Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
lsoft_001.pdf

Overview

General Information

Sample name:lsoft_001.pdf
Analysis ID:1430154
MD5:ea04d7a553c078d6e6a3f1dc9581ec4e
SHA1:51f2c26186caacd405aa65ec540c4331df55d6d2
SHA256:cef8167bc521563bfb33cd5023c15dda10f938682d103e8d327676e9bacd75bb
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 6300 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\lsoft_001.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 4100 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 5832 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1640,i,3425272521665081889,14107538559418711138,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficTCP traffic: 192.168.2.7:49712 -> 23.46.224.162:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 23.46.224.162:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 23.46.224.162:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 23.46.224.162:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 23.46.224.162:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 23.46.224.162:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 23.46.224.162:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 23.46.224.162:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 23.46.224.162:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 23.46.224.162:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 23.46.224.162:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 23.46.224.162:443
Source: global trafficTCP traffic: 23.46.224.162:443 -> 192.168.2.7:49712
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 23.46.224.162:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 23.46.224.162:443
Source: global trafficTCP traffic: 23.46.224.162:443 -> 192.168.2.7:49712
Source: global trafficTCP traffic: 23.46.224.162:443 -> 192.168.2.7:49712
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 23.46.224.162:443
Source: global trafficTCP traffic: 23.46.224.162:443 -> 192.168.2.7:49712
Source: global trafficTCP traffic: 23.46.224.162:443 -> 192.168.2.7:49712
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 23.46.224.162:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 23.46.224.162:443
Source: global trafficTCP traffic: 23.46.224.162:443 -> 192.168.2.7:49712
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 23.46.224.162:443
Source: global trafficTCP traffic: 23.46.224.162:443 -> 192.168.2.7:49712
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 23.46.224.162:443
Source: global trafficTCP traffic: 23.46.224.162:443 -> 192.168.2.7:49712
Source: global trafficTCP traffic: 23.46.224.162:443 -> 192.168.2.7:49712
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 23.46.224.162:443
Source: global trafficTCP traffic: 23.46.224.162:443 -> 192.168.2.7:49712
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 23.46.224.162:443
Source: global trafficTCP traffic: 192.168.2.7:49712 -> 23.46.224.162:443
Source: Joe Sandbox ViewIP Address: 23.46.224.162 23.46.224.162
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.224.162
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.224.162
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.224.162
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.224.162
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.224.162
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.224.162
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.224.162
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.224.162
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.224.162
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.224.162
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.224.162
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: lsoft_001.pdfString found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: lsoft_001.pdfString found in binary or memory: http://www.dynaforms.com
Source: ReaderMessages.0.drString found in binary or memory: https://www.adobe.co
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: classification engineClassification label: clean2.winPDF@14/44@0/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5668Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-23 08-13-58-254.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\lsoft_001.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1640,i,3425272521665081889,14107538559418711138,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1640,i,3425272521665081889,14107538559418711138,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: lsoft_001.pdfInitial sample: PDF keyword /JS count = 0
Source: lsoft_001.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: lsoft_001.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive12
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1430154 Sample: lsoft_001.pdf Startdate: 23/04/2024 Architecture: WINDOWS Score: 2 6 Acrobat.exe 18 71 2->6         started        process3 8 AcroCEF.exe 106 6->8         started        process4 10 AcroCEF.exe 4 8->10         started        dnsIp5 13 23.46.224.162, 443, 49712 AKAMAI-ASUS United States 10->13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://www.adobe.co0%URL Reputationsafe
https://www.adobe.co0%URL Reputationsafe
http://www.dynaforms.com0%VirustotalBrowse

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://www.adobe.coReaderMessages.0.drfalse
  • URL Reputation: safe
  • URL Reputation: safe
unknown
http://www.aiim.org/pdfa/ns/id/lsoft_001.pdffalse
    		high
    http://www.dynaforms.comlsoft_001.pdffalseunknown

    World Map of Contacted IPs

    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs

    Public IPs

    IPDomainCountryFlagASNASN NameMalicious
    23.46.224.162
    		unknownUnited States
    		16625AKAMAI-ASUSfalse

    General Information

    Joe Sandbox version:40.0.0 Tourmaline
    Analysis ID:1430154
    Start date and time:2024-04-23 08:13:05 +02:00
    Joe Sandbox product:CloudBasic
    Overall analysis duration:0h 4m 7s
    Hypervisor based Inspection enabled:false
    Report type:full
    Cookbook file name:defaultwindowspdfcookbook.jbs
    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
    Number of analysed new started processes analysed:22
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • HCA enabled
    • EGA enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:Timeout
    Sample name:lsoft_001.pdf
    Detection:CLEAN
    Classification:clean2.winPDF@14/44@0/1
    EGA Information:Failed
    HCA Information:
    • Successful, ratio: 100%
    • Number of executed functions: 0
    • Number of non-executed functions: 0
    Cookbook Comments:
    • Found application associated with file extension: .pdf
    • Found PDF document
    • Close Viewer

    Warnings

    • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
    • Excluded IPs from analysis (whitelisted): 23.51.56.185, 52.5.13.197, 54.227.187.23, 52.202.204.11, 23.22.254.206, 162.159.61.3, 172.64.41.3, 23.204.152.213, 23.204.152.210, 104.117.182.155, 104.117.182.145
    • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com
    • Not all processes where analyzed, report is missing behavior information

    Simulations

    Behavior and APIs

    ⊘No simulations

    Joe Sandbox View / Context

    IPs

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    23.46.224.162Quarantined Messages.zipGet hashmaliciousUnknownBrowse
      Quotation.xlsGet hashmaliciousUnknownBrowse
        PAYMENT CONFIRMATION.xlsGet hashmaliciousUnknownBrowse
          #U75c5#U6bd2#U67e5#U6740#U5de5#U5177.exeGet hashmaliciousUnknownBrowse
            Payment Advice Copy.xlsGet hashmaliciousUnknownBrowse

              Domains

              ⊘No context

              ASNs

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              AKAMAI-ASUSfile.exeGet hashmaliciousVidarBrowse
              • 23.61.62.148
              pGTQLD9ukH.elfGet hashmaliciousMiraiBrowse
              • 96.25.164.172
              https://www.wsj.pm/download.phpGet hashmaliciousNetSupport RATBrowse
              • 23.54.46.90
              RFQ235.htmlGet hashmaliciousHTMLPhisherBrowse
              • 104.84.231.217
              caA474oBY2.elfGet hashmaliciousMiraiBrowse
              • 23.219.94.238
              wsskM49eA3.elfGet hashmaliciousUnknownBrowse
              • 2.18.165.112
              dI3tFWyJ6d.elfGet hashmaliciousMiraiBrowse
              • 23.3.198.116
              file.exeGet hashmaliciousVidarBrowse
              • 184.30.122.179
              SamFw Tool 4.exeGet hashmaliciousVidarBrowse
              • 23.4.32.216
              8xFzJWrEIa.exeGet hashmaliciousBabuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, VidarBrowse
              • 23.4.32.216

              JA3 Fingerprints

              ⊘No context

              Dropped Files

              ⊘No context

              Created / dropped Files

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):297
              Entropy (8bit):5.207039762971945
              Encrypted:false
              SSDEEP:6:JfK3+q2PcNwi2nKuAl9OmbnIFUt8afiUZZmw+afiUNVkwOcNwi2nKuAl9OmbjLJ:Jy3+vLZHAahFUt8aKUZ/+aKUNV54ZHAR
              MD5:941A0E0762464A9CEB3738854BE9A8CB
              SHA1:E99F043BF263B76A39E0C5FC783A5317149373EC
              SHA-256:293DEDC33D9F0CEBB8962264D53E7F9A31397CE4687806FAAAACF028CD153B1B
              SHA-512:72380B1F0748C3CEECDA9994392056D4DD1C4E43E8CED4206953A845D290BF0F9AA0F69EDA56159D23E7594406A674FF1811D438D47B411C11C6C00A1BDD5B1F
              Malicious:false
              Reputation:low
              Preview:2024/04/23-08:13:56.005 44c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/23-08:13:56.006 44c Recovering log #3.2024/04/23-08:13:56.006 44c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):297
              Entropy (8bit):5.207039762971945
              Encrypted:false
              SSDEEP:6:JfK3+q2PcNwi2nKuAl9OmbnIFUt8afiUZZmw+afiUNVkwOcNwi2nKuAl9OmbjLJ:Jy3+vLZHAahFUt8aKUZ/+aKUNV54ZHAR
              MD5:941A0E0762464A9CEB3738854BE9A8CB
              SHA1:E99F043BF263B76A39E0C5FC783A5317149373EC
              SHA-256:293DEDC33D9F0CEBB8962264D53E7F9A31397CE4687806FAAAACF028CD153B1B
              SHA-512:72380B1F0748C3CEECDA9994392056D4DD1C4E43E8CED4206953A845D290BF0F9AA0F69EDA56159D23E7594406A674FF1811D438D47B411C11C6C00A1BDD5B1F
              Malicious:false
              Reputation:low
              Preview:2024/04/23-08:13:56.005 44c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/23-08:13:56.006 44c Recovering log #3.2024/04/23-08:13:56.006 44c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):344
              Entropy (8bit):5.224611000349551
              Encrypted:false
              SSDEEP:6:JfL834q2PcNwi2nKuAl9Ombzo2jMGIFUt8afL9NJZmw+afLYDkwOcNwi2nKuAl97:Ja4vLZHAa8uFUt8ajJ/+akD54ZHAa8RJ
              MD5:AC28935714322BB5A401D9821996C58F
              SHA1:41D85BD818A3669542AA4109A29D03AE262F14BC
              SHA-256:9FAF333BBBF07BA8D391DB02799F9DD1358BCFB3C422FD32ED47D960F42487E7
              SHA-512:F6B46DFFA9793F9353DB27E93DA02AC2F4897D43EE6AFDC8F06F820C01C9B00BC878CE21AB521175E88478BBD9BCD32C402F7516402E7BE0493B3219EBDD0F5E
              Malicious:false
              Reputation:low
              Preview:2024/04/23-08:13:56.147 1c20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/23-08:13:56.148 1c20 Recovering log #3.2024/04/23-08:13:56.149 1c20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):344
              Entropy (8bit):5.224611000349551
              Encrypted:false
              SSDEEP:6:JfL834q2PcNwi2nKuAl9Ombzo2jMGIFUt8afL9NJZmw+afLYDkwOcNwi2nKuAl97:Ja4vLZHAa8uFUt8ajJ/+akD54ZHAa8RJ
              MD5:AC28935714322BB5A401D9821996C58F
              SHA1:41D85BD818A3669542AA4109A29D03AE262F14BC
              SHA-256:9FAF333BBBF07BA8D391DB02799F9DD1358BCFB3C422FD32ED47D960F42487E7
              SHA-512:F6B46DFFA9793F9353DB27E93DA02AC2F4897D43EE6AFDC8F06F820C01C9B00BC878CE21AB521175E88478BBD9BCD32C402F7516402E7BE0493B3219EBDD0F5E
              Malicious:false
              Reputation:low
              Preview:2024/04/23-08:13:56.147 1c20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/23-08:13:56.148 1c20 Recovering log #3.2024/04/23-08:13:56.149 1c20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\79b7f369-c4d0-4969-9374-3638e2f23396.tmp

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:JSON data
              Category:modified
              Size (bytes):474
              Entropy (8bit):4.970334938707053
              Encrypted:false
              SSDEEP:12:YH/um3RA8sqZ2/sBdOg2H/caq3QYiubSpDyP7E4TX:Y2sRdstAdMHO3QYhbSpDa7n7
              MD5:1979F631597A32FAC65F8D4C679B13F6
              SHA1:B0E0B9D3EDC74ADF208BE96AC4A0EDBF3148292B
              SHA-256:04F3D5778DC97AE4D7EF96F5A8A6A379F547B893A69DBE635BC0038A2E0A2243
              SHA-512:77A2D9E2F2BA640D33B752853721D43A64DD57BBA2F19FFD21BB4F79ABCD8355646DAD8F1396E783A7F72594E32D9B2D9EBF791D2903379ED57C741D4B36AA4C
              Malicious:false
              Reputation:low
              Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13358412847838007","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":90460},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):474
              Entropy (8bit):4.970334938707053
              Encrypted:false
              SSDEEP:12:YH/um3RA8sqZ2/sBdOg2H/caq3QYiubSpDyP7E4TX:Y2sRdstAdMHO3QYhbSpDa7n7
              MD5:1979F631597A32FAC65F8D4C679B13F6
              SHA1:B0E0B9D3EDC74ADF208BE96AC4A0EDBF3148292B
              SHA-256:04F3D5778DC97AE4D7EF96F5A8A6A379F547B893A69DBE635BC0038A2E0A2243
              SHA-512:77A2D9E2F2BA640D33B752853721D43A64DD57BBA2F19FFD21BB4F79ABCD8355646DAD8F1396E783A7F72594E32D9B2D9EBF791D2903379ED57C741D4B36AA4C
              Malicious:false
              Reputation:low
              Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13358412847838007","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":90460},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:data
              Category:dropped
              Size (bytes):4509
              Entropy (8bit):5.2410423984700145
              Encrypted:false
              SSDEEP:96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPY7DaxS3inr7DZ:CwNw1GHqPySfkcigoO3h28ytPY3axSSF
              MD5:6278F3FAEEF00F3507889DA90A634711
              SHA1:BF6CE25DAA4F22D48F7B8E218233661BFC6E1FDA
              SHA-256:5010354C54236A3AA7C17A8D955844E21343A9288513E77FEA5BB67EA023BC39
              SHA-512:60EC804347E764F46FF5D05329269A5D5C52ABF133D816CDFF13D8C1E1C29702B8D00566CEEA8CE80994BA92CDB5D12E73B06BD27272AA4819481214A9BBB389
              Malicious:false
              Reputation:low
              Preview:*...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3*.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):332
              Entropy (8bit):5.213388857761068
              Encrypted:false
              SSDEEP:6:JfTA4q2PcNwi2nKuAl9OmbzNMxIFUt8afTBw3JZmw+afTfVNDkwOcNwi2nKuAl9c:Jk4vLZHAa8jFUt8a1CJ/+a7D54ZHAa8E
              MD5:27A49D76186110AEAEBB7276FD21E980
              SHA1:B020A24751C4FA76A9B3EE3E3C94030DACB5C390
              SHA-256:405613294A89F1BF21D0C3D5FE165CF71890EBAE6B7FC510E985498171635DDD
              SHA-512:5EB321B3903A6C3A50AB8C2AFAE21C8AAF081199486BD65150204A75265DBD9FB03F00B494948C6D1C58F6768408A53C5A7109DB594CBD16DF7A1D17B645D230
              Malicious:false
              Reputation:low
              Preview:2024/04/23-08:13:56.361 1c20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/23-08:13:56.365 1c20 Recovering log #3.2024/04/23-08:13:56.368 1c20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):332
              Entropy (8bit):5.213388857761068
              Encrypted:false
              SSDEEP:6:JfTA4q2PcNwi2nKuAl9OmbzNMxIFUt8afTBw3JZmw+afTfVNDkwOcNwi2nKuAl9c:Jk4vLZHAa8jFUt8a1CJ/+a7D54ZHAa8E
              MD5:27A49D76186110AEAEBB7276FD21E980
              SHA1:B020A24751C4FA76A9B3EE3E3C94030DACB5C390
              SHA-256:405613294A89F1BF21D0C3D5FE165CF71890EBAE6B7FC510E985498171635DDD
              SHA-512:5EB321B3903A6C3A50AB8C2AFAE21C8AAF081199486BD65150204A75265DBD9FB03F00B494948C6D1C58F6768408A53C5A7109DB594CBD16DF7A1D17B645D230
              Malicious:false
              Reputation:low
              Preview:2024/04/23-08:13:56.361 1c20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/23-08:13:56.365 1c20 Recovering log #3.2024/04/23-08:13:56.368 1c20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

              C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240423061400Z-153.bmp

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
              Category:dropped
              Size (bytes):65110
              Entropy (8bit):1.3613777715314024
              Encrypted:false
              SSDEEP:96:Vp860qLEO7fyc4Tiy/TiaMkHQiQ3UXMLMFMM2dMichMtfXxLMHMy8bL567I71MRc:vR7Kcs3BQDeiHZERujQrjffUo2
              MD5:380100D270870C25EF2F967CE4592250
              SHA1:E0923ACDBB332D0077BC66E087B1C89221396D76
              SHA-256:CDA7260F619E2907B4A64AAA17F68856D8459CA415CE2853EB44FB90E4FDD5C8
              SHA-512:E24D16408AB51734EF6A935A81E8D098B4458F6ECBA11AB597DC76730D508B9C5DC501936BB656FD4354307D034C8DD833897CD7978D6C619857976DE7124FC1
              Malicious:false
              Reputation:low
              Preview:BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
              Category:dropped
              Size (bytes):86016
              Entropy (8bit):4.439008956267946
              Encrypted:false
              SSDEEP:384:yeaci5GQiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:18urVgazUpUTTGt
              MD5:5A7BEE6CE25D65EEEEABC40CD980341F
              SHA1:B03C3ABFD2AFCD621092BA9F18944672F6777736
              SHA-256:C8B0D9339F62689806A7D528BBA730665D72511739D9CD152D8107AE3AF9D518
              SHA-512:9FC53D331F795CC26E721B0B7E0BE89637403D0486EE5DD6AB45161ED19083549602CF13DECE502721036CFE747277980CB095BA62847190D98B5A3E39069CD3
              Malicious:false
              Reputation:low
              Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:SQLite Rollback Journal
              Category:dropped
              Size (bytes):8720
              Entropy (8bit):3.77585354495777
              Encrypted:false
              SSDEEP:48:7MNp/E2ioyVhioy3DoWoy1CABoy1JKOioy1noy1AYoy1Wioy1hioybioyhoy1noi:7Wpjuh0iAfXKQYEb9IVXEBodRBks
              MD5:FC7C7BB25C305E9F440FE376CCDC688F
              SHA1:458DC381347081455DA0DE90EEB8EAEAB70D2861
              SHA-256:95B1B8456B3D0978C0C6CF238E192DC594BB5ADF38F61DE00C5A6E6942323E18
              SHA-512:F28ED7A364A5EB70741E01E5781587C7DA6D018B2A8BA622AEEAEF53BAADA947742AED316A52921FC065F920AABB461C759E79B1D8D0CD1DEE478D4A7379EE42
              Malicious:false
              Reputation:low
              Preview:.... .c........9...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5668

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:PostScript document text
              Category:dropped
              Size (bytes):185099
              Entropy (8bit):5.182478651346149
              Encrypted:false
              SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
              MD5:94185C5850C26B3C6FC24ABC385CDA58
              SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
              SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
              SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
              Malicious:false
              Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:PostScript document text
              Category:dropped
              Size (bytes):185099
              Entropy (8bit):5.182478651346149
              Encrypted:false
              SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
              MD5:94185C5850C26B3C6FC24ABC385CDA58
              SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
              SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
              SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
              Malicious:false
              Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:data
              Category:dropped
              Size (bytes):232026
              Entropy (8bit):3.377763938203011
              Encrypted:false
              SSDEEP:1536:NMKP+iyzDtrh1cK3XEivK7VK/3AYvYwgF/r0oL+sn:iKPoJ/3AYvYwglwoL+sn
              MD5:8550BD38B93F6B12D5FD5960F36F3BE4
              SHA1:A91BA0B88C4FEE5226A9631561D7F7A7B6699371
              SHA-256:ACB87772F18DE81709A4E4311A7DF6CD8B2EDA7FCB57489CE82C09429750CE57
              SHA-512:DC796DC8B3C59672208170FE556E45EBCF2BBC5B1EBFF34E7FF461E155F9C780AD555AF7FA442652AA4E6D4E86A78787C7831D7B77CE7CEF50423163C08696BE
              Malicious:false
              Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):295
              Entropy (8bit):5.352236725191392
              Encrypted:false
              SSDEEP:6:YEQXJ2HX+lcSnmU4WsGiIPEeOF0Y9TUoAvJM3g98kUwPeUkwRe9:YvXKX+GSnzsdTeOdjGMbLUkee9
              MD5:9AB378B0C18DBB8A88EE7656E6BB8146
              SHA1:99C46E62C61521AE12D836EDC7D0368C99FD731C
              SHA-256:26DC34AF58E77AEFA240D2A05A37E049834564C5E17B8FAD10B3677371DB8FF7
              SHA-512:D8EE15A168A8FFCEFCA5865AEB76C4D76973E967F4629B17190774FF1A10BD404B6E7D38DDAC1403CF3F9690DE9E06D2D6A38258E0BADDE2004346CA5F66D694
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"afbbfd73-39cf-40b5-a11e-8c3d32c60a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714031131797,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):294
              Entropy (8bit):5.286531064134856
              Encrypted:false
              SSDEEP:6:YEQXJ2HX+lcSnmU4WsGiIPEeOF0Y9TUoAvJfBoTfXpnrPeUkwRe9:YvXKX+GSnzsdTeOdjGWTfXcUkee9
              MD5:3FDBAE83605E9F16B3522A4FA5BC1B4E
              SHA1:A33F793FB5DA06FADDAACF5B817FA9BFAC4F1B12
              SHA-256:A1DAFFD71CF9B2A060FE4A1D2C40BB7AEBBE7DCDCD7D1456F60349962C370155
              SHA-512:7E508E774AC86A92751BCF7D014C739CAA32641A8AE7E5636AD0761EE85C679318F23958BD8860B24E9F200A5632F786466934AF3B496429BD47FBA988D43CD7
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"afbbfd73-39cf-40b5-a11e-8c3d32c60a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714031131797,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):294
              Entropy (8bit):5.2643811577119255
              Encrypted:false
              SSDEEP:6:YEQXJ2HX+lcSnmU4WsGiIPEeOF0Y9TUoAvJfBD2G6UpnrPeUkwRe9:YvXKX+GSnzsdTeOdjGR22cUkee9
              MD5:12ACAE4BF613BD8E06CBAE29AEC05734
              SHA1:E05A387EC51A1B36CCF844F3301D84B5D89DE66A
              SHA-256:4847609C660583B5A882EFC478ED8F0F4A51AC1F8D83ED02AA4487864B134351
              SHA-512:A7CAAB083D53B032CC3033D5344C7D810C1E8EFF9410017CEA3176C335952E1ED43B121729F0F4FE021BFB6FCBDB920CFAFC30CF00BDD456A78F78430068FFEC
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"afbbfd73-39cf-40b5-a11e-8c3d32c60a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714031131797,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):285
              Entropy (8bit):5.338724619183899
              Encrypted:false
              SSDEEP:6:YEQXJ2HX+lcSnmU4WsGiIPEeOF0Y9TUoAvJfPmwrPeUkwRe9:YvXKX+GSnzsdTeOdjGH56Ukee9
              MD5:79EDB34BE76F5696DF776AB2CCBCB15C
              SHA1:D4580388D1241F660AD0E6D943123FF885CA2B08
              SHA-256:DFC1477F7CDAD0D83D8C8EA0629AC3360480DA3AFDEECB108CDDBCFD3DC3C4FA
              SHA-512:781F78A21220D458281CC0697D9ACD4AC3286D072789FD991BC8F5CD3FAA30892E38C1D1B98A8817C5BB86B1208D847031FFDFEF15A5A55E4A753A4AC96CE0A1
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"afbbfd73-39cf-40b5-a11e-8c3d32c60a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714031131797,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):292
              Entropy (8bit):5.288531328372775
              Encrypted:false
              SSDEEP:6:YEQXJ2HX+lcSnmU4WsGiIPEeOF0Y9TUoAvJfJWCtMdPeUkwRe9:YvXKX+GSnzsdTeOdjGBS8Ukee9
              MD5:8D6BAE295ACEC7965560FD7E0A2E7FF8
              SHA1:A94AA91B302A81EAA728EC6A25B1EAD6FE252F41
              SHA-256:EDB97E57057FB6203FA75D2B3323536D2A03BE9EAD7EC61C251620BA2371FFA7
              SHA-512:92040A00864F4C76F2D132FC3DD654FD5560F5DDF41387D931894DE772A261AEF3060430FA5D8C1A4A6C9BAF9F4ED15221B3524127C474CEFD8D875157C5EBBD
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"afbbfd73-39cf-40b5-a11e-8c3d32c60a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714031131797,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):289
              Entropy (8bit):5.273820990544105
              Encrypted:false
              SSDEEP:6:YEQXJ2HX+lcSnmU4WsGiIPEeOF0Y9TUoAvJf8dPeUkwRe9:YvXKX+GSnzsdTeOdjGU8Ukee9
              MD5:EFA6A3D4CCD8A14D76E46F8B8B548BE5
              SHA1:E3BE90F62CDE8AED3EE7BCFE2D237C928CD2857B
              SHA-256:425F3DAC0E1BF1C606B21CD1EC6533055B9BD86A040D9EF090EAF5EED1E2303A
              SHA-512:5C73C720F9D4FBD6EB636E98D64A150A4864C08732D64FC230F2652F8A76C9BA6B496C003DCCB054407A4DA0BA90B744031B398BFEA4C4C8272185205D84B91A
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"afbbfd73-39cf-40b5-a11e-8c3d32c60a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714031131797,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):292
              Entropy (8bit):5.278846814113743
              Encrypted:false
              SSDEEP:6:YEQXJ2HX+lcSnmU4WsGiIPEeOF0Y9TUoAvJfQ1rPeUkwRe9:YvXKX+GSnzsdTeOdjGY16Ukee9
              MD5:1DE6B2224E9DB4C99AFB52D376960779
              SHA1:C5D66A670170B70CC2F42A3762161CC9C64D0156
              SHA-256:B324FC99B6D2E694C0F906DF1E0418D6C4FBA35E35BA1C5D4525732AE36FE481
              SHA-512:5381F6DC4B5C0F7B8AF83921848F84B912A220B1A2EE630E40EA72F58F36081A3AD4EA09E3FBFFF4A7BA74AFCF5E8F61177E7C0AF3BED5087B40EDA3C00BA729
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"afbbfd73-39cf-40b5-a11e-8c3d32c60a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714031131797,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):289
              Entropy (8bit):5.293736643172639
              Encrypted:false
              SSDEEP:6:YEQXJ2HX+lcSnmU4WsGiIPEeOF0Y9TUoAvJfFldPeUkwRe9:YvXKX+GSnzsdTeOdjGz8Ukee9
              MD5:F4D6B5CFC06834483DEE15309F9EE2D8
              SHA1:B3C8ABCFDDF0624DFB9380FA2B2C596279511C87
              SHA-256:54E48BE7AEA8DEA25EC6FAD494D9F9A7DFE2CD4ACCBE0AB2D56AF0EF9306781F
              SHA-512:817260646941D17F40C902FE8ABC56093AE8BB91E25F1488A5837D74AAA1349A94932BCECD800DCB06D81A7420C168EB41E858D37039AA7E5346DC11342A2CB2
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"afbbfd73-39cf-40b5-a11e-8c3d32c60a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714031131797,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):1372
              Entropy (8bit):5.735913375624403
              Encrypted:false
              SSDEEP:24:Yv6XZUzmeO1KLgENRcbrZbq00iCCBrwJo++ns8ct4mFJN4k:YvWe0EgigrNt0wSJn+ns8cvFJuk
              MD5:EC03EDE610957F185144BC903DA86DEC
              SHA1:14C96286E707C7A68D59AA80586A626EE5C6452A
              SHA-256:0D692674F261F74EC8BE757CE4ACC9F9DDFAD2DD3DDCCC4C711B0708DAB5F7F0
              SHA-512:E8D7CD81841C78D22F3125A5A03E56BCB3F1E213E872EAB990CB357A26F513CA4D2559CA44A1F77F36122EABBBD39DD15CFA0B0452F99640B28409DFE190C35B
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"afbbfd73-39cf-40b5-a11e-8c3d32c60a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714031131797,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"79887_247329ActionBlock_0","campaignId":79887,"containerId":"1","controlGroupId":"","treatmentId":"acc56846-d570-4500-a26e-7f8cf2b4acad","variationId":"247329"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJUcnkgQWNyb2JhdCBQcm8ifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNSIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTMiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIDctZGF5IHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0byBwcmVtaXVtIFBERiBhbmQgZS1zaWduaW5nIHRvb2xzLiIsImJ

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):289
              Entropy (8bit):5.2814855753568715
              Encrypted:false
              SSDEEP:6:YEQXJ2HX+lcSnmU4WsGiIPEeOF0Y9TUoAvJfYdPeUkwRe9:YvXKX+GSnzsdTeOdjGg8Ukee9
              MD5:7365C9C24C9F977E1F0046ABB20DB3D6
              SHA1:71F0802882A97122C0FCFE86B9579F7F425AE036
              SHA-256:15B7391B906506B8423C4797C7C1F0ADFAF47DD1D1C6967BA594666587C7CDC0
              SHA-512:8942396144BA9B9AAAB4C3242A3BD3C770FEB6636623A72306D027DD84269C801741B091A04F95787BDD30DA3FF720F2D901600E43FF9F1BE029DCD1653645E0
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"afbbfd73-39cf-40b5-a11e-8c3d32c60a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714031131797,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):1395
              Entropy (8bit):5.771701994335353
              Encrypted:false
              SSDEEP:24:Yv6XZUzmeOorLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNwk:YvWebHgDv3W2aYQfgB5OUupHrQ9FJyk
              MD5:542FB59953DC77405F5F965DCF924690
              SHA1:BC654758CD4658DFDD89B8F3EB13CBBC4CFE84CF
              SHA-256:54BDC02880D18AC03676CD2AD4C520E2D46F02B55EB04E98AAAA948938B01A33
              SHA-512:EB74555514975CA3BA85DD77DFC56E050B5C154C0EA3F058F41A9DC18127E9324743A4DF3ECD741CEBA6D36E42EB89FF45575842084247B2C26E9E7E8518AEAF
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"afbbfd73-39cf-40b5-a11e-8c3d32c60a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714031131797,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):291
              Entropy (8bit):5.2651599199355
              Encrypted:false
              SSDEEP:6:YEQXJ2HX+lcSnmU4WsGiIPEeOF0Y9TUoAvJfbPtdPeUkwRe9:YvXKX+GSnzsdTeOdjGDV8Ukee9
              MD5:1AD5B462EA61E40E04FE020BB2A7DF0D
              SHA1:520355E157FABB9A57A02026B531D071E35DCD4C
              SHA-256:D36F2B0542BF662C44315B0A27BF78A97D919F04549748FB3AD2B31A0FAA7F12
              SHA-512:84A362F32883D1790876B27B8EB89C3D29B16E1775FC7E89BDC84784C253A6B022E1B0A3B4FE9CC7099B8C684840BFF5003A2DAA5001C0C4561B07730884B47B
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"afbbfd73-39cf-40b5-a11e-8c3d32c60a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714031131797,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):287
              Entropy (8bit):5.27013038203952
              Encrypted:false
              SSDEEP:6:YEQXJ2HX+lcSnmU4WsGiIPEeOF0Y9TUoAvJf21rPeUkwRe9:YvXKX+GSnzsdTeOdjG+16Ukee9
              MD5:79E7A228C0E3174407C96AF65377B6DA
              SHA1:1E051C95B76810D1BD9FCEB2E18CF5A490BC4D0F
              SHA-256:375FA0644EF949489CBFFD0F277DB4931227B40A2CEE4AD639796156367B4888
              SHA-512:478675DCDFD6D449FDA29C8C338F80771EB997BCFEFED1A578A9A40722B40EFEC629C6C9A915B090D05158E0EA1DC0E400694DBCAEE88A6AFBFA8CDC906F1821
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"afbbfd73-39cf-40b5-a11e-8c3d32c60a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714031131797,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):289
              Entropy (8bit):5.2880268860407975
              Encrypted:false
              SSDEEP:6:YEQXJ2HX+lcSnmU4WsGiIPEeOF0Y9TUoAvJfbpatdPeUkwRe9:YvXKX+GSnzsdTeOdjGVat8Ukee9
              MD5:A104DA60DC791A8B165186D53DED9EC9
              SHA1:873874E5EFC1CF416F0C579ACAE0B3377FDDFC1F
              SHA-256:39A90E038A26C316481534B17A9D50606FDCF05222E956DB890AEA93EA251F44
              SHA-512:F0B011EC605A960D4960B25D53A3A154C8956FE54328A71364CE3A1A1EB40F09CFFBDDE94800E2EC7F7EEE1FFBE3DE404FE6D3E709F57709ED22810B081D4CBC
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"afbbfd73-39cf-40b5-a11e-8c3d32c60a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714031131797,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):286
              Entropy (8bit):5.244834364313991
              Encrypted:false
              SSDEEP:6:YEQXJ2HX+lcSnmU4WsGiIPEeOF0Y9TUoAvJfshHHrPeUkwRe9:YvXKX+GSnzsdTeOdjGUUUkee9
              MD5:2066A9A329F20AF9F82A29327C64A478
              SHA1:0599DE6ACA093BD16F53EE0953527D530DA2C757
              SHA-256:32F99075B5614A3EDBBB90E7236B26C33441A2DCF3D4CF1DE673B485583FCA2F
              SHA-512:FF497AADFCE3070D4ED94C36857389655C80CE68A34AF65123962BC63B441DD67CB17CEEA978EA513135CB56CFE83C2D7FB6BE29D3F9148171203EEB070ED670
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"afbbfd73-39cf-40b5-a11e-8c3d32c60a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714031131797,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):782
              Entropy (8bit):5.369810705403024
              Encrypted:false
              SSDEEP:12:YvXKX+GSnzsdTeOdjGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhW8tS:Yv6XZUzmeOl168CgEXX5kcIfANhxk
              MD5:7605CD1DE7284F20DD8AD5D5511DEB54
              SHA1:D6913897075625E10CA2D1B00B44BCB88AE5FE2E
              SHA-256:51965EBFA45F71C941E0D24451B640E2068EE3909937F4A055DFDD2A9720B753
              SHA-512:B722B811549FA751C626589E074D8B5E98A269058C6056CC84B13A62D2663D7CF1E06125468F10006206AB81AAA1D9F034745622366A2533444ADCDDE823777E
              Malicious:false
              Preview:{"analyticsData":{"responseGUID":"afbbfd73-39cf-40b5-a11e-8c3d32c60a2a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1714031131797,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1713852841826}}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:data
              Category:dropped
              Size (bytes):4
              Entropy (8bit):0.8112781244591328
              Encrypted:false
              SSDEEP:3:e:e
              MD5:DC84B0D741E5BEAE8070013ADDCC8C28
              SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
              SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
              SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
              Malicious:false
              Preview:....

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):2814
              Entropy (8bit):5.133473062723015
              Encrypted:false
              SSDEEP:48:Ylb/WgxQjoOW4mk/5G9RP2BKH3sSjZ1q4sA1+Sh9oeJN:eLZ4roZXhsw/l
              MD5:1FC2FF042DCFF1D626C3BDF698E71CA8
              SHA1:C788BB842162AEDE25BD867666AF17D6B6837213
              SHA-256:90255977BCB76FB5B56D7F641DAE11A31F197E411F2C1BEDE5565DD370F19259
              SHA-512:23F762468FB7E375EA59061734D1BE20BEA522CDE805EC4EA8635A5DA7261060E2831FF2A05514CCE1C134BDA2ABD9C9ECC658ADA84F985C945ECAD813B0E48F
              Malicious:false
              Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"429159a917f51755c8f68f9cb7abc161","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1713852841000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"91f11b2ed93ce6852bd4616b2e8eca85","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1372,"ts":1713852841000},{"id":"Edit_InApp_Aug2020","info":{"dg":"55789e1f8665737ae344724e460d4119","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1713852841000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"1d9b054daa743062fc148ba7f25d8f70","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1713852841000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"50be9b149f3f5dda9c4a12f87a9eab4c","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1713852841000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"d84c5513db5a7a3f13cc16f0b80fb221","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1713852841000},

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
              Category:dropped
              Size (bytes):12288
              Entropy (8bit):1.4535545212076733
              Encrypted:false
              SSDEEP:48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsAlE:lNVmsw3SHtbDbPe0K3+fDZdY
              MD5:D300D5EB84F2490C76E9BD643DBC3FB5
              SHA1:3C93E620180016B285C0A76C7787931CDF88B6C9
              SHA-256:81DD01A55B7CF8927B6DCB07E1BFE4962A8CF20E4A894370B195319E1FFBA406
              SHA-512:FB009B48C7D1EADC3A736D527F41F058BEE4BA29B6900E536B9DEA50F7B23DAE406AAC24D6CCC7180B298529BA2784CBFDA69E58BB6F14FD29EE99C348D089B6
              Malicious:false
              Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:SQLite Rollback Journal
              Category:dropped
              Size (bytes):8720
              Entropy (8bit):1.9589259806392851
              Encrypted:false
              SSDEEP:48:7MmrvrBd6dHtbGIbPe0K3+fDy2ds1DqFl2GL7mso:7P3SHtbDbPe0K3+fDZdQKVmso
              MD5:535FA5DDA93D70B609DCDA5A1784C668
              SHA1:F010580594AE918AF94F8980C3E2D176ABF3C815
              SHA-256:5C8273DF612496DFDC25D38A8472D02AB9AE44C644759D7E8A2A80F56D0B8510
              SHA-512:02CD5BB2D468D641E7B1913B88121498C119BFCBC965CB52740A2D8F813F80CBF7183ADE2190AC1E0843329094C039AD858ACF829AF2F1A9C5A00AFC80911BA5
              Malicious:false
              Preview:.... .c.......we......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\Temp\MSI730bb.LOG

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
              Category:dropped
              Size (bytes):246
              Entropy (8bit):3.5278731006694652
              Encrypted:false
              SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8rkwlCf9:Qw946cPbiOxDlbYnuRKN
              MD5:59E2B4C2E99BC6A359E91D4E3564E270
              SHA1:79D5FC27AC757331E9A0224E30899BB88C57B581
              SHA-256:FDEE57AE8E1A4F34AEFEC23D2221F37176EF04293892F68DAFF301B91BC690F1
              SHA-512:234EA516858C526E2954F4599B2A7D3A429462A498D385163C19A85C70BFDD6033E30A101D5A6AB847083D934E3DA413932828076D62DA58375EBFE6A9DC9E38
              Malicious:false
              Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.3./.0.4./.2.0.2.4. . .0.8.:.1.4.:.0.5. .=.=.=.....

              C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9a5ytxz_1ez29i6_4dg.tmp

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:data
              Category:dropped
              Size (bytes):872832
              Entropy (8bit):2.1012208151597824
              Encrypted:false
              SSDEEP:3072:DoVEWBraUrZ6A1C42c6wOUyoNqvhNTZ/lbRH9jJPQQ084xuETdm0U4Rfa3GawG6w:uEUrJnPC+G
              MD5:4200F9FB449DA4799021361849352D37
              SHA1:B0E9DBC19CF18F05E179DD2BCCAA296E21F5DAFA
              SHA-256:FA6CDA135FC90EAAC122EBBE15F05455654D43B4632092F0300A55C1638E01ED
              SHA-512:DF3FC23A504D4F9CF0FA134E62D36F49DE3E7CED72ABBDE2704D92080E017FBB17DF95C49B8D165851C5B46A092B8BE68C6C6C4C7F767F4112588EF4C400AB4E
              Malicious:false
              Preview:............................................................................................................................................................................-...)...A12_acrobat_multiFile_generic_dark_32.pdf...................................................................................................8...........................................................................................................%...!...A12_acrobat_parcel_generic_64.pdf...........................................................................................................9...........................................................................................................*...&...A12_acrobat_parcel_generic_dark_32.pdf......................................................................................................:...........................................................................................................*...&...A12_acrobat_parcel_generic_dark_64.pdf..............

              C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-23 08-13-58-254.log

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:ASCII text, with very long lines (393)
              Category:dropped
              Size (bytes):16525
              Entropy (8bit):5.386483451061953
              Encrypted:false
              SSDEEP:384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
              MD5:F49CA270724D610D1589E217EA78D6D1
              SHA1:22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
              SHA-256:D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
              SHA-512:181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
              Malicious:false
              Preview:SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

              C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:ASCII text, with very long lines (393), with CRLF line terminators
              Category:dropped
              Size (bytes):16603
              Entropy (8bit):5.367163857137781
              Encrypted:false
              SSDEEP:384:Zlx8JFo583yrgnrfh/Nrtw55GNWahZEm9qugoY1OzU7qKNh/43418dPCK8Rr+umR:z4H
              MD5:F4E8861E922DE598B821CB44453A2CA1
              SHA1:D913EEF2BADBFED27E89E5B626B4B38F834B57B6
              SHA-256:F77D859C1FF38B26B9FF61705D02660239BCBEFE7931ACC4C984D0E0ADF6A17F
              SHA-512:222ED40BAF6719063AEE6E348107C8614004315642A90F436096241B11181223D34DCD64495143EAA792DD5C950BF4207A72D7B5C33046B2B50652FFA125CC57
              Malicious:false
              Preview:SessionID=e4395ab2-b2c2-4c2f-a470-1ab5378c8f27.1713852838279 Timestamp=2024-04-23T08:13:58:279+0200 ThreadID=7664 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=e4395ab2-b2c2-4c2f-a470-1ab5378c8f27.1713852838279 Timestamp=2024-04-23T08:13:58:280+0200 ThreadID=7664 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=e4395ab2-b2c2-4c2f-a470-1ab5378c8f27.1713852838279 Timestamp=2024-04-23T08:13:58:280+0200 ThreadID=7664 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=e4395ab2-b2c2-4c2f-a470-1ab5378c8f27.1713852838279 Timestamp=2024-04-23T08:13:58:280+0200 ThreadID=7664 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=e4395ab2-b2c2-4c2f-a470-1ab5378c8f27.1713852838279 Timestamp=2024-04-23T08:13:58:280+0200 ThreadID=7664 Component=ngl-lib_NglAppLib Description="SetConf

              C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):35814
              Entropy (8bit):5.410136339260857
              Encrypted:false
              SSDEEP:768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRk:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRK
              MD5:B9DCA726FFC82C33CCC3A789480AF40E
              SHA1:BF4607A70D53B1B3D3CCF3392D74AFD87245D906
              SHA-256:5E59102062B03C71ECF2993981318573C30FB89D042C001C3CA2B6A6238A948E
              SHA-512:F261E3B6380A8C991DD7CD5D7DC701B7B8877F9667B3455496BE2FE45B393CDA411C0B5B0C4D0DCB05E78BC33C7876F9ADBA025C355A52FCAA88AF650CCBF83F
              Malicious:false
              Preview:05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

              C:\Users\user\AppData\Local\Temp\acrocef_low\0736b2d9-e317-4825-9926-544690b644c9.tmp

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
              Category:dropped
              Size (bytes):758601
              Entropy (8bit):7.98639316555857
              Encrypted:false
              SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
              MD5:3A49135134665364308390AC398006F1
              SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
              SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
              SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
              Malicious:false
              Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

              C:\Users\user\AppData\Local\Temp\acrocef_low\14a280d6-eab6-4451-bc33-59fa3273f1b9.tmp

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
              Category:dropped
              Size (bytes):1407294
              Entropy (8bit):7.97605879016224
              Encrypted:false
              SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
              MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
              SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
              SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
              SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
              Malicious:false
              Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

              C:\Users\user\AppData\Local\Temp\acrocef_low\826b09c1-af62-478e-a850-7ed6cec08b6e.tmp

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
              Category:dropped
              Size (bytes):386528
              Entropy (8bit):7.9736851559892425
              Encrypted:false
              SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
              MD5:5C48B0AD2FEF800949466AE872E1F1E2
              SHA1:337D617AE142815EDDACB48484628C1F16692A2F
              SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
              SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
              Malicious:false
              Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

              C:\Users\user\AppData\Local\Temp\acrocef_low\c44361d0-04b0-4682-8b1b-a027e0ef695d.tmp

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
              Category:dropped
              Size (bytes):1419751
              Entropy (8bit):7.976496077007677
              Encrypted:false
              SSDEEP:24576:/gWL07oXGZIZwYIGNPJwdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:4WLxXGZIZwZGM3mlind9i4ufFXpAXkru
              MD5:AAAAB43627E96B02BC54A78F0EE8E32C
              SHA1:03808205C51BA031BF69F0DF07C9C80835098104
              SHA-256:B9ED5860C1528CAE5717E553381762D9C4ED093E546F7500F55B6B18B5C20CEA
              SHA-512:A476038C2BC9573AFA12D831678C0D2A6EFF0C1E065F7D214A0D5684E79AA7F02710DF30524DE0E6EC90CB660E581531DFA57F038EE1BC285B9BC3DAE17D133D
              Malicious:false
              Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

              Static File Info

              General

              File type:PDF document, version 1.4, 8 pages
              Entropy (8bit):7.909989422543639
              TrID:
              • Adobe Portable Document Format (5005/1) 100.00%
              File name:lsoft_001.pdf
              File size:42'791 bytes
              MD5:ea04d7a553c078d6e6a3f1dc9581ec4e
              SHA1:51f2c26186caacd405aa65ec540c4331df55d6d2
              SHA256:cef8167bc521563bfb33cd5023c15dda10f938682d103e8d327676e9bacd75bb
              SHA512:abd5ce36c34e739211c38c22c7a1cb07c462f1255e1b29eccdff82b4d01bc95060ff926a5aeae89a20583b9a66c268cde577eee6eccfc93f6de13575f69ecb82
              SSDEEP:768:ry9U7gBUhuXv9eEtJnool5jQVDiqurdEV8OCJGSPDn7hY58DsJ9AK8e9pMfj:VgBrlXJoolVQVD4reenlfbK82pMfj
              TLSH:D713D0A0C9A56C3CE64B15406386313BA05AB799C1CF75A13C9D834A85C4EF9F9E33E3
              File Content Preview:%PDF-1.4.%......xref.18 7.0000000346 00000 n..0000000437 00000 n..0000000691 00000 n..0000001182 00000 n..0000001418 00000 n..0000027780 00000 n..0000028894 00000 n..trailer.<</Size 25/Root 18 0 R/Info 16 0 R/Prev 42308/ID[<A0F892D2D1D30FFD673F1A9A1529DE8

              File Icon

              Icon Hash:62cc8caeb29e8ae0

              Static PDF Info

              General

              Header:%PDF-1.4
              Total Entropy:7.909989
              Total Bytes:42791
              Stream Entropy:7.986181
              Stream Bytes:37850
              Entropy outside Streams:5.306977
              Bytes outside Streams:4941
              Number of EOF found:2
              Bytes after EOF:

              Keywords Statistics

              NameCount
              obj24
              endobj24
              stream11
              endstream11
              xref2
              trailer2
              startxref2
              /Page8
              /Encrypt0
              /ObjStm0
              /URI0
              /JS0
              /JavaScript0
              /AA0
              /OpenAction0
              /AcroForm0
              /JBIG2Decode0
              /RichMedia0
              /Launch0
              /EmbeddedFile0

              Network Behavior

              Network Port Distribution

              TCP Packets

              TimestampSource PortDest PortSource IPDest IP
              Apr 23, 2024 08:14:08.848229885 CEST49712443192.168.2.723.46.224.162
              Apr 23, 2024 08:14:08.848278046 CEST4434971223.46.224.162192.168.2.7
              Apr 23, 2024 08:14:08.848438025 CEST49712443192.168.2.723.46.224.162
              Apr 23, 2024 08:14:08.848766088 CEST49712443192.168.2.723.46.224.162
              Apr 23, 2024 08:14:08.848778963 CEST4434971223.46.224.162192.168.2.7
              Apr 23, 2024 08:14:09.118485928 CEST4434971223.46.224.162192.168.2.7
              Apr 23, 2024 08:14:09.119498014 CEST49712443192.168.2.723.46.224.162
              Apr 23, 2024 08:14:09.119520903 CEST4434971223.46.224.162192.168.2.7
              Apr 23, 2024 08:14:09.120722055 CEST4434971223.46.224.162192.168.2.7
              Apr 23, 2024 08:14:09.120840073 CEST49712443192.168.2.723.46.224.162
              Apr 23, 2024 08:14:09.122807980 CEST49712443192.168.2.723.46.224.162
              Apr 23, 2024 08:14:09.122886896 CEST4434971223.46.224.162192.168.2.7
              Apr 23, 2024 08:14:09.123104095 CEST49712443192.168.2.723.46.224.162
              Apr 23, 2024 08:14:09.123112917 CEST4434971223.46.224.162192.168.2.7
              Apr 23, 2024 08:14:09.164279938 CEST49712443192.168.2.723.46.224.162
              Apr 23, 2024 08:14:09.211957932 CEST4434971223.46.224.162192.168.2.7
              Apr 23, 2024 08:14:09.212055922 CEST4434971223.46.224.162192.168.2.7
              Apr 23, 2024 08:14:09.216001987 CEST49712443192.168.2.723.46.224.162
              Apr 23, 2024 08:14:09.216027021 CEST4434971223.46.224.162192.168.2.7
              Apr 23, 2024 08:14:09.216115952 CEST49712443192.168.2.723.46.224.162
              Apr 23, 2024 08:14:09.216115952 CEST49712443192.168.2.723.46.224.162

              HTTP Request Dependency Graph

              • armmf.adobe.com

              HTTPS Proxied Packets

              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              0192.168.2.74971223.46.224.1624435832C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              TimestampBytes transferredDirectionData
              2024-04-23 06:14:09 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
              Host: armmf.adobe.com
              Connection: keep-alive
              Accept-Language: en-US,en;q=0.9
              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
              Sec-Fetch-Site: same-origin
              Sec-Fetch-Mode: no-cors
              Sec-Fetch-Dest: empty
              Accept-Encoding: gzip, deflate, br
              If-None-Match: "78-5faa31cce96da"
              If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
              2024-04-23 06:14:09 UTC198INHTTP/1.1 304 Not Modified
              Content-Type: text/plain; charset=UTF-8
              Last-Modified: Mon, 01 May 2023 15:02:33 GMT
              ETag: "78-5faa31cce96da"
              Date: Tue, 23 Apr 2024 06:14:09 GMT
              Connection: close


              Statistics

              CPU Usage

              Click to jump to process

              Memory Usage

              Click to jump to process

              High Level Behavior Distribution

              Click to dive into process behavior distribution

              Behavior

              Click to jump to process

              System Behavior

              General

              Target ID:0
              Start time:08:13:54
              Start date:23/04/2024
              Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              Wow64 process (32bit):false
              Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\lsoft_001.pdf"
              Imagebase:0x7ff702560000
              File size:5'641'176 bytes
              MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:moderate
              Has exited:true

              General

              Target ID:2
              Start time:08:13:55
              Start date:23/04/2024
              Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              Wow64 process (32bit):false
              Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
              Imagebase:0x7ff6c3ff0000
              File size:3'581'912 bytes
              MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:moderate
              Has exited:true

              General

              Target ID:4
              Start time:08:13:55
              Start date:23/04/2024
              Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              Wow64 process (32bit):false
              Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1640,i,3425272521665081889,14107538559418711138,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
              Imagebase:0x7ff6c3ff0000
              File size:3'581'912 bytes
              MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:moderate
              Has exited:true

              Disassembly

              ⊘No disassembly