Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
ITK2024000000345.pdf

Overview

General Information

Sample name:ITK2024000000345.pdf
Analysis ID:1428676
MD5:2b3775bce631873ae65f01d6f685e1a4
SHA1:363b06054658f5f38f86ff5fc4f9144f90e40304
SHA256:d1c29a2edea80f40ef8f2f87beaeba5c39f54a52b2517beefa3b404d06aa0712
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

IP address seen in connection with other malware
PDF has an OpenAction (likely to launch a dropper script)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 6528 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\ITK2024000000345.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 2412 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 3180 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1532,i,7078458210153690288,15258129016823440622,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.46.201.17:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.46.201.17:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.46.201.17:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.46.201.17:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.46.201.17:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.46.201.17:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.46.201.17:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.46.201.17:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.46.201.17:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.46.201.17:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.46.201.17:443
Source: global trafficTCP traffic: 23.46.201.17:443 -> 192.168.2.5:49715
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.46.201.17:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.46.201.17:443
Source: global trafficTCP traffic: 23.46.201.17:443 -> 192.168.2.5:49715
Source: global trafficTCP traffic: 23.46.201.17:443 -> 192.168.2.5:49715
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.46.201.17:443
Source: global trafficTCP traffic: 23.46.201.17:443 -> 192.168.2.5:49715
Source: global trafficTCP traffic: 23.46.201.17:443 -> 192.168.2.5:49715
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.46.201.17:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.46.201.17:443
Source: global trafficTCP traffic: 23.46.201.17:443 -> 192.168.2.5:49715
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.46.201.17:443
Source: global trafficTCP traffic: 23.46.201.17:443 -> 192.168.2.5:49715
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.46.201.17:443
Source: global trafficTCP traffic: 23.46.201.17:443 -> 192.168.2.5:49715
Source: global trafficTCP traffic: 23.46.201.17:443 -> 192.168.2.5:49715
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.46.201.17:443
Source: global trafficTCP traffic: 192.168.2.5:49715 -> 23.46.201.17:443
Source: global trafficTCP traffic: 23.46.201.17:443 -> 192.168.2.5:49715
Source: Joe Sandbox ViewIP Address: 23.46.201.17 23.46.201.17
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.201.17
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.201.17
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.201.17
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.201.17
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.201.17
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.201.17
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.201.17
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.201.17
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.201.17
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.201.17
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: classification engineClassification label: clean2.winPDF@14/41@0/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4712Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-19 11-39-10-505.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\ITK2024000000345.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1532,i,7078458210153690288,15258129016823440622,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1532,i,7078458210153690288,15258129016823440622,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: ITK2024000000345.pdfInitial sample: PDF keyword /JS count = 0
Source: ITK2024000000345.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: ITK2024000000345.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: ITK2024000000345.pdfInitial sample: PDF keyword /OpenAction
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive12
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1428676 Sample: ITK2024000000345.pdf Startdate: 19/04/2024 Architecture: WINDOWS Score: 2 6 Acrobat.exe 18 62 2->6         started        process3 8 AcroCEF.exe 105 6->8         started        process4 10 AcroCEF.exe 2 8->10         started        dnsIp5 13 23.46.201.17, 443, 49715 AKAMAI-ASUS United States 10->13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
ITK2024000000345.pdf0%VirustotalBrowse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
23.46.201.17
unknownUnited States
16625AKAMAI-ASUSfalse

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1428676
Start date and time:2024-04-19 11:38:17 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 7s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultwindowspdfcookbook.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:9
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:ITK2024000000345.pdf
Detection:CLEAN
Classification:clean2.winPDF@14/41@0/1
EGA Information:Failed
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 0
  • Number of non-executed functions: 0
Cookbook Comments:
  • Found application associated with file extension: .pdf
  • Found PDF document
  • Close Viewer

Warnings

  • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 184.27.136.185, 34.193.227.236, 107.22.247.231, 54.144.73.197, 18.207.85.246, 172.64.41.3, 162.159.61.3, 104.76.210.69, 104.76.210.84
  • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
23.46.201.17SA161.pdf.lnkGet hashmaliciousRHADAMANTHYSBrowse
    https://app.box.com/s/cf3xjx2mmpt2vnadnh2br5kbeknr6bvwGet hashmaliciousUnknownBrowse
      Order for new Project ECG EGYPT.xlsGet hashmaliciousUnknownBrowse
        https://objectstorage.eu-paris-1.oraclecloud.com/p/jzi4zyWBod1AR_voArcvKDwXAEPGXCk3xAz_kR8mLqo7nZBsZ2x9jqUW7JxfnQZs/n/oraclepartnersas/b/Student-23c/o/Oracle_Database_23c_Security_2024.pdfGet hashmaliciousUnknownBrowse
          kak-pomilovannye-vagnerovcy-snova.pdf.lnkGet hashmaliciousUnknownBrowse
            fabrika-nakrutok-kak-vk-prevrashchaet-runet.pdfx.lnkGet hashmaliciousUnknownBrowse
              RR1-733859-11972-Transmissora_Alianca_de_Energia_Eletrica_S_A__time_10022023204823.pdf.7zGet hashmaliciousUnknownBrowse

                Domains

                ⊘No context

                ASNs

                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                AKAMAI-ASUShttps://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:24e81d17-b801-4fad-ae25-120d655923c5Get hashmaliciousRemcosBrowse
                • 184.31.61.57
                tA6etkt3gb.exeGet hashmaliciousAmadey, PureLog Stealer, RedLine, RisePro Stealer, zgRATBrowse
                • 23.44.104.130
                BzmhHwFpCV.elfGet hashmaliciousMiraiBrowse
                • 172.225.191.4
                dPFRrhKTeG.elfGet hashmaliciousUnknownBrowse
                • 88.221.207.232
                0001.docGet hashmaliciousDynamerBrowse
                • 23.44.104.130
                PO_983888123.xlsGet hashmaliciousUnknownBrowse
                • 23.36.68.10
                SA162.pdf.download.lnkGet hashmaliciousUnknownBrowse
                • 23.63.158.36
                SA161.pdf.lnkGet hashmaliciousRHADAMANTHYSBrowse
                • 23.46.201.17
                Factura_SA161.pdf.lnkGet hashmaliciousRHADAMANTHYSBrowse
                • 184.31.60.185
                E3kpuuuOfy.elfGet hashmaliciousMiraiBrowse
                • 104.114.141.6

                JA3 Fingerprints

                ⊘No context

                Dropped Files

                ⊘No context

                Created / dropped Files

                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:ASCII text
                Category:dropped
                Size (bytes):291
                Entropy (8bit):5.157110555750484
                Encrypted:false
                SSDEEP:6:Xk7bq2P92nKuAl9OmbnIFUt8Yk7+Zmw+YkIQkwO92nKuAl9OmbjLJ:X+bv4HAahFUt8Y++/+YnQ5LHAaSJ
                MD5:48B0AE319FCF7FCB3CA41F7BF1846CF1
                SHA1:E05EAAFEF42DF77427A56BE7BC8DB02EDD52A13E
                SHA-256:7F789504D0CAE18E84C41ABF60FF1314240D4FD34C9AB561032785F9002766E6
                SHA-512:63AD2552BB8EA328EBDE29F7B00ABB2D5DEC09AA4C325165D3622DCE792B8D11A3E7BEA8CD1248603939FF5C058EBE57FFE1A12E17C586F6D1F8EE7EE5203596
                Malicious:false
                Reputation:low
                Preview:2024/04/19-11:39:08.121 ed0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/19-11:39:08.121 ed0 Recovering log #3.2024/04/19-11:39:08.122 ed0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:ASCII text
                Category:dropped
                Size (bytes):291
                Entropy (8bit):5.157110555750484
                Encrypted:false
                SSDEEP:6:Xk7bq2P92nKuAl9OmbnIFUt8Yk7+Zmw+YkIQkwO92nKuAl9OmbjLJ:X+bv4HAahFUt8Y++/+YnQ5LHAaSJ
                MD5:48B0AE319FCF7FCB3CA41F7BF1846CF1
                SHA1:E05EAAFEF42DF77427A56BE7BC8DB02EDD52A13E
                SHA-256:7F789504D0CAE18E84C41ABF60FF1314240D4FD34C9AB561032785F9002766E6
                SHA-512:63AD2552BB8EA328EBDE29F7B00ABB2D5DEC09AA4C325165D3622DCE792B8D11A3E7BEA8CD1248603939FF5C058EBE57FFE1A12E17C586F6D1F8EE7EE5203596
                Malicious:false
                Reputation:low
                Preview:2024/04/19-11:39:08.121 ed0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/19-11:39:08.121 ed0 Recovering log #3.2024/04/19-11:39:08.122 ed0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:ASCII text
                Category:dropped
                Size (bytes):335
                Entropy (8bit):5.189277227575268
                Encrypted:false
                SSDEEP:6:XkmoWt+q2P92nKuAl9Ombzo2jMGIFUt8YkcJZmw+YkXVkwO92nKuAl9Ombzo2jM4:XHoWov4HAa8uFUt8YT/+Ym5LHAa8RJ
                MD5:46666B893C837C41BA7BE01FF0B5B670
                SHA1:C89CEDC9EE0579646379BE3CC6E2BA1168B3F863
                SHA-256:C2E704F30E8077CC2F22EB0C9E7BC085E5B6DA319E73259E0CD4BDD3F82EB5AF
                SHA-512:C11D5D4E53242473529850E2E3397EC27116249F8DA015A98520FAD41F8DD835F206BA4E78141B7A70D98C7CE27F6BA34F2BBFF114E7AA6433F8A3E1C31E26E7
                Malicious:false
                Reputation:low
                Preview:2024/04/19-11:39:08.209 738 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/19-11:39:08.210 738 Recovering log #3.2024/04/19-11:39:08.211 738 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:ASCII text
                Category:dropped
                Size (bytes):335
                Entropy (8bit):5.189277227575268
                Encrypted:false
                SSDEEP:6:XkmoWt+q2P92nKuAl9Ombzo2jMGIFUt8YkcJZmw+YkXVkwO92nKuAl9Ombzo2jM4:XHoWov4HAa8uFUt8YT/+Ym5LHAa8RJ
                MD5:46666B893C837C41BA7BE01FF0B5B670
                SHA1:C89CEDC9EE0579646379BE3CC6E2BA1168B3F863
                SHA-256:C2E704F30E8077CC2F22EB0C9E7BC085E5B6DA319E73259E0CD4BDD3F82EB5AF
                SHA-512:C11D5D4E53242473529850E2E3397EC27116249F8DA015A98520FAD41F8DD835F206BA4E78141B7A70D98C7CE27F6BA34F2BBFF114E7AA6433F8A3E1C31E26E7
                Malicious:false
                Reputation:low
                Preview:2024/04/19-11:39:08.209 738 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/19-11:39:08.210 738 Recovering log #3.2024/04/19-11:39:08.211 738 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):508
                Entropy (8bit):5.061602859316414
                Encrypted:false
                SSDEEP:12:YH/um3RA8sqZwsBdOg2H6caq3QYiubxnP7E4T3OF+:Y2sRdsadMH13QYhbxP7nbI+
                MD5:69326FE4E19720577E221374D9117637
                SHA1:AEFBCE513088184369ECF579BB18386E572B6A06
                SHA-256:8AD56D6943EA99406842C858B52366E022DD434898A66EDF4451C447A84E6AB6
                SHA-512:EF803367A5349F1A0E6B740FD96C1070A20C4359CB5F7790DD344D6B774DB11A5FD522B8ADEFA95162E347430E3FF12F988AA3BE54D80E008D5B9B1E551B9010
                Malicious:false
                Reputation:low
                Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13358079560051759","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":106050},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\eee2af71-54a0-47a0-b71a-7721a4132225.tmp

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:JSON data
                Category:modified
                Size (bytes):508
                Entropy (8bit):5.061602859316414
                Encrypted:false
                SSDEEP:12:YH/um3RA8sqZwsBdOg2H6caq3QYiubxnP7E4T3OF+:Y2sRdsadMH13QYhbxP7nbI+
                MD5:69326FE4E19720577E221374D9117637
                SHA1:AEFBCE513088184369ECF579BB18386E572B6A06
                SHA-256:8AD56D6943EA99406842C858B52366E022DD434898A66EDF4451C447A84E6AB6
                SHA-512:EF803367A5349F1A0E6B740FD96C1070A20C4359CB5F7790DD344D6B774DB11A5FD522B8ADEFA95162E347430E3FF12F988AA3BE54D80E008D5B9B1E551B9010
                Malicious:false
                Reputation:low
                Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13358079560051759","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":106050},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:data
                Category:dropped
                Size (bytes):4509
                Entropy (8bit):5.233721987878106
                Encrypted:false
                SSDEEP:96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUqtEKPZ:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNL/
                MD5:B86BF6D7C0B4833037A72ABD088E178B
                SHA1:ECD894C4B7E4C06B10E58DA53487D7F7F1B27537
                SHA-256:27F65D8F34DA351CE4DDBF78DFC4A1E4B3745B6B4D64FCC26C6F5068873ED28D
                SHA-512:E41DD7AE160CAE099CDB9A6C90BBC2A81B919B16A3F3608AFF5529BB154397CAE7D670FD5BBDB842DF06631A787D539025EBBDAEF547CEF57E2D6BD4435F5849
                Malicious:false
                Reputation:low
                Preview:*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:ASCII text
                Category:dropped
                Size (bytes):323
                Entropy (8bit):5.20041450541603
                Encrypted:false
                SSDEEP:6:XkhN+q2P92nKuAl9OmbzNMxIFUt8YkyZmw+Yk2aF39VkwO92nKuAl9OmbzNMFLJ:XCIv4HAa8jFUt8Yf/+YSF5LHAa84J
                MD5:2E4FD0D0085362D5F3A6692952E8841D
                SHA1:8A431AD7F61A8A907AA0BD02CDA9EE97204FD967
                SHA-256:883CDD546B97C1139ADBA216F6A8DDB5624BFA05F5744282AE90AAEBF64CF3C1
                SHA-512:4B7A81E227E43F19B1710AD40028078501A8A93254BD1F59D173F83E1AAEC9904D9DC2B70D0EB59FE46454323D5097CEDF5437C4C071FC0F9EC3107BC9614CDE
                Malicious:false
                Reputation:low
                Preview:2024/04/19-11:39:08.398 738 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/19-11:39:08.399 738 Recovering log #3.2024/04/19-11:39:08.400 738 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:ASCII text
                Category:dropped
                Size (bytes):323
                Entropy (8bit):5.20041450541603
                Encrypted:false
                SSDEEP:6:XkhN+q2P92nKuAl9OmbzNMxIFUt8YkyZmw+Yk2aF39VkwO92nKuAl9OmbzNMFLJ:XCIv4HAa8jFUt8Yf/+YSF5LHAa84J
                MD5:2E4FD0D0085362D5F3A6692952E8841D
                SHA1:8A431AD7F61A8A907AA0BD02CDA9EE97204FD967
                SHA-256:883CDD546B97C1139ADBA216F6A8DDB5624BFA05F5744282AE90AAEBF64CF3C1
                SHA-512:4B7A81E227E43F19B1710AD40028078501A8A93254BD1F59D173F83E1AAEC9904D9DC2B70D0EB59FE46454323D5097CEDF5437C4C071FC0F9EC3107BC9614CDE
                Malicious:false
                Reputation:low
                Preview:2024/04/19-11:39:08.398 738 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/19-11:39:08.399 738 Recovering log #3.2024/04/19-11:39:08.400 738 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240419093912Z-152.bmp

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
                Category:dropped
                Size (bytes):71190
                Entropy (8bit):1.7576276412481457
                Encrypted:false
                SSDEEP:384:PSGnQjJ26DLKpXTNImESlEWhO+/uyBg7mL2+XBqsW7MzunW:uFKFZItsbHJLbxjWYiW
                MD5:675CB45FF0483F9C55F0F325F2C589CA
                SHA1:E69AD331E8F6CC444AC81167C2C9BF05EC565382
                SHA-256:62C515F3CF488FC3F2B1313EBB865D10721F7DEF64D721192BAD38D5AFA69E2D
                SHA-512:56704CFC4FCAF9FFA323A8B9FF89531B2804CCF4FA0CC83D7694744674D9AEC10263CB3DE7BD5056DB9DA3FED73DB5C31F8D755034111A499DED606851EDACAA
                Malicious:false
                Reputation:low
                Preview:BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4712

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:PostScript document text
                Category:dropped
                Size (bytes):185099
                Entropy (8bit):5.182478651346149
                Encrypted:false
                SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                MD5:94185C5850C26B3C6FC24ABC385CDA58
                SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                Malicious:false
                Reputation:moderate, very likely benign file
                Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:PostScript document text
                Category:dropped
                Size (bytes):185099
                Entropy (8bit):5.182478651346149
                Encrypted:false
                SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                MD5:94185C5850C26B3C6FC24ABC385CDA58
                SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                Malicious:false
                Reputation:moderate, very likely benign file
                Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:data
                Category:dropped
                Size (bytes):227002
                Entropy (8bit):3.392780893644728
                Encrypted:false
                SSDEEP:1536:WKPC4iyzDtrh1cK3XEivK7VK/3AYvYwgF/rRoL+sn:DPCaJ/3AYvYwglFoL+sn
                MD5:87EDBEE38F56C20298F25D5D3D4D1B5C
                SHA1:7F904E9615AC3186A87472EF366DD8202855B0B7
                SHA-256:A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
                SHA-512:BBEBC1FCD5BC9AE042DD5782425BA8C47BF3EAC283B2487FC4E3FF6BF8101306DAB081E5135594165D4DC1AC120FF125AADBC5B3FFE7C646183C04DF77865E0D
                Malicious:false
                Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):295
                Entropy (8bit):5.3393701170143055
                Encrypted:false
                SSDEEP:6:YEQXJ2HXtQhk7+FIbRI6XVW7+0YYqoAvJM3g98kUwPeUkwRe9:YvXKXtQhzYpW7lGMbLUkee9
                MD5:D3D5F188DE9240BA716310F9BE981DB3
                SHA1:49217ECBAA082BFE413F7A0ECA13443CA854CB28
                SHA-256:8E4E8199B4C285756E0BAF0C8DF74DE419D1BA092F02FEDB49407EEB1F8359D8
                SHA-512:89CF47B143CE2ED80F42B63D9EE978E41D3CD83A89162929709EC341A94B20B7418434C1329956AB0A38534DFB7095ADACF80E070E5811E5F389E15DED13E611
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"36c59c95-2204-47ff-a5f9-2438d32c1e95","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713693613721,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):294
                Entropy (8bit):5.277336984797903
                Encrypted:false
                SSDEEP:6:YEQXJ2HXtQhk7+FIbRI6XVW7+0YYqoAvJfBoTfXpnrPeUkwRe9:YvXKXtQhzYpW7lGWTfXcUkee9
                MD5:BB3B5F9F7EA61FBBE4131ABE71D7FAEE
                SHA1:51459A2101C1EF37871BFD1F764191E95A4FD12D
                SHA-256:9F52448079E916B12EE8F181ED0BBAC734D71102F1C89BEBE7563FC937495E42
                SHA-512:04CC295C498F0A549C4F7E8F8CB49D092A972579E3ABEA75A8FBE310A08FF3AD9B31AB1860914F2CE547C2EB1A1361063134C2D2A6902EF945361EE3AEA81354
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"36c59c95-2204-47ff-a5f9-2438d32c1e95","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713693613721,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):294
                Entropy (8bit):5.255187078374973
                Encrypted:false
                SSDEEP:6:YEQXJ2HXtQhk7+FIbRI6XVW7+0YYqoAvJfBD2G6UpnrPeUkwRe9:YvXKXtQhzYpW7lGR22cUkee9
                MD5:DF92285146BCB5ADBCEC0C15C5E55B14
                SHA1:9B902E34F6BCBFDB3BD010AEE6530BF26CB7CEE3
                SHA-256:D0DAE24AEAC5066C06204893A53E80E1CCD8E85B23C808A265C5EBC79C4638D5
                SHA-512:F213D6CDBCD004C43CBA22CEC2E54F850C0B8EA0C9271A1CE5E48F7B53C446BE1F192BEBB048A8D5BEEB13F2B80B2EF614BB067101B17D758DE19FE2E13C6C4E
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"36c59c95-2204-47ff-a5f9-2438d32c1e95","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713693613721,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):285
                Entropy (8bit):5.317421125569894
                Encrypted:false
                SSDEEP:6:YEQXJ2HXtQhk7+FIbRI6XVW7+0YYqoAvJfPmwrPeUkwRe9:YvXKXtQhzYpW7lGH56Ukee9
                MD5:E0F4FFC6F88198023FBE76E38B7EC2C3
                SHA1:C083186C6D973F62195DCC960EC5AB06FC32A544
                SHA-256:F58AECEBE70118E39A3B9E4AB2200ED050BCC11326D68A66FCC14D05B44CD746
                SHA-512:3C8BD83D4A36AC9673E00B37519886A3A95C460A67FDA37A287FD5374C4F0BBC4194F8202C88D805EE199711E63920218B68009CF6BBF838C142E3CCBB19DFB6
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"36c59c95-2204-47ff-a5f9-2438d32c1e95","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713693613721,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):292
                Entropy (8bit):5.2790653925307005
                Encrypted:false
                SSDEEP:6:YEQXJ2HXtQhk7+FIbRI6XVW7+0YYqoAvJfJWCtMdPeUkwRe9:YvXKXtQhzYpW7lGBS8Ukee9
                MD5:0005A2B027386D55C7C35542205D88B2
                SHA1:A13FC6CCF1EFB0FC6DDA734A9C764C7D86144BF9
                SHA-256:BD48B381F08A51709DB26E760C3A4EFBFCDD51C79C33C5612A26474587C907D5
                SHA-512:2326464B5F895B9E2CD263F0242248368CC591593FFBC25366BDA8D55FADE42088C2255FA9CBEC7585DFF8CAB850612BD09F693BE52643B2DDB0C20C0821D735
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"36c59c95-2204-47ff-a5f9-2438d32c1e95","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713693613721,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):289
                Entropy (8bit):5.2642061080057365
                Encrypted:false
                SSDEEP:6:YEQXJ2HXtQhk7+FIbRI6XVW7+0YYqoAvJf8dPeUkwRe9:YvXKXtQhzYpW7lGU8Ukee9
                MD5:49E0DCEA36C7619A00C3794825E85480
                SHA1:F9275458B0C4C4008A236F39404A32AC6E5D08DD
                SHA-256:51BEEE87408BA31485EC132808B88A03647CE76B0774B7EEAC417B732A40CD6A
                SHA-512:36608D18B6DC6F16030FC354323AD2C0F0212CCC446968D6E6FB2C1A7D5C05223959D97EE319DECAAB04E02075CFD45CAE5924008560BF0B62B92A9B7F5E6C67
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"36c59c95-2204-47ff-a5f9-2438d32c1e95","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713693613721,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):292
                Entropy (8bit):5.265529054903277
                Encrypted:false
                SSDEEP:6:YEQXJ2HXtQhk7+FIbRI6XVW7+0YYqoAvJfQ1rPeUkwRe9:YvXKXtQhzYpW7lGY16Ukee9
                MD5:25F85C566637654BA45F398D46782865
                SHA1:BEF9C6046FDE81E26BC1F5635B121D18B1B93349
                SHA-256:D15C07194E09B7BEE5544FC43B94D02F30712FB1EACAB434704AD762758E83E4
                SHA-512:0971875AB386796B812D07497D9D960AB6E4691532D9A22284F7148467589C84C742974D13F1ADEEE72436E8FCC796B7D61550815C44FCA27B1AF4760B1C80FC
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"36c59c95-2204-47ff-a5f9-2438d32c1e95","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713693613721,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):289
                Entropy (8bit):5.28618278450489
                Encrypted:false
                SSDEEP:6:YEQXJ2HXtQhk7+FIbRI6XVW7+0YYqoAvJfFldPeUkwRe9:YvXKXtQhzYpW7lGz8Ukee9
                MD5:4995C9CB09D44FCD2612B342E2BB943F
                SHA1:0A9797799054542458F7CEFFE2F4C8522A550F4A
                SHA-256:480B74AF8ED6D8DC97FD80460C76553A29B42265EB0DE16257DFC2C66CFFCBED
                SHA-512:66B229D4EBACEBC0B511F1E23A402058BACA23B790854F832272AAB570D0DA8C84B2BC03DBCDCD916CFB7A2CB61C468BCB19B8FF4AE93B5B6B3109CE5B84E118
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"36c59c95-2204-47ff-a5f9-2438d32c1e95","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713693613721,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):1372
                Entropy (8bit):5.7378416063695745
                Encrypted:false
                SSDEEP:24:Yv6XtQGiRKLgENRcbrZbq00iCCBrwJo++ns8ct4mFJN6:YvhxREgigrNt0wSJn+ns8cvFJw
                MD5:C0FCDBA9D6483BC7D359F975AC166417
                SHA1:F2C9B31A9D6D301DBA6A39053F68EF7B0DAD86C6
                SHA-256:8AF7683B624AB8160DB015338B133235B2D0D7DD969A176371C30C152D134369
                SHA-512:778C17AE9B612305B0C2D209DAFFA6848245341185A251B777C383728A1E209695F8880324ECC47488D69F47ADF54CD4C1915D08CC5E45FB2AD9D12117C0C4AF
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"36c59c95-2204-47ff-a5f9-2438d32c1e95","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713693613721,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"79887_247329ActionBlock_0","campaignId":79887,"containerId":"1","controlGroupId":"","treatmentId":"acc56846-d570-4500-a26e-7f8cf2b4acad","variationId":"247329"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJUcnkgQWNyb2JhdCBQcm8ifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNSIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTMiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIDctZGF5IHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0byBwcmVtaXVtIFBERiBhbmQgZS1zaWduaW5nIHRvb2xzLiIsImJ

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):289
                Entropy (8bit):5.272926546947069
                Encrypted:false
                SSDEEP:6:YEQXJ2HXtQhk7+FIbRI6XVW7+0YYqoAvJfYdPeUkwRe9:YvXKXtQhzYpW7lGg8Ukee9
                MD5:D2B124CB50EE1626082C76B045C0CB04
                SHA1:CE181D01F6A69C0B5D2E307C976271C65C7FC981
                SHA-256:2AC5E590C61C192423FF6E8D25AF7CE1FC978A312DF50D53B61E21238973F552
                SHA-512:03F3CA66AEDD4FBA11B28363EAF73F2C86584E0591A5BB6A6FAAF86CFD520F58272FE44BF7C3F8933061BD6ECB5117AAA2123C1EB5A4315304F6CF9D9F1E8150
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"36c59c95-2204-47ff-a5f9-2438d32c1e95","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713693613721,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):1395
                Entropy (8bit):5.770461949350705
                Encrypted:false
                SSDEEP:24:Yv6XtQGicrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNS:YvhxcHgDv3W2aYQfgB5OUupHrQ9FJU
                MD5:2388A653DCD2DB07E8EDF90E61592741
                SHA1:FCED9E7E4877CBFB99B7EDD4318274DCA9062C46
                SHA-256:A57B5851B9074F39747A3F8C9C4D732C3C1D90FDFC09EAE1C8EDBF7EF6E2907D
                SHA-512:9F9562246A6C5E4AEE1FAE037F206CB038BC29F682F0D1C213F12BCD5C26C0CDFB369C34E19F09E27BB6BC5E28A41A23B65BA8D10CF7D0DA0CB7A06DD8DB97D7
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"36c59c95-2204-47ff-a5f9-2438d32c1e95","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713693613721,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):291
                Entropy (8bit):5.256659716463221
                Encrypted:false
                SSDEEP:6:YEQXJ2HXtQhk7+FIbRI6XVW7+0YYqoAvJfbPtdPeUkwRe9:YvXKXtQhzYpW7lGDV8Ukee9
                MD5:C7C5DCF6EE38953817D1FC18DFF42AB7
                SHA1:A5B7495A47F04C41F7437778A90AA18D3A772A7F
                SHA-256:4E6C80A6B229FCCF01F41544D8CE9774EA0F47192F08C34C1675E02604EE0A5C
                SHA-512:91F6FDB27FC9CB5D5487CAEB57BD7905C9EC79B02CC107888DD3D75EFCDAFF5D3B84F544E0F8C68CD10AA475171FE43AFE6ED773178EF567B02E31B7E55743B8
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"36c59c95-2204-47ff-a5f9-2438d32c1e95","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713693613721,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):287
                Entropy (8bit):5.2576438181151275
                Encrypted:false
                SSDEEP:6:YEQXJ2HXtQhk7+FIbRI6XVW7+0YYqoAvJf21rPeUkwRe9:YvXKXtQhzYpW7lG+16Ukee9
                MD5:8F28AFF82F11B418AF26D2C4C4B7BD44
                SHA1:0B1D93776FBD96831E1E25A4CA364A66350D51FC
                SHA-256:0D3F615F377EB28426C74673E573870467477C205953C16DA51AA4362D4D1282
                SHA-512:1A621CA679033B6325E3494FBAEA8231438809B5C1C8FDDC6657695AAC900C4ABBC5D8AD0467EF088EAEFA31E93F9BCBA2744A18C6B2C66D5475D02320925D9F
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"36c59c95-2204-47ff-a5f9-2438d32c1e95","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713693613721,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):289
                Entropy (8bit):5.279467857630995
                Encrypted:false
                SSDEEP:6:YEQXJ2HXtQhk7+FIbRI6XVW7+0YYqoAvJfbpatdPeUkwRe9:YvXKXtQhzYpW7lGVat8Ukee9
                MD5:107F82D8341E2FBD49B4A30147693C2E
                SHA1:32C0DE9717ECCF26A32834AF9F24A96D8C3358CA
                SHA-256:BC330865EB012A1D83738FA66ECDBD73D58806699BE54013CDEE6D538AA43048
                SHA-512:9663FA89EA8D79C2DA0844FB67B88790374B3C7C496361C5589000F80B9EC3D067B3551721B968F84165102973DC23BA2780C7CA15E21EC1DF367F3F28B2BB2D
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"36c59c95-2204-47ff-a5f9-2438d32c1e95","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713693613721,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):286
                Entropy (8bit):5.233196909129704
                Encrypted:false
                SSDEEP:6:YEQXJ2HXtQhk7+FIbRI6XVW7+0YYqoAvJfshHHrPeUkwRe9:YvXKXtQhzYpW7lGUUUkee9
                MD5:442AAC2690018CCAE69FE1B3D8F8E601
                SHA1:77365AEAAE38C7E91607748550238916BCD20CE7
                SHA-256:3A78BA17E3823BFCD8E415B2DE25587D3DE0D9C7527E83C70DF5B14C00B91A9B
                SHA-512:1F3272AB525F716CF50995E50AD49BE766B786735377FABA05C3D4A29B68D80BA9C493176C145327246BABDD56843D8A6920740A308318231CEEB412E6860194
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"36c59c95-2204-47ff-a5f9-2438d32c1e95","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713693613721,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):782
                Entropy (8bit):5.360090584139126
                Encrypted:false
                SSDEEP:12:YvXKXtQhzYpW7lGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhW+:Yv6XtQGiB168CgEXX5kcIfANhD
                MD5:F2547C935466BC9E345E81D4008BF5B6
                SHA1:74304DB12208936451CB102EC529738172B11432
                SHA-256:A168A8C7AFD4329968E27A11F396E3196C26C46F3994C68DA26D60895F940530
                SHA-512:6A39D5BA6BDD25C80BB95A9D7B35F6A60C14785D1D195F2F0BC6E5F72E54786A6A9D7D0D511B2323FF15ECFCEE0F3DDE4BF99ABB927AA20F3AC31AC70008FFC7
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"36c59c95-2204-47ff-a5f9-2438d32c1e95","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1713693613721,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1713519553753}}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:data
                Category:dropped
                Size (bytes):4
                Entropy (8bit):0.8112781244591328
                Encrypted:false
                SSDEEP:3:e:e
                MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                Malicious:false
                Preview:....

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):2814
                Entropy (8bit):5.123983908132658
                Encrypted:false
                SSDEEP:24:Y89EBh+lqzCV7n14DLtYB8waADEay74sTUWQ8sZkjUUsj0ScvCU2Cu2LSGpwn5iq:Y+lsU7n2lSlmYWEwUU+E7oAanAT9/+F
                MD5:BE773D36DC5CD1CD01BE372CE4D5DA0F
                SHA1:CF1680DF0F3CE262B05183E38B37656EC7405ED0
                SHA-256:F73A9ADDDF22C67AB92FC3722B76B09CCB94735D35B9760CC091F9894510277A
                SHA-512:F5A787C0FABCA4E7598F57ABC331708867CD634F9784FF2FE7CE415634C78D3528E0272FF438CD33BE4B595CF7947D572167AECFD21C6C8DA4A01C51FC9F2A46
                Malicious:false
                Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e902dc3933f51260c17ba1f6630de82a","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1713519552000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d08cf6fd2a9ed2cb5ef31d0b0f5727e5","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1372,"ts":1713519552000},{"id":"Edit_InApp_Aug2020","info":{"dg":"6d3a137d22f516fbcd2ba49056c57457","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1713519552000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"f5d09109a0f53ecd8a23dff03629e4f3","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1713519552000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"4b7126640d380632cd0709bb5c5c7b30","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1713519552000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"06ba3348bd7b9d7d70d5b29d50896f3c","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1713519552000},

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
                Category:dropped
                Size (bytes):12288
                Entropy (8bit):0.9850059457383765
                Encrypted:false
                SSDEEP:24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Sp9r4zJwtNBwtNbRZ6bRZ4GrF:TVl2GL7ms6ggOVpGzutYtp6PN
                MD5:AAEC49FBB03FB2A782583CDBA7E91C6A
                SHA1:1E011DF74B56A1243631527238E81D63B4C5905C
                SHA-256:1BD34C236645CD6417C036013497C2CB4F2B670F7A0BB2504A83AA60B6E81CF5
                SHA-512:CF12CC1382779E6205F179A5B82B4E288EA29E3C02C4645EA8C53AD8ED1EC0DD87C9A880288C77A799E099C249713E5BB41EE602CE8BBD6C252F4FC72AFFDE1B
                Malicious:false
                Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:SQLite Rollback Journal
                Category:dropped
                Size (bytes):8720
                Entropy (8bit):1.3392791902764378
                Encrypted:false
                SSDEEP:24:7+t2AD1RZKHs/Ds/Sp9rPzJwtNBwtNbRZ6bRZWf1RZKqRqLBx/XYKQvGJF7urse:7M2GgOVpdzutYtp6PMPqll2GL7mse
                MD5:504385526EBE358BC7E4D2915B649ACD
                SHA1:D3EA9BF620B7C9A97D8BC9508D7EB19DE23E27A6
                SHA-256:E80B86208CB0181E804F451F8C187D3D2360298B44083BD51B4C0A6F367E1129
                SHA-512:4E516B14C8E97A00407AEFBAF2489AD76F9B63137F110979F60AF04730C2AE0C8424749A92F02F04FD6F3CBF7531705BE7112874DF2D2DC38A26783438CCEFFF
                Malicious:false
                Preview:.... .c......%........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\MSIc91c1.LOG

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                Category:dropped
                Size (bytes):246
                Entropy (8bit):3.5248044522866877
                Encrypted:false
                SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8m+aWp:Qw946cPbiOxDlbYnuRKw
                MD5:5026B122957E12E1C0F5697F11FA9D34
                SHA1:C07EFC9446D840611D343FBAC68C7E673EB1A7BB
                SHA-256:6762443A694EA2B13AA2F46143FC0C53992340C54C9AB6AEF87DA65B3DA58FFD
                SHA-512:93A5F67102113836BBDDAB8E0FB797FA132B6AE2159C60F0AEA384143FCBE4541593678003A2213448F10B73CC49600474CD00C326BDE8EDF6AEB849507F96E9
                Malicious:false
                Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.9./.0.4./.2.0.2.4. . .1.1.:.3.9.:.1.5. .=.=.=.....

                C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-19 11-39-10-505.log

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:ASCII text, with very long lines (393)
                Category:dropped
                Size (bytes):16525
                Entropy (8bit):5.376360055978702
                Encrypted:false
                SSDEEP:384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
                MD5:1336667A75083BF81E2632FABAA88B67
                SHA1:46E40800B27D95DAED0DBB830E0D0BA85C031D40
                SHA-256:F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
                SHA-512:D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
                Malicious:false
                Preview:SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

                C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:ASCII text, with very long lines (393), with CRLF line terminators
                Category:dropped
                Size (bytes):16603
                Entropy (8bit):5.370804189014556
                Encrypted:false
                SSDEEP:384:j0wRIU94E/v2cFDRgda24LaaVzWmbP1o7J1okoGw4JCdSJOIdyd909EVTdjRkMog:Xfl
                MD5:DCF130D8C24702CBA0171A9BF6BFAD1D
                SHA1:D09A5E1F9ED8D13755174384BDB6BE552DF9DB46
                SHA-256:C66F8465FF53882C0A66AE843E09213F6FAEE90C680FDF73F62DBF2AC78E0992
                SHA-512:02C327850886BDA15A8CAFF5EFF73D074FA3835E947918BF8504B047B6177A41AC1A8FF6E2B7AC1F5EA32C6EE51C61E20EDEF502F633FE3ED670829E43972139
                Malicious:false
                Preview:SessionID=8784c83e-b760-42c6-92d1-1e7ddc27a817.1713519550523 Timestamp=2024-04-19T11:39:10:523+0200 ThreadID=7664 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=8784c83e-b760-42c6-92d1-1e7ddc27a817.1713519550523 Timestamp=2024-04-19T11:39:10:524+0200 ThreadID=7664 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=8784c83e-b760-42c6-92d1-1e7ddc27a817.1713519550523 Timestamp=2024-04-19T11:39:10:524+0200 ThreadID=7664 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=8784c83e-b760-42c6-92d1-1e7ddc27a817.1713519550523 Timestamp=2024-04-19T11:39:10:524+0200 ThreadID=7664 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=8784c83e-b760-42c6-92d1-1e7ddc27a817.1713519550523 Timestamp=2024-04-19T11:39:10:524+0200 ThreadID=7664 Component=ngl-lib_NglAppLib Description="SetConf

                C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):29845
                Entropy (8bit):5.400517462933604
                Encrypted:false
                SSDEEP:768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbd:5
                MD5:9F8F72082255348F1B1A1461C9A1BF49
                SHA1:A5B66122B32BFF6FD614520D5CB18B5C2297C4FC
                SHA-256:F848B26EC4D8CD1B9A18F0D6CF2E7DB82A2440BFF428DF410ED41A077E08ED3C
                SHA-512:3C6FCB1B4D2047FAEF60997B557BF01340237A09EB1E03354AD42AE522C34E214AC55F0C26C5BBDA31713D353ABF6E6C7A7D0F797F62DD2633A4144FE2A159ED
                Malicious:false
                Preview:04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

                C:\Users\user\AppData\Local\Temp\acrocef_low\218d926f-350a-4baa-9160-1140ded37f27.tmp

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                Category:dropped
                Size (bytes):758601
                Entropy (8bit):7.98639316555857
                Encrypted:false
                SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                MD5:3A49135134665364308390AC398006F1
                SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                Malicious:false
                Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                C:\Users\user\AppData\Local\Temp\acrocef_low\6bba53c7-7e0c-4677-bee9-4dc04d087a8b.tmp

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                Category:dropped
                Size (bytes):1419751
                Entropy (8bit):7.976496077007677
                Encrypted:false
                SSDEEP:24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
                MD5:18E3D04537AF72FDBEB3760B2D10C80E
                SHA1:B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
                SHA-256:BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
                SHA-512:2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
                Malicious:false
                Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                C:\Users\user\AppData\Local\Temp\acrocef_low\87d057c7-3002-40b5-9877-1e37e259f3c1.tmp

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                Category:dropped
                Size (bytes):386528
                Entropy (8bit):7.9736851559892425
                Encrypted:false
                SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                MD5:5C48B0AD2FEF800949466AE872E1F1E2
                SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                Malicious:false
                Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                C:\Users\user\AppData\Local\Temp\acrocef_low\c23aac2d-597c-4182-a2eb-42dd3265f3a7.tmp

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                Category:dropped
                Size (bytes):1407294
                Entropy (8bit):7.97605879016224
                Encrypted:false
                SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
                MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
                SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
                SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
                SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
                Malicious:false
                Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                Static File Info

                General

                File type:PDF document, version 1.6, 1 pages
                Entropy (8bit):7.609558882144718
                TrID:
                • Adobe Portable Document Format (5005/1) 100.00%
                File name:ITK2024000000345.pdf
                File size:160'729 bytes
                MD5:2b3775bce631873ae65f01d6f685e1a4
                SHA1:363b06054658f5f38f86ff5fc4f9144f90e40304
                SHA256:d1c29a2edea80f40ef8f2f87beaeba5c39f54a52b2517beefa3b404d06aa0712
                SHA512:9cb6c2628420b853a006f723356a4118f76d500a5457f5d3e3ae87728ba41af88b49172e4a1e610c371704094fb397a9b0d5c06566d6f30fff2b0f6af4b67e02
                SSDEEP:3072:4iMErKrk8mp8nW7Fxta5vYY0OH2KoKpoaFnASW7nVXSsoc7C0rLZiprmrIOC9qJ8:wrk8/nYFa5v3CKoKLFnHW7rocGhPOCgi
                TLSH:2DF39D80C6496285CCEB6FBA27A769A89E4D3B583FCD50DEF55C3ACDC46393500A0DE4
                File Content Preview:%PDF-1.6..%......1 0 obj.. <<.. /Author()/Title()/Subject()/Producer(Sub Systems, Inc.)/Keywords()/CreationDate(D:20240417134936+00'00')/ModDate(D:20240417134936+00'00')/Creator(Sub Systems, Inc. - pdc9).. >>..endobj..4 0 obj.. <</Length 237>>.. st

                File Icon

                Icon Hash:62cc8caeb29e8ae0

                Static PDF Info

                General

                Header:%PDF-1.6
                Total Entropy:7.609559
                Total Bytes:160729
                Stream Entropy:7.608241
                Stream Bytes:159013
                Entropy outside Streams:5.224954
                Bytes outside Streams:1716
                Number of EOF found:1
                Bytes after EOF:

                Keywords Statistics

                NameCount
                obj9
                endobj9
                stream2
                endstream2
                xref1
                trailer1
                startxref1
                /Page1
                /Encrypt0
                /ObjStm0
                /URI0
                /JS0
                /JavaScript0
                /AA0
                /OpenAction1
                /AcroForm0
                /JBIG2Decode0
                /RichMedia0
                /Launch0
                /EmbeddedFile0

                Image Streams

                IDDHASHMD5Preview
                6e9e9b1e3f1c1c1ae8ee7a0990a8de1418cb6623894a47341

                Network Behavior

                Network Port Distribution

                TCP Packets

                TimestampSource PortDest PortSource IPDest IP
                Apr 19, 2024 11:39:21.296642065 CEST49715443192.168.2.523.46.201.17
                Apr 19, 2024 11:39:21.296686888 CEST4434971523.46.201.17192.168.2.5
                Apr 19, 2024 11:39:21.296756029 CEST49715443192.168.2.523.46.201.17
                Apr 19, 2024 11:39:21.296951056 CEST49715443192.168.2.523.46.201.17
                Apr 19, 2024 11:39:21.296962976 CEST4434971523.46.201.17192.168.2.5
                Apr 19, 2024 11:39:21.613568068 CEST4434971523.46.201.17192.168.2.5
                Apr 19, 2024 11:39:21.613912106 CEST49715443192.168.2.523.46.201.17
                Apr 19, 2024 11:39:21.613943100 CEST4434971523.46.201.17192.168.2.5
                Apr 19, 2024 11:39:21.615012884 CEST4434971523.46.201.17192.168.2.5
                Apr 19, 2024 11:39:21.615104914 CEST49715443192.168.2.523.46.201.17
                Apr 19, 2024 11:39:21.617067099 CEST49715443192.168.2.523.46.201.17
                Apr 19, 2024 11:39:21.617124081 CEST4434971523.46.201.17192.168.2.5
                Apr 19, 2024 11:39:21.617386103 CEST49715443192.168.2.523.46.201.17
                Apr 19, 2024 11:39:21.617393017 CEST4434971523.46.201.17192.168.2.5
                Apr 19, 2024 11:39:21.672195911 CEST49715443192.168.2.523.46.201.17
                Apr 19, 2024 11:39:21.729146004 CEST4434971523.46.201.17192.168.2.5
                Apr 19, 2024 11:39:21.729229927 CEST4434971523.46.201.17192.168.2.5
                Apr 19, 2024 11:39:21.729295969 CEST49715443192.168.2.523.46.201.17
                Apr 19, 2024 11:39:21.729868889 CEST49715443192.168.2.523.46.201.17
                Apr 19, 2024 11:39:21.729885101 CEST4434971523.46.201.17192.168.2.5

                HTTP Request Dependency Graph

                • armmf.adobe.com

                HTTPS Proxied Packets

                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                0192.168.2.54971523.46.201.174433180C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                TimestampBytes transferredDirectionData
                2024-04-19 09:39:21 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
                Host: armmf.adobe.com
                Connection: keep-alive
                Accept-Language: en-US,en;q=0.9
                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
                Sec-Fetch-Site: same-origin
                Sec-Fetch-Mode: no-cors
                Sec-Fetch-Dest: empty
                Accept-Encoding: gzip, deflate, br
                If-None-Match: "78-5faa31cce96da"
                If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
                2024-04-19 09:39:21 UTC198INHTTP/1.1 304 Not Modified
                Content-Type: text/plain; charset=UTF-8
                Last-Modified: Mon, 01 May 2023 15:02:33 GMT
                ETag: "78-5faa31cce96da"
                Date: Fri, 19 Apr 2024 09:39:21 GMT
                Connection: close


                Statistics

                CPU Usage

                Click to jump to process

                Memory Usage

                Click to jump to process

                High Level Behavior Distribution

                Click to dive into process behavior distribution

                Behavior

                Click to jump to process

                System Behavior

                General

                Target ID:0
                Start time:11:39:07
                Start date:19/04/2024
                Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                Wow64 process (32bit):false
                Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\ITK2024000000345.pdf"
                Imagebase:0x7ff686a00000
                File size:5'641'176 bytes
                MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:moderate
                Has exited:true

                General

                Target ID:2
                Start time:11:39:07
                Start date:19/04/2024
                Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                Wow64 process (32bit):false
                Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                Imagebase:0x7ff6413e0000
                File size:3'581'912 bytes
                MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:moderate
                Has exited:true

                General

                Target ID:4
                Start time:11:39:08
                Start date:19/04/2024
                Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                Wow64 process (32bit):false
                Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1532,i,7078458210153690288,15258129016823440622,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                Imagebase:0x7ff6413e0000
                File size:3'581'912 bytes
                MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:moderate
                Has exited:true

                Disassembly

                ⊘No disassembly