Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
CITACI#U00d3N JUDICIAL UE (1).pdf

Overview

General Information

Sample name:CITACI#U00d3N JUDICIAL UE (1).pdf
renamed because original name is a hash value
Original sample name:CITACIN JUDICIAL UE (1).pdf
Analysis ID:1428601
MD5:50cb062ac5cb59b71776da61cb93d47b
SHA1:65be60c85b998828ceced3bdc1c4897da456f8b8
SHA256:c61080e990c67cf2219aac95df3b770d559c6c46c7d91d598da790e441e2f04b
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 7476 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\CITACI#U00d3N JUDICIAL UE (1).pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 7656 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 7876 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1556,i,11480562085678056129,14334011370226977473,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global trafficTCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: Joe Sandbox ViewIP Address: 184.25.164.138 184.25.164.138
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.25.164.138
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: classification engineClassification label: clean2.winPDF@14/43@0/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journalJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-19 09-55-09-448.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\CITACI#U00d3N JUDICIAL UE (1).pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1556,i,11480562085678056129,14334011370226977473,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1556,i,11480562085678056129,14334011370226977473,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: CITACI#U00d3N JUDICIAL UE (1).pdfInitial sample: PDF keyword /JS count = 0
Source: CITACI#U00d3N JUDICIAL UE (1).pdfInitial sample: PDF keyword /JavaScript count = 0
Source: CITACI#U00d3N JUDICIAL UE (1).pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive12
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1428601 Sample: CITACI#U00d3N JUDICIAL UE (1).pdf Startdate: 19/04/2024 Architecture: WINDOWS Score: 2 6 Acrobat.exe 20 72 2->6         started        process3 8 AcroCEF.exe 104 6->8         started        process4 10 AcroCEF.exe 2 8->10         started        dnsIp5 13 184.25.164.138, 443, 49740 BBIL-APBHARTIAirtelLtdIN United States 10->13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
CITACI#U00d3N JUDICIAL UE (1).pdf0%VirustotalBrowse
CITACI#U00d3N JUDICIAL UE (1).pdf0%ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
184.25.164.138
unknownUnited States
9498BBIL-APBHARTIAirtelLtdINfalse

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1428601
Start date and time:2024-04-19 09:54:19 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 4s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultwindowspdfcookbook.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:11
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:CITACI#U00d3N JUDICIAL UE (1).pdf
renamed because original name is a hash value
Original Sample Name:CITACIN JUDICIAL UE (1).pdf
Detection:CLEAN
Classification:clean2.winPDF@14/43@0/1
EGA Information:Failed
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 0
  • Number of non-executed functions: 0
Cookbook Comments:
  • Found application associated with file extension: .pdf
  • Found PDF document
  • Close Viewer

Warnings

  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 23.60.84.177, 23.34.82.7, 23.34.82.6, 18.207.85.246, 34.193.227.236, 107.22.247.231, 54.144.73.197, 172.64.41.3, 162.159.61.3
  • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com
  • Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
184.25.164.138Proposal Invitation_ Proposal is Due by the EOB May 15.emlGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
    file.pdf.download.lnkGet hashmaliciousUnknownBrowse
      Factura_SA161.pdf.lnkGet hashmaliciousRHADAMANTHYSBrowse
        Re_ Medina County Kitchen.emlGet hashmaliciousUnknownBrowse
          oiDDogdK9A.exeGet hashmaliciousLokibot, PureLog Stealer, zgRATBrowse
            New_Order.xlsGet hashmaliciousUnknownBrowse
              https://enfoldindia.org/wp-content/uploads/2019/06/Restorative-Circle-Handbook-for-CCI.pdfGet hashmaliciousUnknownBrowse
                TaxForm.lnkGet hashmaliciousDarkGate, MailPassViewBrowse
                  https://ntnusa0-my.sharepoint.com/:f:/g/personal/ajaronik_ntnusa_com/EjzRads0Sf5Ivon47-zBKVABS1TZOI64W6Uv34YFqNQjmQ?e=NuZrjrGet hashmaliciousHTMLPhisher, ReCaptcha PhishBrowse
                    SOA.xlsGet hashmaliciousUnknownBrowse

                      Domains

                      ⊘No context

                      ASNs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      BBIL-APBHARTIAirtelLtdINhttps://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:24e81d17-b801-4fad-ae25-120d655923c5Get hashmaliciousRemcosBrowse
                      • 23.209.188.17
                      Proposal Invitation_ Proposal is Due by the EOB May 15.emlGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
                      • 184.25.164.138
                      file.pdf.download.lnkGet hashmaliciousUnknownBrowse
                      • 184.25.164.138
                      Factura_SA161.pdf.lnkGet hashmaliciousRHADAMANTHYSBrowse
                      • 184.25.164.138
                      Ud310iQZnO.elfGet hashmaliciousMiraiBrowse
                      • 182.74.25.30
                      tWpGuzQQoW.elfGet hashmaliciousMiraiBrowse
                      • 122.185.203.209
                      kGbjOmkleq.elfGet hashmaliciousMiraiBrowse
                      • 125.23.195.204
                      iH18gdEj8Y.elfGet hashmaliciousMiraiBrowse
                      • 125.19.93.33
                      xmncOD7BwX.elfGet hashmaliciousMiraiBrowse
                      • 122.184.236.50
                      SFTNQEBmOA.elfGet hashmaliciousUnknownBrowse
                      • 182.79.2.232

                      JA3 Fingerprints

                      ⊘No context

                      Dropped Files

                      ⊘No context

                      Created / dropped Files

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.199370487076105
                      Encrypted:false
                      SSDEEP:6:XBfjRq2Pwkn2nKuAl9OmbnIFUt8YBfAKZmw+YBfA2kwOwkn2nKuAl9OmbjLJ:XplvYfHAahFUt8YpAK/+YpA25JfHAaSJ
                      MD5:B61EA59D1590FFCC34E1EE8D5362736A
                      SHA1:A4108478A46BCDD08019AFF2110832DBFEA81439
                      SHA-256:1920C4CF537D85781F3282BE4E1AF706D8DA8CA67D691448CCD305AE62898701
                      SHA-512:A1960E781F7A586C1982FB50413594F03FA02856C1348A728D5E3EAB4CF41D32B7A3148FAF1DEFF05C2124F7C128C4C9479E36E905C4C840C9732E4E3E005BD6
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/19-09:55:07.025 1ea4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/19-09:55:07.026 1ea4 Recovering log #3.2024/04/19-09:55:07.026 1ea4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.199370487076105
                      Encrypted:false
                      SSDEEP:6:XBfjRq2Pwkn2nKuAl9OmbnIFUt8YBfAKZmw+YBfA2kwOwkn2nKuAl9OmbjLJ:XplvYfHAahFUt8YpAK/+YpA25JfHAaSJ
                      MD5:B61EA59D1590FFCC34E1EE8D5362736A
                      SHA1:A4108478A46BCDD08019AFF2110832DBFEA81439
                      SHA-256:1920C4CF537D85781F3282BE4E1AF706D8DA8CA67D691448CCD305AE62898701
                      SHA-512:A1960E781F7A586C1982FB50413594F03FA02856C1348A728D5E3EAB4CF41D32B7A3148FAF1DEFF05C2124F7C128C4C9479E36E905C4C840C9732E4E3E005BD6
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/19-09:55:07.025 1ea4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/19-09:55:07.026 1ea4 Recovering log #3.2024/04/19-09:55:07.026 1ea4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):336
                      Entropy (8bit):5.190339587279391
                      Encrypted:false
                      SSDEEP:6:XBfsVUi+q2Pwkn2nKuAl9Ombzo2jMGIFUt8YBfsX4WZmw+YBfsTIVkwOwkn2nKuA:Xp0/+vYfHAa8uFUt8YpU/+YpPV5JfHAv
                      MD5:FDE80D936A848A0827FB40F669E3371E
                      SHA1:BCBD530699F4879FFADFA2DC25C5D8AB8FA0CA9B
                      SHA-256:DAACE6B15BD47BE39E7E0396377F5BEA9A6A469FDD794BF4A04A9943DA0C36CD
                      SHA-512:4529A4CEBA5785C09A658E028AD26269646F5481CE30411AD9DFD4FE0CE6E8BDD8E21AA090F976840207378BB5313559BB2D03BCDF03B5F8F10C9ABC61ECA712
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/19-09:55:07.350 1f0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/19-09:55:07.352 1f0c Recovering log #3.2024/04/19-09:55:07.353 1f0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):336
                      Entropy (8bit):5.190339587279391
                      Encrypted:false
                      SSDEEP:6:XBfsVUi+q2Pwkn2nKuAl9Ombzo2jMGIFUt8YBfsX4WZmw+YBfsTIVkwOwkn2nKuA:Xp0/+vYfHAa8uFUt8YpU/+YpPV5JfHAv
                      MD5:FDE80D936A848A0827FB40F669E3371E
                      SHA1:BCBD530699F4879FFADFA2DC25C5D8AB8FA0CA9B
                      SHA-256:DAACE6B15BD47BE39E7E0396377F5BEA9A6A469FDD794BF4A04A9943DA0C36CD
                      SHA-512:4529A4CEBA5785C09A658E028AD26269646F5481CE30411AD9DFD4FE0CE6E8BDD8E21AA090F976840207378BB5313559BB2D03BCDF03B5F8F10C9ABC61ECA712
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/19-09:55:07.350 1f0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/19-09:55:07.352 1f0c Recovering log #3.2024/04/19-09:55:07.353 1f0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7fe5462b-ac40-44ca-b54a-10c6a3317db8.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:modified
                      Size (bytes):475
                      Entropy (8bit):4.9684845159534285
                      Encrypted:false
                      SSDEEP:12:YH/um3RA8sqZ36hsBdOg2HPcaq3QYiubInP7E4T3y:Y2sRds+dMH+3QYhbG7nby
                      MD5:3385A54072A247000D0F6EE165A421B7
                      SHA1:BE03F04E394A139AF5AAB78A590F88C3BBA59A08
                      SHA-256:D93096BDCA0681114982737917EC898A5366E21E7FD1D3499D6BB22562BA22C9
                      SHA-512:C2B496A5C194E7463AD4F8154D628E62FB0026DF6707AF47E4DF97361A49AA41AD4CA1CF36EAD752778CA5D50BFF92C4C5E618A7721CB5C401677AB37160AE5F
                      Malicious:false
                      Reputation:low
                      Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13358073318990084","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":107988},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):475
                      Entropy (8bit):4.9684845159534285
                      Encrypted:false
                      SSDEEP:12:YH/um3RA8sqZ36hsBdOg2HPcaq3QYiubInP7E4T3y:Y2sRds+dMH+3QYhbG7nby
                      MD5:3385A54072A247000D0F6EE165A421B7
                      SHA1:BE03F04E394A139AF5AAB78A590F88C3BBA59A08
                      SHA-256:D93096BDCA0681114982737917EC898A5366E21E7FD1D3499D6BB22562BA22C9
                      SHA-512:C2B496A5C194E7463AD4F8154D628E62FB0026DF6707AF47E4DF97361A49AA41AD4CA1CF36EAD752778CA5D50BFF92C4C5E618A7721CB5C401677AB37160AE5F
                      Malicious:false
                      Reputation:low
                      Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13358073318990084","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":107988},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):4730
                      Entropy (8bit):5.264881463330756
                      Encrypted:false
                      SSDEEP:96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo704d0SfSwIZ:etJCV4FiN/jTN/2r8Mta02fEhgO73goE
                      MD5:3A635D7B6D29568A1598E8A153520F0C
                      SHA1:505319AF5983386BED92949D6D5218349ABB5939
                      SHA-256:BC3036B6DE0D0FF8ADA9AA373F223CB3618395486D9ED6D402AAC060B90B863D
                      SHA-512:52BC976327AB50962481CC71F4A21EB4D778423E7D27E56CAF25F3DFC9034AD062B1ADC64BB0FEA1D16FA037555369B243B1363A248F8B7EB7D38BF182488F26
                      Malicious:false
                      Reputation:low
                      Preview:*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):324
                      Entropy (8bit):5.230526552594724
                      Encrypted:false
                      SSDEEP:6:XBfhf3+q2Pwkn2nKuAl9OmbzNMxIFUt8YBfr5WZmw+YBfrfFNVkwOwkn2nKuAl9c:Xp9+vYfHAa8jFUt8Ypo/+Yprf3V5JfHP
                      MD5:24D13FE8112F724F0F43B2ADEF206755
                      SHA1:EEFCA8A82D624BFFEBD190391450314ECD4F2D25
                      SHA-256:1E1D4AD58B51A893F997E4E783AB8CE3751D1F658CA71C7778E44ED97E2862A0
                      SHA-512:0B6A68C1B096214CE388153110C613DAB1FA016B2AC896EECE3CCEFA3CDEE791E80C78249EBD91B5AFBF1593B6EB41B6B2FFF999C5F6C746C5ECE8D3B9D54442
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/19-09:55:07.643 1f0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/19-09:55:07.648 1f0c Recovering log #3.2024/04/19-09:55:07.649 1f0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):324
                      Entropy (8bit):5.230526552594724
                      Encrypted:false
                      SSDEEP:6:XBfhf3+q2Pwkn2nKuAl9OmbzNMxIFUt8YBfr5WZmw+YBfrfFNVkwOwkn2nKuAl9c:Xp9+vYfHAa8jFUt8Ypo/+Yprf3V5JfHP
                      MD5:24D13FE8112F724F0F43B2ADEF206755
                      SHA1:EEFCA8A82D624BFFEBD190391450314ECD4F2D25
                      SHA-256:1E1D4AD58B51A893F997E4E783AB8CE3751D1F658CA71C7778E44ED97E2862A0
                      SHA-512:0B6A68C1B096214CE388153110C613DAB1FA016B2AC896EECE3CCEFA3CDEE791E80C78249EBD91B5AFBF1593B6EB41B6B2FFF999C5F6C746C5ECE8D3B9D54442
                      Malicious:false
                      Reputation:low
                      Preview:2024/04/19-09:55:07.643 1f0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/19-09:55:07.648 1f0c Recovering log #3.2024/04/19-09:55:07.649 1f0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240419075511Z-152.bmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
                      Category:dropped
                      Size (bytes):65110
                      Entropy (8bit):1.7970841992313744
                      Encrypted:false
                      SSDEEP:768:QAr2C4ky6CQ1OVNZiV19zXzz+FxOUl4uTqS2HYML6M+1orjbKHHbpxmE3ptt9I3r:0ni
                      MD5:7B76DE3B41A9C04CABDB8AAE2B93E2B9
                      SHA1:7D04DC28B20E162ACCF2180940CB7427B57C3B31
                      SHA-256:5DAB6D238B0C2C746CD2D0AF699E768D9365A8A8B97F8E4ABB52585E9C582B87
                      SHA-512:758D223385486C9CE0F73AA7423F633CFFA29A62F23B99D4A3ABFC75FDA149731C4F67D462050A1CC6C6F2E0923A109C27DF695AE009EEBE677C8410AF89209E
                      Malicious:false
                      Reputation:low
                      Preview:BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
                      Category:dropped
                      Size (bytes):86016
                      Entropy (8bit):4.445279094481123
                      Encrypted:false
                      SSDEEP:384:yezci5tYiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:r/s3OazzU89UTTgUL
                      MD5:F01D9494736F286F53FB9F4B125EE245
                      SHA1:FAF1A9A23BF8562DB769C9CDD57D80BF63004AEC
                      SHA-256:0D72690C6CC8C6D3166B04BB9A42BB0DC6AB97AC51847AE63208FD9F462799B6
                      SHA-512:0F60E28E18A9985FFB114E1951B2BA9AD5775AAE74735E6BEF908CD08E5B497E828F6D342FDC9C49A297C3D13C1F27B881F7544B91ABC6D36CF0D716D476D55D
                      Malicious:false
                      Reputation:low
                      Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite Rollback Journal
                      Category:dropped
                      Size (bytes):8720
                      Entropy (8bit):3.7786118339425045
                      Encrypted:false
                      SSDEEP:48:7Mdp/E2ioyViioy9oWoy1Cwoy1mKOioy1noy1AYoy1Wioy1hioybioyUoy1noy1t:7qpjuiFZXKQFwb9IVXEBodRBkM
                      MD5:5BB7F8C5BDA980E15D517B316AF3F9E1
                      SHA1:6A5A604ABFBAA8563D182C5333DB90D38DBBA22D
                      SHA-256:1AD2299DF0B3322030DAACB10A3A6B3D47EA2EE355808C71761F5C8388315A64
                      SHA-512:2895598D6160180639537C1A15D298A4EAB8433E02DBCAA87434183FBF7C1ACF1E92D769AD170FA31454B9DB3CD3AECB2D3E1AB79498CF2FA267534E3F95960F
                      Malicious:false
                      Reputation:low
                      Preview:.... .c........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7528

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PostScript document text
                      Category:dropped
                      Size (bytes):185099
                      Entropy (8bit):5.182478651346149
                      Encrypted:false
                      SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                      MD5:94185C5850C26B3C6FC24ABC385CDA58
                      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                      Malicious:false
                      Reputation:moderate, very likely benign file
                      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PostScript document text
                      Category:dropped
                      Size (bytes):185099
                      Entropy (8bit):5.182478651346149
                      Encrypted:false
                      SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                      MD5:94185C5850C26B3C6FC24ABC385CDA58
                      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                      Malicious:false
                      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):243196
                      Entropy (8bit):3.3450692389394283
                      Encrypted:false
                      SSDEEP:1536:vKPCPiyzDtrh1cK3XEivK7VK/3AYvYwgqErRo+RQn:yPClJ/3AYvYwghFo+RQn
                      MD5:F5567C4FF4AB049B696D3BE0DD72A793
                      SHA1:EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916
                      SHA-256:D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
                      SHA-512:E769735991E5B1331E259608854D00CDA4F3E92285FDC500158CBD09CBCCEAD8A387F78256A43919B13EBE70C995D19242377C315B0CCBBD4F813251608C1D56
                      Malicious:false
                      Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):295
                      Entropy (8bit):5.389843267198874
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXDknyS0nHVoZcg1vRcR0YGoAvJM3g98kUwPeUkwRe9:YvXKXgyR2Zc0viGMbLUkee9
                      MD5:A75BD72A8EC85890596B6BBA94D3C2BD
                      SHA1:8DE6486D456087812830F1EF5AE3163E202195E8
                      SHA-256:8E17D9A992C5C041BAF3F15BD3D6607385C8E55AED0E3CE8D3B33010411993DE
                      SHA-512:38B5AD6A79A790E14B9985FA6819D2115D04A7C0B90A09EA0E457185DE0117B005B7A186B9D914E7FA6CDBD4B2BE52C0B245DD6367104C74625D9E97A5972777
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"4b971b3d-8651-4538-816d-a56e475b3407","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713691408320,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.343480549700479
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXDknyS0nHVoZcg1vRcR0YGoAvJfBoTfXpnrPeUkwRe9:YvXKXgyR2Zc0viGWTfXcUkee9
                      MD5:1CA68775A8E38C7497E624A0836E3B87
                      SHA1:B52DC9EFB2796384BCB51FD7EC641E0177E0A1FF
                      SHA-256:658BF9757ECD775CC30D61CAE9D936887C0AF8C92C02BF6E1581232E852FCA43
                      SHA-512:7F9620762CBE3848D8F717B1B5C1D34449B4431E019930CB69CA8FA7A08DE0C16118970AE10E8EA2803D0C4B6C8124757FEEFCBA894AB84418CD0289D6CEE42A
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"4b971b3d-8651-4538-816d-a56e475b3407","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713691408320,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):294
                      Entropy (8bit):5.322678297669683
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXDknyS0nHVoZcg1vRcR0YGoAvJfBD2G6UpnrPeUkwRe9:YvXKXgyR2Zc0viGR22cUkee9
                      MD5:3F1371BCB2728FD5884BFC6A53F6523F
                      SHA1:1E58C7D59E7FA0779E5E67BF857788139745E3E7
                      SHA-256:876131D9C0C17677D5CACDB896873E2E479C77DF7232D851B07907D80D372B2A
                      SHA-512:C99CF75AD3A56996A8F9436B027B200B69C27266C156F4900B3FE23A128EA10A925AF10D03A99FB7BEB14FEB382FE0FE0D3057F4532A20A9481E3E3313FE41A8
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"4b971b3d-8651-4538-816d-a56e475b3407","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713691408320,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):285
                      Entropy (8bit):5.377782892021461
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXDknyS0nHVoZcg1vRcR0YGoAvJfPmwrPeUkwRe9:YvXKXgyR2Zc0viGH56Ukee9
                      MD5:E6674410FFED3669F3659833564AE08E
                      SHA1:C079C6A37617EB1CA2C26B56CE674DD5D204140F
                      SHA-256:69744FEB36B577D0FF8CB467708D4E846C43CED7DE159F63FAB0CB908094DA6A
                      SHA-512:A40F1396248288A9589777D312B58E46B65EEC29A9F9CD7AF8A0F30F8377AC6DF478F35833031216ACE46E7ADA9ACBB494460EBC038ED651DBDB9343E5BD2FA9
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"4b971b3d-8651-4538-816d-a56e475b3407","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713691408320,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.337915896109584
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXDknyS0nHVoZcg1vRcR0YGoAvJfJWCtMdPeUkwRe9:YvXKXgyR2Zc0viGBS8Ukee9
                      MD5:D92C306A00D77FCD1C0470751BFC00BC
                      SHA1:94A483A404F95CE8B9947CBC5FBF6C532B108046
                      SHA-256:E9DB3016D5A61B1EED344A2D0BB290350F48E2C51E169E1B0AE8805794E9A206
                      SHA-512:D64586056353FFD3D122AA8A439442CB2E829424F1328F5933A0EB7B95B640E3B168FA32C48F87D60511D04ADF56C2CC12679D23F3846C39CE8C3DB7EE6582BD
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"4b971b3d-8651-4538-816d-a56e475b3407","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713691408320,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.325854140845819
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXDknyS0nHVoZcg1vRcR0YGoAvJf8dPeUkwRe9:YvXKXgyR2Zc0viGU8Ukee9
                      MD5:35583A0D91AB4EFF88D9ECE695C151E5
                      SHA1:6D60CBC610354722CC16FB0BA02515DCA420111A
                      SHA-256:5DE667B6FE637AD468EBC9707DEF5064BB7E5402751633D72507F8FB16EC30DA
                      SHA-512:824080ADA16AD3D5A50010EFA014620251AE7FFDE14F77DEF92BFB58A0A499610B58568BE8136858B0BEBE779D8EE5348E851F65FC53CB1BA9CE76D86DA3C4F5
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"4b971b3d-8651-4538-816d-a56e475b3407","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713691408320,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):5.3294709537493645
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXDknyS0nHVoZcg1vRcR0YGoAvJfQ1rPeUkwRe9:YvXKXgyR2Zc0viGY16Ukee9
                      MD5:2A1A208580D3A173218ADC2B08CFD970
                      SHA1:0BB93A8E88DF420099A87876591955DE679187B9
                      SHA-256:17D04D8113B1737EC17C74895EFFA9E4F314356A12FD82C8691B20F9EE4BFE70
                      SHA-512:A2DBC89852DEF0AF6287480228472FFD9971EAF37BD3CD4491E115AFDD598289875B889AD47099E5A3CE64D93573DB6C1D1F73BCF8FFE7EB4B8D83BF761DAC2B
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"4b971b3d-8651-4538-816d-a56e475b3407","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713691408320,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.334101370774662
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXDknyS0nHVoZcg1vRcR0YGoAvJfFldPeUkwRe9:YvXKXgyR2Zc0viGz8Ukee9
                      MD5:297481C0B82D5B0C8F6DC8ED00B937F2
                      SHA1:32182000A59AC511FAA528C7F64B98CB5C584CF5
                      SHA-256:F993CF5DCCD0A2A93035FC02A19736298AE41C17087C24715E3BFCBA96575E88
                      SHA-512:654BB3C825C8596CB59CF711F7804F073AFCC5837B711BACA70D4C5F78972C20CA9C852636457BB50BB0A9BAEF71BD225C90A7BA69EE5F499D1521FB584A0050
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"4b971b3d-8651-4538-816d-a56e475b3407","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713691408320,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1372
                      Entropy (8bit):5.7445961742876595
                      Encrypted:false
                      SSDEEP:24:Yv6XCzvOKLgENRcbrZbq00iCCBrwJo++ns8ct4mFJN2:Yv9mEgigrNt0wSJn+ns8cvFJ8
                      MD5:75045EC784A6B749400141237A19A3AA
                      SHA1:E87A7CA9D88DD2657E23C2935BFA32CD4B92ABEE
                      SHA-256:61F521ACBC53D1ED95D1CBE5CD4EA7041281D8CDE58150C30E64F619B8399642
                      SHA-512:191910F0473E62D69F90C149306D176197ECD128540B817623D0DA2002A58F70FCF1C208AA61C7F9C640A39EF9AAE48B11D74BD727C3F9160D8DBE58F781CF40
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"4b971b3d-8651-4538-816d-a56e475b3407","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713691408320,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"79887_247329ActionBlock_0","campaignId":79887,"containerId":"1","controlGroupId":"","treatmentId":"acc56846-d570-4500-a26e-7f8cf2b4acad","variationId":"247329"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJUcnkgQWNyb2JhdCBQcm8ifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNSIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTMiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIDctZGF5IHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0byBwcmVtaXVtIFBERiBhbmQgZS1zaWduaW5nIHRvb2xzLiIsImJ

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.331382785665344
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXDknyS0nHVoZcg1vRcR0YGoAvJfYdPeUkwRe9:YvXKXgyR2Zc0viGg8Ukee9
                      MD5:AD7E72502FA06DF23F5FF54F14CBF8BD
                      SHA1:CDF1DB5C27129DAFFF4AD822FB86E9F3B0039B9C
                      SHA-256:3F0B7ECB13B2C99F4F01D24A4476369D123A33965A12D65F316D368B9D76F6AB
                      SHA-512:9F5D63A87F703731B03BA99114A2B5C5A5E4C51DCF2091FACB3C918DA20DFF406EC0E9C9414D5BA776B372C8CB5929F5BF17CA4D1DC0013E41494DB69D4182CC
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"4b971b3d-8651-4538-816d-a56e475b3407","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713691408320,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1395
                      Entropy (8bit):5.779857986799193
                      Encrypted:false
                      SSDEEP:24:Yv6XCzvFrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJN+:Yv9tHgDv3W2aYQfgB5OUupHrQ9FJw
                      MD5:6ECDBA47534F7C117B0F752244AEA72C
                      SHA1:6E5A75C7437EE221B6DFE4034216488FF8687F82
                      SHA-256:0F256F4B6932D0171EAB55CD56D9DA205DAB12A7CB04B5BC2D35507DF1EBB06B
                      SHA-512:D3FCFA49BFC9F6CBC7EEBEFF9E93B2621EBDB5D0FF6A3AF6DE04F015BADE5E3D83C7C2EA568D103BE29266A1F290F58B679E97B806AAF59511A21716CAA0324B
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"4b971b3d-8651-4538-816d-a56e475b3407","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713691408320,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):291
                      Entropy (8bit):5.314714194090648
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXDknyS0nHVoZcg1vRcR0YGoAvJfbPtdPeUkwRe9:YvXKXgyR2Zc0viGDV8Ukee9
                      MD5:C8C7AC7BEDF9D31C5CDD7C3B2553D997
                      SHA1:7DFD722E5CFFD5D87D471E175E7A69FA83483A68
                      SHA-256:06B814C1311A61E3AFD92ADB267A1536986DEF541CCEB598B14910896B50E725
                      SHA-512:BC42BB516B76CEBD9CE85471F4DF00037E514A829E04BE1528FF0F63B1A037DDEC90DD133F452FCD687C5C4F89F345188176124787DAE97862C56E08385A688C
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"4b971b3d-8651-4538-816d-a56e475b3407","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713691408320,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):287
                      Entropy (8bit):5.31948565073483
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXDknyS0nHVoZcg1vRcR0YGoAvJf21rPeUkwRe9:YvXKXgyR2Zc0viG+16Ukee9
                      MD5:D06F952F545AA78F51F9A03BE909F1F6
                      SHA1:3E06F7F24AECDFC118C7073D0DEA90AE076D234A
                      SHA-256:5656CAA5DE8685A128638539E940B2AE2122BC4253D9996DA41E5F575DF0F26A
                      SHA-512:542E0FF9F75DEE77AA7C5F1FF811A3601125F06CF8134A378CC0B3E56DD98968AE29B0ECC6851C7BBD8BA0DF0341C3B881E7A17D678FA2E369516E23A13C2196
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"4b971b3d-8651-4538-816d-a56e475b3407","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713691408320,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):289
                      Entropy (8bit):5.337924096349269
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXDknyS0nHVoZcg1vRcR0YGoAvJfbpatdPeUkwRe9:YvXKXgyR2Zc0viGVat8Ukee9
                      MD5:B413B1C54074A1E52ECF51B6A429BBE9
                      SHA1:111F75E5191B62B17BA02F51DE16416502744858
                      SHA-256:AD8A8769E95C9D2180B83E5A92E82C3AEC596AB1673852AFF7CA1177D01EB2CA
                      SHA-512:B0DB7987E881C750F0D067E2FC2D1CA4FEF78AC999AB9F7A7FC2B9C42C7B1FBDDE33F07CB995B9F2561498A072C49C99EF7E28EB04C170487BD47E1BC74BB60A
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"4b971b3d-8651-4538-816d-a56e475b3407","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713691408320,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):286
                      Entropy (8bit):5.2952549719333915
                      Encrypted:false
                      SSDEEP:6:YEQXJ2HXDknyS0nHVoZcg1vRcR0YGoAvJfshHHrPeUkwRe9:YvXKXgyR2Zc0viGUUUkee9
                      MD5:34528EDE8CEA2C0ADB6A6FD9576FF233
                      SHA1:1E52E7702BD02FF49C0686C11BF24B41BD90F55E
                      SHA-256:F40578405DE381D0DB79391D75D3F94F690E118DE734E4474C287AC628AB1CAD
                      SHA-512:FDCCE5338FB8AF424432F55317A456705F39F185E311B01ED0B225FF20263EC833D8E40E915890BCE508102615B39C323B08BF9E83F85CFDDB538B547B835327
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"4b971b3d-8651-4538-816d-a56e475b3407","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713691408320,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):782
                      Entropy (8bit):5.377974225903438
                      Encrypted:false
                      SSDEEP:12:YvXKXgyR2Zc0viGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWq:Yv6XCzvs168CgEXX5kcIfANh7
                      MD5:024B024768C39C3B05C40181228B9B0A
                      SHA1:C64953E498D582128068010317D93EFA4C032540
                      SHA-256:254EC27F63D3764FFD494B61FAC117DDC52DAADBEA211A53C5B61477CDEE0119
                      SHA-512:1FE149A55F6F19F48DB5CB424B56D32FECF60217CF85B0E7C1814393EEA595075383FEF0A53D6147506D9B165239E581CFC160C48887944C8DE94F321FA24B71
                      Malicious:false
                      Preview:{"analyticsData":{"responseGUID":"4b971b3d-8651-4538-816d-a56e475b3407","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1713691408320,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1713513313357}}}}

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):4
                      Entropy (8bit):0.8112781244591328
                      Encrypted:false
                      SSDEEP:3:e:e
                      MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                      SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                      SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                      SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                      Malicious:false
                      Preview:....

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):2814
                      Entropy (8bit):5.133786360107891
                      Encrypted:false
                      SSDEEP:24:YzAScqjCpHCafcgKTafoayxa73nSDHgjPmj0SwQ3CE2b02LSqP4QD5sR9huNOG:Y0ScAWX0p6CsPP43vNsbD2R9o
                      MD5:E8A9D5F8DCC0AC8CB03B40DBED73C6C5
                      SHA1:46CA9BCF6FE7301F85DD522AB7A3366B8C0B6C77
                      SHA-256:01D7A65DE4A9317D2BB07DFC127A02F70634F99C23E858FBA1B0B26519249E28
                      SHA-512:E716D882099A157426B94F441018985C377268DFC94299B781C310BBD7ECF6EA710EB86E9883F90752AAE73434B908695059C187B7429F65019D4ED68BD3D6D8
                      Malicious:false
                      Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"0b05bd35a298f011102c93c0f8b6f88c","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1713513312000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"c30faefd6db8e7288a26d27cf095a45e","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1372,"ts":1713513312000},{"id":"Edit_InApp_Aug2020","info":{"dg":"852b39289edd456f926d52bf4bf7f38d","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1713513312000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"a1b3e77a9b53c67d8ab13d95652370e8","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1713513312000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"2cc9babbf7883c424e81b15578388acc","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1713513312000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"d047692121c4ceee7b3acb623cf7d6e0","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":289,"ts":1713513312000},

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
                      Category:dropped
                      Size (bytes):12288
                      Entropy (8bit):1.1867450899283296
                      Encrypted:false
                      SSDEEP:48:TGufl2GL7msEHUUUUUUUUNSSvR9H9vxFGiDIAEkGVvpRU:lNVmswUUUUUUUUNS+FGSItNU
                      MD5:249EE2FE1E036BB962D4EC3B620AAE0E
                      SHA1:51238E1FC42857B411DDD0065DDCDE425F4A41AC
                      SHA-256:136781FD107D19DF53C2CDB7A5508EB0CD0C0642E53370B23515C90E9763FE46
                      SHA-512:B6E2236708B387CCE71887F9C950FA3ADC2AFEAA3FF71F25A1389CAF65D49F52C01883A9565F915BA9CA5BD9D668CE4DB79AC70CAF33B7258ECEC1B3CF16CB73
                      Malicious:false
                      Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite Rollback Journal
                      Category:dropped
                      Size (bytes):8720
                      Entropy (8bit):1.6076339490682314
                      Encrypted:false
                      SSDEEP:48:7MfKUUUUUUUUUUNAvR9H9vxFGiDIAEkGVv8qFl2GL7msqw:7NUUUUUUUUUUN4FGSItiKVmsqw
                      MD5:7306DCF870F9D5D46A725F2BE5E4EE69
                      SHA1:481D7891965E51E0F619AD236C2E70B613DC1282
                      SHA-256:B0FE69F0F51A5BF8E86AEBF1436671C8F861934404F89E9BC2278AA9E4483E1E
                      SHA-512:2C27F53583650884C08CAAE4214B02C58351C156D8BC0FEDC374BF6DE8E04DDBD8E241A8F0D083CA931B575314CE18D4FD661C93FC5B52658D477D863B998353
                      Malicious:false
                      Preview:.... .c........J......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Temp\MSI34b4.LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):246
                      Entropy (8bit):3.5248044522866877
                      Encrypted:false
                      SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8m+qNpH:Qw946cPbiOxDlbYnuRKR
                      MD5:BB7FF9A2DBABF885BA45A49675794BC9
                      SHA1:F8CB1C8F06F9ADDB2B4F8E52CE6A348B801D853F
                      SHA-256:8FA6BD468475DF4172BA324852CBCDF957082C61214DB73D54150D0D39E08D48
                      SHA-512:4FDC3B2EBB070E68B153D56E5AA6AAD73A874F2B8D5196FDBC166AD9D27FC0F0EACFB6076D747A8EBD01F2F8A70506DDD845AC580668F19D841B3A1C08E34FD9
                      Malicious:false
                      Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.9./.0.4./.2.0.2.4. . .0.9.:.5.5.:.1.5. .=.=.=.....

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-19 09-55-09-448.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393)
                      Category:dropped
                      Size (bytes):16525
                      Entropy (8bit):5.345946398610936
                      Encrypted:false
                      SSDEEP:384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
                      MD5:8947C10F5AB6CFFFAE64BCA79B5A0BE3
                      SHA1:70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
                      SHA-256:4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
                      SHA-512:B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
                      Malicious:false
                      Preview:SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393), with CRLF line terminators
                      Category:dropped
                      Size (bytes):16603
                      Entropy (8bit):5.359209635387273
                      Encrypted:false
                      SSDEEP:384:GzPqffWD3YqWhpYdHMbW0DeWV2cdSa/96dxzr75ghXv1TaQWLU8DyD2X5nVjW2uJ:kc1
                      MD5:198D0C85F611833404825F274C8FB2BD
                      SHA1:E00B035702F6FA0F687F95BFCB254A23B961667A
                      SHA-256:47272BC4616DCD9B46B59353BE1065D7E1FD72C40E1835D8799D9CA13F8AA7A7
                      SHA-512:F013754CB8D4CD8936684C2089DCCA817CAF0C5947CF6FA7F765050264EBF94FD721E857ABF4D33610FEDF9576287FD06F0E87DC8F4D2AF8C7006FD0FE2EE506
                      Malicious:false
                      Preview:SessionID=5fb01001-38c4-4afb-b517-0e0787b099bf.1713513309461 Timestamp=2024-04-19T09:55:09:461+0200 ThreadID=7648 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=5fb01001-38c4-4afb-b517-0e0787b099bf.1713513309461 Timestamp=2024-04-19T09:55:09:462+0200 ThreadID=7648 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=5fb01001-38c4-4afb-b517-0e0787b099bf.1713513309461 Timestamp=2024-04-19T09:55:09:462+0200 ThreadID=7648 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=5fb01001-38c4-4afb-b517-0e0787b099bf.1713513309461 Timestamp=2024-04-19T09:55:09:462+0200 ThreadID=7648 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=5fb01001-38c4-4afb-b517-0e0787b099bf.1713513309461 Timestamp=2024-04-19T09:55:09:462+0200 ThreadID=7648 Component=ngl-lib_NglAppLib Description="SetConf

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):29845
                      Entropy (8bit):5.393348354990422
                      Encrypted:false
                      SSDEEP:768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rF:R
                      MD5:3FCC8C482E194D1A6CD58030CBFEF186
                      SHA1:62B2FFB8A081F8FA8BDD73891B9FD42382557535
                      SHA-256:F684B3108DCCF061A7F2338F5C23030A7D476DC7407FCF5B21C08491D2F80F52
                      SHA-512:4D0F3255634561268558679ECE30058A3A73BB78EFA9EB9B18C4B03F3FC06F08FEF7F30EB4C776AF646BBF815E344EB3C5AA07ACB75AE4FC596DC477D61F89ED
                      Malicious:false
                      Preview:03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

                      C:\Users\user\AppData\Local\Temp\acrocef_low\7c4ad8d9-2966-4219-a55b-7117855212a6.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                      Category:dropped
                      Size (bytes):758601
                      Entropy (8bit):7.98639316555857
                      Encrypted:false
                      SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                      MD5:3A49135134665364308390AC398006F1
                      SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                      SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                      SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                      Malicious:false
                      Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                      C:\Users\user\AppData\Local\Temp\acrocef_low\80630c15-20f5-47a6-99a6-565f239d9a8b.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                      Category:dropped
                      Size (bytes):1407294
                      Entropy (8bit):7.97605879016224
                      Encrypted:false
                      SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
                      MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
                      SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
                      SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
                      SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
                      Malicious:false
                      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                      C:\Users\user\AppData\Local\Temp\acrocef_low\a1430a9a-0b62-41e6-b618-6d966d304658.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                      Category:dropped
                      Size (bytes):1419751
                      Entropy (8bit):7.976496077007677
                      Encrypted:false
                      SSDEEP:24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
                      MD5:95F182500FC92778102336D2D5AADCC8
                      SHA1:BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
                      SHA-256:9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
                      SHA-512:D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
                      Malicious:false
                      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                      C:\Users\user\AppData\Local\Temp\acrocef_low\d4962992-9219-4ff1-8e79-366045b9aa3d.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                      Category:dropped
                      Size (bytes):386528
                      Entropy (8bit):7.9736851559892425
                      Encrypted:false
                      SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                      MD5:5C48B0AD2FEF800949466AE872E1F1E2
                      SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                      SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                      SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                      Malicious:false
                      Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                      Static File Info

                      General

                      File type:PDF document, version 1.5, 1 pages
                      Entropy (8bit):7.989712012014312
                      TrID:
                      • Adobe Portable Document Format (5005/1) 100.00%
                      File name:CITACI#U00d3N JUDICIAL UE (1).pdf
                      File size:60'669 bytes
                      MD5:50cb062ac5cb59b71776da61cb93d47b
                      SHA1:65be60c85b998828ceced3bdc1c4897da456f8b8
                      SHA256:c61080e990c67cf2219aac95df3b770d559c6c46c7d91d598da790e441e2f04b
                      SHA512:36bc25d5eead2bf4724518f82f900334bdd8e1c884b08f46a01124b90d105a460ee44ff78b0dc3152415d771afd83e062fb8a5058cc372f821b5045be1173866
                      SSDEEP:1536:i6M7ekO1Y53Cl/RdADOG8gsj7dDiSrqFfm9v8uoR/Lfv:i6M7LO1ws/RdAa5dDGYtKbv
                      TLSH:CD530203B921155C98606935725DC4D408EBD09FEAC5B016323DCB277A0BFB6A1B5FAF
                      File Content Preview:%PDF-1.5..1 0 obj.<</Type /Catalog/Pages 3 0 R/MarkInfo <</Marked true>>/Lang (en-US)/StructTreeRoot 69 0 R>>.endobj.3 0 obj.<</Type /Pages/Count 1/Kids [4 0 R]>>.endobj.9 0 obj.<</Filter /FlateDecode/Length 3996/First 1033/N 116/Type /ObjStm>>stream..x..

                      File Icon

                      Icon Hash:62cc8caeb29e8ae0

                      Static PDF Info

                      General

                      Header:%PDF-1.5
                      Total Entropy:7.989712
                      Total Bytes:60669
                      Stream Entropy:7.994882
                      Stream Bytes:58738
                      Entropy outside Streams:5.177421
                      Bytes outside Streams:1931
                      Number of EOF found:1
                      Bytes after EOF:

                      Keywords Statistics

                      NameCount
                      obj20
                      endobj20
                      stream18
                      endstream18
                      xref0
                      trailer0
                      startxref1
                      /Page0
                      /Encrypt0
                      /ObjStm2
                      /URI0
                      /JS0
                      /JavaScript0
                      /AA0
                      /OpenAction0
                      /AcroForm0
                      /JBIG2Decode0
                      /RichMedia0
                      /Launch0
                      /EmbeddedFile0

                      Image Streams

                      IDDHASHMD5Preview
                      676801080808001002d9a4e2864d7bb13a81f59ba4fd76e476

                      Network Behavior

                      Network Port Distribution

                      TCP Packets

                      TimestampSource PortDest PortSource IPDest IP
                      Apr 19, 2024 09:55:19.801876068 CEST49740443192.168.2.4184.25.164.138
                      Apr 19, 2024 09:55:19.801961899 CEST44349740184.25.164.138192.168.2.4
                      Apr 19, 2024 09:55:19.802068949 CEST49740443192.168.2.4184.25.164.138
                      Apr 19, 2024 09:55:19.802263021 CEST49740443192.168.2.4184.25.164.138
                      Apr 19, 2024 09:55:19.802299976 CEST44349740184.25.164.138192.168.2.4
                      Apr 19, 2024 09:55:20.118525982 CEST44349740184.25.164.138192.168.2.4
                      Apr 19, 2024 09:55:20.119159937 CEST49740443192.168.2.4184.25.164.138
                      Apr 19, 2024 09:55:20.119223118 CEST44349740184.25.164.138192.168.2.4
                      Apr 19, 2024 09:55:20.122842073 CEST44349740184.25.164.138192.168.2.4
                      Apr 19, 2024 09:55:20.122936964 CEST49740443192.168.2.4184.25.164.138
                      Apr 19, 2024 09:55:20.124989033 CEST49740443192.168.2.4184.25.164.138
                      Apr 19, 2024 09:55:20.125190973 CEST44349740184.25.164.138192.168.2.4
                      Apr 19, 2024 09:55:20.125303984 CEST49740443192.168.2.4184.25.164.138
                      Apr 19, 2024 09:55:20.172126055 CEST44349740184.25.164.138192.168.2.4
                      Apr 19, 2024 09:55:20.180171013 CEST49740443192.168.2.4184.25.164.138
                      Apr 19, 2024 09:55:20.180228949 CEST44349740184.25.164.138192.168.2.4
                      Apr 19, 2024 09:55:20.227077961 CEST49740443192.168.2.4184.25.164.138
                      Apr 19, 2024 09:55:20.229655027 CEST44349740184.25.164.138192.168.2.4
                      Apr 19, 2024 09:55:20.229829073 CEST44349740184.25.164.138192.168.2.4
                      Apr 19, 2024 09:55:20.229897022 CEST49740443192.168.2.4184.25.164.138
                      Apr 19, 2024 09:55:20.230345011 CEST49740443192.168.2.4184.25.164.138
                      Apr 19, 2024 09:55:20.230345011 CEST49740443192.168.2.4184.25.164.138
                      Apr 19, 2024 09:55:20.230410099 CEST44349740184.25.164.138192.168.2.4
                      Apr 19, 2024 09:55:20.230472088 CEST49740443192.168.2.4184.25.164.138

                      HTTP Request Dependency Graph

                      • armmf.adobe.com

                      HTTPS Proxied Packets

                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      0192.168.2.449740184.25.164.1384437876C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      TimestampBytes transferredDirectionData
                      2024-04-19 07:55:20 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
                      Host: armmf.adobe.com
                      Connection: keep-alive
                      Accept-Language: en-US,en;q=0.9
                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
                      Sec-Fetch-Site: same-origin
                      Sec-Fetch-Mode: no-cors
                      Sec-Fetch-Dest: empty
                      Accept-Encoding: gzip, deflate, br
                      If-None-Match: "78-5faa31cce96da"
                      If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
                      2024-04-19 07:55:20 UTC198INHTTP/1.1 304 Not Modified
                      Content-Type: text/plain; charset=UTF-8
                      Last-Modified: Mon, 01 May 2023 15:02:33 GMT
                      ETag: "78-5faa31cce96da"
                      Date: Fri, 19 Apr 2024 07:55:20 GMT
                      Connection: close


                      Statistics

                      CPU Usage

                      Click to jump to process

                      Memory Usage

                      Click to jump to process

                      High Level Behavior Distribution

                      Click to dive into process behavior distribution

                      Behavior

                      Click to jump to process

                      System Behavior

                      General

                      Target ID:0
                      Start time:09:55:06
                      Start date:19/04/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\CITACI#U00d3N JUDICIAL UE (1).pdf"
                      Imagebase:0x7ff6bc1b0000
                      File size:5'641'176 bytes
                      MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      General

                      Target ID:1
                      Start time:09:55:06
                      Start date:19/04/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                      Imagebase:0x7ff74bb60000
                      File size:3'581'912 bytes
                      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      General

                      Target ID:3
                      Start time:09:55:07
                      Start date:19/04/2024
                      Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1556,i,11480562085678056129,14334011370226977473,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                      Imagebase:0x7ff74bb60000
                      File size:3'581'912 bytes
                      MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:moderate
                      Has exited:true

                      Disassembly

                      ⊘No disassembly