Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Seminole Casino - 2023 DJI Invoice.pdf

Overview

General Information

Sample name:Seminole Casino - 2023 DJI Invoice.pdf
Analysis ID:1447358
MD5:778252f7dedae0b7954cd30f24e22f20
SHA1:d020f2a610f12d927b710ba17ebadc1b2538b417
SHA256:7453ff20e6036ede9dacaf3f77ebe51ba7665b5b5c520d59795d25c882886dc8
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 2836 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Seminole Casino - 2023 DJI Invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 5272 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 4904 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1732,i,17598775364771508779,3560289457606651016,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficTCP traffic: 192.168.2.6:49711 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49711 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49712 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49712 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49711 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49712 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49711 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49712 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49712 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49711 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49712 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49711 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49712 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49711 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49712 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49712 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49711 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49711 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49712 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49712 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49711 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49711 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49711 -> 23.47.168.24:443
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.6:49711
Source: global trafficTCP traffic: 192.168.2.6:49711 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49712 -> 23.47.168.24:443
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.6:49712
Source: global trafficTCP traffic: 192.168.2.6:49712 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49711 -> 23.47.168.24:443
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.6:49711
Source: global trafficTCP traffic: 192.168.2.6:49712 -> 23.47.168.24:443
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.6:49712
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.6:49711
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.6:49712
Source: global trafficTCP traffic: 192.168.2.6:49711 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49712 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49712 -> 23.47.168.24:443
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.6:49712
Source: global trafficTCP traffic: 192.168.2.6:49711 -> 23.47.168.24:443
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.6:49711
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.6:49712
Source: global trafficTCP traffic: 192.168.2.6:49712 -> 23.47.168.24:443
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.6:49711
Source: global trafficTCP traffic: 192.168.2.6:49711 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49712 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49711 -> 23.47.168.24:443
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.6:49712
Source: global trafficTCP traffic: 192.168.2.6:49712 -> 23.47.168.24:443
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.6:49712
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.6:49711
Source: global trafficTCP traffic: 192.168.2.6:49712 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49711 -> 23.47.168.24:443
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.6:49711
Source: global trafficTCP traffic: 192.168.2.6:49711 -> 23.47.168.24:443
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.6:49712
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.6:49712
Source: global trafficTCP traffic: 192.168.2.6:49712 -> 23.47.168.24:443
Source: global trafficTCP traffic: 192.168.2.6:49712 -> 23.47.168.24:443
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.6:49712
Source: global trafficTCP traffic: 192.168.2.6:49711 -> 23.47.168.24:443
Source: global trafficTCP traffic: 23.47.168.24:443 -> 192.168.2.6:49711
Source: global trafficTCP traffic: 192.168.2.6:49711 -> 23.47.168.24:443
Source: Joe Sandbox ViewIP Address: 23.47.168.24 23.47.168.24
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.2.drString found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.drString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: classification engineClassification label: clean2.winPDF@14/47@0/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.992Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-05-24 15-42-51-357.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Seminole Casino - 2023 DJI Invoice.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1732,i,17598775364771508779,3560289457606651016,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1732,i,17598775364771508779,3560289457606651016,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: Seminole Casino - 2023 DJI Invoice.pdfInitial sample: PDF keyword /JS count = 0
Source: Seminole Casino - 2023 DJI Invoice.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: Seminole Casino - 2023 DJI Invoice.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive12
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1447358 Sample: Seminole Casino - 2023 DJI ... Startdate: 24/05/2024 Architecture: WINDOWS Score: 2 6 Acrobat.exe 18 70 2->6         started        process3 8 AcroCEF.exe 105 6->8         started        process4 10 AcroCEF.exe 2 8->10         started        dnsIp5 13 23.47.168.24, 443, 49711, 49712 AKAMAI-ASUS United States 10->13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
bg.microsoft.map.fastly.net
199.232.214.172
truefalse
    		unknown

    World Map of Contacted IPs

    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs

    Public IPs

    IPDomainCountryFlagASNASN NameMalicious
    23.47.168.24
    		unknownUnited States
    		16625AKAMAI-ASUSfalse

    General Information

    Joe Sandbox version:40.0.0 Tourmaline
    Analysis ID:1447358
    Start date and time:2024-05-24 21:41:58 +02:00
    Joe Sandbox product:CloudBasic
    Overall analysis duration:0h 4m 8s
    Hypervisor based Inspection enabled:false
    Report type:full
    Cookbook file name:defaultwindowspdfcookbook.jbs
    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
    Number of analysed new started processes analysed:12
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • EGA enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:Timeout
    Sample name:Seminole Casino - 2023 DJI Invoice.pdf
    Detection:CLEAN
    Classification:clean2.winPDF@14/47@0/1
    Cookbook Comments:
    • Found application associated with file extension: .pdf
    • Found PDF document
    • Close Viewer

    Warnings

    • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
    • Excluded IPs from analysis (whitelisted): 184.28.88.176, 23.22.254.206, 52.5.13.197, 52.202.204.11, 54.227.187.23, 172.64.41.3, 162.159.61.3, 88.221.110.120, 88.221.110.59, 2.16.100.176, 2.16.202.123, 95.101.54.195, 199.232.214.172
    • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, identrust.edgesuite.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, a1952.dscq.akamai.net, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com, apps.identrust.com, wu-b-net.trafficmanager.net
    • VT rate limit hit for: Seminole Casino - 2023 DJI Invoice.pdf

    Simulations

    Behavior and APIs

    TimeTypeDescription
    15:43:01API Interceptor2x Sleep call for process: AcroCEF.exe modified

    LLM Input / Output

    InputOutput
    URL: PDF Model: gpt-4o
    ```json
{
  "riskscore": 2,
  "reasons": "The PDF appears to be a legitimate invoice from a known foundation. The email address provided (Events@turn2foundation.org) seems to be consistent with the organization's domain. However, there is always a minimal risk of phishing, especially if the email address is spoofed or if the PDF was received unexpectedly. Users should verify the authenticity of the invoice by contacting the foundation directly using known contact information."
}

    Joe Sandbox View / Context

    IPs

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    23.47.168.24phish_alert_iocp_v1.4.48 (2).emlGet hashmaliciousCaptcha Phish, HTMLPhisherBrowse
      Job Description (LM HR Division II).pdf .scr.exeGet hashmaliciousUnknownBrowse
        Offer 15492024 15602024.docx.docGet hashmaliciousUnknownBrowse
          PIO88938MB.docx.docGet hashmaliciousUnknownBrowse
            http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdfGet hashmaliciousUnknownBrowse
              http://6.imimg.com/data6/Rfq/2024/3/404696953/HX/AW/IV/217882449/square-breathing-pdf.pdfGet hashmaliciousUnknownBrowse
                phish_alert_iocp_v1.4.48 (23).emlGet hashmaliciousHTMLPhisherBrowse
                  https://app.nihaocloud.com/f/bf027d5695e84bac920c/Get hashmaliciousUnknownBrowse
                    MDE_File_Sample_f29ce0d93859cca71356213c6e187a644debf0c9.zipGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
                      https://docvmentdrive.au1.cdn-alpha.com/wordplusnero/Payment.pdfGet hashmaliciousUnknownBrowse

                        Domains

                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        bg.microsoft.map.fastly.netNFs_468.msiGet hashmaliciousVMdetectBrowse
                        • 199.232.214.172
                        https://pgbhs-my.sharepoint.com/:o:/p/slancaster/EuHa5N_a49ZGmoDysHv3FRUBv4_n5owuRcmYk_hWT4x3Wg?e=5%3aaSN98j&at=9Get hashmaliciousHTMLPhisherBrowse
                        • 199.232.214.172
                        https://vc.newsletter-vcapital.com/preipo/Get hashmaliciousUnknownBrowse
                        • 199.232.210.172
                        SecuriteInfo.com.Variant.Lazy.448806.8704.4188.dllGet hashmaliciousUnknownBrowse
                        • 199.232.214.172
                        http://twomancake.comGet hashmaliciousUnknownBrowse
                        • 199.232.214.172
                        https://velocity-fun-2217.my.salesforce.com/sfc/p/QH000002usKl/a/QH0000002nEL/LTOT56SDzrUp.yFyeUs.72X20B9VMYmnaeC6PCTUZvsGet hashmaliciousHTMLPhisherBrowse
                        • 199.232.214.172
                        REF0000QWERT544FILE.vbeGet hashmaliciousAgentTeslaBrowse
                        • 199.232.210.172
                        https://rb.gy/jvrhq5Get hashmaliciousUnknownBrowse
                        • 199.232.214.172
                        https://google.de/amp/s/server1404398.netart.com/wordpress/wpn_pierwszainstalacja/n1/nice2Get hashmaliciousHTMLPhisherBrowse
                        • 199.232.214.172
                        B8Zt27YJRD.exeGet hashmaliciousLummaC, RisePro StealerBrowse
                        • 199.232.210.172

                        ASNs

                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        AKAMAI-ASUSfile.exeGet hashmaliciousVidarBrowse
                        • 104.102.42.29
                        mQPyKe8cqn.exeGet hashmaliciousVidarBrowse
                        • 104.102.42.29
                        6T1S0q3QLa.elfGet hashmaliciousMiraiBrowse
                        • 88.221.138.6
                        hs1vfUvu3u.elfGet hashmaliciousMiraiBrowse
                        • 104.116.165.103
                        phish_alert_iocp_v1.4.48 (2).emlGet hashmaliciousCaptcha Phish, HTMLPhisherBrowse
                        • 23.47.168.24
                        file.exeGet hashmaliciousVidarBrowse
                        • 104.102.42.29
                        Quarantined Messages(1).zipGet hashmaliciousHTMLPhisherBrowse
                        • 23.50.131.146
                        https://www.brownfieldagnews.com/news/Get hashmaliciousUnknownBrowse
                        • 23.208.148.134
                        SecuriteInfo.com.Win32.Malware-gen.198.6512.exeGet hashmaliciousPureLog Stealer, VidarBrowse
                        • 23.199.218.33
                        BI6oo9z4In.exeGet hashmaliciousCryptOne, Djvu, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro StealerBrowse
                        • 104.102.42.29

                        JA3 Fingerprints

                        ⊘No context

                        Dropped Files

                        ⊘No context

                        Created / dropped Files

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):295
                        Entropy (8bit):5.185331383199297
                        Encrypted:false
                        SSDEEP:6:DXq6mN4q2PN72nKuAl9OmbnIFUt86XqnJZmw+6XqnDkwON72nKuAl9OmbjLJ:D66mOvVaHAahFUt866J/+66D5OaHAaSJ
                        MD5:7B99B0F37361CBE5CF18621509560619
                        SHA1:87A9CA9C464CB104DFE766FD57F01036CE41A560
                        SHA-256:A55E011C488846794759D673A9BAD06763C9CC088E2D66CB1EDEA9EC2438A5E4
                        SHA-512:C87EDFE2FCFD10AD8ED1D0B14DE1FE4BE05E1BF7AB892F5070D2FBADAB8B781EE5C6319768FB19FB747C0039514097BD3B5D514378E787613DA513C960E6F76E
                        Malicious:false
                        Reputation:low
                        Preview:2024/05/24-15:42:49.480 c70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/05/24-15:42:49.482 c70 Recovering log #3.2024/05/24-15:42:49.482 c70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):295
                        Entropy (8bit):5.185331383199297
                        Encrypted:false
                        SSDEEP:6:DXq6mN4q2PN72nKuAl9OmbnIFUt86XqnJZmw+6XqnDkwON72nKuAl9OmbjLJ:D66mOvVaHAahFUt866J/+66D5OaHAaSJ
                        MD5:7B99B0F37361CBE5CF18621509560619
                        SHA1:87A9CA9C464CB104DFE766FD57F01036CE41A560
                        SHA-256:A55E011C488846794759D673A9BAD06763C9CC088E2D66CB1EDEA9EC2438A5E4
                        SHA-512:C87EDFE2FCFD10AD8ED1D0B14DE1FE4BE05E1BF7AB892F5070D2FBADAB8B781EE5C6319768FB19FB747C0039514097BD3B5D514378E787613DA513C960E6F76E
                        Malicious:false
                        Reputation:low
                        Preview:2024/05/24-15:42:49.480 c70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/05/24-15:42:49.482 c70 Recovering log #3.2024/05/24-15:42:49.482 c70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):339
                        Entropy (8bit):5.142195377537517
                        Encrypted:false
                        SSDEEP:6:DXqC1yq2PN72nKuAl9Ombzo2jMGIFUt86Xq8j1Zmw+6XqIMlRkwON72nKuAl9OmT:D6C1yvVaHAa8uFUt8668J/+66IQR5Oag
                        MD5:3C9846DFC18E8371806424AECF20245E
                        SHA1:63F0D0D0A774707F45C290B91DC173388D696964
                        SHA-256:08563C2FD32B004C9BB8D4A67638E9328223E187C9D40502C843E4766482E929
                        SHA-512:B51AA9841104ED34EA09A77F6FAB6D616BE66695B51AFEAD3CA9FE388830EA53B45DF356FAECFCF19CBBDD5F557234BEC1F1B83CDA8583CEDF814ABB537FD1C3
                        Malicious:false
                        Reputation:low
                        Preview:2024/05/24-15:42:49.550 d90 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/05/24-15:42:49.552 d90 Recovering log #3.2024/05/24-15:42:49.553 d90 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):339
                        Entropy (8bit):5.142195377537517
                        Encrypted:false
                        SSDEEP:6:DXqC1yq2PN72nKuAl9Ombzo2jMGIFUt86Xq8j1Zmw+6XqIMlRkwON72nKuAl9OmT:D6C1yvVaHAa8uFUt8668J/+66IQR5Oag
                        MD5:3C9846DFC18E8371806424AECF20245E
                        SHA1:63F0D0D0A774707F45C290B91DC173388D696964
                        SHA-256:08563C2FD32B004C9BB8D4A67638E9328223E187C9D40502C843E4766482E929
                        SHA-512:B51AA9841104ED34EA09A77F6FAB6D616BE66695B51AFEAD3CA9FE388830EA53B45DF356FAECFCF19CBBDD5F557234BEC1F1B83CDA8583CEDF814ABB537FD1C3
                        Malicious:false
                        Reputation:low
                        Preview:2024/05/24-15:42:49.550 d90 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/05/24-15:42:49.552 d90 Recovering log #3.2024/05/24-15:42:49.553 d90 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8ad11e5a-0ee4-4f63-be33-647c357b6ad1.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:JSON data
                        Category:modified
                        Size (bytes):475
                        Entropy (8bit):4.9538772718856245
                        Encrypted:false
                        SSDEEP:12:YH/um3RA8sqRHWsBdOg2Hxfcaq3QYiubcP7E4T3y:Y2sRdss7dMHxu3QYhbA7nby
                        MD5:C840C9AC51828AF4CC4A922E3D809E46
                        SHA1:C476655287B7B3E1C6395A4FA7C7D9E04404A672
                        SHA-256:460C4452D8380E9B0A94D4DE851CC1D728132BE32064340E6D556EE2525AA39E
                        SHA-512:26296F3F738197A2709C899B6F55F5A464E2A641ABD69B484D367F91E0AB409596B06453E8FB586C7EB8C31818A181677F83D46420708C2C5D7D8926987C27D5
                        Malicious:false
                        Reputation:low
                        Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13361139781744433","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":142282},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):475
                        Entropy (8bit):4.9538772718856245
                        Encrypted:false
                        SSDEEP:12:YH/um3RA8sqRHWsBdOg2Hxfcaq3QYiubcP7E4T3y:Y2sRdss7dMHxu3QYhbA7nby
                        MD5:C840C9AC51828AF4CC4A922E3D809E46
                        SHA1:C476655287B7B3E1C6395A4FA7C7D9E04404A672
                        SHA-256:460C4452D8380E9B0A94D4DE851CC1D728132BE32064340E6D556EE2525AA39E
                        SHA-512:26296F3F738197A2709C899B6F55F5A464E2A641ABD69B484D367F91E0AB409596B06453E8FB586C7EB8C31818A181677F83D46420708C2C5D7D8926987C27D5
                        Malicious:false
                        Reputation:low
                        Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13361139781744433","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":142282},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):5859
                        Entropy (8bit):5.2486060233948395
                        Encrypted:false
                        SSDEEP:96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7zA/2v:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhv
                        MD5:1EDE1B07BF01DFC6DFD408FC1464E997
                        SHA1:DB9672EB041715EA037FF05BA6A059909D203783
                        SHA-256:C05FF6E55162B50BD127324776E0898FAFCC0E6C37715BD8ADEFCAE4CA174951
                        SHA-512:BD25DB92E4852FCC53937B822C5D47C2B492B6F587FCD2F1F067234B2C77BF82238E98018885C51B0F9FDB64D5E42939FAE770BCBA85F1582103ADCC05CA582D
                        Malicious:false
                        Reputation:low
                        Preview:*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):327
                        Entropy (8bit):5.192799582809804
                        Encrypted:false
                        SSDEEP:6:DXq21yq2PN72nKuAl9OmbzNMxIFUt86Xqg1Zmw+6Xq9jRkwON72nKuAl9OmbzNMT:D621yvVaHAa8jFUt866O/+669jR5OaHP
                        MD5:5309D8A37C7B1CD234A3C1B23593F764
                        SHA1:65A501C78CFE603D6F025BB84BBF6B32604267DD
                        SHA-256:69EF2795D7B8D65773805F3C52D7E379CB6B7F7F61F3D60CDDA8E627D85B9873
                        SHA-512:A16C4C786471B0A3B88AB38573B140E320AA0BFA91BD92DCC8F1EEB0073A8676A8EAA961DA4B4FAD4AE561706F360D55E6537CBEB447B2579D4C41CEDC687B10
                        Malicious:false
                        Reputation:low
                        Preview:2024/05/24-15:42:49.752 d90 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/05/24-15:42:49.754 d90 Recovering log #3.2024/05/24-15:42:49.766 d90 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:ASCII text
                        Category:dropped
                        Size (bytes):327
                        Entropy (8bit):5.192799582809804
                        Encrypted:false
                        SSDEEP:6:DXq21yq2PN72nKuAl9OmbzNMxIFUt86Xqg1Zmw+6Xq9jRkwON72nKuAl9OmbzNMT:D621yvVaHAa8jFUt866O/+669jR5OaHP
                        MD5:5309D8A37C7B1CD234A3C1B23593F764
                        SHA1:65A501C78CFE603D6F025BB84BBF6B32604267DD
                        SHA-256:69EF2795D7B8D65773805F3C52D7E379CB6B7F7F61F3D60CDDA8E627D85B9873
                        SHA-512:A16C4C786471B0A3B88AB38573B140E320AA0BFA91BD92DCC8F1EEB0073A8676A8EAA961DA4B4FAD4AE561706F360D55E6537CBEB447B2579D4C41CEDC687B10
                        Malicious:false
                        Reputation:low
                        Preview:2024/05/24-15:42:49.752 d90 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/05/24-15:42:49.754 d90 Recovering log #3.2024/05/24-15:42:49.766 d90 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                        C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240524194253Z-155.bmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
                        Category:dropped
                        Size (bytes):71190
                        Entropy (8bit):1.6404651398837147
                        Encrypted:false
                        SSDEEP:192:+DewsWzzFem+oGXkFtGx0bZLPJ96TTTHq0j3y3AXjUvs3RTnm63Mq:Q3z/dGXkvGx0bZjJ96TTTHqwy3AXjGsz
                        MD5:C3B16464E1EBB1F3A68C59E385F536D0
                        SHA1:6980576D63EEAC8CA72AAA79E440E5A9C9314692
                        SHA-256:C8A4E57C6736CACE1A9C5BACDAB977A2BC47CCB11D2E71F707D47867D03F66F1
                        SHA-512:CC84C31E9292FAF327C1D130468C25AECA6FADD4130CDF5E440ECDA2D800FAC6C93CBEECEF15313B7F08B8E339354D63B0D78BFDE0AF88F28F56EFAC576FC843
                        Malicious:false
                        Reputation:low
                        Preview:BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
                        Category:dropped
                        Size (bytes):86016
                        Entropy (8bit):4.44491292466675
                        Encrypted:false
                        SSDEEP:384:ye6ci5tliBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mOs3OazzU89UTTgUL
                        MD5:7544B72F9A468EDFBC1FE7C3B2481E7D
                        SHA1:7A5CF95E1A4750E9DE40C7116D855AE383A41344
                        SHA-256:0B176AB52397DD68CC9304C266BD263857AFC5A75465823D606737120B56E4B8
                        SHA-512:B1D5CC3CEA7F44978B97D2587B1D56EBE6E2F0BB61299BF4CC21B1C1E55D7FACC2BB094E3B828D70D14207C716F539F2795E4FB795360A199E9416CAEA6C69C2
                        Malicious:false
                        Reputation:low
                        Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:SQLite Rollback Journal
                        Category:dropped
                        Size (bytes):8720
                        Entropy (8bit):3.7678828004670346
                        Encrypted:false
                        SSDEEP:48:7MbJioyVEtioyJWoy1C7oy16oy1XsKOioy1noy1AYoy1Wioy1oioykioyBoy1no3:7QJuEtgP2AXjBikb9IVXEBodRBkV
                        MD5:5087260674364661117AEEA8D7CD0FD3
                        SHA1:FEFBC8D8ADA0A78B467D23435D5D7D17C12C0AC6
                        SHA-256:7C355D8E0C72406A6ACF820C4223C552390604090196DA11F6075643C6D38017
                        SHA-512:ED9D4526575C243E95BA33D2A9B54460234218FD87C14C00D6038557C2FC55F6CF37019743807D39CF239DFFE68FDF1EB16F4BDADEF818E286FFBBB8650303D1
                        Malicious:false
                        Preview:.... .c.......Y................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 69993 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                        Category:dropped
                        Size (bytes):69993
                        Entropy (8bit):7.99584879649948
                        Encrypted:true
                        SSDEEP:1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
                        MD5:29F65BA8E88C063813CC50A4EA544E93
                        SHA1:05A7040D5C127E68C25D81CC51271FFB8BEF3568
                        SHA-256:1ED81FA8DFB6999A9FEDC6E779138FFD99568992E22D300ACD181A6D2C8DE184
                        SHA-512:E29B2E92C496245BED3372578074407E8EF8882906CE10C35B3C8DEEBFEFE01B5FD7F3030ACAA693E175F4B7ACA6CD7D8D10AE1C731B09C5FA19035E005DE3AA
                        Malicious:false
                        Preview:MSCF....i.......,...................I.................oXAy .authroot.stl.Ez..Q6..CK..<Tk...p.k..1...3...[..%Y.f..."K.6)..[*I.hOB."..rK.RQ*..}f..f...}....9.|.....gA...30.,O2L...0..%.U...U.t.....`dqM2.x..t...<(uad.c...x5V.x..t..agd.v......i...KD..q(. ...JJ......#..'=. ...3.x...}...+T.K..!.'.`w .!.x.r.......YafhG..O.3....'P[..'.D../....n..t....R<..=\E7L0?{..T.f...ID...,...r....3z..O/.b.Iwx.. .o...a\.s........."..'.......<;s.[...l...6.)ll..B.P.....k.... k0.".t!/.,........{...P8....B..0(.. .Q.....d...q,\.$.n.Q.\.p...R..:.hr./..8.S<a.s...+#3....D..h1.a.0....{.9.....:e.......n.~G.{.M.1..OU.....B.Q..y_>.P{...}i.=.a..QQT.U..|!.pyCD@.....l..70..w..)...W^.`l...%Y.\................i..=hYV.O8W@P.=.r.=..1m..1....)\.p..|.c.3..t..[...).....l.{.Y....\S.....y....[.mCt....Js;...H....Q..F.....g.O...[..A.=...F[..z....k...mo.lW{`....O...T.g.Y.Uh.;m.'.N..f..}4..9i..t4p_bI..`.....Ie..l.P.... ...Lg......[....5g...~D.s.h'>n.m.c.7...-..P.gG...i$...v.m.b[.yO.P/*.YH.

                        C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):893
                        Entropy (8bit):7.366016576663508
                        Encrypted:false
                        SSDEEP:24:hBntmDvKUQQDvKUr7C5fpqp8gPvXHmXvponXux:3ntmD5QQD5XC5RqHHXmXvp++x
                        MD5:D4AE187B4574036C2D76B6DF8A8C1A30
                        SHA1:B06F409FA14BAB33CBAF4A37811B8740B624D9E5
                        SHA-256:A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
                        SHA-512:1F44A360E8BB8ADA22BC5BFE001F1BABB4E72005A46BC2A94C33C4BD149FF256CCE6F35D65CA4F7FC2A5B9E15494155449830D2809C8CF218D0B9196EC646B0C
                        Malicious:false
                        Preview:0..y..*.H.........j0..f...1.0...*.H.........N0..J0..2.......D....'..09...@k0...*.H........0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30...000930211219Z..210930140115Z0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30.."0...*.H.............0..........P..W..be......,k0.[...}.@......3vI*.?!I..N..>H.e...!.e.*.2....w..{........s.z..2..~..0....*8.y.1.P..e.Qc...a.Ka..Rk...K.(.H......>.... .[.*....p....%.tr.{j.4.0...h.{T....Z...=d.....Ap..r.&.8U9C....\@........%.......:..n.>..\..<.i....*.)W..=....]......B0@0...U.......0....0...U...........0...U.........{,q...K.u...`...0...*.H...............,...\...(f7:...?K.... ]..YD.>.>..K.t.....t..~.....K. D....}..j.....N..:.pI...........:^H...X._..Z.....Y..n......f3.Y[...sG.+..7H..VK....r2...D.SrmC.&H.Rg.X..gvqx...V..9$1....Z0G..P.......dc`........}...=2.e..|.Wv..(9..e...w.j..w.......)...55.1.

                        C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:data
                        Category:modified
                        Size (bytes):330
                        Entropy (8bit):3.2300565441917586
                        Encrypted:false
                        SSDEEP:6:kK07kVlEN+SkQlPlEGYRMY9z+4KlDA3RUeVlWI/Vt:uSlbkPlE99SNxAhUeVLVt
                        MD5:A7CA1465C6F24FDA9CB2125F200E01EA
                        SHA1:5E8EE5C0F0CEAE52044FC3B877C9DA7287379AAD
                        SHA-256:DF3A3F3646A93159EA59E09E824C89367EAB124A95DC386D235855885F1979C7
                        SHA-512:093F1D8CAEC7FB2ED8ACB0B971CB2C78C4A08998A12C4213786CD37C998DCB3497330E643C2B3852EF04FBB4B515563D18ADFD8377E6F0D31FECAB324EA9DE92
                        Malicious:false
                        Preview:p...... ...............(....................................................... ........M.........(.....wl....i...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".b.3.6.8.5.3.8.5.a.4.7.f.d.a.1.:.0."...

                        C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):252
                        Entropy (8bit):3.034404395079139
                        Encrypted:false
                        SSDEEP:3:kkFklSttfllXlE/E/KRkzllPlzRkwWBARLNDU+ZMlKlBkvclcMlVHblB8V7lnklc:kKLzxliBAIdQZV7I7kc3
                        MD5:8FDF21CF3461C6C41356C7204EFB2E61
                        SHA1:2C064E2C8C9C5C0A6EF2B3387369BBB37EDD9B5D
                        SHA-256:91CE075A5EC178D7B51260920D78D056D11544CB6C2A9B3224FF4D267493C604
                        SHA-512:1AEF05C99B9B5BFCD564D88DD0436A7E3D1AA11815FD2DCD8E63D9868121B304AE2978132C8C76664BF8C5ED409518D1E2773CD2BFBF01939275E29B15B4ECEA
                        Malicious:false
                        Preview:p...... ....`...........(....................................................... ........!.M........(...........}...h.t.t.p.:././.a.p.p.s...i.d.e.n.t.r.u.s.t...c.o.m./.r.o.o.t.s./.d.s.t.r.o.o.t.c.a.x.3...p.7.c...".3.7.d.-.6.0.7.9.b.8.c.0.9.2.9.c.0."...

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.992

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:PostScript document text
                        Category:dropped
                        Size (bytes):185099
                        Entropy (8bit):5.182478651346149
                        Encrypted:false
                        SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                        MD5:94185C5850C26B3C6FC24ABC385CDA58
                        SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                        SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                        SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                        Malicious:false
                        Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:PostScript document text
                        Category:dropped
                        Size (bytes):185099
                        Entropy (8bit):5.182478651346149
                        Encrypted:false
                        SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                        MD5:94185C5850C26B3C6FC24ABC385CDA58
                        SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                        SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                        SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                        Malicious:false
                        Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):227002
                        Entropy (8bit):3.392780893644728
                        Encrypted:false
                        SSDEEP:1536:qKPC4iyzDtrh1cK3XEivK7VK/3AYvYwgF/rRoL+sn:XPCaJ/3AYvYwglFoL+sn
                        MD5:265E3E1166312A864FB63291EA661C6A
                        SHA1:80DFF3187FF929596EB22E1DB9021BAD6F97178C
                        SHA-256:C13E08B1887A4E44DC39609D7234E8D732A6BC11313B55D6F4ECFB060CD87728
                        SHA-512:48776A2BFE8F25E5601DCC0137F7AB103D5684517334B806E3ACF61683DD9B283828475FC85CE0CBE4E8AF88E6F8B25EED0A77640E2CFFF2CC73708726519AFA
                        Malicious:false
                        Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):295
                        Entropy (8bit):5.362053405593646
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXF0GgsWnWn0nZiQ0YtqoAvJM3g98kUwPeUkwRe9:YvXKXFosWni0ccGMbLUkee9
                        MD5:7B38614BAD062B07DE4F676A983F3A43
                        SHA1:BADACC60431BD94DCCDF8606207D10124086295C
                        SHA-256:D8501868B4F959A4D7B1BCA3AF94A3710088CA4DD6F1017716DE23323F395B61
                        SHA-512:C4953E59B2B6D7559DD73979A9F5908398C70042BC3198A48D05F12C6A62F144ED1003CDFEE8B50DC021C384FEA1A4704620308D324093D4986A59A78289E1C2
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"2d5fc314-5993-4818-9b80-c84ce01c6d7f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1716756505154,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):294
                        Entropy (8bit):5.314874637743992
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXF0GgsWnWn0nZiQ0YtqoAvJfBoTfXpnrPeUkwRe9:YvXKXFosWni0ccGWTfXcUkee9
                        MD5:E214DAC54009FD01BBB26D9D5B839FCA
                        SHA1:51EF3D4E763170DA8F3686914ACF4EEB88ACE968
                        SHA-256:94D615EC68B1EADFD6FF0D5BBD1DABE09667D6F0FF2FCFBD17CE7F75AE0CD3AE
                        SHA-512:7E4975808D11C22D7F0ABEA9F9D8E3061760683DB7B4F602F9076F631E558E278672C32541A17D1D78BE7186A00083BA503BC638572A3D1C115AB6F879F41AB0
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"2d5fc314-5993-4818-9b80-c84ce01c6d7f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1716756505154,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):294
                        Entropy (8bit):5.2923468869476205
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXF0GgsWnWn0nZiQ0YtqoAvJfBD2G6UpnrPeUkwRe9:YvXKXFosWni0ccGR22cUkee9
                        MD5:C3C560A7668C20EB16D4B9F21B118410
                        SHA1:DE2736607B24B4F8E1E48C48DAAE4EBD126B877D
                        SHA-256:5F11B1D6D3AD379334DCC73C4F3E79D5B89F1A1B67652122C6F73B7BA35B05BF
                        SHA-512:DC48AA9858FDB105B28E021B02E8B562368DD660C90D3CF96A78DC0D7E03DA08A2815FF18F2A9F746360FCC8C9F9EF79DCD6FF5E4FD753EF3912A789AB367BEC
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"2d5fc314-5993-4818-9b80-c84ce01c6d7f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1716756505154,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):285
                        Entropy (8bit):5.342030017021669
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXF0GgsWnWn0nZiQ0YtqoAvJfPmwrPeUkwRe9:YvXKXFosWni0ccGH56Ukee9
                        MD5:79722DE41AB6F5DE527B39D6556C4D59
                        SHA1:7AA9087D6A0F0F8268925DD3D67669E302045B36
                        SHA-256:9F94C2186900F391692C8A58B3CE38C05A5819E1012BE4C8E90C991EB7093F0A
                        SHA-512:A1904E3F151E5D53AC61F5951B302BD06AF9B52F95A00C6D234EA92276CE682EAE2632F3047AC2C2856D09E81372BDFFB648C26B39DAD1AF86EF3DDCDDD707D7
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"2d5fc314-5993-4818-9b80-c84ce01c6d7f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1716756505154,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):292
                        Entropy (8bit):5.3092413489342345
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXF0GgsWnWn0nZiQ0YtqoAvJfJWCtMdPeUkwRe9:YvXKXFosWni0ccGBS8Ukee9
                        MD5:839F5FD319BC3AE83C858DA3FD56CCCA
                        SHA1:07B09CBB1DEEC8DFDECB96FB1E95966154EA234B
                        SHA-256:C0B013298F44DCFEB5F3BC8FE77C390E87EB94FB6775693334A0C9C4420F83C2
                        SHA-512:435170CAEC7D5B5E52EE0D0AB0E8DDB80651EC6906B0CD3B893F1A0EE39494DBF06C29C34FD9D91DF512BB59F1F43C735177CDB3824E5BCCE2A166EDE3A475C9
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"2d5fc314-5993-4818-9b80-c84ce01c6d7f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1716756505154,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):289
                        Entropy (8bit):5.2925123503395985
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXF0GgsWnWn0nZiQ0YtqoAvJf8dPeUkwRe9:YvXKXFosWni0ccGU8Ukee9
                        MD5:3B29E831CDB9E21EDD22CAC524EAD343
                        SHA1:0905F954DE170D9F58D9098D31C7D58180DDD921
                        SHA-256:008DEE51D54DA55CE521994D9475FEB6F5FEB7DEEA4DF7C873D80E10E3A1B310
                        SHA-512:66DE46BF8F64D8AB7946BF3C8A1690CDC334893D90B5ED7D18E67EFCF5656E4BD5A6BCDA7EA92C432B455D64B37778AB631A30B29E60DDE81BD219E839DB9E6F
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"2d5fc314-5993-4818-9b80-c84ce01c6d7f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1716756505154,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):292
                        Entropy (8bit):5.294893705552621
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXF0GgsWnWn0nZiQ0YtqoAvJfQ1rPeUkwRe9:YvXKXFosWni0ccGY16Ukee9
                        MD5:F40AB42DD3F6E1422BE9E980BAB8A712
                        SHA1:7FE2030707BCE0EAEC3D1ECF0688404A3F700D64
                        SHA-256:F2F95A95C4D6FE53B6BEB2EBD1008412ABED02B5C5E466F7E6D1AACD6E4623CA
                        SHA-512:F8E4018D807446812A1FE116812B7ED03D892D45A1F9234C397660B470DA508CAE438FC026961BBF342058C5F3F09C89C7D9387EBB5DF47CDFF3C43C6C81A530
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"2d5fc314-5993-4818-9b80-c84ce01c6d7f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1716756505154,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):289
                        Entropy (8bit):5.303867821460468
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXF0GgsWnWn0nZiQ0YtqoAvJfFldPeUkwRe9:YvXKXFosWni0ccGz8Ukee9
                        MD5:76BA4F1ABE796D1A2AAD24CF2E419FEF
                        SHA1:A93E49FA8E3BA70ECBCE53093E80E58BC6E6EDF4
                        SHA-256:F66B9DC03395C80F0BF5496F08519C922F21B5274D8934F2BFBAD96C5F850CD8
                        SHA-512:764BA28EBC57112372CB53E192BE3B671E0AB78A70DD1B97DDE5021D3F10379B8B4CFFAE1944A72802472F7C1A2D7D8249318F1A04F25FF8A989441C96619643
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"2d5fc314-5993-4818-9b80-c84ce01c6d7f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1716756505154,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):1372
                        Entropy (8bit):5.741936794928705
                        Encrypted:false
                        SSDEEP:24:Yv6XrZEKLgENRcbrZbq00iCCBrwJo++ns8ct4mFJNF:YvtEgigrNt0wSJn+ns8cvFJX
                        MD5:74AA6D78D178FE433092F7991748D74D
                        SHA1:E13B7EB90A332C326EC6D05E1EDD7F01BAB71B34
                        SHA-256:79876FAAE7651394D953E69708DD4E8CECFF75B5C85EEFB4941B79FEBFF176B4
                        SHA-512:F7A4B5EBD8FE24C3484C42416069F1C81A52B8888E773E195C15C7C120F4911B29464B1051AD92588BB089184E8D714445B555295F4BB666796798F4247869C3
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"2d5fc314-5993-4818-9b80-c84ce01c6d7f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1716756505154,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"79887_247329ActionBlock_0","campaignId":79887,"containerId":"1","controlGroupId":"","treatmentId":"acc56846-d570-4500-a26e-7f8cf2b4acad","variationId":"247329"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJUcnkgQWNyb2JhdCBQcm8ifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNSIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTMiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIDctZGF5IHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0byBwcmVtaXVtIFBERiBhbmQgZS1zaWduaW5nIHRvb2xzLiIsImJ

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):289
                        Entropy (8bit):5.301149236351149
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXF0GgsWnWn0nZiQ0YtqoAvJfYdPeUkwRe9:YvXKXFosWni0ccGg8Ukee9
                        MD5:19DE1A029D24381045B668E0C1C2B6C1
                        SHA1:81F0EA85AF095CABD1A082C4196D060E144F2625
                        SHA-256:28326A5A3136024783786D41A8FCE57C2B2030FF58A9C5F40D2D8466227570B4
                        SHA-512:97784B6FE97CF73F59BE2E0DC71E71921F159336C9102B64768CC36DFC092D5F6E9545055FD31AB222DDF8F507F313858CCA4ED64F450A5576AA59CE38325F0B
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"2d5fc314-5993-4818-9b80-c84ce01c6d7f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1716756505154,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):1395
                        Entropy (8bit):5.778202785224074
                        Encrypted:false
                        SSDEEP:24:Yv6XrZrrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNN:YvwHgDv3W2aYQfgB5OUupHrQ9FJz
                        MD5:4F0BDC6E2E0A77D65CB2E7B00F7B764F
                        SHA1:12DF6BB436C81D8ADE7348FD6546FBD04AB88508
                        SHA-256:9BACC105FCE9EB26353655283DA9390621968913C9D4566120FD171D7182D713
                        SHA-512:C97BDED7B2D2B540C16FDA355643E573F8EE75C3EEC5A35E43768F3C765F68EB784BF778397383B08FAC24A160AA51A77CB2FB8E0989DBE3635210351FBA217F
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"2d5fc314-5993-4818-9b80-c84ce01c6d7f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1716756505154,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):291
                        Entropy (8bit):5.284688435493388
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXF0GgsWnWn0nZiQ0YtqoAvJfbPtdPeUkwRe9:YvXKXFosWni0ccGDV8Ukee9
                        MD5:29901E6475FCD3AA0E9584413F464988
                        SHA1:919EB382C330FA1E6C5D174973A21D6EDC9C00FD
                        SHA-256:E8EE10057C3CE0FE268D1FA12047BB4C04D28549A16FC666634FE6B8B0E31A72
                        SHA-512:FCE5C7C8BB0C105EDE94AC90E027E186E16C0674BD653D997C0A1B9651FCB39200BBD2F8D8DB83A2EFEADDC9CA9B270B6EF71DA26873324F9006295259EE2CD8
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"2d5fc314-5993-4818-9b80-c84ce01c6d7f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1716756505154,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):287
                        Entropy (8bit):5.287435912863912
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXF0GgsWnWn0nZiQ0YtqoAvJf21rPeUkwRe9:YvXKXFosWni0ccG+16Ukee9
                        MD5:A1330A9D884165C2A6F9989A6B9BF011
                        SHA1:28D146E2AFC5628F2B5A5DC2AB3A305CC2B963FB
                        SHA-256:7DF8D2BDB7B164053C22253AD2A7B3DC1F284ED459F30C38A13E9C8F1ACAE6FA
                        SHA-512:57BD380B830FB74B612016B0EA4BC51D24C6FBEBF6411F08115C6C4AA9D21458774FCE359FB040BC900FE024DFF2E206F7EB35466B156320BEB1F74392F35441
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"2d5fc314-5993-4818-9b80-c84ce01c6d7f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1716756505154,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):289
                        Entropy (8bit):5.307690547035075
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXF0GgsWnWn0nZiQ0YtqoAvJfbpatdPeUkwRe9:YvXKXFosWni0ccGVat8Ukee9
                        MD5:5E8A495C48423A104388CD1879BBA8C8
                        SHA1:91172FEC359F1D088578743B1217ABF89C12DDA4
                        SHA-256:2008E5EF0E06814E0ECEDBC768B3C0FCB83BC97ABE1D4E415089482A750EE68F
                        SHA-512:983B8148C4FE1197E00B772FA4FC0EA262D2F0E2D900A6E57125A44BEAD502300FFDC101CBDD13C013CFA5A9806B6A322EB4C674DB7CB2FE9CC1FB68EBD4A706
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"2d5fc314-5993-4818-9b80-c84ce01c6d7f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1716756505154,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):286
                        Entropy (8bit):5.26470428748653
                        Encrypted:false
                        SSDEEP:6:YEQXJ2HXF0GgsWnWn0nZiQ0YtqoAvJfshHHrPeUkwRe9:YvXKXFosWni0ccGUUUkee9
                        MD5:CB0DCC61F20530C706CE8C3428CDA562
                        SHA1:7C39DB31713911F649B431F4B667B1E5CD9B4CE5
                        SHA-256:D5CBE6F48040FD75085C9D1EF474A091CA39C49F1ADDEDED4ED9B77B37CB5F7D
                        SHA-512:0125892CD98045544B841FB51AE5C5E727A6EA91677EA1328D0A9AB94E28F686A002B234CB2CBC0056D0FE410A23E0A4D33A5B81BDFA911DE95FF91E15538C79
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"2d5fc314-5993-4818-9b80-c84ce01c6d7f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1716756505154,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):782
                        Entropy (8bit):5.361307903520206
                        Encrypted:false
                        SSDEEP:12:YvXKXFosWni0ccGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWB:Yv6XrZy168CgEXX5kcIfANho
                        MD5:F1020179072334498F3F50E95BEFE4DD
                        SHA1:0A6E3BDE0E26C6786A17C52F2D6285F3BF5CFD29
                        SHA-256:D55972A941009075248AA9A490F9B7C340A52AB2A7DA660EF3532A47CBBAE14C
                        SHA-512:00DDCB35C817514BB499E75DEAC66B1BFDD605E1A8F2A26AC725B5681FAE86C4DF229408930E63404ECF41A474B4C927E5DF54705BC5B469967773A2618FAE11
                        Malicious:false
                        Preview:{"analyticsData":{"responseGUID":"2d5fc314-5993-4818-9b80-c84ce01c6d7f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1716756505154,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1716579775182}}}}

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):4
                        Entropy (8bit):0.8112781244591328
                        Encrypted:false
                        SSDEEP:3:e:e
                        MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                        SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                        SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                        SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                        Malicious:false
                        Preview:....

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:JSON data
                        Category:dropped
                        Size (bytes):2814
                        Entropy (8bit):5.135341051187209
                        Encrypted:false
                        SSDEEP:24:Yf8WCe+cetroHgzRaHi11ayWMs55M0TWmh4Djv01j0SNcvh20KL2LSfL8eG5ZtoD:Yb3+ceBo/iLs5TTLM6wVKLx1Gto9aS
                        MD5:FE25A81C028EDF76E2DE249892B92D6A
                        SHA1:868BEE070B5D91787AAE0A2742E4348121E8EDAE
                        SHA-256:EEB196109BFD69596FDE56C7B53329BB7BC1CE4DF62F5664E5C49C9E4C4648BF
                        SHA-512:F7712EB1B43773327E9ABED758AADC45FEA407D11CA31510C7F53BE8F5AA61EBE52202FF9D4BCE4A72E1446D531FBE6672E5B9103D3B2A8798E70F0C64EE98F3
                        Malicious:false
                        Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"65161844572d8d0dff78faef109b0157","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1716579774000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"8e40deb82a9c0b3c62a9dbb19ccad073","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1372,"ts":1716579774000},{"id":"Edit_InApp_Aug2020","info":{"dg":"ff5540ae0649069af860938d6982992e","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1716579774000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"16c7e9d0d618baab1bf43bba9c240132","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1716579774000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"50d32be1b0e97ca3b4464aff4afdf783","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1716579774000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"a50ea567d2a32bbd40bc548f84082a57","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1716579774000},

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
                        Category:dropped
                        Size (bytes):12288
                        Entropy (8bit):1.145739065392205
                        Encrypted:false
                        SSDEEP:24:TLhx/XYKQvGJF7ursk1ZLRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUuk:TFl2GL7msuPXc+XcGNFlRYIX2v3kDh
                        MD5:7E3F4ACA142407AE6A78A7FBF5811CCD
                        SHA1:9EF70BAA81849201E31901CFD76D1CCB04A80EB4
                        SHA-256:E5357A234ADB53CC796A17A89CD9610174E4AD980D592888DE1BFE1AF22CC72C
                        SHA-512:C79535EE4A810CE30BE55ABF928A7658E868B789445CE839F1F34D7759A6C1FCA21D6ED22CB8DED2A43A0A659050A23A5BDDD5310A93FE4E11F039AF35C8098E
                        Malicious:false
                        Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:SQLite Rollback Journal
                        Category:dropped
                        Size (bytes):8720
                        Entropy (8bit):1.5498566290573073
                        Encrypted:false
                        SSDEEP:24:7+t51ZLUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxApqLxx/h:7Mh4Xc+XcGNFlRYIX2v9qVl2GL7msv
                        MD5:5CF87AD401F0EA2742454D321D267979
                        SHA1:4A820D48A3AFD667F1787C1CF2307C731D0D09D4
                        SHA-256:31EEE25952273AAA1F5A8C955A5F02CAF00884AC3AB2027704EFADADACF4270E
                        SHA-512:12C444D868AB97984B7CC16378C3D55FBB75D625D9118F4E3F25086E62BDD5C668339CF367DF1E301F3BF2BD80D9F91728C1474529FD1F255934EFB1EFEE4740
                        Malicious:false
                        Preview:.... .c.......72..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Temp\MSIdc65b.LOG

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):246
                        Entropy (8bit):3.518261198325562
                        Encrypted:false
                        SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8c6846e:Qw946cPbiOxDlbYnuRKHsr
                        MD5:FCB35E300B617593C029F1C85FA9DC34
                        SHA1:789325F5F30246607F693FD455097F7D4A393F6F
                        SHA-256:01DADD849A4FCD87B5B32AE631E884A4557A94F68F22DA34D9119ED0B4D9A47D
                        SHA-512:53E58292FA1A117196C01994AF0BD10E7143CAA76878BBA367C93F3D21BFC7E9E76B7F752712E022F4CAB0B9E9AE25C93D455693F528575E690CE6E7C7ACE34A
                        Malicious:false
                        Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.4./.0.5./.2.0.2.4. . .1.5.:.4.2.:.5.6. .=.=.=.....

                        C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-05-24 15-42-51-357.log

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:ASCII text, with very long lines (393)
                        Category:dropped
                        Size (bytes):16525
                        Entropy (8bit):5.338264912747007
                        Encrypted:false
                        SSDEEP:384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
                        MD5:128A51060103D95314048C2F32A15C66
                        SHA1:EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
                        SHA-256:601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
                        SHA-512:55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
                        Malicious:false
                        Preview:SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

                        C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:ASCII text, with very long lines (393), with CRLF line terminators
                        Category:dropped
                        Size (bytes):16601
                        Entropy (8bit):5.343357521147715
                        Encrypted:false
                        SSDEEP:384:Rh3bYCRHeJAuhf8NhvmTf0JT3W2GRDP4Un4qkIq77SWgd/SDpQYzZsZAN0GCZmuc:5VrB
                        MD5:5C6E5251DD98526BCDEAB68DF94D408D
                        SHA1:4A648FB0DDF40AD29051E431D3CD341CEEF55378
                        SHA-256:A7F373DC5C7BFB84AB37EF723A7C9397B3F3D810B573B9561D62BA76474075F6
                        SHA-512:E07A67B068D58D70873F9C940D9A48A1C40A9304C7C81091C4E39EF6EF5783CBD461E4A081F17E1D6F0DF646121119BE5B57068E5338300C0172787102103DC5
                        Malicious:false
                        Preview:SessionID=aa101cd2-73c6-4a88-ae79-66fea3a5c603.1716579771380 Timestamp=2024-05-24T15:42:51:380-0400 ThreadID=7412 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=aa101cd2-73c6-4a88-ae79-66fea3a5c603.1716579771380 Timestamp=2024-05-24T15:42:51:381-0400 ThreadID=7412 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=aa101cd2-73c6-4a88-ae79-66fea3a5c603.1716579771380 Timestamp=2024-05-24T15:42:51:381-0400 ThreadID=7412 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=aa101cd2-73c6-4a88-ae79-66fea3a5c603.1716579771380 Timestamp=2024-05-24T15:42:51:382-0400 ThreadID=7412 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=aa101cd2-73c6-4a88-ae79-66fea3a5c603.1716579771380 Timestamp=2024-05-24T15:42:51:382-0400 ThreadID=7412 Component=ngl-lib_NglAppLib Description="SetConf

                        C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        File Type:ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):29845
                        Entropy (8bit):5.39187426610857
                        Encrypted:false
                        SSDEEP:192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbTqyqAqAqEq1qgqXqAqLqzq+qtS:V3fOCIdJDemCb
                        MD5:0D653F2A869E3870BA7943B470390E7B
                        SHA1:05D145BC590821B365F3B5A32010055D63A95F5D
                        SHA-256:C3466FCFDD256B120FAF730A0DC2C7A29AE795E6D2412331D76521C5334AA837
                        SHA-512:82063C7A2097E101C8DF429D0FE7C4E7AF392134BE1E2188C8C5B83CA976D0F4D8A9C9CC5473D3FA9F7B68160B1088C774FBFB8D92B64120B699BF8E313F88AD
                        Malicious:false
                        Preview:05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

                        C:\Users\user\AppData\Local\Temp\acrocef_low\23ba4243-6949-49ec-a52a-0129dad24188.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                        Category:dropped
                        Size (bytes):386528
                        Entropy (8bit):7.9736851559892425
                        Encrypted:false
                        SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                        MD5:5C48B0AD2FEF800949466AE872E1F1E2
                        SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                        SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                        SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                        Malicious:false
                        Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                        C:\Users\user\AppData\Local\Temp\acrocef_low\339f3f57-8321-42ce-9ffb-a217c6fb9054.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                        Category:dropped
                        Size (bytes):1419751
                        Entropy (8bit):7.976496077007677
                        Encrypted:false
                        SSDEEP:24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
                        MD5:18E3D04537AF72FDBEB3760B2D10C80E
                        SHA1:B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
                        SHA-256:BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
                        SHA-512:2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
                        Malicious:false
                        Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                        C:\Users\user\AppData\Local\Temp\acrocef_low\5a281295-77d7-4f1e-bbd0-9d7397857f5f.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                        Category:dropped
                        Size (bytes):1407294
                        Entropy (8bit):7.97605879016224
                        Encrypted:false
                        SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
                        MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
                        SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
                        SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
                        SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
                        Malicious:false
                        Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                        C:\Users\user\AppData\Local\Temp\acrocef_low\89f7f50c-b718-409e-b43c-2d58b994cee7.tmp

                        Download File
                        Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                        Category:dropped
                        Size (bytes):758601
                        Entropy (8bit):7.98639316555857
                        Encrypted:false
                        SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                        MD5:3A49135134665364308390AC398006F1
                        SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                        SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                        SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                        Malicious:false
                        Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                        Static File Info

                        General

                        File type:PDF document, version 1.3, 1 pages
                        Entropy (8bit):7.955915791207243
                        TrID:
                        • Adobe Portable Document Format (5005/1) 100.00%
                        File name:Seminole Casino - 2023 DJI Invoice.pdf
                        File size:80'972 bytes
                        MD5:778252f7dedae0b7954cd30f24e22f20
                        SHA1:d020f2a610f12d927b710ba17ebadc1b2538b417
                        SHA256:7453ff20e6036ede9dacaf3f77ebe51ba7665b5b5c520d59795d25c882886dc8
                        SHA512:3ce8c54bdc1cd50e7058663c754193ca4d9fe9078649a7e852986a09af493a213f9f7add3fa3f691303afcb3de4302004a42ee07e1fd9c006d41945013a6e5f2
                        SSDEEP:1536:R/LaECkion40gX+02WZ+gfig9wMGch8iYSw5uJa+:RTaECk40v02bgqMrh8XuJa+
                        TLSH:1B83CF5AD7C8CC8FD809E512465FEBB4C5EA73B1859C1BC13E24BECA2C91998633B354
                        File Content Preview:%PDF-1.3.%............3 0 obj.<< /Filter /FlateDecode /Length 6355 >>.stream.x..].s.......,E..&.....t.m...?.3.]..p.r*w%%g...._...0c...)Ui...........w..Y...n.....]..u.1k.~.G...V....s.d..S...?e.p.i...._.kQ.....aW../?........?......~.~./.C..Y..EQ`...9.vh....

                        File Icon

                        Icon Hash:62cc8caeb29e8ae0

                        Static PDF Info

                        General

                        Header:%PDF-1.3
                        Total Entropy:7.955916
                        Total Bytes:80972
                        Stream Entropy:7.978318
                        Stream Bytes:75978
                        Entropy outside Streams:5.115579
                        Bytes outside Streams:4994
                        Number of EOF found:1
                        Bytes after EOF:

                        Keywords Statistics

                        NameCount
                        obj27
                        endobj27
                        stream13
                        endstream13
                        xref1
                        trailer1
                        startxref1
                        /Page1
                        /Encrypt0
                        /ObjStm0
                        /URI0
                        /JS0
                        /JavaScript0
                        /AA0
                        /OpenAction0
                        /AcroForm0
                        /JBIG2Decode0
                        /RichMedia0
                        /Launch0
                        /EmbeddedFile0

                        Image Streams

                        IDDHASHMD5Preview
                        500000000000000002a51157a8f80a9d51d2fc080fc6b1664
                        60000000000000000965bff88bff4961eb2d1d715016f6864
                        1604102ea2e2ea0082ad038f8486aa3b1d500f511eae537f02

                        Network Behavior

                        Network Port Distribution

                        TCP Packets

                        TimestampSource PortDest PortSource IPDest IP
                        May 24, 2024 21:43:02.343172073 CEST49711443192.168.2.623.47.168.24
                        May 24, 2024 21:43:02.343260050 CEST4434971123.47.168.24192.168.2.6
                        May 24, 2024 21:43:02.343355894 CEST49711443192.168.2.623.47.168.24
                        May 24, 2024 21:43:02.343826056 CEST49712443192.168.2.623.47.168.24
                        May 24, 2024 21:43:02.343858957 CEST4434971223.47.168.24192.168.2.6
                        May 24, 2024 21:43:02.343945980 CEST49712443192.168.2.623.47.168.24
                        May 24, 2024 21:43:02.344182014 CEST49711443192.168.2.623.47.168.24
                        May 24, 2024 21:43:02.344223022 CEST4434971123.47.168.24192.168.2.6
                        May 24, 2024 21:43:02.344439030 CEST49712443192.168.2.623.47.168.24
                        May 24, 2024 21:43:02.344465017 CEST4434971223.47.168.24192.168.2.6
                        May 24, 2024 21:43:03.046226025 CEST4434971123.47.168.24192.168.2.6
                        May 24, 2024 21:43:03.062251091 CEST4434971223.47.168.24192.168.2.6
                        May 24, 2024 21:43:03.088432074 CEST49711443192.168.2.623.47.168.24
                        May 24, 2024 21:43:03.103987932 CEST49712443192.168.2.623.47.168.24
                        May 24, 2024 21:43:03.188163996 CEST49712443192.168.2.623.47.168.24
                        May 24, 2024 21:43:03.188179970 CEST4434971223.47.168.24192.168.2.6
                        May 24, 2024 21:43:03.188179016 CEST49711443192.168.2.623.47.168.24
                        May 24, 2024 21:43:03.188234091 CEST4434971123.47.168.24192.168.2.6
                        May 24, 2024 21:43:03.191869974 CEST4434971223.47.168.24192.168.2.6
                        May 24, 2024 21:43:03.191936970 CEST49712443192.168.2.623.47.168.24
                        May 24, 2024 21:43:03.192260027 CEST4434971123.47.168.24192.168.2.6
                        May 24, 2024 21:43:03.192346096 CEST49711443192.168.2.623.47.168.24
                        May 24, 2024 21:43:03.203069925 CEST49712443192.168.2.623.47.168.24
                        May 24, 2024 21:43:03.203167915 CEST49711443192.168.2.623.47.168.24
                        May 24, 2024 21:43:03.203259945 CEST4434971223.47.168.24192.168.2.6
                        May 24, 2024 21:43:03.203385115 CEST49712443192.168.2.623.47.168.24
                        May 24, 2024 21:43:03.203396082 CEST4434971223.47.168.24192.168.2.6
                        May 24, 2024 21:43:03.203440905 CEST4434971123.47.168.24192.168.2.6
                        May 24, 2024 21:43:03.244672060 CEST49712443192.168.2.623.47.168.24
                        May 24, 2024 21:43:03.246109009 CEST49711443192.168.2.623.47.168.24
                        May 24, 2024 21:43:03.246170998 CEST4434971123.47.168.24192.168.2.6
                        May 24, 2024 21:43:03.291534901 CEST49711443192.168.2.623.47.168.24
                        May 24, 2024 21:43:03.329572916 CEST4434971223.47.168.24192.168.2.6
                        May 24, 2024 21:43:03.334628105 CEST4434971223.47.168.24192.168.2.6
                        May 24, 2024 21:43:03.334702969 CEST49712443192.168.2.623.47.168.24
                        May 24, 2024 21:43:03.373114109 CEST49712443192.168.2.623.47.168.24
                        May 24, 2024 21:43:03.373140097 CEST4434971223.47.168.24192.168.2.6
                        May 24, 2024 21:43:13.785764933 CEST49711443192.168.2.623.47.168.24
                        May 24, 2024 21:43:13.786015034 CEST4434971123.47.168.24192.168.2.6
                        May 24, 2024 21:43:13.786087990 CEST49711443192.168.2.623.47.168.24

                        DNS Answers

                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                        May 24, 2024 21:43:02.588073969 CEST1.1.1.1192.168.2.60x42b8No error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
                        May 24, 2024 21:43:02.588073969 CEST1.1.1.1192.168.2.60x42b8No error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false

                        HTTP Request Dependency Graph

                        • armmf.adobe.com

                        HTTPS Proxied Packets

                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                        0192.168.2.64971223.47.168.244434904C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        TimestampBytes transferredDirectionData
                        2024-05-24 19:43:03 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
                        Host: armmf.adobe.com
                        Connection: keep-alive
                        Accept-Language: en-US,en;q=0.9
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
                        Sec-Fetch-Site: same-origin
                        Sec-Fetch-Mode: no-cors
                        Sec-Fetch-Dest: empty
                        Accept-Encoding: gzip, deflate, br
                        If-None-Match: "78-5faa31cce96da"
                        If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
                        2024-05-24 19:43:03 UTC198INHTTP/1.1 304 Not Modified
                        Content-Type: text/plain; charset=UTF-8
                        Last-Modified: Mon, 01 May 2023 15:02:33 GMT
                        ETag: "78-5faa31cce96da"
                        Date: Fri, 24 May 2024 19:43:03 GMT
                        Connection: close


                        Statistics

                        CPU Usage

                        Click to jump to process

                        Memory Usage

                        Click to jump to process

                        High Level Behavior Distribution

                        Click to dive into process behavior distribution

                        Behavior

                        Click to jump to process

                        System Behavior

                        General

                        Target ID:1
                        Start time:15:42:48
                        Start date:24/05/2024
                        Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                        Wow64 process (32bit):false
                        Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Seminole Casino - 2023 DJI Invoice.pdf"
                        Imagebase:0x7ff651090000
                        File size:5'641'176 bytes
                        MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:moderate
                        Has exited:true

                        General

                        Target ID:2
                        Start time:15:42:48
                        Start date:24/05/2024
                        Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        Wow64 process (32bit):false
                        Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                        Imagebase:0x7ff70df30000
                        File size:3'581'912 bytes
                        MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:moderate
                        Has exited:true

                        General

                        Target ID:4
                        Start time:15:42:49
                        Start date:24/05/2024
                        Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                        Wow64 process (32bit):false
                        Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1732,i,17598775364771508779,3560289457606651016,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                        Imagebase:0x7ff70df30000
                        File size:3'581'912 bytes
                        MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:moderate
                        Has exited:true

                        Disassembly

                        ⊘No disassembly