32428811A2A618F21303517E88CDD87BA9741DCBFC8CE38D518866D7DAD67131FC417B1519FAAC5C0E8D16298C75C16B06C422EAC3
                    Malicious:false
                    Preview:{"analyticsData":{"responseGUID":"dd4d58ec-5ec3-47da-9b44-79f506b6cefc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652815602,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):286
                    Entropy (8bit):5.261422448285901
                    Encrypted:false
                    SSDEEP:6:YEQXJ2HXSdjyeTc9VoZcg1vRcR0YlXXYREeoAvJfshHHrPeUkwRe9:YvXKXSdjyeTcEZc0vgHYiVGUUUkee9
                    MD5:94852897EFC112FA0852A8EDB6CA6C54
                    SHA1:145299DEE6E756FEA595FFD5F368D9B4029A80C5
                    SHA-256:55FDA0AA99F4897652F316AE41E5B0D2158F11A7A478DEE3B706FFEC69C1C1DA
                    SHA-512:006D1D9E567F7EB069B1FF406E6AA68BB34D2B1AAB1224886782C293C39F96BE53B8A20008C103E60A17B242B72AE736D1FEB94AC16FACF467C2C6874D24A956
                    Malicious:false
                    Preview:{"analyticsData":{"responseGUID":"dd4d58ec-5ec3-47da-9b44-79f506b6cefc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652815602,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):782
                    Entropy (8bit):5.3655090644200705
                    Encrypted:false
                    SSDEEP:12:YvXKXSdjyeTcEZc0vgHYiVGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uC:Yv6XSdPLzvgHYix168CgEXX5kcIfANho
                    MD5:B5AAABA77E9902C84A146A812E5CAB1E
                    SHA1:0AABF798778AFD44B08F00BCC5724F2FD4501FBC
                    SHA-256:C2AC04067E093EBCF9E71CD66FA9F288DEA47591AB8F1F1F6FDDFEE399299A4B
                    SHA-512:B78A32A73A70572A81E7B0FAC2C79FE5D887490C46DAF7DBA429321654EB182638836CEB7BC936552BF3A71C8553C8327F64618ACDDA8EEEDCB93AD8252502DF
                    Malicious:false
                    Preview:{"analyticsData":{"responseGUID":"dd4d58ec-5ec3-47da-9b44-79f506b6cefc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713652815602,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1713473700641}}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):4
                    Entropy (8bit):0.8112781244591328
                    Encrypted:false
                    SSDEEP:3:e:e
                    MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                    SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                    SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                    SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                    Malicious:false
                    Preview:....

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):2814
                    Entropy (8bit):5.128859755612693
                    Encrypted:false
                    SSDEEP:24:YMJYFylIkOkM1MCoRcNquLRHPynaBV03ayya2G7RyoDcjKldsj0StS0Wu/2a/2LZ:YryTuUuFB6nQ2+dH/UI3DkU9PkX
                    MD5:7936D38D742D9A23979FDEF672F5A10E
                    SHA1:9EFAB642CB21CA473E5C6241A86867EE649584D0
                    SHA-256:CD9236BAC03FA92B3C99348A7D88E705522FAD97C4A79C27D8DFFD961CD5D25C
                    SHA-512:BEB6FE24B323103CA1932371528F3BED1AD1E021EF560ACB908C5083D27FD0A9F4666A0FC9841204470806B15D5BCC7A05ABF030190AD5FCE8FCF7FFEC2E1BC6
                    Malicious:false
                    Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"a5bae48d2b10b9ddc47b76265676e97a","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1713473700000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"3ea098f56d9ff62f89e2841693ff6567","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1372,"ts":1713473700000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"feeb6a8798d89029a05fb32e4d06a337","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1713473700000},{"id":"Edit_InApp_Aug2020","info":{"dg":"3f5c75b633eea0441f9f818990490693","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1713473700000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"bc35aa56e1b0c5d828b5ade918bfdf3d","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1713473700000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"8025724deb5ab67d30949ca5989e77f2","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1713473700000},

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
                    Category:dropped
                    Size (bytes):12288
                    Entropy (8bit):1.1886203613680317
                    Encrypted:false
                    SSDEEP:48:TGufl2GL7msEHUUUUUUUUACSvR9H9vxFGiDIAEkGVvpkk:lNVmswUUUUUUUUR+FGSItV
                    MD5:12F7FD87739E6301B6AAF70DE847DD92
                    SHA1:8AAEAE78EA21A2C3A7D457F0E7D507E917F2BC18
                    SHA-256:C90EE06E20221948E367ED60050D3ED868612E0FF9543AF483794908A20C0DA9
                    SHA-512:F972DA8F1ABB4F67BDE5431F2C56195566D22E07DE4CAF3D0F6B47C8AA5F0887BB3B967786A06B2C8E215CABF4957052F3EA74857225C0E2F98950AD37916C22
                    Malicious:false
                    Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:SQLite Rollback Journal
                    Category:dropped
                    Size (bytes):8720
                    Entropy (8bit):1.6089818018922701
                    Encrypted:false
                    SSDEEP:48:7MQKUUUUUUUUUUAQvR9H9vxFGiDIAEkGVvcqFl2GL7msF:7kUUUUUUUUUU9FGSItmKVmsF
                    MD5:9926C20FC0814D014C45C47944A6F628
                    SHA1:FB98AB1926FE672D67D157478A922D0927109895
                    SHA-256:067EAAA8C5796869380311F87520F3378864849A33AB89D14AF802E12EFB2D15
                    SHA-512:684C2746E88A55E7675FBC27385C4E76FE7363A8B3DBF01E1E5985D0DF4B0F4AC823AFFBCB4251E443C71F381ABF3EC73F6220F90E467AA6CCA27FC43DCE0325
                    Malicious:false
                    Preview:.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Temp\MSI859db.LOG

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                    Category:dropped
                    Size (bytes):246
                    Entropy (8bit):3.529459928009153
                    Encrypted:false
                    SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8sKkMl+iwCH:Qw946cPbiOxDlbYnuRKSdLl
                    MD5:EF7B68E6347063A42154AE8BDE021508
                    SHA1:4CD5B068C8BEC5B25BC1894C7EDBF075D47B6767
                    SHA-256:9E2EE5DF6FF0301EB96898CEF52C7F9E1E95F71E9FF87D960F336D88E695EE63
                    SHA-512:F830D0C51F8F9C6E2D5D2BDEA3D0621DEF9E828B6490E710873A85BCFD72A0F455C18859049E75A03DFAC2917709BF13964125CF54AC012A2F6CA63C883A690E
                    Malicious:false
                    Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.8./.0.4./.2.0.2.4. . .2.2.:.5.5.:.0.3. .=.=.=.....

                    C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-18 22-54-58-052.log

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:ASCII text, with very long lines (393)
                    Category:dropped
                    Size (bytes):16525
                    Entropy (8bit):5.345946398610936
                    Encrypted:false
                    SSDEEP:384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
                    MD5:8947C10F5AB6CFFFAE64BCA79B5A0BE3
                    SHA1:70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
                    SHA-256:4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
                    SHA-512:B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
                    Malicious:false
                    Preview:SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

                    C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:ASCII text, with very long lines (393), with CRLF line terminators
                    Category:dropped
                    Size (bytes):16603
                    Entropy (8bit):5.3797365711802
                    Encrypted:false
                    SSDEEP:384:SuQT4GyF671S8KOfPbDXAs59Orh6vjKJK+CYsYGz/XGQ+BKsleY0J0ZMqgH5ksgw:S9X
                    MD5:2FA101928931225649F65FDF480A8B85
                    SHA1:BAF77B9F21EC6707DA503F8F73AECAC862CE6A5E
                    SHA-256:DDE22B227371D283E415D7972353D36ACD8B6AEF24397809D3E33E1E98A66D21
                    SHA-512:8DD0ECAD6D04C1B5CD64E83523F5B7B68B1A77717E90C10AE1EFEB88F0C46023646E9242D34710A080A6CAC539B863EF047294EDF7553ED7C370B3F2A7791393
                    Malicious:false
                    Preview:SessionID=34b6c98e-01a0-4cbc-bf6e-037deaa41992.1713473698079 Timestamp=2024-04-18T22:54:58:079+0200 ThreadID=7036 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=34b6c98e-01a0-4cbc-bf6e-037deaa41992.1713473698079 Timestamp=2024-04-18T22:54:58:083+0200 ThreadID=7036 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=34b6c98e-01a0-4cbc-bf6e-037deaa41992.1713473698079 Timestamp=2024-04-18T22:54:58:083+0200 ThreadID=7036 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=34b6c98e-01a0-4cbc-bf6e-037deaa41992.1713473698079 Timestamp=2024-04-18T22:54:58:083+0200 ThreadID=7036 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=34b6c98e-01a0-4cbc-bf6e-037deaa41992.1713473698079 Timestamp=2024-04-18T22:54:58:083+0200 ThreadID=7036 Component=ngl-lib_NglAppLib Description="SetConf

                    C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:ASCII text, with CRLF line terminators
                    Category:dropped
                    Size (bytes):29845
                    Entropy (8bit):5.389466278403755
                    Encrypted:false
                    SSDEEP:768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rc:Q
                    MD5:82AE3EF18645CEB765A6ECFCE18F12B4
                    SHA1:1CE31FB5BBE75E35D5B30408ED0496F167D719AE
                    SHA-256:289C4AFF7B252AD4ADF3E9649405EF2C4EBB3FFB1C265873DD418925F61AD646
                    SHA-512:4BDD84D56FEB2B84E62D6D14E8436BCFDB82615B52BE1409DBFE358E2A6F3494015602DBC5924067E239F97C4C050103F3590CC8244A66EB4883D93CC1701BA4
                    Malicious:false
                    Preview:03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

                    C:\Users\user\AppData\Local\Temp\acrocef_low\1d0988aa-13fd-4e0e-8d38-0de5ae824ff9.tmp

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                    Category:dropped
                    Size (bytes):1419751
                    Entropy (8bit):7.976496077007677
                    Encrypted:false
                    SSDEEP:24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
                    MD5:18E3D04537AF72FDBEB3760B2D10C80E
                    SHA1:B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
                    SHA-256:BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
                    SHA-512:2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
                    Malicious:false
                    Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                    C:\Users\user\AppData\Local\Temp\acrocef_low\999ee5b8-c839-4ba4-a9ac-9f1ffd5f17b2.tmp

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                    Category:dropped
                    Size (bytes):1407294
                    Entropy (8bit):7.97605879016224
                    Encrypted:false
                    SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
                    MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
                    SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
                    SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
                    SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
                    Malicious:false
                    Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                    C:\Users\user\AppData\Local\Temp\acrocef_low\e63dc28d-d46d-4435-878d-8771a1829520.tmp

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                    Category:dropped
                    Size (bytes):386528
                    Entropy (8bit):7.9736851559892425
                    Encrypted:false
                    SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                    MD5:5C48B0AD2FEF800949466AE872E1F1E2
                    SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                    SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                    SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                    Malicious:false
                    Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                    C:\Users\user\AppData\Local\Temp\acrocef_low\f9075341-59dd-4e78-ac6d-b029a6657626.tmp

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                    Category:dropped
                    Size (bytes):758601
                    Entropy (8bit):7.98639316555857
                    Encrypted:false
                    SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                    MD5:3A49135134665364308390AC398006F1
                    SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                    SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                    SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                    Malicious:false
                    Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                    Static File Info

                    General

                    File type:PDF document, version 1.5 (zip deflate encoded)
                    Entropy (8bit):7.82466843578202
                    TrID:
                    • Adobe Portable Document Format (5005/1) 100.00%
                    File name:Mental Health Services Provider Cover RFP 2024013- CC Family.pdf
                    File size:118'395 bytes
                    MD5:1f1c94dc25e8dacecaecc125de1706ba
                    SHA1:64d97b4c81e249d87350ee1f4508c901422705c0
                    SHA256:d43ead01155de2720b57ec936661612de86794a375ec0dc379d41fb39a7f3c1f
                    SHA512:9ebcc6f04677783958ec267ce1d6642e99bb281d375ac90840f5d1644e76bf9a799505e19fb7625c48822ade0a84eafd8de167c283fd9b2d31226945b92f3025
                    SSDEEP:1536:kbeJBshmY72iQmkIMLunODffjA7FyzVe1dTTXP7QNVeG:JBIxQmBOD0IBeP8Nj
                    TLSH:ECC37D327D64EA52503A46045EB85E3CE4369B13B52FBF61B9DE4EBF9B20E83114B341
                    File Content Preview:%PDF-1.5.%......10 0 obj.<</Linearized 1/L 118395/O 12/E 113976/N 1/T 118091/H [ 495 172]>>.endobj. ..26 0 obj.<</DecodeParms<</Columns 5/Predictor 12>>/Filter/FlateDecode/ID[<6818E8286CFF76C4B76820E717F0BC4C><EB237977CF04134FBF7AA3FB62BCF5D

                    File Icon

                    Icon Hash:62cc8caeb29e8ae0

                    Static PDF Info

                    General

                    Header:%PDF-1.5
                    Total Entropy:7.824668
                    Total Bytes:118395
                    Stream Entropy:7.823834
                    Stream Bytes:115806
                    Entropy outside Streams:5.262125
                    Bytes outside Streams:2589
                    Number of EOF found:2
                    Bytes after EOF:

                    Keywords Statistics

                    NameCount
                    obj23
                    endobj23
                    stream20
                    endstream20
                    xref0
                    trailer0
                    startxref2
                    /Page1
                    /Encrypt0
                    /ObjStm4
                    /URI0
                    /JS0
                    /JavaScript0
                    /AA0
                    /OpenAction0
                    /AcroForm0
                    /JBIG2Decode0
                    /RichMedia0
                    /Launch0
                    /EmbeddedFile0

                    Image Streams

                    IDDHASHMD5Preview
                    2200009890e028606045bfbfef616656791ae2f8a9eda7f3ec
                    23686000000000000074587a4b9e871d3738738f1147c119b1
                    250000008209a0a65141b3862cf158db3263d102655c34c40c

                    Network Behavior

                    Network Port Distribution

                    TCP Packets

                    TimestampSource PortDest PortSource IPDest IP
                    Apr 18, 2024 22:55:08.364231110 CEST49740443192.168.2.423.46.240.131
                    Apr 18, 2024 22:55:08.364279985 CEST4434974023.46.240.131192.168.2.4
                    Apr 18, 2024 22:55:08.364351988 CEST49740443192.168.2.423.46.240.131
                    Apr 18, 2024 22:55:08.364600897 CEST49740443192.168.2.423.46.240.131
                    Apr 18, 2024 22:55:08.364619017 CEST4434974023.46.240.131192.168.2.4
                    Apr 18, 2024 22:55:08.689205885 CEST4434974023.46.240.131192.168.2.4
                    Apr 18, 2024 22:55:08.689560890 CEST49740443192.168.2.423.46.240.131
                    Apr 18, 2024 22:55:08.689580917 CEST4434974023.46.240.131192.168.2.4
                    Apr 18, 2024 22:55:08.691289902 CEST4434974023.46.240.131192.168.2.4
                    Apr 18, 2024 22:55:08.691399097 CEST49740443192.168.2.423.46.240.131
                    Apr 18, 2024 22:55:08.693538904 CEST49740443192.168.2.423.46.240.131
                    Apr 18, 2024 22:55:08.693634033 CEST4434974023.46.240.131192.168.2.4
                    Apr 18, 2024 22:55:08.693732977 CEST49740443192.168.2.423.46.240.131
                    Apr 18, 2024 22:55:08.693743944 CEST4434974023.46.240.131192.168.2.4
                    Apr 18, 2024 22:55:08.737257957 CEST49740443192.168.2.423.46.240.131
                    Apr 18, 2024 22:55:08.799186945 CEST4434974023.46.240.131192.168.2.4
                    Apr 18, 2024 22:55:08.799299955 CEST4434974023.46.240.131192.168.2.4
                    Apr 18, 2024 22:55:08.799372911 CEST49740443192.168.2.423.46.240.131
                    Apr 18, 2024 22:55:08.800018072 CEST49740443192.168.2.423.46.240.131
                    Apr 18, 2024 22:55:08.800035954 CEST4434974023.46.240.131192.168.2.4

                    HTTP Request Dependency Graph

                    • armmf.adobe.com

                    HTTPS Proxied Packets

                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                    0192.168.2.44974023.46.240.1314437680C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    TimestampBytes transferredDirectionData
                    2024-04-18 20:55:08 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
                    Host: armmf.adobe.com
                    Connection: keep-alive
                    Accept-Language: en-US,en;q=0.9
                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
                    Sec-Fetch-Site: same-origin
                    Sec-Fetch-Mode: no-cors
                    Sec-Fetch-Dest: empty
                    Accept-Encoding: gzip, deflate, br
                    If-None-Match: "78-5faa31cce96da"
                    If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
                    2024-04-18 20:55:08 UTC198INHTTP/1.1 304 Not Modified
                    Content-Type: text/plain; charset=UTF-8
                    Last-Modified: Mon, 01 May 2023 15:02:33 GMT
                    ETag: "78-5faa31cce96da"
                    Date: Thu, 18 Apr 2024 20:55:08 GMT
                    Connection: close


                    Statistics

                    CPU Usage

                    Click to jump to process

                    Memory Usage

                    Click to jump to process

                    High Level Behavior Distribution

                    Click to dive into process behavior distribution

                    Behavior

                    Click to jump to process

                    System Behavior

                    General

                    Target ID:0
                    Start time:22:54:54
                    Start date:18/04/2024
                    Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    Wow64 process (32bit):false
                    Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Mental Health Services Provider Cover RFP 2024013- CC Family.pdf"
                    Imagebase:0x7ff6bc1b0000
                    File size:5'641'176 bytes
                    MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:moderate
                    Has exited:true

                    General

                    Target ID:1
                    Start time:22:54:55
                    Start date:18/04/2024
                    Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    Wow64 process (32bit):false
                    Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                    Imagebase:0x7ff74bb60000
                    File size:3'581'912 bytes
                    MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:moderate
                    Has exited:true

                    General

                    Target ID:3
                    Start time:22:54:55
                    Start date:18/04/2024
                    Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    Wow64 process (32bit):false
                    Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1596,i,17097383006528070282,10288752137020408786,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                    Imagebase:0x7ff74bb60000
                    File size:3'581'912 bytes
                    MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:moderate
                    Has exited:true

                    Disassembly

                    ⊘No disassembly