Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://api.elementarypos.com/doc/receipt/97ad00f9-6c1f-4536-81e7-8bc31d2f3b10

Overview

General Information

Sample URL:https://api.elementarypos.com/doc/receipt/97ad00f9-6c1f-4536-81e7-8bc31d2f3b10
Analysis ID:1500395
Infos:

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Drops files with a non-matching file extension (content does not match file extension)
Stores files to the Windows start menu directory

Classification

Process Tree

  • System is w10x64
  • chrome.exe (PID: 4508 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 2964 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 --field-trial-handle=2528,i,7590472072302088992,16121679000214963585,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 7156 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://api.elementarypos.com/doc/receipt/97ad00f9-6c1f-4536-81e7-8bc31d2f3b10" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • Acrobat.exe (PID: 5752 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\downloaded.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 5664 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 3688 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2160 --field-trial-handle=1596,i,15970232470759308740,10123792887249288780,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://api.elementarypos.com/doc/receipt/97ad00f9-6c1f-4536-81e7-8bc31d2f3b10HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdfHTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdfHTTP Parser: No favicon
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: global trafficHTTP traffic detected: GET /doc/receipt/97ad00f9-6c1f-4536-81e7-8bc31d2f3b10 HTTP/1.1Host: api.elementarypos.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: api.elementarypos.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://api.elementarypos.com/doc/receipt/97ad00f9-6c1f-4536-81e7-8bc31d2f3b10Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /doc/receipt/97ad00f9-6c1f-4536-81e7-8bc31d2f3b10 HTTP/1.1Host: api.elementarypos.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=spSRR6Mwb1TMFpX&MD=8UH7bNmV HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=spSRR6Mwb1TMFpX&MD=8UH7bNmV HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global trafficDNS traffic detected: DNS query: api.elementarypos.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: unknownHTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message
Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.8.drString found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: unknownNetwork traffic detected: HTTP traffic on port 49674 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49703 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49703
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: classification engineClassification label: clean1.win@38/55@5/5
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome AppsJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-08-28 06-07-04-140.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 --field-trial-handle=2528,i,7590472072302088992,16121679000214963585,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://api.elementarypos.com/doc/receipt/97ad00f9-6c1f-4536-81e7-8bc31d2f3b10"
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\downloaded.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2160 --field-trial-handle=1596,i,15970232470759308740,10123792887249288780,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 --field-trial-handle=2528,i,7590472072302088992,16121679000214963585,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2160 --field-trial-handle=1596,i,15970232470759308740,10123792887249288780,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Google Drive.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeFile opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\crash_reporter.cfgJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: Chrome Cache Entry: 226
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: Chrome Cache Entry: 226Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome AppsJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnkJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
Registry Run Keys / Startup Folder		1
Process Injection		11
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
Registry Run Keys / Startup Folder		1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media3
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive4
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1500395 URL: https://api.elementarypos.c... Startdate: 28/08/2024 Architecture: WINDOWS Score: 1 22 chrome.cloudflare-dns.com 2->22 7 chrome.exe 21 2->7         started        10 Acrobat.exe 20 61 2->10         started        12 chrome.exe 2->12         started        process3 dnsIp4 26 192.168.2.5, 443, 49703, 49709 unknown unknown 7->26 28 239.255.255.250 unknown Reserved 7->28 14 chrome.exe 7->14         started        17 AcroCEF.exe 109 10->17         started        process5 dnsIp6 30 www.google.com 142.250.185.68, 443, 49714, 49727 GOOGLEUS United States 14->30 32 api.elementarypos.com 3.75.191.100, 443, 49709, 49710 AMAZON-02US United States 14->32 19 AcroCEF.exe 2 17->19         started        process7 dnsIp8 24 chrome.cloudflare-dns.com 162.159.61.3, 443, 49731, 49732 CLOUDFLARENETUS United States 19->24

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
https://api.elementarypos.com/doc/receipt/97ad00f9-6c1f-4536-81e7-8bc31d2f3b100%Avira URL Cloudsafe
https://api.elementarypos.com/doc/receipt/97ad00f9-6c1f-4536-81e7-8bc31d2f3b100%VirustotalBrowse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://chrome.cloudflare-dns.com/dns-query0%URL Reputationsafe
https://api.elementarypos.com/favicon.ico0%Avira URL Cloudsafe
file:///C:/Users/user/Downloads/downloaded.pdf0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
chrome.cloudflare-dns.com
162.159.61.3
truefalse
    		unknown
    www.google.com
    		142.250.185.68
    		truefalse
      		unknown
      api.elementarypos.com
      		3.75.191.100
      		truefalse
        		unknown

        Contacted URLs

        NameMaliciousAntivirus DetectionReputation
        https://api.elementarypos.com/doc/receipt/97ad00f9-6c1f-4536-81e7-8bc31d2f3b10false
          		unknown
          https://chrome.cloudflare-dns.com/dns-queryfalse
          • URL Reputation: safe
          		unknown
          file:///C:/Users/user/Downloads/downloaded.pdffalse
          • Avira URL Cloud: safe
          		unknown
          https://api.elementarypos.com/favicon.icofalse
          • Avira URL Cloud: safe
          		unknown

          World Map of Contacted IPs

          • No. of IPs < 25%
          • 25% < No. of IPs < 50%
          • 50% < No. of IPs < 75%
          • 75% < No. of IPs

          Public IPs

          IPDomainCountryFlagASNASN NameMalicious
          142.250.185.68
          		www.google.comUnited States
          		15169GOOGLEUSfalse
          162.159.61.3
          		chrome.cloudflare-dns.comUnited States
          		13335CLOUDFLARENETUSfalse
          239.255.255.250
          		unknownReserved
          		unknownunknownfalse
          3.75.191.100
          		api.elementarypos.comUnited States
          		16509AMAZON-02USfalse

          Private

          IP
          192.168.2.5

          General Information

          Joe Sandbox version:40.0.0 Tourmaline
          Analysis ID:1500395
          Start date and time:2024-08-28 12:04:51 +02:00
          Joe Sandbox product:CloudBasic
          Overall analysis duration:0h 3m 39s
          Hypervisor based Inspection enabled:false
          Report type:full
          Cookbook file name:browseurl.jbs
          Sample URL:https://api.elementarypos.com/doc/receipt/97ad00f9-6c1f-4536-81e7-8bc31d2f3b10
          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
          Number of analysed new started processes analysed:12
          Number of new started drivers analysed:0
          Number of existing processes analysed:0
          Number of existing drivers analysed:0
          Number of injected processes analysed:0
          Technologies:
          • HCA enabled
          • EGA enabled
          • AMSI enabled
          Analysis Mode:default
          Analysis stop reason:Timeout
          Detection:CLEAN
          Classification:clean1.win@38/55@5/5
          EGA Information:Failed
          HCA Information:
          • Successful, ratio: 100%
          • Number of executed functions: 0
          • Number of non-executed functions: 0
          Cookbook Comments:
          • Found PDF document
          • Close Viewer

          Warnings

          • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
          • Excluded IPs from analysis (whitelisted): 142.250.186.131, 74.125.133.84, 216.58.212.174, 34.104.35.123, 199.232.210.172, 192.229.221.95, 142.250.186.99, 184.28.88.176, 23.22.254.206, 54.227.187.23, 52.202.204.11, 52.5.13.197, 2.16.202.123, 95.101.54.195, 2.19.126.143, 2.19.126.149, 142.250.72.99, 142.250.81.227, 104.126.112.182
          • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, slscr.update.microsoft.com, e4578.dscb.akamaiedge.net, clientservices.googleapis.com, acroipm2.adobe.com, a1952.dscq.akamai.net, clients2.google.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, update.googleapis.com, www.gstatic.com, apps.identrust.com, fs.microsoft.com, identrust.edgesuite.net, accounts.google.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, ssl.adobe.com.edgekey.net, edgedl.me.gvt1.com, armmf.adobe.com, clients.l.google.com, geo2.adobe.com
          • Not all processes where analyzed, report is missing behavior information
          • Report size getting too big, too many NtSetInformationFile calls found.

          Simulations

          Behavior and APIs

          TimeTypeDescription
          06:07:14API Interceptor1x Sleep call for process: AcroCEF.exe modified

          Joe Sandbox View / Context

          IPs

          ⊘No context

          Domains

          ⊘No context

          ASNs

          ⊘No context

          JA3 Fingerprints

          ⊘No context

          Dropped Files

          ⊘No context

          Created / dropped Files

          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
          File Type:ASCII text
          Category:dropped
          Size (bytes):291
          Entropy (8bit):5.171348171822452
          Encrypted:false
          SSDEEP:6:N8q5pM+q2P92nKuAl9OmbnIFUt888qJEXZmw+88qmjMVkwO92nKuAl9OmbjLJ:NBPM+v4HAahFUt88BJEX/+8BMMV5LHAR
          MD5:B5B5FEA05DEFE61F719518F5DC5940FA
          SHA1:78D67139E9CE97E2F1B969EE6251C68EA2F06CBC
          SHA-256:2ADA4A38B1500792A4A0B498A20415FFF54196F50C6D0032A702F5235C20573B
          SHA-512:8308E29DC13B2611C5AA1150DD87C0148197DC573FC0923BEB607480FCDA5D6E8D6A7C93B144EF118991F4F11AB2652A8BA2C249DF40AB9BAA3C19C8A1BADDDB
          Malicious:false
          Reputation:low
          Preview:2024/08/28-06:07:01.741 e8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/08/28-06:07:01.743 e8c Recovering log #3.2024/08/28-06:07:01.744 e8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
          File Type:ASCII text
          Category:dropped
          Size (bytes):291
          Entropy (8bit):5.171348171822452
          Encrypted:false
          SSDEEP:6:N8q5pM+q2P92nKuAl9OmbnIFUt888qJEXZmw+88qmjMVkwO92nKuAl9OmbjLJ:NBPM+v4HAahFUt88BJEX/+8BMMV5LHAR
          MD5:B5B5FEA05DEFE61F719518F5DC5940FA
          SHA1:78D67139E9CE97E2F1B969EE6251C68EA2F06CBC
          SHA-256:2ADA4A38B1500792A4A0B498A20415FFF54196F50C6D0032A702F5235C20573B
          SHA-512:8308E29DC13B2611C5AA1150DD87C0148197DC573FC0923BEB607480FCDA5D6E8D6A7C93B144EF118991F4F11AB2652A8BA2C249DF40AB9BAA3C19C8A1BADDDB
          Malicious:false
          Reputation:low
          Preview:2024/08/28-06:07:01.741 e8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/08/28-06:07:01.743 e8c Recovering log #3.2024/08/28-06:07:01.744 e8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
          File Type:ASCII text
          Category:dropped
          Size (bytes):335
          Entropy (8bit):5.1652924607411865
          Encrypted:false
          SSDEEP:6:N8qkxQ+q2P92nKuAl9Ombzo2jMGIFUt888qk9kdWZmw+88qkGkQVkwO92nKuAl97:NBt+v4HAa8uFUt88B9W/+8BRRV5LHAaU
          MD5:7EEDFFDED34A0AFECB50C44DBC22160B
          SHA1:51DA705634C2D6C5D9EFE53EB29376F1D4C48097
          SHA-256:5092C9B39F35728EC52729654738C4C6A0EC1C7DF7CD32FC1DDD756A1511F2AF
          SHA-512:BE83E5CA9533C3F9D052BFC94745AF47D1F9E4D4B22DA1B8B8BDC2466E9773CB0854C87356D64842116D6E93AC7338283980B8E96FB43BF43550353B96A9FBAE
          Malicious:false
          Reputation:low
          Preview:2024/08/28-06:07:01.820 93c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/08/28-06:07:01.821 93c Recovering log #3.2024/08/28-06:07:01.822 93c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
          File Type:ASCII text
          Category:dropped
          Size (bytes):335
          Entropy (8bit):5.1652924607411865
          Encrypted:false
          SSDEEP:6:N8qkxQ+q2P92nKuAl9Ombzo2jMGIFUt888qk9kdWZmw+88qkGkQVkwO92nKuAl97:NBt+v4HAa8uFUt88B9W/+8BRRV5LHAaU
          MD5:7EEDFFDED34A0AFECB50C44DBC22160B
          SHA1:51DA705634C2D6C5D9EFE53EB29376F1D4C48097
          SHA-256:5092C9B39F35728EC52729654738C4C6A0EC1C7DF7CD32FC1DDD756A1511F2AF
          SHA-512:BE83E5CA9533C3F9D052BFC94745AF47D1F9E4D4B22DA1B8B8BDC2466E9773CB0854C87356D64842116D6E93AC7338283980B8E96FB43BF43550353B96A9FBAE
          Malicious:false
          Reputation:low
          Preview:2024/08/28-06:07:01.820 93c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/08/28-06:07:01.821 93c Recovering log #3.2024/08/28-06:07:01.822 93c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0f613add-bcd0-49b4-8a79-834ae490bba0.tmp

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
          File Type:JSON data
          Category:modified
          Size (bytes):508
          Entropy (8bit):5.054693853402385
          Encrypted:false
          SSDEEP:12:YH/um3RA8sq5/ShsBdOg2H5caq3QYiubxnP7E4T3OF+:Y2sRds0JdMHA3QYhbxP7nbI+
          MD5:C64CDD7D3D90EAAF8E2EA01DC149D733
          SHA1:04D5A2788413E28CA5AAC88DBF1097F819F0486C
          SHA-256:04E58EA585304E97C12D9DC5FD439FD4B08A677EF6C3A2B0E8BE346F3515198B
          SHA-512:4FD19C68B25707C27D6301DF2DBB807DBE271D3238D037F6AD2AE15A96A90B9406FD2A707E3075FE9547DDB2D4E7581BAE73BBCF92782B2E0936FD52333D75D8
          Malicious:false
          Reputation:low
          Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13369399634048794","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149852},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
          File Type:JSON data
          Category:dropped
          Size (bytes):508
          Entropy (8bit):5.054693853402385
          Encrypted:false
          SSDEEP:12:YH/um3RA8sq5/ShsBdOg2H5caq3QYiubxnP7E4T3OF+:Y2sRds0JdMHA3QYhbxP7nbI+
          MD5:C64CDD7D3D90EAAF8E2EA01DC149D733
          SHA1:04D5A2788413E28CA5AAC88DBF1097F819F0486C
          SHA-256:04E58EA585304E97C12D9DC5FD439FD4B08A677EF6C3A2B0E8BE346F3515198B
          SHA-512:4FD19C68B25707C27D6301DF2DBB807DBE271D3238D037F6AD2AE15A96A90B9406FD2A707E3075FE9547DDB2D4E7581BAE73BBCF92782B2E0936FD52333D75D8
          Malicious:false
          Reputation:low
          Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13369399634048794","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149852},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
          File Type:data
          Category:dropped
          Size (bytes):4509
          Entropy (8bit):5.240466788884354
          Encrypted:false
          SSDEEP:96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUPN+ssN2Z:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLW
          MD5:B326BCCEA5212C388DD5AB2348E9DB3B
          SHA1:12A6AD1415BB1CE6AD4E32890E0E61784EA78004
          SHA-256:D48FA1DA8DAF477CB93EA23012B1C4C5160D20554700395FA614AD30E99BA2FF
          SHA-512:4F37A55770968E23D1B9AC6625FEB67E72043B89D9513996072B4FABC94DF41E5721B9B3F21AAD8AC57FEC04D28FE2F806C91CC21DBEC0954E3ED39AC62D5D99
          Malicious:false
          Reputation:low
          Preview:*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
          File Type:ASCII text
          Category:dropped
          Size (bytes):323
          Entropy (8bit):5.208462738931186
          Encrypted:false
          SSDEEP:6:N8qkjQ+q2P92nKuAl9OmbzNMxIFUt888qk7NAdWZmw+88qkDGSQVkwO92nKuAl9c:NB3+v4HAa8jFUt88Bm2W/+8BaiV5LHAo
          MD5:7CBA5AFDD92C7DEE40BBF28D89AEA550
          SHA1:182C166D9F3F041D5A645F2BD04025ACBEA35336
          SHA-256:A94FB682BA6308F86909AB01B25D754612A60905C836B3C3982E683CC300436A
          SHA-512:AB36EAD01439289B9977AE3E03C856BE93B26385D8ED9061D7AB85798B8A3C0156A70347A93497A9F1306FF9F5021697165A3DC596840A8A3343C6FB2FBA62CA
          Malicious:false
          Reputation:low
          Preview:2024/08/28-06:07:01.893 93c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/08/28-06:07:01.894 93c Recovering log #3.2024/08/28-06:07:01.895 93c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
          File Type:ASCII text
          Category:dropped
          Size (bytes):323
          Entropy (8bit):5.208462738931186
          Encrypted:false
          SSDEEP:6:N8qkjQ+q2P92nKuAl9OmbzNMxIFUt888qk7NAdWZmw+88qkDGSQVkwO92nKuAl9c:NB3+v4HAa8jFUt88Bm2W/+8BaiV5LHAo
          MD5:7CBA5AFDD92C7DEE40BBF28D89AEA550
          SHA1:182C166D9F3F041D5A645F2BD04025ACBEA35336
          SHA-256:A94FB682BA6308F86909AB01B25D754612A60905C836B3C3982E683CC300436A
          SHA-512:AB36EAD01439289B9977AE3E03C856BE93B26385D8ED9061D7AB85798B8A3C0156A70347A93497A9F1306FF9F5021697165A3DC596840A8A3343C6FB2FBA62CA
          Malicious:false
          Reputation:low
          Preview:2024/08/28-06:07:01.893 93c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/08/28-06:07:01.894 93c Recovering log #3.2024/08/28-06:07:01.895 93c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

          C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240828100705Z-160.bmp

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
          File Type:PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
          Category:dropped
          Size (bytes):65110
          Entropy (8bit):0.6931963880765591
          Encrypted:false
          SSDEEP:96:UME+OdMMMTfMD+HEfyM4MxMIAASIXTqeEqz0tQ32nw:zsIKpQTw
          MD5:4E50A62EF5E9E0F002C1A58E4406CF23
          SHA1:1D0C9AC97D1F90E8D75DD23D8A112F82D496D5BB
          SHA-256:222F12A8D72E4CF168EF9E1866347322FA6F50CACB156AC77BB4F3AF7B844A6E
          SHA-512:2E75F9217DF578CE60736FCF8B18FAA432B372E4E32C054BA0CDE54DD67FAFE7899F18E92C7DF28C4CB03C2E426121192F5A41BD0AC1B1E5E6A60C968D2279B8
          Malicious:false
          Reputation:low
          Preview:BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

          C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
          File Type:data
          Category:dropped
          Size (bytes):893
          Entropy (8bit):7.366016576663508
          Encrypted:false
          SSDEEP:24:hBntmDvKUQQDvKUr7C5fpqp8gPvXHmXvponXux:3ntmD5QQD5XC5RqHHXmXvp++x
          MD5:D4AE187B4574036C2D76B6DF8A8C1A30
          SHA1:B06F409FA14BAB33CBAF4A37811B8740B624D9E5
          SHA-256:A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
          SHA-512:1F44A360E8BB8ADA22BC5BFE001F1BABB4E72005A46BC2A94C33C4BD149FF256CCE6F35D65CA4F7FC2A5B9E15494155449830D2809C8CF218D0B9196EC646B0C
          Malicious:false
          Reputation:low
          Preview:0..y..*.H.........j0..f...1.0...*.H.........N0..J0..2.......D....'..09...@k0...*.H........0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30...000930211219Z..210930140115Z0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30.."0...*.H.............0..........P..W..be......,k0.[...}.@......3vI*.?!I..N..>H.e...!.e.*.2....w..{........s.z..2..~..0....*8.y.1.P..e.Qc...a.Ka..Rk...K.(.H......>.... .[.*....p....%.tr.{j.4.0...h.{T....Z...=d.....Ap..r.&.8U9C....\@........%.......:..n.>..\..<.i....*.)W..=....]......B0@0...U.......0....0...U...........0...U.........{,q...K.u...`...0...*.H...............,...\...(f7:...?K.... ]..YD.>.>..K.t.....t..~.....K. D....}..j.....N..:.pI...........:^H...X._..Z.....Y..n......f3.Y[...sG.+..7H..VK....r2...D.SrmC.&H.Rg.X..gvqx...V..9$1....Z0G..P.......dc`........}...=2.e..|.Wv..(9..e...w.j..w.......)...55.1.

          C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
          File Type:data
          Category:dropped
          Size (bytes):252
          Entropy (8bit):3.0056539486591527
          Encrypted:false
          SSDEEP:3:kkFkl3SntfllXlE/E/KRkzllPlzRkwWBARLNDU+ZMlKlBkvclcMlVHblB8V7lnka:kKxxliBAIdQZV7I7kc3
          MD5:255030C443DBFEE8BDA96C8BED60DBD6
          SHA1:95D415F193D5D47F69101F117070CC762854FC35
          SHA-256:6941E1C0919E0794C35063F1E737A87BC76C9A04FACE1FF3D4986C7CE3B5FB6A
          SHA-512:5F3FA7921EBDB3F549BBB85B5C03265283D2D62ED7A852A9E6F508458E4955A747EC09A38E75B8946F048BDECB2AB271730E8A89AC5275A4E68FE7A2CFFA1844
          Malicious:false
          Reputation:low
          Preview:p...... ....`...)+7.2...(....................................................... ........!.M........(...........}...h.t.t.p.:././.a.p.p.s...i.d.e.n.t.r.u.s.t...c.o.m./.r.o.o.t.s./.d.s.t.r.o.o.t.c.a.x.3...p.7.c...".3.7.d.-.6.0.7.9.b.8.c.0.9.2.9.c.0."...

          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
          File Type:data
          Category:dropped
          Size (bytes):227002
          Entropy (8bit):3.392780893644728
          Encrypted:false
          SSDEEP:1536:WKPC4iyzDtrh1cK3XEivK7VK/3AYvYwgF/rRoL+sn:DPCaJ/3AYvYwglFoL+sn
          MD5:87EDBEE38F56C20298F25D5D3D4D1B5C
          SHA1:7F904E9615AC3186A87472EF366DD8202855B0B7
          SHA-256:A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
          SHA-512:BBEBC1FCD5BC9AE042DD5782425BA8C47BF3EAC283B2487FC4E3FF6BF8101306DAB081E5135594165D4DC1AC120FF125AADBC5B3FFE7C646183C04DF77865E0D
          Malicious:false
          Reputation:low
          Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
          File Type:JSON data
          Category:dropped
          Size (bytes):295
          Entropy (8bit):5.331834579367873
          Encrypted:false
          SSDEEP:6:YEQXJ2HXKIpujcGRx+FIbRI6XVW7+0YREHDeoAvJM3g98kUwPeUkwRe9:YvXKXKIGcAUYpW7gkGMbLUkee9
          MD5:830754CD806F4F2E42F82863213BCE35
          SHA1:26C6EB7444D24B485A507BEBD7A7A8A2782D45F4
          SHA-256:4F02FC143382965CD5BEC64A1F778911B5E6E0C190BDDCB605C1196F21DE8898
          SHA-512:782956D14715581BC1D2321FE865871F5068D1173B2977F39021F2118ABBD1C3371DF3CDCA0691510ED810AC1ED4A56F1C73F5523C803253EDB79735F81EFC2D
          Malicious:false
          Reputation:low
          Preview:{"analyticsData":{"responseGUID":"1d0ee425-92b5-4cd2-9ce9-60199c485f96","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1725018653208,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
          File Type:JSON data
          Category:dropped
          Size (bytes):294
          Entropy (8bit):5.269466613935359
          Encrypted:false
          SSDEEP:6:YEQXJ2HXKIpujcGRx+FIbRI6XVW7+0YREHDeoAvJfBoTfXpnrPeUkwRe9:YvXKXKIGcAUYpW7gkGWTfXcUkee9
          MD5:C63E03164E534ED9CD1C1180571A942D
          SHA1:6D6FD936BBDF01C0D9F11840F79092C3C4FCDB2F
          SHA-256:4DC89B31F1120766B3A6C49A4DEC91142A81C52DA08E20C393553032CAB4609A
          SHA-512:F606A9151AABFD3A45E560CBA1F56BAB6C8D24B5832A8945404E55F14DCC10962FE18E6E09495F2C362B459C3DE412B9ACDAA9207797BCE591376F4FD3D0063A
          Malicious:false
          Reputation:low
          Preview:{"analyticsData":{"responseGUID":"1d0ee425-92b5-4cd2-9ce9-60199c485f96","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1725018653208,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
          File Type:JSON data
          Category:dropped
          Size (bytes):294
          Entropy (8bit):5.24787828720022
          Encrypted:false
          SSDEEP:6:YEQXJ2HXKIpujcGRx+FIbRI6XVW7+0YREHDeoAvJfBD2G6UpnrPeUkwRe9:YvXKXKIGcAUYpW7gkGR22cUkee9
          MD5:786EFA2D76224F3409262551DD6C3399
          SHA1:776C485371E1E47C0D86188BBCE1F4F4B347FCBC
          SHA-256:D784CAACD520258DB90ABB7BC767E254F08C5B52BE7FADF691CD0277B283A0BC
          SHA-512:FFBDC94DAD3B9B8BDD2A226CB6F9E1C4AB2A0F5453D0B5FF3421231E2BE8AD5C919D4E84307960DEEA9E3BCECF36515B7D3594E979D2DF969DA44346C55D1F3C
          Malicious:false
          Reputation:low
          Preview:{"analyticsData":{"responseGUID":"1d0ee425-92b5-4cd2-9ce9-60199c485f96","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1725018653208,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
          File Type:JSON data
          Category:dropped
          Size (bytes):285
          Entropy (8bit):5.309621183093763
          Encrypted:false
          SSDEEP:6:YEQXJ2HXKIpujcGRx+FIbRI6XVW7+0YREHDeoAvJfPmwrPeUkwRe9:YvXKXKIGcAUYpW7gkGH56Ukee9
          MD5:65EA05F4B2CE83C929A1865CDB27F5FB
          SHA1:6427AE35E607C490B71257378908604B06C11130
          SHA-256:B807F8387A819ED8558E1FB8C4B5D05133478182B9C62C7D143D1627DE012F1C
          SHA-512:39D4BC9719D86AF122667CF991DEBBED01D6F25BDFCA265EC09268F1653107B091ECAD14746B4D485B654D43F306F2D3BC1484B572250659C9A3937250C613B4
          Malicious:false
          Reputation:low
          Preview:{"analyticsData":{"responseGUID":"1d0ee425-92b5-4cd2-9ce9-60199c485f96","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1725018653208,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
          File Type:JSON data
          Category:dropped
          Size (bytes):1063
          Entropy (8bit):5.662296697634659
          Encrypted:false
          SSDEEP:24:Yv6XScAFighpLgEFqciGennl0RCmK8czOCY4w2CY:YvRmghhgLtaAh8cvYvfY
          MD5:BA47F38B9CB76E6020162B29681766AE
          SHA1:DDFA5098E431CF082E7CFCC9EFB1AB1424EE5767
          SHA-256:B7F027DCB65784BCACDDDEC9DBE18FCA1AD174C3356E04090D703BFBB9CDFA4C
          SHA-512:392872B9DEDF8EE1B0C00A038DA7434DA340C3B212A85EE92BCA6B07F0EA21F2A2594239483A3D58797746F9A7DD4CD2BFF94B63BB4B547308830298C243AEA8
          Malicious:false
          Reputation:low
          Preview:{"analyticsData":{"responseGUID":"1d0ee425-92b5-4cd2-9ce9-60199c485f96","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1725018653208,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_2","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"afb9c2a3-eaf4-41f9-9d73-768e72f72282","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQgZmlsZXMgdG8gYW5kIGZyb20gUERGXG53aXRob3V0IGxpbWl0cy4ifSwidGNhdElkIjpudWxsfQ==","dataType":"application\/json","encodingSc

          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
          File Type:JSON data
          Category:dropped
          Size (bytes):1050
          Entropy (8bit):5.6456603609579865
          Encrypted:false
          SSDEEP:24:Yv6XScAFig9VLgEF0c7sbnl0RCmK8czOCYHflEpwiVCY:YvRmg9Fg6sGAh8cvYHWpwtY
          MD5:D74EF7E17FB72E0FE13258A9E90DA27B
          SHA1:D38788164A314C17BF36487AA8D389B88A18D483
          SHA-256:67071D9FED2841178C06C7B4D690613F6CF61DDAD4769877E6CC533B2D790D30
          SHA-512:4275DE78B5B7C455BB48ABFC3081E235F65A950B6944A1490D4DA00E0ED8FBC53AFE58DAD386D9A66A4188D452ED6FF0B9CD5DC1771C04526D8ED701A0F7DCFB
          Malicious:false
          Reputation:low
          Preview:{"analyticsData":{"responseGUID":"1d0ee425-92b5-4cd2-9ce9-60199c485f96","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1725018653208,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_0","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"0924134e-3c59-4f53-b731-add558c56fec","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuZm9ybXMgJiBhZ3JlZW1lbnRzLiJ9LCJ0Y2F0SWQiOm51bGx9","dataType":"application\/json","encodingScheme":true},"

          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
          File Type:JSON data
          Category:dropped
          Size (bytes):292
          Entropy (8bit):5.25453423988332
          Encrypted:false
          SSDEEP:6:YEQXJ2HXKIpujcGRx+FIbRI6XVW7+0YREHDeoAvJfQ1rPeUkwRe9:YvXKXKIGcAUYpW7gkGY16Ukee9
          MD5:85D81F2CDE94DD83F1D01D6CF13DE38E
          SHA1:071CEA0D8B9E4BF348E21049A80DCA723A7F6CB5
          SHA-256:BC1E6928DFBB7660748D168556E9217FDF8506017E0BE4CB07380E7F63FFB1E6
          SHA-512:5A720C451C1FF3EB94E94D4C5B0A0334F406CAD62F72BEB5D1276C05DD42560A3E64B55A503B944CAA0082304E02904E73576BEAD7D569FF03B269D77102DA89
          Malicious:false
          Reputation:low
          Preview:{"analyticsData":{"responseGUID":"1d0ee425-92b5-4cd2-9ce9-60199c485f96","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1725018653208,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
          File Type:JSON data
          Category:dropped
          Size (bytes):1038
          Entropy (8bit):5.644049489083549
          Encrypted:false
          SSDEEP:24:Yv6XScAFig82LgEF7cciAXs0nl0RCmK8czOCAPtciBCY:YvRmg8ogc8hAh8cvAwY
          MD5:5D578C14B622E0793821E1869FC861FB
          SHA1:2348721AF5E4E1D4D3BEA50C411BBEAB6E1910AE
          SHA-256:2FAEF4402E5847D9063DDB9C84F6348922BAA399D5CD54AA37CEC7D598FFCF04
          SHA-512:DAF1B8452836AFFC467607F386E23DAACD1CA08E2D630C60989AA9AB59ACE152E331282587E93819C1A9921F88CED2AA49E4C33C88E95912F8C6B87A1402F9C7
          Malicious:false
          Reputation:low
          Preview:{"analyticsData":{"responseGUID":"1d0ee425-92b5-4cd2-9ce9-60199c485f96","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1725018653208,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_1","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"49d2f713-7aa9-44db-aa50-0a7a22add459","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVkaXQgdGV4dCwgaW1hZ2VzLCBwYWdlcywgYW5kIG1vcmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme":true},"endDTS":1744

          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
          File Type:JSON data
          Category:dropped
          Size (bytes):1164
          Entropy (8bit):5.6972178281079655
          Encrypted:false
          SSDEEP:24:Yv6XScAFig8KLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK5CY:YvRmg8EgqprtrS5OZjSlwTmAfSKsY
          MD5:71914E1DF71E0F5C3C49570A880F6E39
          SHA1:21F203A060198D3455DC5B963685E6234B1CB26A
          SHA-256:EB539DADB0B0A27E13115E4BDF65D77137A94860BB9FDD52E271E59E15F3AF7A
          SHA-512:C8ADF381D6F79A7E6D23314F743FE40FB5DB7E3300C0AF68BD2211644ACFDD76F304FDE9F8CBB1A795422247C1AE4AD2636794E069FBEF423517C18F003C6D74
          Malicious:false
          Reputation:low
          Preview:{"analyticsData":{"responseGUID":"1d0ee425-92b5-4cd2-9ce9-60199c485f96","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1725018653208,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
          File Type:JSON data
          Category:dropped
          Size (bytes):289
          Entropy (8bit):5.262150647482445
          Encrypted:false
          SSDEEP:6:YEQXJ2HXKIpujcGRx+FIbRI6XVW7+0YREHDeoAvJfYdPeUkwRe9:YvXKXKIGcAUYpW7gkGg8Ukee9
          MD5:8CEBEA477C0A70C473618D6A8291495D
          SHA1:A140C3E59941F5A565957187EC28D39A25A0445F
          SHA-256:6657BB55ABFF3575FCECC443D36786C9E9DC6E5F628066287AD08B25A69643F7
          SHA-512:F7800D80FC243DDAF15DC85FD4693A7A0A6618EAB9E51995DFD2B8D2A60E55F9CAAAD04435EF8A92AEB07E1F76B0F5336AF3850B4F5D0A3E0691F93BB022ECE1
          Malicious:false
          Reputation:low
          Preview:{"analyticsData":{"responseGUID":"1d0ee425-92b5-4cd2-9ce9-60199c485f96","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1725018653208,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
          File Type:JSON data
          Category:dropped
          Size (bytes):1395
          Entropy (8bit):5.770682383781911
          Encrypted:false
          SSDEEP:24:Yv6XScAFigzrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNaY:YvRmgzHgDv3W2aYQfgB5OUupHrQ9FJsY
          MD5:508563A1D319879B6BD59EA5D6E8D532
          SHA1:40D051E4644C6D6B834FE25BE9DD6D18C9BA8611
          SHA-256:2454D9DC22607F8D07A723019AC50196AB50D75939108BA5A3A23FE8071D7513
          SHA-512:C1B27E1A8606366B9AE906F163716B3667D3C429AE219662C6E6948CC99835E94DE4EBE9B7387D232B5362D5AB2A478710E1D1FA70B31C82914770853DC0A273
          Malicious:false
          Reputation:low
          Preview:{"analyticsData":{"responseGUID":"1d0ee425-92b5-4cd2-9ce9-60199c485f96","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1725018653208,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
          File Type:JSON data
          Category:dropped
          Size (bytes):291
          Entropy (8bit):5.245957878163301
          Encrypted:false
          SSDEEP:6:YEQXJ2HXKIpujcGRx+FIbRI6XVW7+0YREHDeoAvJfbPtdPeUkwRe9:YvXKXKIGcAUYpW7gkGDV8Ukee9
          MD5:B6691FBC5A79DD932475D1945FB78C8B
          SHA1:2A05E378EEA8662C165B5C9685B6D294BEF555DC
          SHA-256:C3097189E8BFE30BEB8DE79ED88E8781537557DACC4FFF59F968838CE9D96D50
          SHA-512:7B1CAF863D379F616D51E8606A3E0D46CFDA8793F5A41E82D6E8C032A937B96CECBFCF090C3796DD2BAE5D188219ADE21807F6F93339ADA06E4083B9B0DCC560
          Malicious:false
          Reputation:low
          Preview:{"analyticsData":{"responseGUID":"1d0ee425-92b5-4cd2-9ce9-60199c485f96","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1725018653208,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
          File Type:JSON data
          Category:dropped
          Size (bytes):287
          Entropy (8bit):5.246457455795171
          Encrypted:false
          SSDEEP:6:YEQXJ2HXKIpujcGRx+FIbRI6XVW7+0YREHDeoAvJf21rPeUkwRe9:YvXKXKIGcAUYpW7gkG+16Ukee9
          MD5:14C53695BBF8A8ED90D29466735E69A0
          SHA1:9309E01B4FB02E0C5F357C949C0083560C0682ED
          SHA-256:42CDCA6C4A1299FAAF6BBBC679AD7B9554C6F57C577E59B792C7DED0BD78FA0E
          SHA-512:656081D9D4806C30CE811EC9ACE4D4F00CCC05DA277AC11D4E79FBD6347F61D179C817BF98534C449FAFB36AFFFA23F422A06E8D9979F38322B9C2C7A7373CCA
          Malicious:false
          Reputation:low
          Preview:{"analyticsData":{"responseGUID":"1d0ee425-92b5-4cd2-9ce9-60199c485f96","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1725018653208,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
          File Type:JSON data
          Category:dropped
          Size (bytes):1058
          Entropy (8bit):5.652015094153135
          Encrypted:false
          SSDEEP:24:Yv6XScAFighamXayLgEFRcONaqnl0RCmK8czOC+w2E+tg8BCY:YvRmgtBguOAh8cv+NKHY
          MD5:D64D5BE7D50CFC6A745859A25D596306
          SHA1:D08E39758C4D4D0C9D9AF44C686DF93EFB4C65F2
          SHA-256:DCBF0EBC2A5220B87E26EDCEA67467ACB8AA6900C38B22824C12C9CBE6A57B04
          SHA-512:AC59AFF5A5642A0172E559DBAA3BD5D4364650EB82773D8191DD7279F40D69E9B28D48B7099C7A57FD7F71F505972E73FDE380D53AA9EDFDD19460E2E9A75652
          Malicious:false
          Reputation:low
          Preview:{"analyticsData":{"responseGUID":"1d0ee425-92b5-4cd2-9ce9-60199c485f96","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1725018653208,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_3","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"ece07729-7db6-4f20-9f8d-7976ad373049","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IlNlbmQgZG9jdW1lbnRzICYgZm9ybXNcbmZvciBmYXN0IGUtc2lnbmluZyBvbmxpbmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme"

          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
          File Type:JSON data
          Category:dropped
          Size (bytes):286
          Entropy (8bit):5.221869550484532
          Encrypted:false
          SSDEEP:6:YEQXJ2HXKIpujcGRx+FIbRI6XVW7+0YREHDeoAvJfshHHrPeUkwRe9:YvXKXKIGcAUYpW7gkGUUUkee9
          MD5:FD96BB6AF2004FED1B9C77368C962B06
          SHA1:E3110B77A52C640EFB93CA35AEC52AF2FEA61508
          SHA-256:CA91D0BB4BCA6FA181CA499E8F1B7FDB3EC4AD65ECA8A1069B82202A922A48CD
          SHA-512:587FEC3EBCCAA4E47E6CC9C1DD2E128055C95E14D83A7391A1ED13D7B2E823AD6099076AC14BF0A31BB8930EB2F9189ABE2EC9BD97A672EA16CCAEED8FCAA6DD
          Malicious:false
          Reputation:low
          Preview:{"analyticsData":{"responseGUID":"1d0ee425-92b5-4cd2-9ce9-60199c485f96","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1725018653208,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
          File Type:JSON data
          Category:dropped
          Size (bytes):782
          Entropy (8bit):5.358398939282312
          Encrypted:false
          SSDEEP:12:YvXKXKIGcAUYpW7gkGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWriY:Yv6XScAFigK168CgEXX5kcIfANhtY
          MD5:46A862834B8003BE88076D5CD523307B
          SHA1:37DB1E58EF9F5F1ACE56C65DC6951CD453A4A879
          SHA-256:6315F308F0D6A95DDD5D9857479C1DCFE1B302859F20ABB236C014324FAEAFB2
          SHA-512:DD6022149A2749371693DFA3531E7CA6B7E7406FBB4EE997E924F0B5453140D1ED7097E99071FCC54F3FF2C1320020D366A72F8D92B5AF180F31A55386794687
          Malicious:false
          Reputation:low
          Preview:{"analyticsData":{"responseGUID":"1d0ee425-92b5-4cd2-9ce9-60199c485f96","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1725018653208,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1724839628233}}}}

          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
          File Type:data
          Category:dropped
          Size (bytes):4
          Entropy (8bit):0.8112781244591328
          Encrypted:false
          SSDEEP:3:e:e
          MD5:DC84B0D741E5BEAE8070013ADDCC8C28
          SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
          SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
          SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
          Malicious:false
          Reputation:low
          Preview:....

          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
          File Type:JSON data
          Category:dropped
          Size (bytes):2818
          Entropy (8bit):5.145647929996231
          Encrypted:false
          SSDEEP:24:Y0fh/VzaYaydvGpuMr5BBW2CcMlAMRvluTwjej0S0eICY2lT12LSe3o0/5jr79CN:Y0fPvGp3r53V8CMDnA6fmc3o0/V79u
          MD5:A8892D60677B55C20F5C5D6E72BC30D0
          SHA1:3CA0C52559B1ECACE1BC23038EB71C0D5E2BA298
          SHA-256:3067F0E1107A325F9DFC45F80018E7DBED8F2F7F0FC9CE8ECDEE74333BE78801
          SHA-512:69DE075437FE15259FCE1BB43DD994F73ED108224E5364BC2043B97C1140FC889D7DF4064ABB08D43FA078E7234AEA85A136CA29EC2131317F15A53E18EEDF05
          Malicious:false
          Reputation:low
          Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"5634cd761b0a6d53943e8ab26305044d","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1050,"ts":1724839627000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"8dd83e975524d8ae0c0b3c03c9c5be13","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1724839627000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"475693f5118374262cb4637f25a8320f","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1058,"ts":1724839627000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"89f3cbdb91a9195574326c491f45c7b8","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1063,"ts":1724839627000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"7e8252c3d1b3cbe251cb0769d9f0e515","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1038,"ts":1724839627000},{"id":"Edit_InApp_Aug2020","info":{"dg":"04a1f3a609d3773968d54b9c5acffc52","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":17

          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
          File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
          Category:dropped
          Size (bytes):12288
          Entropy (8bit):0.9836068164314128
          Encrypted:false
          SSDEEP:24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Spwr4zJwtNBwtNbRZ6bRZ4HrF:TVl2GL7ms6ggOVphzutYtp6PA
          MD5:1DE31994047D3850D39CFCE0292854A4
          SHA1:C03DBC624DB5AFA0AF16E8322CC25212E12A30EA
          SHA-256:5666EC035468EE6D7D46531FDD3CC8A946BE1B5EA9F7AF3D858DD76161EA48E5
          SHA-512:4E499D250FB5533E92B4C9D68E5C0D19C449A39EBE182B7320145CC50A60129CE67B0E4B8DC15B7146C5D96849A9C4363509A770FF90E65D14BE92CB8EB8ED58
          Malicious:false
          Reputation:low
          Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
          File Type:SQLite Rollback Journal
          Category:dropped
          Size (bytes):8720
          Entropy (8bit):1.3369713139804886
          Encrypted:false
          SSDEEP:24:7+tNAD1RZKHs/Ds/SpwrPzJwtNBwtNbRZ6bRZWf1RZKefqLBx/XYKQvGJF7urss:7MNGgOVp6zutYtp6PMZqll2GL7mss
          MD5:159D29C6FB5F1DAC26FD7B21BF7902A9
          SHA1:3BEEF67374C12F0AFD40726AAF2781D4CBF1FD7C
          SHA-256:6CF12F6B352F342DBDF74B5B5B7E57E3970AD1FE1AD050218BE09A33196CB6C9
          SHA-512:E9E1BE3CC315CEA9DDD4967BDB34EB1CE29FC8B9CB277CB9683B234ED2E52629002AC0B47633D730C9C41B16CB95B1F765F00353270668BE75D895BD6F95B24B
          Malicious:false
          Reputation:low
          Preview:.... .c.....yB.'......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

          C:\Users\user\AppData\Local\Temp\MSIf1188.LOG

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
          Category:dropped
          Size (bytes):246
          Entropy (8bit):3.5274671434738973
          Encrypted:false
          SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8duSww:Qw946cPbiOxDlbYnuRKzk
          MD5:CA81CB31845CEE100CF636B16FE1B1A4
          SHA1:CB21CB4649895CCBE849C3A6915F116273333440
          SHA-256:8123E387965C653B03DE51E9348388D4CBBD78C4F33B08C3A336D2A73F5A0C50
          SHA-512:5498A9B2243A3FD33BB751AC56D7C527612E56689194A46CD0453B3E50F78ED7D42B6490872477166B544BFC7266AF3C13458478B64C8D80DA6FFA7507909EBC
          Malicious:false
          Reputation:low
          Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.8./.0.8./.2.0.2.4. . .0.6.:.0.7.:.0.9. .=.=.=.....

          C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-08-28 06-07-04-140.log

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
          File Type:ASCII text, with very long lines (393)
          Category:dropped
          Size (bytes):16525
          Entropy (8bit):5.376360055978702
          Encrypted:false
          SSDEEP:384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
          MD5:1336667A75083BF81E2632FABAA88B67
          SHA1:46E40800B27D95DAED0DBB830E0D0BA85C031D40
          SHA-256:F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
          SHA-512:D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
          Malicious:false
          Reputation:low
          Preview:SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

          C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
          File Type:ASCII text, with very long lines (393), with CRLF line terminators
          Category:dropped
          Size (bytes):16603
          Entropy (8bit):5.321240002149558
          Encrypted:false
          SSDEEP:384:N4spssdEXZyilpgjKMbIVT1oACN0MKqplumC4wyMt4EE29SPvYRKNyNNE2EnlmOX:EFfw
          MD5:66D036ACED7A18B9245363D33837E00B
          SHA1:FD072393E6A3C2451A0DC9B1CCABF408553A2D4C
          SHA-256:1926A675BF51342938A81E4CEAD0B1A1D373F3C2D9EBABD50EE9DF70BD31067B
          SHA-512:347AA3A1F03CEAE215C2AF56D30BFDCE8E62E5E6C9ED2491B9F8B0211D7474C2990F585759D49DD5CA79469E0D71EFE676CD76EC6C3E7F47A5851C5DA45D6035
          Malicious:false
          Reputation:low
          Preview:SessionID=08432c08-2a7b-431a-a741-2b77bfa021d1.1724839624153 Timestamp=2024-08-28T06:07:04:153-0400 ThreadID=3608 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=08432c08-2a7b-431a-a741-2b77bfa021d1.1724839624153 Timestamp=2024-08-28T06:07:04:154-0400 ThreadID=3608 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=08432c08-2a7b-431a-a741-2b77bfa021d1.1724839624153 Timestamp=2024-08-28T06:07:04:154-0400 ThreadID=3608 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=08432c08-2a7b-431a-a741-2b77bfa021d1.1724839624153 Timestamp=2024-08-28T06:07:04:154-0400 ThreadID=3608 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=08432c08-2a7b-431a-a741-2b77bfa021d1.1724839624153 Timestamp=2024-08-28T06:07:04:154-0400 ThreadID=3608 Component=ngl-lib_NglAppLib Description="SetConf

          C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
          File Type:ASCII text, with CRLF line terminators
          Category:dropped
          Size (bytes):29752
          Entropy (8bit):5.399018847776903
          Encrypted:false
          SSDEEP:768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGb2:C
          MD5:C4FA57AADC116847F0569A065974C633
          SHA1:85BBF9788E780D447199539C5896C3F69D9E9FA5
          SHA-256:329C8C3D03581093784E9DEFA7084E2BF5D05CD84E68D103AFF2F455E069EF90
          SHA-512:0CD1FF20BB7813A32479291B72B7757C44CE2FB17F3D259CC8114A5581268DB87A06F5C2C4CAD50D17F87F0F1A6C20062B5B03643803A8CCD13BD81B2EB075C3
          Malicious:false
          Reputation:low
          Preview:04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

          C:\Users\user\AppData\Local\Temp\acrocef_low\1382c385-8d93-4374-97a7-f8f0793b2c87.tmp

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
          File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
          Category:dropped
          Size (bytes):1419751
          Entropy (8bit):7.976496077007677
          Encrypted:false
          SSDEEP:24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
          MD5:95F182500FC92778102336D2D5AADCC8
          SHA1:BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
          SHA-256:9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
          SHA-512:D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
          Malicious:false
          Reputation:low
          Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

          C:\Users\user\AppData\Local\Temp\acrocef_low\3672495f-a69b-4009-9a86-174ebf52fcdd.tmp

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
          File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
          Category:dropped
          Size (bytes):386528
          Entropy (8bit):7.9736851559892425
          Encrypted:false
          SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
          MD5:5C48B0AD2FEF800949466AE872E1F1E2
          SHA1:337D617AE142815EDDACB48484628C1F16692A2F
          SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
          SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
          Malicious:false
          Reputation:low
          Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

          C:\Users\user\AppData\Local\Temp\acrocef_low\5ca726d1-bcdc-4f53-902f-8826e5fb4789.tmp

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
          File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
          Category:dropped
          Size (bytes):1407294
          Entropy (8bit):7.97605879016224
          Encrypted:false
          SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
          MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
          SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
          SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
          SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
          Malicious:false
          Reputation:low
          Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

          C:\Users\user\AppData\Local\Temp\acrocef_low\72072104-8063-4965-b1d6-0ba13c6d32a1.tmp

          Download File
          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
          File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
          Category:dropped
          Size (bytes):758601
          Entropy (8bit):7.98639316555857
          Encrypted:false
          SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
          MD5:3A49135134665364308390AC398006F1
          SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
          SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
          SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
          Malicious:false
          Reputation:low
          Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

          Download File
          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Aug 28 09:05:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
          Category:dropped
          Size (bytes):2677
          Entropy (8bit):3.977557224567105
          Encrypted:false
          SSDEEP:48:8oJdVT9ZNcHxZidAKZdA19ehwiZUklqehTy+3:8CPNIIy
          MD5:CA05852D5D14416CD8EB869472B648B5
          SHA1:DFE431B858CEC16609224705318141D429C2ADAD
          SHA-256:24B6A6A6563FC53D9140454143C7572E49EDC7CD1FEA25C7D3A3E25B3FFCDA3F
          SHA-512:5A219184549E926B8F6D30AC70AC94D7937ED0F19BE0717A45BE544EDD742BBF48A031D46D027128AE33E3555E8E077BF44CBB3AF85E0A22C2D91DCF34B19A12
          Malicious:false
          Reputation:low
          Preview:L..................F.@.. ...$+.,......u.1...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.P....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.P....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.P....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.P..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.P...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

          Download File
          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Aug 28 09:05:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
          Category:dropped
          Size (bytes):2679
          Entropy (8bit):3.989308770956425
          Encrypted:false
          SSDEEP:48:8aJdVT9ZNcHxZidAKZdA1weh/iZUkAQkqeh4y+2:8sPNC9Q1y
          MD5:29DD832A689F1C87B275401930C01B73
          SHA1:09A858832018A3032C5AA4F9E9C3177FB81B47DE
          SHA-256:4FC4DB8CDDE16242761FFE01DA12FB07283B6FCF0929C3C3F850BA6E516D241C
          SHA-512:D81D4CA80BA37131EB929378B3E724A993742032A8507F69903EAB4A05994C867F8209F3623163ECAE4F12DA8377B371A08AC492870C85C1252F5E8C89A6C2E5
          Malicious:false
          Reputation:low
          Preview:L..................F.@.. ...$+.,....p.j.1...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.P....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.P....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.P....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.P..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.P...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

          Download File
          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
          Category:dropped
          Size (bytes):2693
          Entropy (8bit):4.004288990090917
          Encrypted:false
          SSDEEP:48:8x+JdVT9ZsHxZidAKZdA14tseh7sFiZUkmgqeh7s6y+BX:8xwPanUy
          MD5:E6104E938435C1A3799D13115BD7853C
          SHA1:FB912736CA743430622E35E03A91908D523B80B2
          SHA-256:F1D17242E04A9B8039DDF6A78CE9AEF3452D75EB2D1C74F8DA57F0C93D0864DA
          SHA-512:A8BADF027BF14DCA49D0293AA4F8C084D6BBA84631284B944E6DDA63C91E9322A741BCE456651B5A384FBD9C196C46D5EEDA8F1736C80FB4228B13DF0B32D936
          Malicious:false
          Reputation:low
          Preview:L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.P....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.P....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.P....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.P..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

          Download File
          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Aug 28 09:05:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
          Category:dropped
          Size (bytes):2681
          Entropy (8bit):3.9914906573368745
          Encrypted:false
          SSDEEP:48:8XJdVT9ZNcHxZidAKZdA1vehDiZUkwqeh8y+R:8hPNJCy
          MD5:EF1F606EF25D6CA4E0B2A3E0C935FEB5
          SHA1:6D9D74BA10C63C9206C119C37DDC68F33AF6B59B
          SHA-256:969F5334B74CAD085096EF3E95531938542D0A39F650895AC613953062F8A60C
          SHA-512:D1180105FA3FBFE8F57544505AC5E78FF6BABC9D4ED1EA5A8E7C6B7B6430F2D70376D94706D6015FD2955839816165AC458A6D318EE20EB4B8BB4F5D0D931218
          Malicious:false
          Reputation:low
          Preview:L..................F.@.. ...$+.,......d.1...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.P....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.P....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.P....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.P..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.P...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

          Download File
          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Aug 28 09:05:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
          Category:dropped
          Size (bytes):2681
          Entropy (8bit):3.9791941228835213
          Encrypted:false
          SSDEEP:48:8TJdVT9ZNcHxZidAKZdA1hehBiZUk1W1qehGy+C:8tPN59my
          MD5:430789ED2E0BB71AFCD16D23A20C0D0E
          SHA1:CD7B8614F50B6CBD1A6DFF8CA2CAD476EB93ADA9
          SHA-256:10BD7625671F3386DCFEA01951C2CE90775662C87A66ED88C3B47314B703423A
          SHA-512:9D0B28034C32287A7140B35F0AB3F8C9309756BEC00F8C60EED27D632EDB48D1F03DB4D34F8D1DF2FD38AD777F4568AEC20556456AD630B8B1DF2EB57C2F32B7
          Malicious:false
          Reputation:low
          Preview:L..................F.@.. ...$+.,.....?p.1...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.P....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.P....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.P....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.P..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.P...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

          Download File
          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Aug 28 09:05:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
          Category:dropped
          Size (bytes):2683
          Entropy (8bit):3.9930151277599917
          Encrypted:false
          SSDEEP:48:8gJdVT9ZNcHxZidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbUy+yT+:86PNFT/TbxWOvTbUy7T
          MD5:90AA5CF9FE8FEC93E957B24072D9C577
          SHA1:C4B3F8F93DD319F6F342942FC8F9B428BE800E2C
          SHA-256:BF8761A0DE0ED507398F73ECA282D2365D645574BDC494B107B631935576A990
          SHA-512:2131954402ED0E8EC14804732CC7EBD26E3E1F00C304F26EA26DCD3F8931E3547FDAB0155DA312B0E78A8D7AA8EE75C7881A3FD2251C4274644609602777C8D4
          Malicious:false
          Reputation:low
          Preview:L..................F.@.. ...$+.,......[.1...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.P....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.P....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.P....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.P..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.P...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

          C:\Users\user\Downloads\0c266ecf-0026-4c4e-ac45-33d4f7789ae3.tmp

          Download File
          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
          File Type:PDF document, version 1.4, 1 pages
          Category:dropped
          Size (bytes):36092
          Entropy (8bit):7.965502887431051
          Encrypted:false
          SSDEEP:768:gk9UD27mwZjSxs5FwCnpxR+09nkwhhjcaU+wscFc9F/P2JHGbc:gkyD27mAjSS51vhhjcaU+dcP
          MD5:E0B323E296969729209B97B07A237CCD
          SHA1:FADE4D826FAB3D761702238C93E359EEAF67F5B9
          SHA-256:A9B7BAB1157E8D7A4839B77B0CDA02DDE82F0ED1E7E155D9A634BD7E0B6A21A5
          SHA-512:6E756554DBFB568507D5A3C56AB1623EB842A019F281DD9DDB4F0996CCF3CA5B8355F87082CCD8DE9DF28637C28C8A322BE8D5BFE62CE6F7DFF38504F51EBE99
          Malicious:false
          Reputation:low
          Preview:%PDF-1.4.%.....3 0 obj.<</Length 996/Filter/FlateDecode>>stream.x....N.@..W../."!......T....k.H......j{..^.X=....tf.............wf6.%.f.2..L:.....F...._{.".2.}O..`..M.%;g=6.O=.<a....7..K....&{..;....../.I^....c.......G..y..U...G.9..=.C[6.].}Qw.I..'...Hw.........H...n.C...^..g.*.........]2=..c...Gs..T.P ......3..1.D......:2x#=......l.DMi..&..c....*.l#.....+=.j.<..d..~W..C.<e<O...5.Cs......o.7...U..+.2Kc..$...y.\..l...gi;......+..^X..Q....*p..v.V.0.F..t-..0..r....0...!..F.Q..1a`..#.Z..1a]{.I.i...>..j...o\.."!2Ol.q.*K.'.v......]C..wa..(..~...5...$!x....B.U...o5.<.,:m..r.....ek.[K*...-..a;....*[.....\3...9.E.5\...C..p.|.8F.&..Ji=....P!.c$f..O.L..]~.W}.8r...;Sx1.W..j...)......Y8k..q...>.w.y.\*.].jI...g...=w...T...."./.[Ap.<.....I.6O.P...L!Gpr.{h87D...........I...i...<o..i5.......9IkSpmIs.Z.2..6..)...>ta.....M.uh..C.97.....]......m.^...1.."`...M....7...-v........@...R.....Y].Z.....m.0.%Ql=...e..K@....c#!L...~.6{d..WJ...7(

          C:\Users\user\Downloads\341b1295-1cdf-40d0-aa16-3ea6aec4e0da.tmp

          Download File
          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
          File Type:PDF document, version 1.4, 1 pages
          Category:dropped
          Size (bytes):36092
          Entropy (8bit):7.965502887431051
          Encrypted:false
          SSDEEP:768:gk9UD27mwZjSxs5FwCnpxR+09nkwhhjcaU+wscFc9F/P2JHGbc:gkyD27mAjSS51vhhjcaU+dcP
          MD5:E0B323E296969729209B97B07A237CCD
          SHA1:FADE4D826FAB3D761702238C93E359EEAF67F5B9
          SHA-256:A9B7BAB1157E8D7A4839B77B0CDA02DDE82F0ED1E7E155D9A634BD7E0B6A21A5
          SHA-512:6E756554DBFB568507D5A3C56AB1623EB842A019F281DD9DDB4F0996CCF3CA5B8355F87082CCD8DE9DF28637C28C8A322BE8D5BFE62CE6F7DFF38504F51EBE99
          Malicious:false
          Reputation:low
          Preview:%PDF-1.4.%.....3 0 obj.<</Length 996/Filter/FlateDecode>>stream.x....N.@..W../."!......T....k.H......j{..^.X=....tf.............wf6.%.f.2..L:.....F...._{.".2.}O..`..M.%;g=6.O=.<a....7..K....&{..;....../.I^....c.......G..y..U...G.9..=.C[6.].}Qw.I..'...Hw.........H...n.C...^..g.*.........]2=..c...Gs..T.P ......3..1.D......:2x#=......l.DMi..&..c....*.l#.....+=.j.<..d..~W..C.<e<O...5.Cs......o.7...U..+.2Kc..$...y.\..l...gi;......+..^X..Q....*p..v.V.0.F..t-..0..r....0...!..F.Q..1a`..#.Z..1a]{.I.i...>..j...o\.."!2Ol.q.*K.'.v......]C..wa..(..~...5...$!x....B.U...o5.<.,:m..r.....ek.[K*...-..a;....*[.....\3...9.E.5\...C..p.|.8F.&..Ji=....P!.c$f..O.L..]~.W}.8r...;Sx1.W..j...)......Y8k..q...>.w.y.\*.].jI...g...=w...T...."./.[Ap.<.....I.6O.P...L!Gpr.{h87D...........I...i...<o..i5.......9IkSpmIs.Z.2..6..)...>ta.....M.uh..C.97.....]......m.^...1.."`...M....7...-v........@...R.....Y].Z.....m.0.%Ql=...e..K@....c#!L...~.6{d..WJ...7(

          C:\Users\user\Downloads\downloaded.pdf (copy)

          Download File
          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
          File Type:PDF document, version 1.4, 1 pages
          Category:dropped
          Size (bytes):36092
          Entropy (8bit):7.965502887431051
          Encrypted:false
          SSDEEP:768:gk9UD27mwZjSxs5FwCnpxR+09nkwhhjcaU+wscFc9F/P2JHGbc:gkyD27mAjSS51vhhjcaU+dcP
          MD5:E0B323E296969729209B97B07A237CCD
          SHA1:FADE4D826FAB3D761702238C93E359EEAF67F5B9
          SHA-256:A9B7BAB1157E8D7A4839B77B0CDA02DDE82F0ED1E7E155D9A634BD7E0B6A21A5
          SHA-512:6E756554DBFB568507D5A3C56AB1623EB842A019F281DD9DDB4F0996CCF3CA5B8355F87082CCD8DE9DF28637C28C8A322BE8D5BFE62CE6F7DFF38504F51EBE99
          Malicious:false
          Reputation:low
          Preview:%PDF-1.4.%.....3 0 obj.<</Length 996/Filter/FlateDecode>>stream.x....N.@..W../."!......T....k.H......j{..^.X=....tf.............wf6.%.f.2..L:.....F...._{.".2.}O..`..M.%;g=6.O=.<a....7..K....&{..;....../.I^....c.......G..y..U...G.9..=.C[6.].}Qw.I..'...Hw.........H...n.C...^..g.*.........]2=..c...Gs..T.P ......3..1.D......:2x#=......l.DMi..&..c....*.l#.....+=.j.<..d..~W..C.<e<O...5.Cs......o.7...U..+.2Kc..$...y.\..l...gi;......+..^X..Q....*p..v.V.0.F..t-..0..r....0...!..F.Q..1a`..#.Z..1a]{.I.i...>..j...o\.."!2Ol.q.*K.'.v......]C..wa..(..~...5...$!x....B.U...o5.<.,:m..r.....ek.[K*...-..a;....*[.....\3...9.E.5\...C..p.|.8F.&..Ji=....P!.c$f..O.L..]~.W}.8r...;Sx1.W..j...)......Y8k..q...>.w.y.\*.].jI...g...=w...T...."./.[Ap.<.....I.6O.P...L!Gpr.{h87D...........I...i...<o..i5.......9IkSpmIs.Z.2..6..)...>ta.....M.uh..C.97.....]......m.^...1.."`...M....7...-v........@...R.....Y].Z.....m.0.%Ql=...e..K@....c#!L...~.6{d..WJ...7(

          C:\Users\user\Downloads\downloaded.pdf.crdownload (copy)

          Download File
          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
          File Type:PDF document, version 1.4, 1 pages
          Category:dropped
          Size (bytes):36092
          Entropy (8bit):7.965502887431051
          Encrypted:false
          SSDEEP:768:gk9UD27mwZjSxs5FwCnpxR+09nkwhhjcaU+wscFc9F/P2JHGbc:gkyD27mAjSS51vhhjcaU+dcP
          MD5:E0B323E296969729209B97B07A237CCD
          SHA1:FADE4D826FAB3D761702238C93E359EEAF67F5B9
          SHA-256:A9B7BAB1157E8D7A4839B77B0CDA02DDE82F0ED1E7E155D9A634BD7E0B6A21A5
          SHA-512:6E756554DBFB568507D5A3C56AB1623EB842A019F281DD9DDB4F0996CCF3CA5B8355F87082CCD8DE9DF28637C28C8A322BE8D5BFE62CE6F7DFF38504F51EBE99
          Malicious:false
          Reputation:low
          Preview:%PDF-1.4.%.....3 0 obj.<</Length 996/Filter/FlateDecode>>stream.x....N.@..W../."!......T....k.H......j{..^.X=....tf.............wf6.%.f.2..L:.....F...._{.".2.}O..`..M.%;g=6.O=.<a....7..K....&{..;....../.I^....c.......G..y..U...G.9..=.C[6.].}Qw.I..'...Hw.........H...n.C...^..g.*.........]2=..c...Gs..T.P ......3..1.D......:2x#=......l.DMi..&..c....*.l#.....+=.j.<..d..~W..C.<e<O...5.Cs......o.7...U..+.2Kc..$...y.\..l...gi;......+..^X..Q....*p..v.V.0.F..t-..0..r....0...!..F.Q..1a`..#.Z..1a]{.I.i...>..j...o\.."!2Ol.q.*K.'.v......]C..wa..(..~...5...$!x....B.U...o5.<.,:m..r.....ek.[K*...-..a;....*[.....\3...9.E.5\...C..p.|.8F.&..Ji=....P!.c$f..O.L..]~.W}.8r...;Sx1.W..j...)......Y8k..q...>.w.y.\*.].jI...g...=w...T...."./.[Ap.<.....I.6O.P...L!Gpr.{h87D...........I...i...<o..i5.......9IkSpmIs.Z.2..6..)...>ta.....M.uh..C.97.....]......m.^...1.."`...M....7...-v........@...R.....Y].Z.....m.0.%Ql=...e..K@....c#!L...~.6{d..WJ...7(

          Chrome Cache Entry: 225

          Download File
          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
          File Type:JSON data
          Category:downloaded
          Size (bytes):100
          Entropy (8bit):4.712531001095376
          Encrypted:false
          SSDEEP:3:YRM9WREaxIyZfF1x2ybLvSaijJpOTS+MdLLMi:YsWioH1gcLKnJpOTSzJLMi
          MD5:620488CDEF248039C496D858AFABD75C
          SHA1:7D1A18F9DA2264202E8D6A3159A62A2DC7408D62
          SHA-256:94A532148734DDB96FDCC092682FAF962A005001AFCF9F92C53E84DBF546F156
          SHA-512:6D7E2DD5BEB466DA6482C05E4F2A560F27C3C7BA8E8977A347157314BF39CDAC677DA8307E03164BD05FB3CCE0677FC945570BC4212B92F63B881C3173539873
          Malicious:false
          Reputation:low
          URL:https://api.elementarypos.com/favicon.ico
          Preview:{"timestamp":"2024-08-28T10:05:46.661+00:00","status":404,"error":"Not Found","path":"/favicon.ico"}

          Chrome Cache Entry: 226

          Download File
          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
          File Type:PDF document, version 1.4, 1 pages
          Category:downloaded
          Size (bytes):36092
          Entropy (8bit):7.965722270667505
          Encrypted:false
          SSDEEP:768:gk9UD27mwZjSxs5FwCnpxR+9Unk1hhjcaU+wscFc9F/P23GxqUSbQ:gkyD27mAjSS51N6hjcaU+dcbQjJ
          MD5:14227FFDB82E825E0477003BA7D8D4FB
          SHA1:69B44E2FFCD99A907678EAFD22E834A20B5869A1
          SHA-256:098E5323E9F393CC197D8490049CBAA9190DBD1BB084C4B69B5A58FCD5821F22
          SHA-512:238E957807707C82BCF8F5EC8B6B70736D0CDCCD3EF5CF3BECB07E5D3F14D4DC60CE2D41F2D02E0F1BA2150E8B48D8E54D2DC53460923942FA852CA9C5FAC4AE
          Malicious:false
          Reputation:low
          URL:https://api.elementarypos.com/doc/receipt/97ad00f9-6c1f-4536-81e7-8bc31d2f3b10
          Preview:%PDF-1.4.%.....3 0 obj.<</Length 996/Filter/FlateDecode>>stream.x....N.@..W../."!......T....k.H......j{..^.X=....tf.............wf6.%.f.2..L:.....F...._{.".2.}O..`..M.%;g=6.O=.<a....7..K....&{..;....../.I^....c.......G..y..U...G.9..=.C[6.].}Qw.I..'...Hw.........H...n.C...^..g.*.........]2=..c...Gs..T.P ......3..1.D......:2x#=......l.DMi..&..c....*.l#.....+=.j.<..d..~W..C.<e<O...5.Cs......o.7...U..+.2Kc..$...y.\..l...gi;......+..^X..Q....*p..v.V.0.F..t-..0..r....0...!..F.Q..1a`..#.Z..1a]{.I.i...>..j...o\.."!2Ol.q.*K.'.v......]C..wa..(..~...5...$!x....B.U...o5.<.,:m..r.....ek.[K*...-..a;....*[.....\3...9.E.5\...C..p.|.8F.&..Ji=....P!.c$f..O.L..]~.W}.8r...;Sx1.W..j...)......Y8k..q...>.w.y.\*.].jI...g...=w...T...."./.[Ap.<.....I.6O.P...L!Gpr.{h87D...........I...i...<o..i5.......9IkSpmIs.Z.2..6..)...>ta.....M.uh..C.97.....]......m.^...1.."`...M....7...-v........@...R.....Y].Z.....m.0.%Ql=...e..K@....c#!L...~.6{d..WJ...7(

          Static File Info

          ⊘No static file info

          File Icon

          Icon Hash:00b29a8e86828200

          Network Behavior

          Network Port Distribution

          TCP Packets

          TimestampSource PortDest PortSource IPDest IP
          Aug 28, 2024 12:05:37.044229031 CEST49675443192.168.2.523.1.237.91
          Aug 28, 2024 12:05:37.044230938 CEST49674443192.168.2.523.1.237.91
          Aug 28, 2024 12:05:37.372317076 CEST49673443192.168.2.523.1.237.91
          Aug 28, 2024 12:05:43.996931076 CEST49709443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:43.996979952 CEST443497093.75.191.100192.168.2.5
          Aug 28, 2024 12:05:43.997075081 CEST49709443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:43.999208927 CEST49710443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:43.999218941 CEST443497103.75.191.100192.168.2.5
          Aug 28, 2024 12:05:43.999283075 CEST49710443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:43.999759912 CEST49710443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:43.999774933 CEST443497103.75.191.100192.168.2.5
          Aug 28, 2024 12:05:44.000086069 CEST49709443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:44.000097036 CEST443497093.75.191.100192.168.2.5
          Aug 28, 2024 12:05:44.642976999 CEST443497103.75.191.100192.168.2.5
          Aug 28, 2024 12:05:44.643301964 CEST49710443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:44.643326998 CEST443497103.75.191.100192.168.2.5
          Aug 28, 2024 12:05:44.643722057 CEST443497093.75.191.100192.168.2.5
          Aug 28, 2024 12:05:44.643868923 CEST49709443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:44.643876076 CEST443497093.75.191.100192.168.2.5
          Aug 28, 2024 12:05:44.644273043 CEST443497103.75.191.100192.168.2.5
          Aug 28, 2024 12:05:44.644334078 CEST49710443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:44.644917965 CEST443497093.75.191.100192.168.2.5
          Aug 28, 2024 12:05:44.644974947 CEST49709443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:44.645478010 CEST49710443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:44.645551920 CEST443497103.75.191.100192.168.2.5
          Aug 28, 2024 12:05:44.645849943 CEST49709443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:44.645915985 CEST443497093.75.191.100192.168.2.5
          Aug 28, 2024 12:05:44.646195889 CEST49710443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:44.646203995 CEST443497103.75.191.100192.168.2.5
          Aug 28, 2024 12:05:44.686933041 CEST49710443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:44.716555119 CEST49709443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:44.716573000 CEST443497093.75.191.100192.168.2.5
          Aug 28, 2024 12:05:44.908510923 CEST49709443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:45.013020992 CEST443497103.75.191.100192.168.2.5
          Aug 28, 2024 12:05:45.013045073 CEST443497103.75.191.100192.168.2.5
          Aug 28, 2024 12:05:45.013056993 CEST443497103.75.191.100192.168.2.5
          Aug 28, 2024 12:05:45.013071060 CEST443497103.75.191.100192.168.2.5
          Aug 28, 2024 12:05:45.013103008 CEST443497103.75.191.100192.168.2.5
          Aug 28, 2024 12:05:45.013273954 CEST49710443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:45.013274908 CEST49710443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:45.013307095 CEST443497103.75.191.100192.168.2.5
          Aug 28, 2024 12:05:45.013354063 CEST49710443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:45.014807940 CEST443497103.75.191.100192.168.2.5
          Aug 28, 2024 12:05:45.014827013 CEST443497103.75.191.100192.168.2.5
          Aug 28, 2024 12:05:45.014863968 CEST443497103.75.191.100192.168.2.5
          Aug 28, 2024 12:05:45.014902115 CEST49710443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:45.014910936 CEST443497103.75.191.100192.168.2.5
          Aug 28, 2024 12:05:45.014931917 CEST443497103.75.191.100192.168.2.5
          Aug 28, 2024 12:05:45.014961958 CEST49710443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:45.014988899 CEST49710443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:45.025535107 CEST49710443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:45.025557041 CEST443497103.75.191.100192.168.2.5
          Aug 28, 2024 12:05:46.496180058 CEST49709443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:46.540504932 CEST443497093.75.191.100192.168.2.5
          Aug 28, 2024 12:05:46.646100998 CEST49675443192.168.2.523.1.237.91
          Aug 28, 2024 12:05:46.646100998 CEST49674443192.168.2.523.1.237.91
          Aug 28, 2024 12:05:46.756937981 CEST443497093.75.191.100192.168.2.5
          Aug 28, 2024 12:05:46.757030964 CEST443497093.75.191.100192.168.2.5
          Aug 28, 2024 12:05:46.757247925 CEST49709443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:46.830431938 CEST49709443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:46.830459118 CEST443497093.75.191.100192.168.2.5
          Aug 28, 2024 12:05:46.986531973 CEST49673443192.168.2.523.1.237.91
          Aug 28, 2024 12:05:47.214456081 CEST49713443192.168.2.5184.28.90.27
          Aug 28, 2024 12:05:47.214509964 CEST44349713184.28.90.27192.168.2.5
          Aug 28, 2024 12:05:47.214610100 CEST49713443192.168.2.5184.28.90.27
          Aug 28, 2024 12:05:47.216440916 CEST49713443192.168.2.5184.28.90.27
          Aug 28, 2024 12:05:47.216454983 CEST44349713184.28.90.27192.168.2.5
          Aug 28, 2024 12:05:47.330080032 CEST49714443192.168.2.5142.250.185.68
          Aug 28, 2024 12:05:47.330107927 CEST44349714142.250.185.68192.168.2.5
          Aug 28, 2024 12:05:47.330166101 CEST49714443192.168.2.5142.250.185.68
          Aug 28, 2024 12:05:47.333601952 CEST49714443192.168.2.5142.250.185.68
          Aug 28, 2024 12:05:47.333622932 CEST44349714142.250.185.68192.168.2.5
          Aug 28, 2024 12:05:47.349493027 CEST49715443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:47.349539042 CEST443497153.75.191.100192.168.2.5
          Aug 28, 2024 12:05:47.349775076 CEST49715443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:47.350289106 CEST49715443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:47.350302935 CEST443497153.75.191.100192.168.2.5
          Aug 28, 2024 12:05:47.857619047 CEST44349713184.28.90.27192.168.2.5
          Aug 28, 2024 12:05:47.857692957 CEST49713443192.168.2.5184.28.90.27
          Aug 28, 2024 12:05:47.871840000 CEST49713443192.168.2.5184.28.90.27
          Aug 28, 2024 12:05:47.871865034 CEST44349713184.28.90.27192.168.2.5
          Aug 28, 2024 12:05:47.872095108 CEST44349713184.28.90.27192.168.2.5
          Aug 28, 2024 12:05:47.919195890 CEST49713443192.168.2.5184.28.90.27
          Aug 28, 2024 12:05:47.985234022 CEST443497153.75.191.100192.168.2.5
          Aug 28, 2024 12:05:47.992681026 CEST44349714142.250.185.68192.168.2.5
          Aug 28, 2024 12:05:48.018158913 CEST49715443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:48.018183947 CEST443497153.75.191.100192.168.2.5
          Aug 28, 2024 12:05:48.018412113 CEST49714443192.168.2.5142.250.185.68
          Aug 28, 2024 12:05:48.018434048 CEST44349714142.250.185.68192.168.2.5
          Aug 28, 2024 12:05:48.018620968 CEST443497153.75.191.100192.168.2.5
          Aug 28, 2024 12:05:48.021256924 CEST49715443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:48.021346092 CEST443497153.75.191.100192.168.2.5
          Aug 28, 2024 12:05:48.021425962 CEST49715443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:48.022810936 CEST44349714142.250.185.68192.168.2.5
          Aug 28, 2024 12:05:48.022897959 CEST49714443192.168.2.5142.250.185.68
          Aug 28, 2024 12:05:48.029057026 CEST49714443192.168.2.5142.250.185.68
          Aug 28, 2024 12:05:48.029247046 CEST44349714142.250.185.68192.168.2.5
          Aug 28, 2024 12:05:48.055617094 CEST49713443192.168.2.5184.28.90.27
          Aug 28, 2024 12:05:48.068497896 CEST443497153.75.191.100192.168.2.5
          Aug 28, 2024 12:05:48.075474977 CEST49715443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:48.075737000 CEST49714443192.168.2.5142.250.185.68
          Aug 28, 2024 12:05:48.075751066 CEST44349714142.250.185.68192.168.2.5
          Aug 28, 2024 12:05:48.100500107 CEST44349713184.28.90.27192.168.2.5
          Aug 28, 2024 12:05:48.122332096 CEST49714443192.168.2.5142.250.185.68
          Aug 28, 2024 12:05:48.244920015 CEST44349713184.28.90.27192.168.2.5
          Aug 28, 2024 12:05:48.244993925 CEST44349713184.28.90.27192.168.2.5
          Aug 28, 2024 12:05:48.245074034 CEST49713443192.168.2.5184.28.90.27
          Aug 28, 2024 12:05:48.332763910 CEST49713443192.168.2.5184.28.90.27
          Aug 28, 2024 12:05:48.332792044 CEST44349713184.28.90.27192.168.2.5
          Aug 28, 2024 12:05:48.369132042 CEST443497153.75.191.100192.168.2.5
          Aug 28, 2024 12:05:48.369152069 CEST443497153.75.191.100192.168.2.5
          Aug 28, 2024 12:05:48.369158983 CEST443497153.75.191.100192.168.2.5
          Aug 28, 2024 12:05:48.369177103 CEST443497153.75.191.100192.168.2.5
          Aug 28, 2024 12:05:48.369188070 CEST443497153.75.191.100192.168.2.5
          Aug 28, 2024 12:05:48.369196892 CEST443497153.75.191.100192.168.2.5
          Aug 28, 2024 12:05:48.369205952 CEST49715443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:48.369216919 CEST443497153.75.191.100192.168.2.5
          Aug 28, 2024 12:05:48.369236946 CEST49715443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:48.369256020 CEST49715443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:48.370359898 CEST443497153.75.191.100192.168.2.5
          Aug 28, 2024 12:05:48.370377064 CEST443497153.75.191.100192.168.2.5
          Aug 28, 2024 12:05:48.370431900 CEST49715443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:48.370438099 CEST443497153.75.191.100192.168.2.5
          Aug 28, 2024 12:05:48.370487928 CEST49715443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:48.371326923 CEST443497153.75.191.100192.168.2.5
          Aug 28, 2024 12:05:48.371372938 CEST49715443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:48.371376038 CEST443497153.75.191.100192.168.2.5
          Aug 28, 2024 12:05:48.371422052 CEST443497153.75.191.100192.168.2.5
          Aug 28, 2024 12:05:48.371457100 CEST49715443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:48.371462107 CEST443497153.75.191.100192.168.2.5
          Aug 28, 2024 12:05:48.371481895 CEST49715443192.168.2.53.75.191.100
          Aug 28, 2024 12:05:48.378171921 CEST49716443192.168.2.5184.28.90.27
          Aug 28, 2024 12:05:48.378199100 CEST44349716184.28.90.27192.168.2.5
          Aug 28, 2024 12:05:48.378252029 CEST49716443192.168.2.5184.28.90.27
          Aug 28, 2024 12:05:48.378526926 CEST49716443192.168.2.5184.28.90.27
          Aug 28, 2024 12:05:48.378539085 CEST44349716184.28.90.27192.168.2.5
          Aug 28, 2024 12:05:48.651736975 CEST4434970323.1.237.91192.168.2.5
          Aug 28, 2024 12:05:48.651829958 CEST49703443192.168.2.523.1.237.91
          Aug 28, 2024 12:05:49.015392065 CEST44349716184.28.90.27192.168.2.5
          Aug 28, 2024 12:05:49.015460968 CEST49716443192.168.2.5184.28.90.27
          Aug 28, 2024 12:05:49.017213106 CEST49716443192.168.2.5184.28.90.27
          Aug 28, 2024 12:05:49.017239094 CEST44349716184.28.90.27192.168.2.5
          Aug 28, 2024 12:05:49.017473936 CEST44349716184.28.90.27192.168.2.5
          Aug 28, 2024 12:05:49.018429995 CEST49716443192.168.2.5184.28.90.27
          Aug 28, 2024 12:05:49.060499907 CEST44349716184.28.90.27192.168.2.5
          Aug 28, 2024 12:05:49.291388988 CEST44349716184.28.90.27192.168.2.5
          Aug 28, 2024 12:05:49.291469097 CEST44349716184.28.90.27192.168.2.5
          Aug 28, 2024 12:05:49.291656017 CEST49716443192.168.2.5184.28.90.27
          Aug 28, 2024 12:05:49.413314104 CEST49716443192.168.2.5184.28.90.27
          Aug 28, 2024 12:05:49.413351059 CEST44349716184.28.90.27192.168.2.5
          Aug 28, 2024 12:05:49.413366079 CEST49716443192.168.2.5184.28.90.27
          Aug 28, 2024 12:05:49.413372993 CEST44349716184.28.90.27192.168.2.5
          Aug 28, 2024 12:05:57.255728006 CEST49718443192.168.2.513.85.23.86
          Aug 28, 2024 12:05:57.255775928 CEST4434971813.85.23.86192.168.2.5
          Aug 28, 2024 12:05:57.255845070 CEST49718443192.168.2.513.85.23.86
          Aug 28, 2024 12:05:57.257247925 CEST49718443192.168.2.513.85.23.86
          Aug 28, 2024 12:05:57.257258892 CEST4434971813.85.23.86192.168.2.5
          Aug 28, 2024 12:05:57.882148027 CEST44349714142.250.185.68192.168.2.5
          Aug 28, 2024 12:05:57.882210970 CEST44349714142.250.185.68192.168.2.5
          Aug 28, 2024 12:05:57.882270098 CEST49714443192.168.2.5142.250.185.68
          Aug 28, 2024 12:05:57.932373047 CEST4434971813.85.23.86192.168.2.5
          Aug 28, 2024 12:05:57.932449102 CEST49718443192.168.2.513.85.23.86
          Aug 28, 2024 12:05:57.934328079 CEST49718443192.168.2.513.85.23.86
          Aug 28, 2024 12:05:57.934341908 CEST4434971813.85.23.86192.168.2.5
          Aug 28, 2024 12:05:57.934554100 CEST4434971813.85.23.86192.168.2.5
          Aug 28, 2024 12:05:57.982961893 CEST49718443192.168.2.513.85.23.86
          Aug 28, 2024 12:05:58.542927980 CEST49718443192.168.2.513.85.23.86
          Aug 28, 2024 12:05:58.588500977 CEST4434971813.85.23.86192.168.2.5
          Aug 28, 2024 12:05:58.765759945 CEST4434971813.85.23.86192.168.2.5
          Aug 28, 2024 12:05:58.765780926 CEST4434971813.85.23.86192.168.2.5
          Aug 28, 2024 12:05:58.765788078 CEST4434971813.85.23.86192.168.2.5
          Aug 28, 2024 12:05:58.765798092 CEST4434971813.85.23.86192.168.2.5
          Aug 28, 2024 12:05:58.765835047 CEST4434971813.85.23.86192.168.2.5
          Aug 28, 2024 12:05:58.765872002 CEST49718443192.168.2.513.85.23.86
          Aug 28, 2024 12:05:58.765898943 CEST4434971813.85.23.86192.168.2.5
          Aug 28, 2024 12:05:58.765919924 CEST49718443192.168.2.513.85.23.86
          Aug 28, 2024 12:05:58.765947104 CEST49718443192.168.2.513.85.23.86
          Aug 28, 2024 12:05:58.765990019 CEST4434971813.85.23.86192.168.2.5
          Aug 28, 2024 12:05:58.766077995 CEST49718443192.168.2.513.85.23.86
          Aug 28, 2024 12:05:58.766086102 CEST4434971813.85.23.86192.168.2.5
          Aug 28, 2024 12:05:58.766325951 CEST4434971813.85.23.86192.168.2.5
          Aug 28, 2024 12:05:58.766379118 CEST49718443192.168.2.513.85.23.86
          Aug 28, 2024 12:05:58.803910017 CEST49714443192.168.2.5142.250.185.68
          Aug 28, 2024 12:05:58.803941011 CEST44349714142.250.185.68192.168.2.5
          Aug 28, 2024 12:05:59.476901054 CEST49718443192.168.2.513.85.23.86
          Aug 28, 2024 12:05:59.476932049 CEST4434971813.85.23.86192.168.2.5
          Aug 28, 2024 12:05:59.476943970 CEST49718443192.168.2.513.85.23.86
          Aug 28, 2024 12:05:59.476949930 CEST4434971813.85.23.86192.168.2.5
          Aug 28, 2024 12:06:35.934278965 CEST49725443192.168.2.513.85.23.86
          Aug 28, 2024 12:06:35.934309006 CEST4434972513.85.23.86192.168.2.5
          Aug 28, 2024 12:06:35.935811996 CEST49725443192.168.2.513.85.23.86
          Aug 28, 2024 12:06:35.936537981 CEST49725443192.168.2.513.85.23.86
          Aug 28, 2024 12:06:35.936548948 CEST4434972513.85.23.86192.168.2.5
          Aug 28, 2024 12:06:36.616529942 CEST4434972513.85.23.86192.168.2.5
          Aug 28, 2024 12:06:36.616604090 CEST49725443192.168.2.513.85.23.86
          Aug 28, 2024 12:06:36.620773077 CEST49725443192.168.2.513.85.23.86
          Aug 28, 2024 12:06:36.620780945 CEST4434972513.85.23.86192.168.2.5
          Aug 28, 2024 12:06:36.621006012 CEST4434972513.85.23.86192.168.2.5
          Aug 28, 2024 12:06:36.631469011 CEST49725443192.168.2.513.85.23.86
          Aug 28, 2024 12:06:36.676506042 CEST4434972513.85.23.86192.168.2.5
          Aug 28, 2024 12:06:36.882086992 CEST4434972513.85.23.86192.168.2.5
          Aug 28, 2024 12:06:36.882105112 CEST4434972513.85.23.86192.168.2.5
          Aug 28, 2024 12:06:36.882121086 CEST4434972513.85.23.86192.168.2.5
          Aug 28, 2024 12:06:36.882208109 CEST49725443192.168.2.513.85.23.86
          Aug 28, 2024 12:06:36.882225990 CEST4434972513.85.23.86192.168.2.5
          Aug 28, 2024 12:06:36.882285118 CEST49725443192.168.2.513.85.23.86
          Aug 28, 2024 12:06:36.883269072 CEST4434972513.85.23.86192.168.2.5
          Aug 28, 2024 12:06:36.883302927 CEST4434972513.85.23.86192.168.2.5
          Aug 28, 2024 12:06:36.883339882 CEST49725443192.168.2.513.85.23.86
          Aug 28, 2024 12:06:36.883346081 CEST4434972513.85.23.86192.168.2.5
          Aug 28, 2024 12:06:36.883382082 CEST49725443192.168.2.513.85.23.86
          Aug 28, 2024 12:06:36.883429050 CEST4434972513.85.23.86192.168.2.5
          Aug 28, 2024 12:06:36.883470058 CEST4434972513.85.23.86192.168.2.5
          Aug 28, 2024 12:06:36.883521080 CEST49725443192.168.2.513.85.23.86
          Aug 28, 2024 12:06:36.886954069 CEST49725443192.168.2.513.85.23.86
          Aug 28, 2024 12:06:36.886967897 CEST4434972513.85.23.86192.168.2.5
          Aug 28, 2024 12:06:36.886979103 CEST49725443192.168.2.513.85.23.86
          Aug 28, 2024 12:06:36.886986017 CEST4434972513.85.23.86192.168.2.5
          Aug 28, 2024 12:06:47.379802942 CEST49727443192.168.2.5142.250.185.68
          Aug 28, 2024 12:06:47.379846096 CEST44349727142.250.185.68192.168.2.5
          Aug 28, 2024 12:06:47.379987955 CEST49727443192.168.2.5142.250.185.68
          Aug 28, 2024 12:06:47.380419016 CEST49727443192.168.2.5142.250.185.68
          Aug 28, 2024 12:06:47.380434036 CEST44349727142.250.185.68192.168.2.5
          Aug 28, 2024 12:06:48.030704975 CEST44349727142.250.185.68192.168.2.5
          Aug 28, 2024 12:06:48.031029940 CEST49727443192.168.2.5142.250.185.68
          Aug 28, 2024 12:06:48.031045914 CEST44349727142.250.185.68192.168.2.5
          Aug 28, 2024 12:06:48.032902002 CEST44349727142.250.185.68192.168.2.5
          Aug 28, 2024 12:06:48.033409119 CEST49727443192.168.2.5142.250.185.68
          Aug 28, 2024 12:06:48.033476114 CEST44349727142.250.185.68192.168.2.5
          Aug 28, 2024 12:06:48.076457977 CEST49727443192.168.2.5142.250.185.68
          Aug 28, 2024 12:06:57.939165115 CEST44349727142.250.185.68192.168.2.5
          Aug 28, 2024 12:06:57.939244986 CEST44349727142.250.185.68192.168.2.5
          Aug 28, 2024 12:06:57.939304113 CEST49727443192.168.2.5142.250.185.68
          Aug 28, 2024 12:06:58.800199032 CEST49727443192.168.2.5142.250.185.68
          Aug 28, 2024 12:06:58.800223112 CEST44349727142.250.185.68192.168.2.5
          Aug 28, 2024 12:07:07.831785917 CEST49731443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:07.831826925 CEST44349731162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:07.832004070 CEST49732443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:07.832050085 CEST44349732162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:07.832089901 CEST49731443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:07.832098961 CEST49732443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:07.832314014 CEST49731443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:07.832328081 CEST44349731162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:07.832465887 CEST49732443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:07.832489967 CEST44349732162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:08.308331013 CEST44349731162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:08.308743000 CEST49731443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:08.308753967 CEST44349731162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:08.309797049 CEST44349731162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:08.309952974 CEST49731443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:08.312176943 CEST49731443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:08.312242031 CEST44349731162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:08.312454939 CEST49731443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:08.312463045 CEST44349731162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:08.316788912 CEST44349732162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:08.316999912 CEST49732443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:08.317012072 CEST44349732162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:08.317996025 CEST44349732162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:08.318075895 CEST49732443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:08.319946051 CEST49732443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:08.319994926 CEST44349732162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:08.320280075 CEST49732443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:08.320286036 CEST44349732162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:08.418390036 CEST49731443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:08.418494940 CEST49732443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:08.423353910 CEST44349731162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:08.423424959 CEST44349731162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:08.423624992 CEST49731443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:08.423899889 CEST49731443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:08.423914909 CEST44349731162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:08.460381985 CEST44349732162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:08.460438967 CEST44349732162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:08.460506916 CEST49732443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:08.460798979 CEST49732443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:08.460808039 CEST44349732162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:14.256803036 CEST49733443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:14.256839991 CEST44349733162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:14.256953001 CEST49733443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:14.257167101 CEST49733443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:14.257184029 CEST44349733162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:14.735059023 CEST44349733162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:14.735371113 CEST49733443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:14.735384941 CEST44349733162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:14.736268044 CEST44349733162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:14.736326933 CEST49733443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:14.736743927 CEST49733443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:14.736809015 CEST44349733162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:14.736892939 CEST49733443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:14.736900091 CEST44349733162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:14.776717901 CEST49733443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:14.860266924 CEST44349733162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:14.860346079 CEST44349733162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:14.860399008 CEST49733443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:14.860733986 CEST49733443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:14.860755920 CEST44349733162.159.61.3192.168.2.5

          UDP Packets

          TimestampSource PortDest PortSource IPDest IP
          Aug 28, 2024 12:05:42.780553102 CEST53535961.1.1.1192.168.2.5
          Aug 28, 2024 12:05:42.780574083 CEST53564681.1.1.1192.168.2.5
          Aug 28, 2024 12:05:43.940774918 CEST5333753192.168.2.51.1.1.1
          Aug 28, 2024 12:05:43.940924883 CEST6552253192.168.2.51.1.1.1
          Aug 28, 2024 12:05:43.951467991 CEST53535071.1.1.1192.168.2.5
          Aug 28, 2024 12:05:43.976541042 CEST53533371.1.1.1192.168.2.5
          Aug 28, 2024 12:05:44.124886990 CEST53655221.1.1.1192.168.2.5
          Aug 28, 2024 12:05:47.317997932 CEST5882353192.168.2.51.1.1.1
          Aug 28, 2024 12:05:47.318341970 CEST6398253192.168.2.51.1.1.1
          Aug 28, 2024 12:05:47.324903011 CEST53588231.1.1.1192.168.2.5
          Aug 28, 2024 12:05:47.325263023 CEST53639821.1.1.1192.168.2.5
          Aug 28, 2024 12:06:01.917702913 CEST53556321.1.1.1192.168.2.5
          Aug 28, 2024 12:06:20.756095886 CEST53625381.1.1.1192.168.2.5
          Aug 28, 2024 12:06:42.204334974 CEST53601641.1.1.1192.168.2.5
          Aug 28, 2024 12:06:43.365408897 CEST53551791.1.1.1192.168.2.5
          Aug 28, 2024 12:07:07.681168079 CEST6446053192.168.2.51.1.1.1
          Aug 28, 2024 12:07:07.830111027 CEST53644601.1.1.1192.168.2.5
          Aug 28, 2024 12:07:13.954778910 CEST61619443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:14.256800890 CEST61619443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:14.430202007 CEST44361619162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:14.430222988 CEST44361619162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:14.430233002 CEST44361619162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:14.430238962 CEST44361619162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:14.430248976 CEST44361619162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:14.431168079 CEST61619443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:14.432909966 CEST61619443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:14.793360949 CEST61619443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:14.893070936 CEST44361619162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:15.174985886 CEST61619443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:15.175318956 CEST61619443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:15.274760008 CEST44361619162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:15.274785995 CEST44361619162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:15.274800062 CEST44361619162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:15.274808884 CEST44361619162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:15.275301933 CEST61619443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:15.275522947 CEST61619443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:15.375755072 CEST44361619162.159.61.3192.168.2.5
          Aug 28, 2024 12:07:15.401251078 CEST61619443192.168.2.5162.159.61.3
          Aug 28, 2024 12:07:27.069641113 CEST61619443192.168.2.5162.159.61.3

          ICMP Packets

          TimestampSource IPDest IPChecksumCodeType
          Aug 28, 2024 12:05:44.125153065 CEST192.168.2.51.1.1.1c225(Port unreachable)Destination Unreachable

          DNS Queries

          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
          Aug 28, 2024 12:05:43.940774918 CEST192.168.2.51.1.1.10xfde9Standard query (0)api.elementarypos.comA (IP address)IN (0x0001)false
          Aug 28, 2024 12:05:43.940924883 CEST192.168.2.51.1.1.10x9089Standard query (0)api.elementarypos.com65IN (0x0001)false
          Aug 28, 2024 12:05:47.317997932 CEST192.168.2.51.1.1.10x36eStandard query (0)www.google.comA (IP address)IN (0x0001)false
          Aug 28, 2024 12:05:47.318341970 CEST192.168.2.51.1.1.10x21b6Standard query (0)www.google.com65IN (0x0001)false
          Aug 28, 2024 12:07:07.681168079 CEST192.168.2.51.1.1.10x5719Standard query (0)chrome.cloudflare-dns.comA (IP address)IN (0x0001)false

          DNS Answers

          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
          Aug 28, 2024 12:05:43.976541042 CEST1.1.1.1192.168.2.50xfde9No error (0)api.elementarypos.com3.75.191.100A (IP address)IN (0x0001)false
          Aug 28, 2024 12:05:47.324903011 CEST1.1.1.1192.168.2.50x36eNo error (0)www.google.com142.250.185.68A (IP address)IN (0x0001)false
          Aug 28, 2024 12:05:47.325263023 CEST1.1.1.1192.168.2.50x21b6No error (0)www.google.com65IN (0x0001)false
          Aug 28, 2024 12:07:07.830111027 CEST1.1.1.1192.168.2.50x5719No error (0)chrome.cloudflare-dns.com162.159.61.3A (IP address)IN (0x0001)false
          Aug 28, 2024 12:07:07.830111027 CEST1.1.1.1192.168.2.50x5719No error (0)chrome.cloudflare-dns.com172.64.41.3A (IP address)IN (0x0001)false

          HTTP Request Dependency Graph

          • api.elementarypos.com
          • https:
          • fs.microsoft.com
          • slscr.update.microsoft.com
          • chrome.cloudflare-dns.com

          HTTPS Proxied Packets

          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
          0192.168.2.5497103.75.191.1004432964C:\Program Files\Google\Chrome\Application\chrome.exe
          TimestampBytes transferredDirectionData
          2024-08-28 10:05:44 UTC712OUTGET /doc/receipt/97ad00f9-6c1f-4536-81e7-8bc31d2f3b10 HTTP/1.1
          Host: api.elementarypos.com
          Connection: keep-alive
          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
          sec-ch-ua-mobile: ?0
          sec-ch-ua-platform: "Windows"
          Upgrade-Insecure-Requests: 1
          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
          Sec-Fetch-Site: none
          Sec-Fetch-Mode: navigate
          Sec-Fetch-User: ?1
          Sec-Fetch-Dest: document
          Accept-Encoding: gzip, deflate, br
          Accept-Language: en-US,en;q=0.9
          2024-08-28 10:05:45 UTC526INHTTP/1.1 200
          Server: nginx/1.18.0 (Ubuntu)
          Date: Wed, 28 Aug 2024 10:05:44 GMT
          Content-Type: application/pdf
          Content-Length: 36092
          Connection: close
          content-disposition: filename*=UTF-8''5D4A-1.pdf
          access-control-expose-headers: Content-Disposition
          Access-Control-Allow-Origin: *
          Access-Control-Allow-Credentials: true
          Access-Control-Allow-Methods: GET, POST, OPTIONS
          Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,x-api-key
          2024-08-28 10:05:45 UTC15858INData Raw: 25 50 44 46 2d 31 2e 34 0a 25 e2 e3 cf d3 0a 33 20 30 20 6f 62 6a 0a 3c 3c 2f 4c 65 6e 67 74 68 20 39 39 36 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 3e 3e 73 74 72 65 61 6d 0a 78 9c 9d 98 cd 4e db 40 10 c7 57 ca a1 92 2f b4 22 21 a5 b4 92 0f 94 82 54 16 ef 87 d7 eb 6b 15 48 c4 87 08 10 0a 95 e8 a5 6a 7b a8 c4 81 5e fa 58 3d f4 da 97 ea 1b 74 66 bd 0e b1 bd b3 01 84 8c 82 c7 bf 99 ff 8e 77 66 36 dc 25 1f 66 89 32 a9 cd 4c 3a fb 9a a8 bc e4 46 a5 bb c2 e2 5f 7b 07 22 15 32 9d 7d 4f b6 99 60 7f d9 94 4d d8 25 3b 67 3d 36 86 4f 3d f8 3c 61 07 ec 98 ed c3 bd 37 f0 f7 4b f6 8e 0d d9 26 7b ce fa 3b b3 1f c9 ae f7 96 a1 2f 9d 49 5e d4 8e b7 d9 cd 8e 63 8f d8 c8 91 03 b6 0e bf 47 ec d0 79 1f b0 55 b8 86 ce 47 c5 39 17 d9 3d de 43 5b 36 bf 5d ea 86
          Data Ascii: %PDF-1.4%3 0 obj<</Length 996/Filter/FlateDecode>>streamxN@W/"!TkHj{^X=tfwf6%f2L:F_{"2}O`M%;g=6O=<a7K&{;/I^cGyUG9=C[6]
          2024-08-28 10:05:45 UTC16384INData Raw: 7a b4 21 e7 1e a4 e3 27 ed c6 eb 68 c8 e3 c7 5f 07 53 af a1 fc d9 29 8d c6 c8 0e 83 ef 95 1e 0c 83 5f bb 1a a1 d5 35 d7 d7 81 b6 57 c8 0a 3f 8b fd 89 30 58 d9 25 de 01 30 45 df 6f 8d 0e c7 49 94 85 66 40 0f 20 59 47 c3 7e e0 3a 72 d0 e6 15 de f3 34 cc 33 bc 77 8a d4 45 e4 28 1c d5 d1 70 dd a8 fd 8f ee 77 bf ce fd 73 e1 e7 ce 5d 1d ef 27 98 da a8 cd b9 46 d7 8d 79 d6 ca ea 5f af 5e ab 5f 34 ec 15 b1 27 12 02 28 ff 83 83 af 25 e6 44 ca e1 7b 0e 6d df a1 ed 51 1a f6 05 7c 2f 95 d3 88 46 fa 88 f0 7c 9d fb d7 ee dd c0 c7 2f ac c9 da 9a ca f3 95 01 34 0a fb ed 34 79 04 8d e2 ef 3d 22 ef 72 1a de d5 84 df 19 f0 6f 10 b5 6f 64 f8 b9 25 ff 1e b1 2f f6 ef 26 32 a9 0f 92 57 fb 0e ea 77 d4 5d fb b6 47 0c 9f 8b 8e a3 a9 fc bb 38 f6 4c e8 7b ed ef 05 f0 6f 96 72 68 86
          Data Ascii: z!'h_S)_5W?0X%0EoIf@ YG~:r43wE(pws]'Fy_^_4'(%D{mQ|/F|/44y="rood%/&2Ww]G8L{orh
          2024-08-28 10:05:45 UTC3850INData Raw: 0d ef 58 02 df 32 be e9 ff b6 85 df d5 f1 ef 08 f7 f9 3e 36 56 f8 6a 94 73 be 1a ed fb a5 77 f4 6f 72 f8 f7 79 da fb c8 6f a9 9b f6 3d db 57 be 2b da f7 fc e8 47 ce a0 5c 29 1c 7d cc a2 09 52 4f 5a 2d df 4a 13 94 03 38 27 5a 68 b4 b2 9f 46 8b 97 68 ba d4 9a 46 2a cf d3 ad 92 85 d6 f8 d3 a3 e5 0a ba 43 fe 86 ee 50 ca 69 b4 94 82 b1 53 68 94 f2 0c da ac a7 e5 f2 97 e8 33 19 65 ad b5 f2 91 52 26 cd 97 8a 11 27 dc 4b f7 29 1f d3 36 69 2e 8d 92 a6 d1 c3 f2 5f e8 0e f5 4b ba 53 0a 46 fd 56 74 8f 94 86 ba 5e ba 5d 19 42 8f 6a df d0 f3 ef ef 9b 9c 77 f8 fd 55 e0 dd 8c ff dd 40 7f d3 5e b2 a8 c7 29 c1 34 90 8a d4 f6 34 9a 7f 1f a3 0e a6 19 e6 8d 90 cf 22 ed 2e f1 7a df c2 fd 26 b0 30 9c bd 00 43 07 da 15 80 b6 1e 07 28 47 55 28 4a e9 4d ed a4 0d d4 4f 3c 4b 63 a5
          Data Ascii: X2>6Vjsworyo=W+G\)}ROZ-J8'ZhFhF*CPiSh3eR&'K)6i._KSFVt^]BjwU@^)44".z&0C(GU(JMO<Kc


          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
          1192.168.2.5497093.75.191.1004432964C:\Program Files\Google\Chrome\Application\chrome.exe
          TimestampBytes transferredDirectionData
          2024-08-28 10:05:46 UTC646OUTGET /favicon.ico HTTP/1.1
          Host: api.elementarypos.com
          Connection: keep-alive
          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
          sec-ch-ua-mobile: ?0
          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
          sec-ch-ua-platform: "Windows"
          Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
          Sec-Fetch-Site: same-origin
          Sec-Fetch-Mode: no-cors
          Sec-Fetch-Dest: image
          Referer: https://api.elementarypos.com/doc/receipt/97ad00f9-6c1f-4536-81e7-8bc31d2f3b10
          Accept-Encoding: gzip, deflate, br
          Accept-Language: en-US,en;q=0.9
          2024-08-28 10:05:46 UTC285INHTTP/1.1 404
          Server: nginx/1.18.0 (Ubuntu)
          Date: Wed, 28 Aug 2024 10:05:46 GMT
          Content-Type: application/json
          Transfer-Encoding: chunked
          Connection: close
          vary: Origin
          vary: Access-Control-Request-Method
          vary: Access-Control-Request-Headers
          Access-Control-Allow-Origin: *
          2024-08-28 10:05:46 UTC111INData Raw: 36 34 0d 0a 7b 22 74 69 6d 65 73 74 61 6d 70 22 3a 22 32 30 32 34 2d 30 38 2d 32 38 54 31 30 3a 30 35 3a 34 36 2e 36 36 31 2b 30 30 3a 30 30 22 2c 22 73 74 61 74 75 73 22 3a 34 30 34 2c 22 65 72 72 6f 72 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 2c 22 70 61 74 68 22 3a 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 7d 0d 0a 30 0d 0a 0d 0a
          Data Ascii: 64{"timestamp":"2024-08-28T10:05:46.661+00:00","status":404,"error":"Not Found","path":"/favicon.ico"}0


          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
          2192.168.2.5497153.75.191.1004432964C:\Program Files\Google\Chrome\Application\chrome.exe
          TimestampBytes transferredDirectionData
          2024-08-28 10:05:48 UTC384OUTGET /doc/receipt/97ad00f9-6c1f-4536-81e7-8bc31d2f3b10 HTTP/1.1
          Host: api.elementarypos.com
          Connection: keep-alive
          Sec-Fetch-Site: none
          Sec-Fetch-Mode: navigate
          Sec-Fetch-Dest: empty
          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
          Accept-Encoding: gzip, deflate, br
          Accept-Language: en-US,en;q=0.9
          2024-08-28 10:05:48 UTC526INHTTP/1.1 200
          Server: nginx/1.18.0 (Ubuntu)
          Date: Wed, 28 Aug 2024 10:05:48 GMT
          Content-Type: application/pdf
          Content-Length: 36092
          Connection: close
          content-disposition: filename*=UTF-8''5D4A-1.pdf
          access-control-expose-headers: Content-Disposition
          Access-Control-Allow-Origin: *
          Access-Control-Allow-Credentials: true
          Access-Control-Allow-Methods: GET, POST, OPTIONS
          Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,x-api-key
          2024-08-28 10:05:48 UTC15858INData Raw: 25 50 44 46 2d 31 2e 34 0a 25 e2 e3 cf d3 0a 33 20 30 20 6f 62 6a 0a 3c 3c 2f 4c 65 6e 67 74 68 20 39 39 36 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 3e 3e 73 74 72 65 61 6d 0a 78 9c 9d 98 cd 4e db 40 10 c7 57 ca a1 92 2f b4 22 21 a5 b4 92 0f 94 82 54 16 ef 87 d7 eb 6b 15 48 c4 87 08 10 0a 95 e8 a5 6a 7b a8 c4 81 5e fa 58 3d f4 da 97 ea 1b 74 66 bd 0e b1 bd b3 01 84 8c 82 c7 bf 99 ff 8e 77 66 36 dc 25 1f 66 89 32 a9 cd 4c 3a fb 9a a8 bc e4 46 a5 bb c2 e2 5f 7b 07 22 15 32 9d 7d 4f b6 99 60 7f d9 94 4d d8 25 3b 67 3d 36 86 4f 3d f8 3c 61 07 ec 98 ed c3 bd 37 f0 f7 4b f6 8e 0d d9 26 7b ce fa 3b b3 1f c9 ae f7 96 a1 2f 9d 49 5e d4 8e b7 d9 cd 8e 63 8f d8 c8 91 03 b6 0e bf 47 ec d0 79 1f b0 55 b8 86 ce 47 c5 39 17 d9 3d de 43 5b 36 bf 5d ea 86
          Data Ascii: %PDF-1.4%3 0 obj<</Length 996/Filter/FlateDecode>>streamxN@W/"!TkHj{^X=tfwf6%f2L:F_{"2}O`M%;g=6O=<a7K&{;/I^cGyUG9=C[6]
          2024-08-28 10:05:48 UTC16384INData Raw: 7a b4 21 e7 1e a4 e3 27 ed c6 eb 68 c8 e3 c7 5f 07 53 af a1 fc d9 29 8d c6 c8 0e 83 ef 95 1e 0c 83 5f bb 1a a1 d5 35 d7 d7 81 b6 57 c8 0a 3f 8b fd 89 30 58 d9 25 de 01 30 45 df 6f 8d 0e c7 49 94 85 66 40 0f 20 59 47 c3 7e e0 3a 72 d0 e6 15 de f3 34 cc 33 bc 77 8a d4 45 e4 28 1c d5 d1 70 dd a8 fd 8f ee 77 bf ce fd 73 e1 e7 ce 5d 1d ef 27 98 da a8 cd b9 46 d7 8d 79 d6 ca ea 5f af 5e ab 5f 34 ec 15 b1 27 12 02 28 ff 83 83 af 25 e6 44 ca e1 7b 0e 6d df a1 ed 51 1a f6 05 7c 2f 95 d3 88 46 fa 88 f0 7c 9d fb d7 ee dd c0 c7 2f ac c9 da 9a ca f3 95 01 34 0a fb ed 34 79 04 8d e2 ef 3d 22 ef 72 1a de d5 84 df 19 f0 6f 10 b5 6f 64 f8 b9 25 ff 1e b1 2f f6 ef 26 32 a9 0f 92 57 fb 0e ea 77 d4 5d fb b6 47 0c 9f 8b 8e a3 a9 fc bb 38 f6 4c e8 7b ed ef 05 f0 6f 96 72 68 86
          Data Ascii: z!'h_S)_5W?0X%0EoIf@ YG~:r43wE(pws]'Fy_^_4'(%D{mQ|/F|/44y="rood%/&2Ww]G8L{orh
          2024-08-28 10:05:48 UTC3850INData Raw: 0d ef 58 02 df 32 be e9 ff b6 85 df d5 f1 ef 08 f7 f9 3e 36 56 f8 6a 94 73 be 1a ed fb a5 77 f4 6f 72 f8 f7 79 da fb c8 6f a9 9b f6 3d db 57 be 2b da f7 fc e8 47 ce a0 5c 29 1c 7d cc a2 09 52 4f 5a 2d df 4a 13 94 03 38 27 5a 68 b4 b2 9f 46 8b 97 68 ba d4 9a 46 2a cf d3 ad 92 85 d6 f8 d3 a3 e5 0a ba 43 fe 86 ee 50 ca 69 b4 94 82 b1 53 68 94 f2 0c da ac a7 e5 f2 97 e8 33 19 65 ad b5 f2 91 52 26 cd 97 8a 11 27 dc 4b f7 29 1f d3 36 69 2e 8d 92 a6 d1 c3 f2 5f e8 0e f5 4b ba 53 0a 46 fd 56 74 8f 94 86 ba 5e ba 5d 19 42 8f 6a df d0 f3 ef ef 9b 9c 77 f8 fd 55 e0 dd 8c ff dd 40 7f d3 5e b2 a8 c7 29 c1 34 90 8a d4 f6 34 9a 7f 1f a3 0e a6 19 e6 8d 90 cf 22 ed 2e f1 7a df c2 fd 26 b0 30 9c bd 00 43 07 da 15 80 b6 1e 07 28 47 55 28 4a e9 4d ed a4 0d d4 4f 3c 4b 63 a5
          Data Ascii: X2>6Vjsworyo=W+G\)}ROZ-J8'ZhFhF*CPiSh3eR&'K)6i._KSFVt^]BjwU@^)44".z&0C(GU(JMO<Kc


          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
          3192.168.2.549713184.28.90.27443
          TimestampBytes transferredDirectionData
          2024-08-28 10:05:48 UTC161OUTHEAD /fs/windows/config.json HTTP/1.1
          Connection: Keep-Alive
          Accept: */*
          Accept-Encoding: identity
          User-Agent: Microsoft BITS/7.8
          Host: fs.microsoft.com
          2024-08-28 10:05:48 UTC467INHTTP/1.1 200 OK
          Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
          Content-Type: application/octet-stream
          ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
          Last-Modified: Tue, 16 May 2017 22:58:00 GMT
          Server: ECAcc (lpl/EF06)
          X-CID: 11
          X-Ms-ApiVersion: Distribute 1.2
          X-Ms-Region: prod-weu-z1
          Cache-Control: public, max-age=257465
          Date: Wed, 28 Aug 2024 10:05:48 GMT
          Connection: close
          X-CID: 2


          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
          4192.168.2.549716184.28.90.27443
          TimestampBytes transferredDirectionData
          2024-08-28 10:05:49 UTC239OUTGET /fs/windows/config.json HTTP/1.1
          Connection: Keep-Alive
          Accept: */*
          Accept-Encoding: identity
          If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT
          Range: bytes=0-2147483646
          User-Agent: Microsoft BITS/7.8
          Host: fs.microsoft.com
          2024-08-28 10:05:49 UTC515INHTTP/1.1 200 OK
          ApiVersion: Distribute 1.1
          Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
          Content-Type: application/octet-stream
          ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
          Last-Modified: Tue, 16 May 2017 22:58:00 GMT
          Server: ECAcc (lpl/EF06)
          X-CID: 11
          X-Ms-ApiVersion: Distribute 1.2
          X-Ms-Region: prod-weu-z1
          Cache-Control: public, max-age=257417
          Date: Wed, 28 Aug 2024 10:05:49 GMT
          Content-Length: 55
          Connection: close
          X-CID: 2
          2024-08-28 10:05:49 UTC55INData Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d
          Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}


          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
          5192.168.2.54971813.85.23.86443
          TimestampBytes transferredDirectionData
          2024-08-28 10:05:58 UTC306OUTGET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=spSRR6Mwb1TMFpX&MD=8UH7bNmV HTTP/1.1
          Connection: Keep-Alive
          Accept: */*
          User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
          Host: slscr.update.microsoft.com
          2024-08-28 10:05:58 UTC560INHTTP/1.1 200 OK
          Cache-Control: no-cache
          Pragma: no-cache
          Content-Type: application/octet-stream
          Expires: -1
          Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
          ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880"
          MS-CorrelationId: beb8abd7-f79a-4141-9eff-66d335a85d6c
          MS-RequestId: 10149704-e8b6-4742-b953-d9f71a7c4ec2
          MS-CV: f6+Ya7GEJE28O/HH.0
          X-Microsoft-SLSClientCache: 2880
          Content-Disposition: attachment; filename=environment.cab
          X-Content-Type-Options: nosniff
          Date: Wed, 28 Aug 2024 10:05:58 GMT
          Connection: close
          Content-Length: 24490
          2024-08-28 10:05:58 UTC15824INData Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58
          Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
          2024-08-28 10:05:58 UTC8666INData Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31
          Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1


          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
          6192.168.2.54972513.85.23.86443
          TimestampBytes transferredDirectionData
          2024-08-28 10:06:36 UTC306OUTGET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=spSRR6Mwb1TMFpX&MD=8UH7bNmV HTTP/1.1
          Connection: Keep-Alive
          Accept: */*
          User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
          Host: slscr.update.microsoft.com
          2024-08-28 10:06:36 UTC560INHTTP/1.1 200 OK
          Cache-Control: no-cache
          Pragma: no-cache
          Content-Type: application/octet-stream
          Expires: -1
          Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
          ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440"
          MS-CorrelationId: 81cb2ae0-803f-4832-94f0-0e8eed518fbe
          MS-RequestId: 538220b5-14f8-4e87-94b9-b5c3ccd480da
          MS-CV: FZBZ3ztKpUK4z8/1.0
          X-Microsoft-SLSClientCache: 1440
          Content-Disposition: attachment; filename=environment.cab
          X-Content-Type-Options: nosniff
          Date: Wed, 28 Aug 2024 10:06:36 GMT
          Connection: close
          Content-Length: 30005
          2024-08-28 10:06:36 UTC15824INData Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e
          Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
          2024-08-28 10:06:36 UTC14181INData Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f
          Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro


          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
          7192.168.2.549731162.159.61.34433688C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
          TimestampBytes transferredDirectionData
          2024-08-28 10:07:08 UTC245OUTPOST /dns-query HTTP/1.1
          Host: chrome.cloudflare-dns.com
          Connection: keep-alive
          Content-Length: 128
          Accept: application/dns-message
          Accept-Language: *
          User-Agent: Chrome
          Accept-Encoding: identity
          Content-Type: application/dns-message
          2024-08-28 10:07:08 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
          Data Ascii: wwwgstaticcom)TP
          2024-08-28 10:07:08 UTC247INHTTP/1.1 200 OK
          Server: cloudflare
          Date: Wed, 28 Aug 2024 10:07:08 GMT
          Content-Type: application/dns-message
          Connection: close
          Access-Control-Allow-Origin: *
          Content-Length: 468
          CF-RAY: 8ba37e1d5b007ca8-EWR
          alt-svc: h3=":443"; ma=86400
          2024-08-28 10:07:08 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0b 00 04 8e fa 48 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
          Data Ascii: wwwgstaticcomHc)


          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
          8192.168.2.549732162.159.61.34433688C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
          TimestampBytes transferredDirectionData
          2024-08-28 10:07:08 UTC245OUTPOST /dns-query HTTP/1.1
          Host: chrome.cloudflare-dns.com
          Connection: keep-alive
          Content-Length: 128
          Accept: application/dns-message
          Accept-Language: *
          User-Agent: Chrome
          Accept-Encoding: identity
          Content-Type: application/dns-message
          2024-08-28 10:07:08 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
          Data Ascii: wwwgstaticcom)TP
          2024-08-28 10:07:08 UTC247INHTTP/1.1 200 OK
          Server: cloudflare
          Date: Wed, 28 Aug 2024 10:07:08 GMT
          Content-Type: application/dns-message
          Connection: close
          Access-Control-Allow-Origin: *
          Content-Length: 468
          CF-RAY: 8ba37e1d8a2a1a3c-EWR
          alt-svc: h3=":443"; ma=86400
          2024-08-28 10:07:08 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 09 00 04 8e fa 51 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
          Data Ascii: wwwgstaticcomQ)


          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
          9192.168.2.549733162.159.61.34433688C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
          TimestampBytes transferredDirectionData
          2024-08-28 10:07:14 UTC245OUTPOST /dns-query HTTP/1.1
          Host: chrome.cloudflare-dns.com
          Connection: keep-alive
          Content-Length: 128
          Accept: application/dns-message
          Accept-Language: *
          User-Agent: Chrome
          Accept-Encoding: identity
          Content-Type: application/dns-message
          2024-08-28 10:07:14 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 05 61 72 6d 6d 66 05 61 64 6f 62 65 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
          Data Ascii: armmfadobecom)TP
          2024-08-28 10:07:14 UTC247INHTTP/1.1 200 OK
          Server: cloudflare
          Date: Wed, 28 Aug 2024 10:07:14 GMT
          Content-Type: application/dns-message
          Connection: close
          Access-Control-Allow-Origin: *
          Content-Length: 468
          CF-RAY: 8ba37e458f114396-EWR
          alt-svc: h3=":443"; ma=86400
          2024-08-28 10:07:14 UTC468INData Raw: 00 00 81 80 00 01 00 03 00 00 00 01 05 61 72 6d 6d 66 05 61 64 6f 62 65 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 01 1b 00 1b 03 73 73 6c 05 61 64 6f 62 65 03 63 6f 6d 07 65 64 67 65 6b 65 79 03 6e 65 74 00 c0 2d 00 05 00 01 00 00 54 4f 00 18 05 65 34 35 37 38 04 64 73 63 62 0a 61 6b 61 6d 61 69 65 64 67 65 c0 43 c0 54 00 01 00 01 00 00 00 03 00 04 68 7e 70 b6 00 00 29 04 d0 00 00 00 00 01 4d 00 0c 01 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
          Data Ascii: armmfadobecomssladobecomedgekeynet-TOe4578dscbakamaiedgeCTh~p)MI


          Statistics

          CPU Usage

          Click to jump to process

          Memory Usage

          Click to jump to process

          High Level Behavior Distribution

          Click to dive into process behavior distribution

          Behavior

          Click to jump to process

          System Behavior

          General

          Target ID:0
          Start time:06:05:38
          Start date:28/08/2024
          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
          Wow64 process (32bit):false
          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
          Imagebase:0x7ff715980000
          File size:3'242'272 bytes
          MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:C, C++ or other language
          Reputation:low
          Has exited:true

          General

          Target ID:2
          Start time:06:05:41
          Start date:28/08/2024
          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
          Wow64 process (32bit):false
          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 --field-trial-handle=2528,i,7590472072302088992,16121679000214963585,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
          Imagebase:0x7ff715980000
          File size:3'242'272 bytes
          MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:C, C++ or other language
          Reputation:low
          Has exited:true

          General

          Target ID:3
          Start time:06:05:42
          Start date:28/08/2024
          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
          Wow64 process (32bit):false
          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://api.elementarypos.com/doc/receipt/97ad00f9-6c1f-4536-81e7-8bc31d2f3b10"
          Imagebase:0x7ff715980000
          File size:3'242'272 bytes
          MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:C, C++ or other language
          Reputation:low
          Has exited:true

          General

          Target ID:7
          Start time:06:07:00
          Start date:28/08/2024
          Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
          Wow64 process (32bit):false
          Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\downloaded.pdf"
          Imagebase:0x7ff686a00000
          File size:5'641'176 bytes
          MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:C, C++ or other language
          Reputation:low
          Has exited:true

          General

          Target ID:8
          Start time:06:07:01
          Start date:28/08/2024
          Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
          Wow64 process (32bit):false
          Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
          Imagebase:0x7ff6413e0000
          File size:3'581'912 bytes
          MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:C, C++ or other language
          Reputation:low
          Has exited:true

          General

          Target ID:9
          Start time:06:07:01
          Start date:28/08/2024
          Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
          Wow64 process (32bit):false
          Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2160 --field-trial-handle=1596,i,15970232470759308740,10123792887249288780,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
          Imagebase:0x7ff6413e0000
          File size:3'581'912 bytes
          MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:C, C++ or other language
          Reputation:low
          Has exited:true

          Disassembly

          ⊘No disassembly