Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Invoice INV-06765.pdf

Overview

General Information

Sample name:Invoice INV-06765.pdf
Analysis ID:1431289
MD5:6fc0a38af5eb50d380874c74ec6b19dc
SHA1:edf86d6f34d39b5d09041889a7d3abb7e55c9527
SHA256:45b3c59e3bb5e2a9b10dfddd6cf937efe93b5ef0d147e1610d0f81e5c384eb8c
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 7260 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Invoice INV-06765.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 7432 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 7616 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2064 --field-trial-handle=1668,i,16263588452798232946,7047895391847360399,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.62.176.141:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.62.176.141:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.62.176.141:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.62.176.141:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.62.176.141:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.62.176.141:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.62.176.141:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.62.176.141:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.62.176.141:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.62.176.141:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.62.176.141:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.62.176.141:443
Source: global trafficTCP traffic: 23.62.176.141:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.62.176.141:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.62.176.141:443
Source: global trafficTCP traffic: 23.62.176.141:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 23.62.176.141:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.62.176.141:443
Source: global trafficTCP traffic: 23.62.176.141:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 23.62.176.141:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.62.176.141:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.62.176.141:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.62.176.141:443
Source: global trafficTCP traffic: 23.62.176.141:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 23.62.176.141:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.62.176.141:443
Source: global trafficTCP traffic: 23.62.176.141:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.62.176.141:443
Source: global trafficTCP traffic: 23.62.176.141:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 23.62.176.141:443 -> 192.168.2.4:49740
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.62.176.141:443
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 23.62.176.141:443
Source: global trafficTCP traffic: 23.62.176.141:443 -> 192.168.2.4:49740
Source: Joe Sandbox ViewIP Address: 23.62.176.141 23.62.176.141
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 23.62.176.141
Source: unknownTCP traffic detected without corresponding DNS query: 23.62.176.141
Source: unknownTCP traffic detected without corresponding DNS query: 23.62.176.141
Source: unknownTCP traffic detected without corresponding DNS query: 23.62.176.141
Source: unknownTCP traffic detected without corresponding DNS query: 23.62.176.141
Source: unknownTCP traffic detected without corresponding DNS query: 23.62.176.141
Source: unknownTCP traffic detected without corresponding DNS query: 23.62.176.141
Source: unknownTCP traffic detected without corresponding DNS query: 23.62.176.141
Source: unknownTCP traffic detected without corresponding DNS query: 23.62.176.141
Source: unknownTCP traffic detected without corresponding DNS query: 23.62.176.141
Source: unknownTCP traffic detected without corresponding DNS query: 23.62.176.141
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: Invoice INV-06765.pdfString found in binary or memory: http://www.aiim.org/pdfa/ns/extension/
Source: Invoice INV-06765.pdfString found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: Invoice INV-06765.pdfString found in binary or memory: http://www.aiim.org/pdfa/ns/schema#
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: classification engineClassification label: clean2.winPDF@14/44@0/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journalJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-24 19-37-38-325.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Invoice INV-06765.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2064 --field-trial-handle=1668,i,16263588452798232946,7047895391847360399,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2064 --field-trial-handle=1668,i,16263588452798232946,7047895391847360399,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: Invoice INV-06765.pdfInitial sample: PDF keyword /JS count = 0
Source: Invoice INV-06765.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: A91xjvdh3_1ttlvlu_5ns.tmp.0.drInitial sample: PDF keyword /JS count = 0
Source: A91xjvdh3_1ttlvlu_5ns.tmp.0.drInitial sample: PDF keyword /JavaScript count = 0
Source: Invoice INV-06765.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive12
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1431289 Sample: Invoice INV-06765.pdf Startdate: 24/04/2024 Architecture: WINDOWS Score: 2 6 Acrobat.exe 20 73 2->6         started        process3 8 AcroCEF.exe 105 6->8         started        process4 10 AcroCEF.exe 2 8->10         started        dnsIp5 13 23.62.176.141, 443, 49740 GTT-BACKBONEGTTDE United States 10->13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Invoice INV-06765.pdf0%ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http://www.aiim.org/pdfa/ns/extension/Invoice INV-06765.pdffalse
    		high
    http://www.aiim.org/pdfa/ns/id/Invoice INV-06765.pdffalse
      		high
      http://www.aiim.org/pdfa/ns/schema#Invoice INV-06765.pdffalse
        		high

        World Map of Contacted IPs

        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs

        Public IPs

        IPDomainCountryFlagASNASN NameMalicious
        23.62.176.141
        		unknownUnited States
        		3257GTT-BACKBONEGTTDEfalse

        General Information

        Joe Sandbox version:40.0.0 Tourmaline
        Analysis ID:1431289
        Start date and time:2024-04-24 19:36:47 +02:00
        Joe Sandbox product:CloudBasic
        Overall analysis duration:0h 4m 10s
        Hypervisor based Inspection enabled:false
        Report type:full
        Cookbook file name:defaultwindowspdfcookbook.jbs
        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
        Number of analysed new started processes analysed:10
        Number of new started drivers analysed:0
        Number of existing processes analysed:0
        Number of existing drivers analysed:0
        Number of injected processes analysed:0
        Technologies:
        • HCA enabled
        • EGA enabled
        • AMSI enabled
        Analysis Mode:default
        Analysis stop reason:Timeout
        Sample name:Invoice INV-06765.pdf
        Detection:CLEAN
        Classification:clean2.winPDF@14/44@0/1
        EGA Information:Failed
        HCA Information:
        • Successful, ratio: 100%
        • Number of executed functions: 0
        • Number of non-executed functions: 0
        Cookbook Comments:
        • Found application associated with file extension: .pdf
        • Found PDF document
        • Close Viewer

        Warnings

        • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
        • Excluded IPs from analysis (whitelisted): 23.202.56.131, 52.5.13.197, 54.227.187.23, 52.202.204.11, 23.22.254.206, 23.199.47.144, 23.199.47.150, 172.64.41.3, 162.159.61.3
        • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com
        • Not all processes where analyzed, report is missing behavior information
        • VT rate limit hit for: Invoice INV-06765.pdf

        Simulations

        Behavior and APIs

        ⊘No simulations

        Joe Sandbox View / Context

        IPs

        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        23.62.176.141Order Req. March.docx.docGet hashmaliciousUnknownBrowse
          38#U0438.exeGet hashmaliciousGamaredonBrowse
            STS3780032024.xlsGet hashmaliciousUnknownBrowse
              2500.xlsGet hashmaliciousUnknownBrowse
                UNB-DHLO88938MBANSOPE.docx.docGet hashmaliciousUnknownBrowse
                  PostalOffice.exeGet hashmaliciousUnknownBrowse
                    rtahanan.zipGet hashmaliciousUnknownBrowse
                      Shipping_Documents.xlsGet hashmaliciousUnknownBrowse

                        Domains

                        ⊘No context

                        ASNs

                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        GTT-BACKBONEGTTDEFE8sC55u4j.elfGet hashmaliciousMiraiBrowse
                        • 62.50.4.183
                        ZOHH8muwjh.elfGet hashmaliciousMiraiBrowse
                        • 194.183.117.247
                        enEQvjUlGl.elfGet hashmaliciousMiraiBrowse
                        • 81.31.17.51
                        Yui1pUgieI.elfGet hashmaliciousMiraiBrowse
                        • 195.81.19.29
                        https://webex-install.comGet hashmaliciousNetSupport RATBrowse
                        • 23.203.101.20
                        VOlsbvDoA0.elfGet hashmaliciousMiraiBrowse
                        • 151.171.24.157
                        994LJMbRxE.elfGet hashmaliciousMiraiBrowse
                        • 66.7.159.79
                        5DkGWDuyYR.elfGet hashmaliciousMiraiBrowse
                        • 77.67.63.236
                        xQwEu422am.elfGet hashmaliciousMiraiBrowse
                        • 212.222.239.85

                        JA3 Fingerprints

                        ⊘No context

                        Dropped Files

                        ⊘No context

                        Created / dropped Files

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):292
                        Entropy (8bit):5.208735922003362
                        Encrypted:false
                        SSDEEP:6:/BkVq2Pwkn2nKuAl9OmbnIFUt8gBkgZmw+gBkIkwOwkn2nKuAl9OmbjLJ:mvYfHAahFUt80/+05JfHAaSJ
                        MD5:C9ADF7EB6EC263F3C397666E776092B7
                        SHA1:23D230C6C6C5646C82FFE3A5EB93B6EF14792404
                        SHA-256:CAEC834D709CA2B16229506E3FEAF9D4D1A2E3F0BB25EE434608F26A3E593BCD
                        SHA-512:718549EA38063FEA4AE3C56888EBDDB03FF03B2337C13F04E40B41CF9C4FC70A37B206D7CD96B40EA31D62738900903BA6B59CB746A92ABF7F6EF6424D3D04B3
                        Malicious:false
                        Reputation:low
                        Preview:2024/04/24-19:37:36.032 1d24 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/24-19:37:36.032 1d24 Recovering log #3.2024/04/24-19:37:36.032 1d24 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):292
                        Entropy (8bit):5.208735922003362
                        Encrypted:false
                        SSDEEP:6:/BkVq2Pwkn2nKuAl9OmbnIFUt8gBkgZmw+gBkIkwOwkn2nKuAl9OmbjLJ:mvYfHAahFUt80/+05JfHAaSJ
                        MD5:C9ADF7EB6EC263F3C397666E776092B7
                        SHA1:23D230C6C6C5646C82FFE3A5EB93B6EF14792404
                        SHA-256:CAEC834D709CA2B16229506E3FEAF9D4D1A2E3F0BB25EE434608F26A3E593BCD
                        SHA-512:718549EA38063FEA4AE3C56888EBDDB03FF03B2337C13F04E40B41CF9C4FC70A37B206D7CD96B40EA31D62738900903BA6B59CB746A92ABF7F6EF6424D3D04B3
                        Malicious:false
                        Reputation:low
                        Preview:2024/04/24-19:37:36.032 1d24 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/24-19:37:36.032 1d24 Recovering log #3.2024/04/24-19:37:36.032 1d24 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):336
                        Entropy (8bit):5.166212214627004
                        Encrypted:false
                        SSDEEP:6:/lBFIq2Pwkn2nKuAl9Ombzo2jMGIFUt8g/ZNZZmw+gEFkwOwkn2nKuAl9Ombzo23:9cvYfHAa8uFUt8K/+FF5JfHAa8RJ
                        MD5:937F3499ED6B218B41DFF3E793B49366
                        SHA1:1A16AF0F679D94389B752954D8BAC90B6344BFF8
                        SHA-256:E8A6922A791A19D12254FAFBE06402BC8650CBDD8820B127362DFC8C5BDF87F8
                        SHA-512:61A6E8AF76886E5A75FE6A1DCB30DC8124E52370C203812FE0141CE7D6289DEC527979EA89658F60E7490059518782DFBBA0AFB4778D676F6CED6FA30423F9D1
                        Malicious:false
                        Reputation:low
                        Preview:2024/04/24-19:37:36.110 1e00 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/24-19:37:36.112 1e00 Recovering log #3.2024/04/24-19:37:36.113 1e00 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):336
                        Entropy (8bit):5.166212214627004
                        Encrypted:false
                        SSDEEP:6:/lBFIq2Pwkn2nKuAl9Ombzo2jMGIFUt8g/ZNZZmw+gEFkwOwkn2nKuAl9Ombzo23:9cvYfHAa8uFUt8K/+FF5JfHAa8RJ
                        MD5:937F3499ED6B218B41DFF3E793B49366
                        SHA1:1A16AF0F679D94389B752954D8BAC90B6344BFF8
                        SHA-256:E8A6922A791A19D12254FAFBE06402BC8650CBDD8820B127362DFC8C5BDF87F8
                        SHA-512:61A6E8AF76886E5A75FE6A1DCB30DC8124E52370C203812FE0141CE7D6289DEC527979EA89658F60E7490059518782DFBBA0AFB4778D676F6CED6FA30423F9D1
                        Malicious:false
                        Reputation:low
                        Preview:2024/04/24-19:37:36.110 1e00 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/24-19:37:36.112 1e00 Recovering log #3.2024/04/24-19:37:36.113 1e00 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):475
                        Entropy (8bit):4.969516568575897
                        Encrypted:false
                        SSDEEP:12:YH/um3RA8sqZRhsBdOg2HKAcaq3QYiubInP7E4T3y:Y2sRdsXdMHKr3QYhbG7nby
                        MD5:9741C7CF2CBC59446478653BDF4AE9E8
                        SHA1:F4CA0CE956832D808AB47C08DA6280DEE32AD47F
                        SHA-256:7C21A9412FA99AFF415E23B1BFC3100E56EE51050ED9D7C10765CEC3A0569CD6
                        SHA-512:6BF4EEE97F079233BC71660A03661BACE1877C94CBC8F65129C4E5590645C2007A3955542E23EF3799E1DEB4514D4BAF3340EEFF2E261D040B9C4F03EB04F5ED
                        Malicious:false
                        Reputation:low
                        Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13358540268117634","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":154809},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\bb136336-7609-4182-b816-64603bbc6329.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:JSON data
                        Category:modified
                        Size (bytes):475
                        Entropy (8bit):4.969516568575897
                        Encrypted:false
                        SSDEEP:12:YH/um3RA8sqZRhsBdOg2HKAcaq3QYiubInP7E4T3y:Y2sRdsXdMHKr3QYhbG7nby
                        MD5:9741C7CF2CBC59446478653BDF4AE9E8
                        SHA1:F4CA0CE956832D808AB47C08DA6280DEE32AD47F
                        SHA-256:7C21A9412FA99AFF415E23B1BFC3100E56EE51050ED9D7C10765CEC3A0569CD6
                        SHA-512:6BF4EEE97F079233BC71660A03661BACE1877C94CBC8F65129C4E5590645C2007A3955542E23EF3799E1DEB4514D4BAF3340EEFF2E261D040B9C4F03EB04F5ED
                        Malicious:false
                        Reputation:low
                        Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13358540268117634","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":154809},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):4730
                        Entropy (8bit):5.249414421746943
                        Encrypted:false
                        SSDEEP:96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7ttc7wlZ:etJCV4FiN/jTN/2r8Mta02fEhgO73go9
                        MD5:AD2D0B0E033C44654AD610C0E51AC1D9
                        SHA1:28C93EAE9FD210FA51397CDC3B8B03BE0BDC04B9
                        SHA-256:AADDB295D20EB267346955FE78D2EEE157BA679617D1D9B58C42CACCAC8B3503
                        SHA-512:37DAB6B991089EE8BB273848E091B59039880DA011BE8BCCEECC9BA6F834F207E501DD97FB0E9D8CDD6E8EB77E638EB5079ED51677A072D50E42C41AFB5BB87C
                        Malicious:false
                        Reputation:low
                        Preview:*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):324
                        Entropy (8bit):5.164788611109315
                        Encrypted:false
                        SSDEEP:6:/xvIq2Pwkn2nKuAl9OmbzNMxIFUt8gmUAVhZmw+gYAzkwOwkn2nKuAl9OmbzNMFd:SvYfHAa8jFUt8ff/+FM5JfHAa84J
                        MD5:2BBCA859C2179196B3658987661D158F
                        SHA1:E0D23AB99E07090927C206CBA47DD9CD10CAD705
                        SHA-256:8DB9E05327BEE135F6E4A7422E37E62BA7244E72A3CC825F0AD6E288FE2CD545
                        SHA-512:09A2E4233FB5DCEACC15B0CAEF31C8BA6D6E2F0D98139ABC85865A3554E99DA6E526DFE37D4CEE8F9F9548912DBE72CFC754FD877ADF5E6CD071C2371BC3C1D0
                        Malicious:false
                        Reputation:low
                        Preview:2024/04/24-19:37:36.240 1e00 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/24-19:37:36.241 1e00 Recovering log #3.2024/04/24-19:37:36.242 1e00 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):324
                        Entropy (8bit):5.164788611109315
                        Encrypted:false
                        SSDEEP:6:/xvIq2Pwkn2nKuAl9OmbzNMxIFUt8gmUAVhZmw+gYAzkwOwkn2nKuAl9OmbzNMFd:SvYfHAa8jFUt8ff/+FM5JfHAa84J
                        MD5:2BBCA859C2179196B3658987661D158F
                        SHA1:E0D23AB99E07090927C206CBA47DD9CD10CAD705
                        SHA-256:8DB9E05327BEE135F6E4A7422E37E62BA7244E72A3CC825F0AD6E288FE2CD545
                        SHA-512:09A2E4233FB5DCEACC15B0CAEF31C8BA6D6E2F0D98139ABC85865A3554E99DA6E526DFE37D4CEE8F9F9548912DBE72CFC754FD877ADF5E6CD071C2371BC3C1D0
                        Malicious:false
                        Reputation:low
                        Preview:2024/04/24-19:37:36.240 1e00 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/24-19:37:36.241 1e00 Recovering log #3.2024/04/24-19:37:36.242 1e00 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240424173740Z-155.bmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
                        Category:dropped
                        Size (bytes):71190
                        Entropy (8bit):0.9115517986426381
                        Encrypted:false
                        SSDEEP:192:bl+tZSs5phkyBhCAFs77T0bvrvuEjrZVPBxISy:bl+XSs5phvBhCA60OEjrZVPXBy
                        MD5:F5748049781DF801C0D0ADDB9FDBFB83
                        SHA1:D3F8CBB77F4A2B1F573EA1CFD6310818F0576A2D
                        SHA-256:CEFC8019C77EE55729822918D09F4A732F0F0512E1FAA9C48DE351E66AAE8EB9
                        SHA-512:347691DA893258D112ECFF5EA5F8D769C06E38D6A8F099C416B96B1FB1967BA789B55A5AB5B48F9EC9DBD9934583F124142E3A181F6116D44717A987D5DB9413
                        Malicious:false
                        Reputation:low
                        Preview:BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
                        Category:dropped
                        Size (bytes):86016
                        Entropy (8bit):4.44534983638152
                        Encrypted:false
                        SSDEEP:384:yezci5tEMN2oiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rEMN2Ps3OazzU89UTTgUL
                        MD5:0B493808096AB973520BD6A1C9A8D5AE
                        SHA1:57CA3BB20152D705945F1397525E0F4B8CBE315A
                        SHA-256:9177F52A25A02ABCD3FC3655E785A989A07B571C50C79485F85B80AF0D5EC3FB
                        SHA-512:97D64EB60D4601DE8EB4F6121EC3AE97C0C73D0C48FA8990A434749C926E24EC1CAE2D544496029819418FC9E52165F00A8A4AA9D9317FB334D01A01A7225DED
                        Malicious:false
                        Reputation:low
                        Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:SQLite Rollback Journal
                        Category:dropped
                        Size (bytes):8720
                        Entropy (8bit):3.7719312768137483
                        Encrypted:false
                        SSDEEP:48:7MWp/E2ioyVTBioy9oWoy1Cwoy1KqKOioy1noy1AYoy1Wioy1hioybioyk+oy1nd:7ZpjuTBF1iXKQv8ub9IVXEBodRBko
                        MD5:096B925B34CCFEE2C5E71EB7BFE83EE8
                        SHA1:31255C6201DEA9F4BC25FC82909E99E8BAC21B0E
                        SHA-256:ADC2E8DD2E149095818B81FE6F457363919172367BC0C0D9AB31C9D5325B43A4
                        SHA-512:064C606CAEA353481F2F293AABF4850541D1DE76DC8BF80518776821AE1752B77428FFADD883A572954D2CB65285C7E093E447AE541C5CA82322D0098384C3BA
                        Malicious:false
                        Reputation:low
                        Preview:.... .c......0.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7336

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:PostScript document text
                        Category:dropped
                        Size (bytes):185099
                        Entropy (8bit):5.182478651346149
                        Encrypted:false
                        SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                        MD5:94185C5850C26B3C6FC24ABC385CDA58
                        SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                        SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                        SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                        Malicious:false
                        Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:PostScript document text
                        Category:dropped
                        Size (bytes):185099
                        Entropy (8bit):5.182478651346149
                        Encrypted:false
                        SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                        MD5:94185C5850C26B3C6FC24ABC385CDA58
                        SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                        SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                        SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                        Malicious:false
                        Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):243196
                        Entropy (8bit):3.3450692389394283
                        Encrypted:false
                        SSDEEP:1536:vKPCPiyzDtrh1cK3XEivK7VK/3AYvYwgqErRo+RQn:yPClJ/3AYvYwghFo+RQn
                        MD5:F5567C4FF4AB049B696D3BE0DD72A793
                        SHA1:EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916
                        SHA-256:D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
                        SHA-512:E769735991E5B1331E259608854D00CDA4F3E92285FDC500158CBD09CBCCEAD8A387F78256A43919B13EBE70C995D19242377C315B0CCBBD4F813251608C1D56
                        Malicious:false
                        Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):295
                        Entropy (8bit):5.339066813998915
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXYs9VoZcg1vRcR0Y2oAvJM3g98kUwPeUkwRe9:YvXKXYsEZc0vWGMbLUkee9
                        MD5:96E238202E8F4A1358109F186C3A74CF
                        SHA1:A69392A73514E35DF40610C67624939F12FCA7E1
                        SHA-256:44373C7BBC9E65F8D746C9F91BDF66EE4BD37F6103FF8F2299328E6E6DA7F09B
                        SHA-512:FA5B1C978355C3C0C5D9DF81E1E304C31D95567C8D71789B6A4B77962A0DF0D29F13775C4C28968EF9D2D737075BC507C66216C1B575E3699F0AE67CFCC59541
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"a26ae425-ce5f-413c-828b-fa2e0272f5ee","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714154937793,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):294
                        Entropy (8bit):5.283147500799135
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXYs9VoZcg1vRcR0Y2oAvJfBoTfXpnrPeUkwRe9:YvXKXYsEZc0vWGWTfXcUkee9
                        MD5:69B22BC97BC80625A83B595FFB32ACDC
                        SHA1:84A48660941EE5D238B32534FC037657A2AE08B5
                        SHA-256:B4B48198759FAC41F520A7D57BD011BA994B13DF90D805CA9BB4972E04C768E4
                        SHA-512:A649F7C73CBA3F83414892A288F925562384CA22C010EF38972964A15D53AD19A530466548E3B89BFEE228E1ED48B58BB2A499BD9F864E0B42E6FDA4F35E23CA
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"a26ae425-ce5f-413c-828b-fa2e0272f5ee","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714154937793,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):294
                        Entropy (8bit):5.262472423637727
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXYs9VoZcg1vRcR0Y2oAvJfBD2G6UpnrPeUkwRe9:YvXKXYsEZc0vWGR22cUkee9
                        MD5:DA62940A60251F6AB44888236A124519
                        SHA1:B687FCE8D291C8BB3C6C9CE91259AA80DB469F88
                        SHA-256:389864676A497C7BE812DCCC579C535374FAD440218AFC0D3AC1BD8694DEC366
                        SHA-512:A7BC1F40468C319DFB43E5E64A0F5580CCFC8B85A8E7016CAB9FFCD564284A3BA3A67A916462D91F078CFAC8761F0FC6440827CAF1EC3564472B5260A63AAB4D
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"a26ae425-ce5f-413c-828b-fa2e0272f5ee","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714154937793,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):285
                        Entropy (8bit):5.32522480888466
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXYs9VoZcg1vRcR0Y2oAvJfPmwrPeUkwRe9:YvXKXYsEZc0vWGH56Ukee9
                        MD5:F2E8505DE1F8FB45285000E1D7310928
                        SHA1:8E0C77D9D43DF5F940E98713D2D4F9B2AFC72BAA
                        SHA-256:77C72110E0D9511C385F0B16D36DB373745E560850E14D1F23620888205B5C0E
                        SHA-512:EA3C1A84D2E757E81597C8EABC7F295F62DC2C5722CDEF3F7BBACED8A7D10D5A5734BF0EF67456EE86325A2D7D190711CE18650B99D90F382883146C62A2E459
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"a26ae425-ce5f-413c-828b-fa2e0272f5ee","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714154937793,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):292
                        Entropy (8bit):5.283612590396711
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXYs9VoZcg1vRcR0Y2oAvJfJWCtMdPeUkwRe9:YvXKXYsEZc0vWGBS8Ukee9
                        MD5:4A8C6770BA37EBA1C2E013FC983B32B8
                        SHA1:7CD30AF55B4A47BFF14428502E88B9DBB48D1A5B
                        SHA-256:BF2DC3C2EFCB99E32745E8F773D44297C96C1515A6DF0F1B55FAB478E554433C
                        SHA-512:D4CF9C10C24BE09CED4B044B1FDF13AD4D943497B9D77C8DAD4F3C5BE0C95B54BAABBA8DA50ED5B9434A0DC844990FABD9645A505E81DB7595D66960A8478E4E
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"a26ae425-ce5f-413c-828b-fa2e0272f5ee","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714154937793,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):289
                        Entropy (8bit):5.271015139351133
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXYs9VoZcg1vRcR0Y2oAvJf8dPeUkwRe9:YvXKXYsEZc0vWGU8Ukee9
                        MD5:A878EFC69F957DF91E2A18E3AC46D0B7
                        SHA1:EA968CE7309D1583405015FF3054684F8D374460
                        SHA-256:F7C47681C66C22FDF2105C135F3AB5C90EAE51900C5D0DF1A79C8C54961FE2F6
                        SHA-512:D8CF79D0C93648688B44167A2F875C25E7EAF125AA23B93CF4CFB710A30BF71C214890DDA93D3E64D9BF7BAFE4FC8F053CED22910C87174B491C9765699F9F98
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"a26ae425-ce5f-413c-828b-fa2e0272f5ee","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714154937793,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):292
                        Entropy (8bit):5.274722438501138
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXYs9VoZcg1vRcR0Y2oAvJfQ1rPeUkwRe9:YvXKXYsEZc0vWGY16Ukee9
                        MD5:3F30D6BC412B0743A8DA304BAFC2E802
                        SHA1:A90932CCA9D3560F53E1D687F25A0D7799572147
                        SHA-256:72948AD045F3AA77E8B9A59CA56A22AC93D03A0AF7A6FFAEC0E8EF313B2B27DB
                        SHA-512:8672FCC495A53EF54B7CFBCED715F15F704F7064EA05822D2A4364C155E7598A9151BA920CCA629BF40E705CC25E9BBE4442DF89CF0B0690AAB65059002E9316
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"a26ae425-ce5f-413c-828b-fa2e0272f5ee","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714154937793,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):289
                        Entropy (8bit):5.2825847356301825
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXYs9VoZcg1vRcR0Y2oAvJfFldPeUkwRe9:YvXKXYsEZc0vWGz8Ukee9
                        MD5:8B29DFBF3D3E3805990EAB97CAB51685
                        SHA1:CEB3F17C155BD6FC68B20D5DAAA5C817D38C36B7
                        SHA-256:CA07D69E01D2635C8F3F6194319FDFF916D7C33AC06699E00512EF06D999FF9A
                        SHA-512:6853A432F23D8553DE7DF5EA92556DC36A9CBB300D7467EAE93D648EA56EF0EC6C531E2DF2C3E7069719A191D97376F9302E6602EBF551CE9DDCB41BF40CED6F
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"a26ae425-ce5f-413c-828b-fa2e0272f5ee","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714154937793,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):1372
                        Entropy (8bit):5.735639276423234
                        Encrypted:false
                        SSDEEP:24:Yv6XY3zviKLgENRcbrZbq00iCCBrwJo++ns8ct4mFJNM:YvBaEgigrNt0wSJn+ns8cvFJq
                        MD5:AA5AE1D20C2AAA741637CF2427ABB913
                        SHA1:DAA5E35DF75D7E6375CEECD07C0C06B96C1064EC
                        SHA-256:9C64E1111C29CBBCE869666BD10CB1D3FEAFAF051631F89C9A87DEFFF3B27440
                        SHA-512:9A650C296505E00C8672C51ACC3C96C50880991459A856202F1CF34F713FBD8AABB56DFBE783933621FAE7C5DB132C679625B2E553964B63725F8714FB4E3406
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"a26ae425-ce5f-413c-828b-fa2e0272f5ee","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714154937793,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"79887_247329ActionBlock_0","campaignId":79887,"containerId":"1","controlGroupId":"","treatmentId":"acc56846-d570-4500-a26e-7f8cf2b4acad","variationId":"247329"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJUcnkgQWNyb2JhdCBQcm8ifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNSIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTMiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIDctZGF5IHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0byBwcmVtaXVtIFBERiBhbmQgZS1zaWduaW5nIHRvb2xzLiIsImJ

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):289
                        Entropy (8bit):5.276515777817041
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXYs9VoZcg1vRcR0Y2oAvJfYdPeUkwRe9:YvXKXYsEZc0vWGg8Ukee9
                        MD5:05EA103EE444D5E3C0EABA48A54E2E0D
                        SHA1:E8B5A370788DE7987732397A1FCE5F63A5B8CD43
                        SHA-256:B69A3F89446BED4CB6E49A08A19BCB740859A3C139DEF7A2F433AE5D9617E8E6
                        SHA-512:644ED7BDAC37A4A685AE9548A426541815C638B020BEAFA6BE31209CB2AF9F607E44E56B565F1BFFDBBD1633373D4FD0123C370D9E0FFFCA5886189DBEC89CA1
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"a26ae425-ce5f-413c-828b-fa2e0272f5ee","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714154937793,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):1395
                        Entropy (8bit):5.776237419194219
                        Encrypted:false
                        SSDEEP:24:Yv6XY3zvhrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNE:YvBJHgDv3W2aYQfgB5OUupHrQ9FJe
                        MD5:B59B62711F25FFF1B9AE8CFE775238DB
                        SHA1:4A933485B9E5BC10D9CD3ACB0F09A4B866B59840
                        SHA-256:A96AFABEFE36AD28D90AD157A3671DE6BF9E83F7DE737853A584A5ED69FF08F6
                        SHA-512:F0790242F37B4D2E396470702E91D8AF9E06D0C350F434DCB179F480762B02D685938E3391217E7CE1E0B89FAD2B56CCB96BB874DBED2CB6339F3E064546B922
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"a26ae425-ce5f-413c-828b-fa2e0272f5ee","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714154937793,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):291
                        Entropy (8bit):5.260224279079791
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXYs9VoZcg1vRcR0Y2oAvJfbPtdPeUkwRe9:YvXKXYsEZc0vWGDV8Ukee9
                        MD5:38205A611B942677381DA427B064E8E1
                        SHA1:A1B26B5040A78DB04C17E9999C57D31D34B2D25A
                        SHA-256:5E1A5D2177F8521E4B8FA60B5C145ACCFDC57B2E7946AADE9AE9EF3DDC403501
                        SHA-512:0563B2D6C5F30D503A3055C126F425955D42E7BF8DE0157B1C0E8EB212E64BB7BD49C8DECFE67F4B43C35F6343673E5A8E5EF34AE88808832936F0C89AFB883E
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"a26ae425-ce5f-413c-828b-fa2e0272f5ee","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714154937793,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):287
                        Entropy (8bit):5.264846540597806
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXYs9VoZcg1vRcR0Y2oAvJf21rPeUkwRe9:YvXKXYsEZc0vWG+16Ukee9
                        MD5:566629A9DF136E4011ADC5DA6E2D7D31
                        SHA1:A5AA255A2EBC1106D8D2F3DAB7263595C06B3A63
                        SHA-256:954886E89050D80375909128C06C75BAF3B242CC29FECB58EFADC9D1A087ADB3
                        SHA-512:E94699AC1870083EF02C9F61FB0FD0A43F9C63100ECE9F12C79ECCEDFE4C05CF85EBFB6FA9CA5B722AE03E81484A5FA53550C5F696243CAECCD4C2E0F4FA42F1
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"a26ae425-ce5f-413c-828b-fa2e0272f5ee","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714154937793,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):289
                        Entropy (8bit):5.284140948983151
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXYs9VoZcg1vRcR0Y2oAvJfbpatdPeUkwRe9:YvXKXYsEZc0vWGVat8Ukee9
                        MD5:CC891DBA9A7AD4D68FCB1ADF581FB527
                        SHA1:5009FA674F4B28689484C365B2FDEB092FBE1A54
                        SHA-256:9668A1B12B177365B6177F164FDC5B9F204E3E34A41D67D736EB0714EFC5B2CC
                        SHA-512:6B15C63D21951DBDC960B6577EA597A1FAB28D144078481ED6245B4B8E2F08990737F368EA23CA7E49836AC2656587E814FCFF17174D1E2B90FE6112227910E2
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"a26ae425-ce5f-413c-828b-fa2e0272f5ee","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714154937793,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):286
                        Entropy (8bit):5.243197952504177
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXYs9VoZcg1vRcR0Y2oAvJfshHHrPeUkwRe9:YvXKXYsEZc0vWGUUUkee9
                        MD5:9B2FFCC71F4EDB715C02B26CACD5A675
                        SHA1:439603B20439C7F8FDB16062F2EB1EEC2807660B
                        SHA-256:BA35CC77E138A48D4582D0D3E6152674F3539455C9F07B725B8EED79D9DCE350
                        SHA-512:014100FBD1450E3396BBBA6A49FD95C4C674DF3224AF0B1D9EA6599756AF8FE55B53DAC3472A690D603C74BA6B078452165266EF1EEA33BE137042C76D8A6CEF
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"a26ae425-ce5f-413c-828b-fa2e0272f5ee","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714154937793,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):782
                        Entropy (8bit):5.365188082686943
                        Encrypted:false
                        SSDEEP:12:YvXKXYsEZc0vWGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWw:Yv6XY3zvw168CgEXX5kcIfANhV
                        MD5:DD1E41D1D6AA98AD41FB141589533E0B
                        SHA1:7C0887D5D901F1CDD412D48606EFA4A250A66EE5
                        SHA-256:CD8B06CF5269F9D5DD591B1734F5F23B3B3CE49260159E17460866F75698B101
                        SHA-512:CC39E67B6448287BFD7B101F48381712D244A528C7D2A5AA4AE22745E60A48B49EE103A0090D3D5B78C6A9C90CBAE920EEFBFE4D2E73175572FDE49389430849
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"a26ae425-ce5f-413c-828b-fa2e0272f5ee","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714154937793,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1713980262855}}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):4
                        Entropy (8bit):0.8112781244591328
                        Encrypted:false
                        SSDEEP:3:e:e
                        MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                        SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                        SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                        SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                        Malicious:false
                        Preview:....

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):2814
                        Entropy (8bit):5.131530681263055
                        Encrypted:false
                        SSDEEP:24:YYkyOOZ0C7qskxSL1pYm6617brDa8M1ayK75d9fk9jvgMj0STmSXC32i2LS9zo52:YgOFYXtRpYj6AOIvgeXkjjzovXh9oQE
                        MD5:05E1E48B4EA9BBA09E571C3DA45E2726
                        SHA1:309C0170ABCF2933206941D1A06ABC5D63DF73C8
                        SHA-256:3735353D4622A781D8FF9C44F0C2A327B0CD7F76BC2CCEFD6148E44C046DC590
                        SHA-512:1E1D22949F21F95AAF0FD56F35798891FDEA121855BF99D78760691C06BE4A3467F4DEC92B0943F726EDFCBF498358A63DA596898A97D28E8BD15A7FF050B78B
                        Malicious:false
                        Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"6a2176bc2ddadaf94356bfbf7860e1af","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1713980261000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"cc59b9652e72307b5daeb8f8cabcf239","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1372,"ts":1713980261000},{"id":"Edit_InApp_Aug2020","info":{"dg":"4c3fce574ad2c0b0df65cbe8deb81c97","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1713980261000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"00fb3739847c57416b3155797c96e4b5","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1713980261000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"b7b692c01389e6a1083abc6e3b0b815e","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1713980261000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"56025d0b8d9cc6a20195c0b903165cd3","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1713980261000},

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
                        Category:dropped
                        Size (bytes):12288
                        Entropy (8bit):1.1871896585194606
                        Encrypted:false
                        SSDEEP:48:TGufl2GL7msEHUUUUUUUUD+SvR9H9vxFGiDIAEkGVvpvY:lNVmswUUUUUUUUS+FGSItU
                        MD5:4250B6AA11149EBEC3D262ACD45FE49C
                        SHA1:45427D944EE5EB0478958469A4BDDB3C21671F87
                        SHA-256:CD9F8666A6194C9C52D1884902B2207081B58EC544BCBB62FBA4D242D9D095EE
                        SHA-512:C77B09F06EF79063D933FD00F39BBB40C8DAE797805220DDF70E46C1BFE8C26B8F83280012BBCA7DFA65676FE5ED639820BFF20F5C0D5C58C38D5868618269A5
                        Malicious:false
                        Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:SQLite Rollback Journal
                        Category:dropped
                        Size (bytes):8720
                        Entropy (8bit):1.603796524533358
                        Encrypted:false
                        SSDEEP:48:7MSKUUUUUUUUUUDsvR9H9vxFGiDIAEkGVvLqFl2GL7msE:7eUUUUUUUUUU4FGSItNKVmsE
                        MD5:21B8DE5C793E84C3780B59CFC18DC661
                        SHA1:6684B3EA19D1992ED9792C66AF86A705B4A73CD5
                        SHA-256:89FB506957C29F7380CB8CB4CFA3F2096D55C69AB29B264927873443B566638B
                        SHA-512:F5B86F365A4BC3EF8B8722D95846A868E6B2E5B83B9441D616F3AA4768E9121B60ABF9BAE50FE3F09DCA2FD70A10DD480AAE7FA9AAF72D17F4A2F430D26C5DE6
                        Malicious:false
                        Preview:.... .c.....i.e@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Temp\MSI99f48.LOG

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):246
                        Entropy (8bit):3.5162684137903053
                        Encrypted:false
                        SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8c+aw:Qw946cPbiOxDlbYnuRKHk
                        MD5:85E02029CE824DA7C56D6FABC58B5DD8
                        SHA1:1A46986921540E1A9F42DB0577410A5C84DF5436
                        SHA-256:8FB38B4385C7216BE3CDE82AEC29D043339F0B836DE1E9E68B07E5D7214875AF
                        SHA-512:E6B0631F6D54907C281B96404E2E72D86A4087305ED8B0E14C6FAA4D79D8EE47B14554AD154EFA50699B955722EED6E1E239A227D4ACA6FAE937F9CF3A06DF50
                        Malicious:false
                        Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.4./.0.4./.2.0.2.4. . .1.9.:.3.7.:.4.4. .=.=.=.....

                        C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91xjvdh3_1ttlvlu_5ns.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:PDF document, version 1.6, 0 pages
                        Category:dropped
                        Size (bytes):358
                        Entropy (8bit):5.041429053557045
                        Encrypted:false
                        SSDEEP:6:IngVMrexJzJT0y9VEQIFVmb/eu2g/86S1kxROO84iqhWrv4iqhWubMTCSyAAO:IngVMre9T0HQIDmy9g06JXfWrvaWUMTR
                        MD5:800B88850D13CF93D5ADC76507279579
                        SHA1:711A5CFEF8349B555D0891CE2BD9ADDD17A05F83
                        SHA-256:18D15890A6AC227AF37F905C0EEE6E9FDF80106395F30094234C8F2C7EA9710C
                        SHA-512:7FEB7FC39E57331611868C849CFE3CFF37C86E4B6A58A1551C293D263BC40FF355DCAED1C650906776941F87729490DC8ECA40D59BDCCDBA0DF2A013A4E8E17F
                        Malicious:false
                        Preview:%PDF-1.6.%......1 0 obj.<</Pages 2 0 R/Type/Catalog>>.endobj.2 0 obj.<</Count 0/Kids[]/Type/Pages>>.endobj.3 0 obj.<<>>.endobj.xref..0 4..0000000000 65535 f..0000000016 00000 n..0000000061 00000 n..0000000107 00000 n..trailer..<</Size 4/Root 1 0 R/Info 3 0 R/ID[<4C37940143A945418474A2A93D34B7F5><4C37940143A945418474A2A93D34B7F5>]>>..startxref..127..%%EOF..

                        C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-24 19-37-38-325.log

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:ASCII text, with very long lines (393)
                        Category:dropped
                        Size (bytes):16525
                        Entropy (8bit):5.345946398610936
                        Encrypted:false
                        SSDEEP:384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
                        MD5:8947C10F5AB6CFFFAE64BCA79B5A0BE3
                        SHA1:70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
                        SHA-256:4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
                        SHA-512:B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
                        Malicious:false
                        Preview:SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

                        C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:ASCII text, with very long lines (393), with CRLF line terminators
                        Category:dropped
                        Size (bytes):16603
                        Entropy (8bit):5.353875389750655
                        Encrypted:false
                        SSDEEP:384:D9BwRBHOjQoBjiN6pZPpHeTDUrQTtVj3EG06ik1NZoGUUPPJkYfZIZ0VP1Ehmme4:+oj
                        MD5:CE9D3263FCDE731CCB65DBC76E0393D6
                        SHA1:D7A5A35FD07EE68EA03CD9D4FCCA59118C716078
                        SHA-256:47A5B928D4FB72AA2A931926C07EADB61628372C7EB37A9CC40CC8B8C3C25E5D
                        SHA-512:030D23943639CBC569A459285239038496E38351C34C189F4A4240EE52334850D7882C3B092AA71648794C151B5E0A621CE0333926DA83D13D1CB4BDB4C01691
                        Malicious:false
                        Preview:SessionID=2fcdbd53-5ac7-4c55-beb0-ec0c8c2d5bc0.1713980258347 Timestamp=2024-04-24T19:37:38:347+0200 ThreadID=7424 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=2fcdbd53-5ac7-4c55-beb0-ec0c8c2d5bc0.1713980258347 Timestamp=2024-04-24T19:37:38:347+0200 ThreadID=7424 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=2fcdbd53-5ac7-4c55-beb0-ec0c8c2d5bc0.1713980258347 Timestamp=2024-04-24T19:37:38:347+0200 ThreadID=7424 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=2fcdbd53-5ac7-4c55-beb0-ec0c8c2d5bc0.1713980258347 Timestamp=2024-04-24T19:37:38:347+0200 ThreadID=7424 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=2fcdbd53-5ac7-4c55-beb0-ec0c8c2d5bc0.1713980258347 Timestamp=2024-04-24T19:37:38:347+0200 ThreadID=7424 Component=ngl-lib_NglAppLib Description="SetConf

                        C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):29845
                        Entropy (8bit):5.391529320634055
                        Encrypted:false
                        SSDEEP:768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rV:J
                        MD5:B8A703B5978FA61E1AD2DFFB6977256B
                        SHA1:FBCEDD6BE02ECF6E6A6FBD495C7263A14576E282
                        SHA-256:9BF147DEBC32542E7DD9FECB9381222F2C2FD758E5FD0A0508136C74A345B4DE
                        SHA-512:95D67B62A26C10056968A001EEFF716CB8462CEF88EABA2466A3FE3F719F4D37650BBB2F4C6EBF44E5D2DF94AE82ABEE45A9A585D52038CC1BDE7004D4899DCF
                        Malicious:false
                        Preview:03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

                        C:\Users\user\AppData\Local\Temp\acrocef_low\13b43590-36c2-4f20-9f73-19e9d98893cb.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                        Category:dropped
                        Size (bytes):758601
                        Entropy (8bit):7.98639316555857
                        Encrypted:false
                        SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                        MD5:3A49135134665364308390AC398006F1
                        SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                        SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                        SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                        Malicious:false
                        Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                        C:\Users\user\AppData\Local\Temp\acrocef_low\2f62eeec-3781-4018-9abd-4029acd13a7b.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                        Category:dropped
                        Size (bytes):1407294
                        Entropy (8bit):7.97605879016224
                        Encrypted:false
                        SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
                        MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
                        SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
                        SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
                        SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
                        Malicious:false
                        Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                        C:\Users\user\AppData\Local\Temp\acrocef_low\60ca891c-099b-4b00-8238-15fafb97b6de.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                        Category:dropped
                        Size (bytes):1419751
                        Entropy (8bit):7.976496077007677
                        Encrypted:false
                        SSDEEP:24576:/xaWL07oFGZswYIGNPJwdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JaWLxFGZswZGM3mlind9i4ufFXpAXkru
                        MD5:E8C0E02FD4DCB83BF3EC95A987292D88
                        SHA1:B2FC5004CA22C6EE65B66AD6AF29F7EDC745A3B4
                        SHA-256:C665BF4A480724AE9C6ECB6450C3AC538DF2102B7988E25675516772687222B5
                        SHA-512:C103FE7A6FAE4B175395AA57E2052CA5125CFD05539C92F363E72C638776430154C369E34979FE84227930D5876BA50F1A538E9D05E4B38A58ECE75F8AFCFCC8
                        Malicious:false
                        Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                        C:\Users\user\AppData\Local\Temp\acrocef_low\c266be77-45e5-4f45-9494-0af74f4885e6.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                        Category:dropped
                        Size (bytes):386528
                        Entropy (8bit):7.9736851559892425
                        Encrypted:false
                        SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                        MD5:5C48B0AD2FEF800949466AE872E1F1E2
                        SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                        SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                        SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                        Malicious:false
                        Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                        Static File Info

                        General

                        File type:PDF document, version 1.7, 0 pages (zip deflate encoded)
                        Entropy (8bit):7.397751240635249
                        TrID:
                        • Adobe Portable Document Format (5005/1) 100.00%
                        File name:Invoice INV-06765.pdf
                        File size:55'552 bytes
                        MD5:6fc0a38af5eb50d380874c74ec6b19dc
                        SHA1:edf86d6f34d39b5d09041889a7d3abb7e55c9527
                        SHA256:45b3c59e3bb5e2a9b10dfddd6cf937efe93b5ef0d147e1610d0f81e5c384eb8c
                        SHA512:776e878f83a6b4f865eb049261a9422f318f301a23c6fe8fa6ad34a6b89100026372a8bfc6de0c587cebd4f42fc0f978daeca1a7fa92b8f1308005322681a6ba
                        SSDEEP:1536:PWG4gMzOj301xkUYP5JFkF35KpRsgDzkt:zFMzOTSkUYPPFkp5GWGU
                        TLSH:0543BFC8F2A6EE5CEC11DEB4705A3A1481EDF0C397CA45B775C88A8540C0A7DBEE15E6
                        File Content Preview:%PDF-1.7.%........1 0 obj.<</Version/1.7/Names 8 0 R/Outlines 2 0 R/Pages 3 0 R/Type/Catalog/Metadata 26 0 R>>.endobj.2 0 obj.<</Type/Outlines/Count 0>>.endobj.3 0 obj.<</Type/Pages/Count 1/Kids[9 0 R]>>.endobj.4 0 obj.<</ModDate(D:20240424145834+00'00)/A

                        File Icon

                        Icon Hash:62cc8caeb29e8ae0

                        Static PDF Info

                        General

                        Header:%PDF-1.7
                        Total Entropy:7.397751
                        Total Bytes:55552
                        Stream Entropy:7.383742
                        Stream Bytes:51013
                        Entropy outside Streams:5.267551
                        Bytes outside Streams:4539
                        Number of EOF found:2
                        Bytes after EOF:

                        Keywords Statistics

                        NameCount
                        obj28
                        endobj28
                        stream13
                        endstream13
                        xref2
                        trailer2
                        startxref2
                        /Page1
                        /Encrypt0
                        /ObjStm0
                        /URI0
                        /JS0
                        /JavaScript0
                        /AA0
                        /OpenAction0
                        /AcroForm0
                        /JBIG2Decode0
                        /RichMedia0
                        /Launch0
                        /EmbeddedFile0

                        Image Streams

                        IDDHASHMD5Preview
                        2000000000000000009999f3db39aa2e904fb3a4478b9c842b
                        214040003101004000ebe4230aabaf5d3752909388b4790d24
                        23000000000000000051c57068e116cfe054c2bb1a9573d1fa
                        240000000000000000fd0fcd59cfb56e6eed54283408124833

                        Network Behavior

                        Network Port Distribution

                        TCP Packets

                        TimestampSource PortDest PortSource IPDest IP
                        Apr 24, 2024 19:37:49.342853069 CEST49740443192.168.2.423.62.176.141
                        Apr 24, 2024 19:37:49.342936993 CEST4434974023.62.176.141192.168.2.4
                        Apr 24, 2024 19:37:49.343039989 CEST49740443192.168.2.423.62.176.141
                        Apr 24, 2024 19:37:49.343436956 CEST49740443192.168.2.423.62.176.141
                        Apr 24, 2024 19:37:49.343509912 CEST4434974023.62.176.141192.168.2.4
                        Apr 24, 2024 19:37:49.831453085 CEST4434974023.62.176.141192.168.2.4
                        Apr 24, 2024 19:37:49.831806898 CEST49740443192.168.2.423.62.176.141
                        Apr 24, 2024 19:37:49.831835032 CEST4434974023.62.176.141192.168.2.4
                        Apr 24, 2024 19:37:49.833514929 CEST4434974023.62.176.141192.168.2.4
                        Apr 24, 2024 19:37:49.833596945 CEST49740443192.168.2.423.62.176.141
                        Apr 24, 2024 19:37:49.836246014 CEST49740443192.168.2.423.62.176.141
                        Apr 24, 2024 19:37:49.836505890 CEST49740443192.168.2.423.62.176.141
                        Apr 24, 2024 19:37:49.836518049 CEST4434974023.62.176.141192.168.2.4
                        Apr 24, 2024 19:37:49.836570978 CEST4434974023.62.176.141192.168.2.4
                        Apr 24, 2024 19:37:49.879687071 CEST49740443192.168.2.423.62.176.141
                        Apr 24, 2024 19:37:49.879741907 CEST4434974023.62.176.141192.168.2.4
                        Apr 24, 2024 19:37:49.926609993 CEST49740443192.168.2.423.62.176.141
                        Apr 24, 2024 19:37:50.101921082 CEST4434974023.62.176.141192.168.2.4
                        Apr 24, 2024 19:37:50.102011919 CEST4434974023.62.176.141192.168.2.4
                        Apr 24, 2024 19:37:50.102202892 CEST49740443192.168.2.423.62.176.141
                        Apr 24, 2024 19:37:50.102710009 CEST49740443192.168.2.423.62.176.141
                        Apr 24, 2024 19:37:50.102771044 CEST4434974023.62.176.141192.168.2.4

                        HTTP Request Dependency Graph

                        • armmf.adobe.com

                        HTTPS Proxied Packets

                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                        0192.168.2.44974023.62.176.1414437616C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        TimestampBytes transferredDirectionData
                        2024-04-24 17:37:49 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
                        Host: armmf.adobe.com
                        Connection: keep-alive
                        Accept-Language: en-US,en;q=0.9
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
                        Sec-Fetch-Site: same-origin
                        Sec-Fetch-Mode: no-cors
                        Sec-Fetch-Dest: empty
                        Accept-Encoding: gzip, deflate, br
                        If-None-Match: "78-5faa31cce96da"
                        If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
                        2024-04-24 17:37:50 UTC198INHTTP/1.1 304 Not Modified
                        Content-Type: text/plain; charset=UTF-8
                        Last-Modified: Mon, 01 May 2023 15:02:33 GMT
                        ETag: "78-5faa31cce96da"
                        Date: Wed, 24 Apr 2024 17:37:50 GMT
                        Connection: close


                        Statistics

                        CPU Usage

                        Click to jump to process

                        Memory Usage

                        Click to jump to process

                        High Level Behavior Distribution

                        Click to dive into process behavior distribution

                        Behavior

                        Click to jump to process

                        System Behavior

                        General

                        Target ID:0
                        Start time:19:37:35
                        Start date:24/04/2024
                        Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        Wow64 process (32bit):false
                        Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Invoice INV-06765.pdf"
                        Imagebase:0x7ff6bc1b0000
                        File size:5'641'176 bytes
                        MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:moderate
                        Has exited:true

                        General

                        Target ID:1
                        Start time:19:37:35
                        Start date:24/04/2024
                        Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        Wow64 process (32bit):false
                        Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                        Imagebase:0x7ff74bb60000
                        File size:3'581'912 bytes
                        MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:moderate
                        Has exited:true

                        General

                        Target ID:3
                        Start time:19:37:36
                        Start date:24/04/2024
                        Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        Wow64 process (32bit):false
                        Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2064 --field-trial-handle=1668,i,16263588452798232946,7047895391847360399,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                        Imagebase:0x7ff74bb60000
                        File size:3'581'912 bytes
                        MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:moderate
                        Has exited:true

                        Disassembly

                        ⊘No disassembly