Edit tour

Windows Analysis Report
https://customers.pressrelations.de/apps/nrx/files/stored_files/F867FA34-FAAA-EF11-84B9-D4F5EF0B30A8

Overview

General Information

Sample URL:	https://customers.pressrelations.de/apps/nrx/files/stored_files/F867FA34-FAAA-EF11-84B9-D4F5EF0B30A8
Analysis ID:	1562324
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Usage Of Web Request Commands And Cmdlets

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 7540 cmdline: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://customers.pressrelations.de/apps/nrx/files/stored_files/F867FA34-FAAA-EF11-84B9-D4F5EF0B30A8" > cmdline.out 2>&1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wget.exe (PID: 7596 cmdline: wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://customers.pressrelations.de/apps/nrx/files/stored_files/F867FA34-FAAA-EF11-84B9-D4F5EF0B30A8" MD5: 3DADB6E2ECE9C4B3E1E322E617658B60)

Acrobat.exe (PID: 4600 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\download\ medienspiegel_25.11.2024.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7780 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7976 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1616,i,15777726874990857100,5183867942386221178,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cleanup

Sigma Signatures

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://customers.pressrelations.de/apps/nrx/files/stored_files/F867FA34-FAAA-EF11-84B9-D4F5EF0B30A8" > cmdline.out 2>&1, CommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://customers.pressrelations.de/apps/nrx/files/stored_files/F867FA34-FAAA-EF11-84B9-D4F5EF0B30A8" > cmdline.out 2>&1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 5768, ProcessCommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://customers.pressrelations.de/apps/nrx/files/stored_files/F867FA34-FAAA-EF11-84B9-D4F5EF0B30A8" > cmdline.out 2>&1, ProcessId: 7540, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown

HTTPS traffic detected: 217.113.45.178:443 -> 192.168.2.4:49730 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 34.193.227.236
Source: unknown	TCP traffic detected without corresponding DNS query: 34.193.227.236
Source: unknown	TCP traffic detected without corresponding DNS query: 34.193.227.236
Source: unknown	TCP traffic detected without corresponding DNS query: 34.193.227.236
Source: unknown	TCP traffic detected without corresponding DNS query: 34.193.227.236
Source: unknown	TCP traffic detected without corresponding DNS query: 34.193.227.236
Source: unknown	TCP traffic detected without corresponding DNS query: 34.193.227.236
Source: unknown	TCP traffic detected without corresponding DNS query: 34.193.227.236
Source: unknown	TCP traffic detected without corresponding DNS query: 34.193.227.236
Source: unknown	TCP traffic detected without corresponding DNS query: 34.193.227.236
Source: unknown	TCP traffic detected without corresponding DNS query: 34.193.227.236
Source: unknown	TCP traffic detected without corresponding DNS query: 34.193.227.236
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /apps/nrx/files/stored_files/F867FA34-FAAA-EF11-84B9-D4F5EF0B30A8 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like GeckoAccept: /Accept-Encoding: identityHost: customers.pressrelations.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: a4ecfc44-3976-4051-8c45-0a7e26b55a37x-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br

Source: global traffic	DNS traffic detected: DNS query: customers.pressrelations.de
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.5.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.5.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: wget.exe, 00000002.00000002.1742581616.0000000000D18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://customers.pressrelations.de/apps/nrx/files/stored_files/F867FA34-FAAA-E
Source: wget.exe, 00000002.00000002.1742581616.0000000000D10000.00000004.00000020.00020000.00000000.sdmp, cmdline.out.0.dr	String found in binary or memory: https://customers.pressrelations.de/apps/nrx/files/stored_files/F867FA34-FAAA-EF11-84B9-D4F5EF0B30A8

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443

Source: unknown

HTTPS traffic detected: 217.113.45.178:443 -> 192.168.2.4:49730 version: TLS 1.2

Source: classification engine

Classification label: clean2.win@18/33@3/2

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\Desktop\cmdline.out

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7548:120:WilError_03

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-25 07-49-42-504.log

Jump to behavior

Source: C:\Windows\SysWOW64\wget.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://customers.pressrelations.de/apps/nrx/files/stored_files/F867FA34-FAAA-EF11-84B9-D4F5EF0B30A8" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://customers.pressrelations.de/apps/nrx/files/stored_files/F867FA34-FAAA-EF11-84B9-D4F5EF0B30A8"
Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\download\ medienspiegel_25.11.2024.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1616,i,15777726874990857100,5183867942386221178,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://customers.pressrelations.de/apps/nrx/files/stored_files/F867FA34-FAAA-EF11-84B9-D4F5EF0B30A8"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1616,i,15777726874990857100,5183867942386221178,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: explorerframe.dll	Jump to behavior

Source: C:\Windows\SysWOW64\wget.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\crash_reporter.cfg

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: wget.exe, 00000002.00000002.1742581616.0000000000D18000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /c wget -t 2 -v -t 60 -p "c:\users\user\desktop\download" --no-check-certificate --content-disposition --user-agent="mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; as; rv:11.0) like gecko" "https://customers.pressrelations.de/apps/nrx/files/stored_files/f867fa34-faaa-ef11-84b9-d4f5ef0b30a8" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -t 60 -p "c:\users\user\desktop\download" --no-check-certificate --content-disposition --user-agent="mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; as; rv:11.0) like gecko" "https://customers.pressrelations.de/apps/nrx/files/stored_files/f867fa34-faaa-ef11-84b9-d4f5ef0b30a8"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -t 60 -p "c:\users\user\desktop\download" --no-check-certificate --content-disposition --user-agent="mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; as; rv:11.0) like gecko" "https://customers.pressrelations.de/apps/nrx/files/stored_files/f867fa34-faaa-ef11-84b9-d4f5ef0b30a8"	Jump to behavior

Source: C:\Windows\SysWOW64\wget.exe

Queries volume information: C:\Users\user\Desktop\download VolumeInformation

Jump to behavior

Source: C:\Windows\SysWOW64\wget.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://customers.pressrelations.de/apps/nrx/files/stored_files/F867FA34-FAAA-EF11-84B9-D4F5EF0B30A8	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label	Link
https://customers.pressrelations.de/apps/nrx/files/stored_files/F867FA34-FAAA-E	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
customers.pressrelations.de	217.113.45.178	true	false	unknown
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://customers.pressrelations.de/apps/nrx/files/stored_files/F867FA34-FAAA-EF11-84B9-D4F5EF0B30A8	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.5.dr	false		high
https://customers.pressrelations.de/apps/nrx/files/stored_files/F867FA34-FAAA-E	wget.exe, 00000002.00000002.1742581616.0000000000D18000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
217.113.45.178	customers.pressrelations.de	Germany		16218	ASN-IACDIACDAutonomousSystemDE	false
34.193.227.236	unknown	United States		14618	AMAZON-AESUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562324
Start date and time:	2024-11-25 13:48:39 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	urldownload.jbs
Sample URL:	https://customers.pressrelations.de/apps/nrx/files/stored_files/F867FA34-FAAA-EF11-84B9-D4F5EF0B30A8
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean2.win@18/33@3/2

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.218.208.137, 23.32.239.27, 23.32.239.56, 162.159.61.3, 172.64.41.3, 54.227.187.23, 23.22.254.206, 52.202.204.11, 52.5.13.197, 23.195.39.65, 199.232.210.172, 2.20.40.170, 23.54.81.169, 23.54.81.176, 2.19.198.27
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, e4578.dscb.akamaiedge.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ssl.adobe.com.edgekey.net, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://customers.pressrelations.de/apps/nrx/files/stored_files/F867FA34-FAAA-EF11-84B9-D4F5EF0B30A8

Simulations

Behavior and APIs

Time	Type	Description
07:49:51	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Input	Output
URL: https://customers.pressrelations.de Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://customers.pressrelations.de

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.263680089463398
Encrypted:	false
SSDEEP:	6:HAob/+q2Pwkn2nKuAl9OmbnIFUt8YAoaU4mWZmw+YAoaU4NVkwOwkn2nKuAl9Omt:gy/+vYfHAahFUt87e4Z/+7e4NV5JfHAR
MD5:	35E2EF8BD2F2BEF0BD804E77835616E5
SHA1:	B3ADF43BEFA6C88C724A44E68BE592519FF22337
SHA-256:	60853C3C44B4BD42E330711A1F137B7C36AF7EA0253D4A59713EE9F1082794A6
SHA-512:	C1FE611620F2CB0CAA8F203E41EA65DB68A2B5346B3B9DA0566D2E9C49EE64D7D22EE9D04E5E81E0626C2347BA9CD4BD7400192B096092E47095B24AFD7607BB
Malicious:	false
Reputation:	low
Preview:	2024/11/25-07:49:40.383 1f0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/25-07:49:40.386 1f0c Recovering log #3.2024/11/25-07:49:40.386 1f0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.263680089463398
Encrypted:	false
SSDEEP:	6:HAob/+q2Pwkn2nKuAl9OmbnIFUt8YAoaU4mWZmw+YAoaU4NVkwOwkn2nKuAl9Omt:gy/+vYfHAahFUt87e4Z/+7e4NV5JfHAR
MD5:	35E2EF8BD2F2BEF0BD804E77835616E5
SHA1:	B3ADF43BEFA6C88C724A44E68BE592519FF22337
SHA-256:	60853C3C44B4BD42E330711A1F137B7C36AF7EA0253D4A59713EE9F1082794A6
SHA-512:	C1FE611620F2CB0CAA8F203E41EA65DB68A2B5346B3B9DA0566D2E9C49EE64D7D22EE9D04E5E81E0626C2347BA9CD4BD7400192B096092E47095B24AFD7607BB
Malicious:	false
Reputation:	low
Preview:	2024/11/25-07:49:40.383 1f0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/25-07:49:40.386 1f0c Recovering log #3.2024/11/25-07:49:40.386 1f0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.259217963792066
Encrypted:	false
SSDEEP:	6:HAo6L+q2Pwkn2nKuAl9Ombzo2jMGIFUt8YAopJ1Zmw+YAoeLVkwOwkn2nKuAl9OU:gMvYfHAa8uFUt8781/+7/5JfHAa8RJ
MD5:	5EAA421FC1AF557FF64CA8AB8D0002B0
SHA1:	DE3588945BE00196D8826173A324803B746BA92E
SHA-256:	5275503DA869DD8F836129EDDBBD5E27AEE9AE38D80F50D56AF8E70625B7047B
SHA-512:	A8418D7B9655872525184BFA5692A0D7B27540733FEF0911D804C5E048B22A9A865BF9B9E623648A3F2677B9C07EA91AF03F4B72CAC0440C2A8C335F82DA8770
Malicious:	false
Reputation:	low
Preview:	2024/11/25-07:49:40.535 1f78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/11/25-07:49:40.556 1f78 Recovering log #3.2024/11/25-07:49:40.557 1f78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.259217963792066
Encrypted:	false
SSDEEP:	6:HAo6L+q2Pwkn2nKuAl9Ombzo2jMGIFUt8YAopJ1Zmw+YAoeLVkwOwkn2nKuAl9OU:gMvYfHAa8uFUt8781/+7/5JfHAa8RJ
MD5:	5EAA421FC1AF557FF64CA8AB8D0002B0
SHA1:	DE3588945BE00196D8826173A324803B746BA92E
SHA-256:	5275503DA869DD8F836129EDDBBD5E27AEE9AE38D80F50D56AF8E70625B7047B
SHA-512:	A8418D7B9655872525184BFA5692A0D7B27540733FEF0911D804C5E048B22A9A865BF9B9E623648A3F2677B9C07EA91AF03F4B72CAC0440C2A8C335F82DA8770
Malicious:	false
Reputation:	low
Preview:	2024/11/25-07:49:40.535 1f78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/11/25-07:49:40.556 1f78 Recovering log #3.2024/11/25-07:49:40.557 1f78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1e9c204a-0b62-4cf8-86c3-d0114ac74de4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.968905002143365
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq2HosBdOg2Hp2caq3QYiubInP7E4TX:Y2sRdsFddMHpJ3QYhbG7n7
MD5:	CAB9AE8E31084125855106D3A5BF5C38
SHA1:	A61AF04BEE7D76392CAECDF67C1B014EF991BC29
SHA-256:	4E17543BE29970D39B811ECE6D039AA03B84747AC43CE800B7484CD09B693552
SHA-512:	0A2D717730C63583CF174C2A926D7C7E589FD8C86E68A68F7C5FFEBAF3B9657CFCFCA97709CC4315C6A2C44B81559A5B036D343877A8124F27AA2B90355B269A
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377098989243022","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":622969},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6cc77f8d-62a6-4bee-995f-093f83924f45.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF501b33.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.248990276344564
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7LU+ctr:etJCV4FiN/jTN/2r8Mta02fEhgO73goO
MD5:	78FD14036666D50427DAB02084D89ADB
SHA1:	C788BEE4C8FA7ABF7AF71E48F011E90EB9F195A5
SHA-256:	C6CB499A4F4AC6B9E8F9A93728D2F3FA9B100A2115E7218D66BDBC8622307576
SHA-512:	6F5AB72BF0DC511F42DF768456E525112B0E58DE65AA16EF0CA8A816B05D1A8A92AF220A499AB1DB775FAA74B4038CC3E9E4DFCF25E85F923F69CF7DA1D4520F
Malicious:	false
Reputation:	low
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.235473251354939
Encrypted:	false
SSDEEP:	6:HAorL+q2Pwkn2nKuAl9OmbzNMxIFUt8YAoL/1Zmw+YAoLpLVkwOwkn2nKuAl9Omk:gJvYfHAa8jFUt87e/1/+7eP5JfHAa84J
MD5:	0D76F53C81A128F3DBAA32B5038B93D9
SHA1:	438B4D5598CF6C264CF2988DB67AEF04F484FC33
SHA-256:	B02D71E15D2F0B148BF461A7BBE2B1ECFD887D3D950887BAA2D0C9BFF9483DDA
SHA-512:	A429530EF7AABAC0B4B2391E7F5C311F4D03BB57FEE745D1A813E0044ABD2E9215DCD949C34C402F2380A36F0F4CC393C894422C71F4BF0070CE8F3A97BBD0AD
Malicious:	false
Reputation:	low
Preview:	2024/11/25-07:49:40.749 1f78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/11/25-07:49:40.750 1f78 Recovering log #3.2024/11/25-07:49:40.750 1f78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.235473251354939
Encrypted:	false
SSDEEP:	6:HAorL+q2Pwkn2nKuAl9OmbzNMxIFUt8YAoL/1Zmw+YAoLpLVkwOwkn2nKuAl9Omk:gJvYfHAa8jFUt87e/1/+7eP5JfHAa84J
MD5:	0D76F53C81A128F3DBAA32B5038B93D9
SHA1:	438B4D5598CF6C264CF2988DB67AEF04F484FC33
SHA-256:	B02D71E15D2F0B148BF461A7BBE2B1ECFD887D3D950887BAA2D0C9BFF9483DDA
SHA-512:	A429530EF7AABAC0B4B2391E7F5C311F4D03BB57FEE745D1A813E0044ABD2E9215DCD949C34C402F2380A36F0F4CC393C894422C71F4BF0070CE8F3A97BBD0AD
Malicious:	false
Reputation:	low
Preview:	2024/11/25-07:49:40.749 1f78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/11/25-07:49:40.750 1f78 Recovering log #3.2024/11/25-07:49:40.750 1f78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241125124945Z-187.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
Category:	dropped
Size (bytes):	65110
Entropy (8bit):	4.477142562970657
Encrypted:	false
SSDEEP:	1536:MtnSW1/84aJN9ElL5okM7BHZ1Zx0+Ww/4du:9gYJNmV5hiDbGu
MD5:	A0E6C18ACBD8E95CB6DA29187EDC171A
SHA1:	B816336D8A6A6382B3612640B725F841B59AAAFC
SHA-256:	3E3BB9E778BF488E82E1A0BF917F2FEBAD5063700B71ADB1B09E12672E28E2F4
SHA-512:	82F93E196B99B87CDAE587D8283DCC4D70CD2E328A8DE28C1B903D3B762607474C375F27F54C03B516A45C9E8D2524845BC03B99B8D7E3B18E93D6C30A83BF7E
Malicious:	false
Reputation:	low
Preview:	BMV.......6...(...k...h..... .......................................................q.......o................vrv.LDC.....................................................................................z\|..TQV.NKO.XTZ.XV\.QPU.VU\.uu~.........&)-.%$%.YLE..ud..}m...x...n..}j..yf..ub..p^..m[..jU..iU..lY..hT..gQ..n\..nb..kb..k\..lY..p]..s^..q\..qZ..t]..q[..oX..nX.m[H.A;...qW..y[..uY..uY..oU..y`..r[..m].{jf.{ln.nUI.gL;.gK5.eH4.eI6.aF1..............................}..}o................tv.SOQ...}..................................................................................YX_.UQX.VSX.OMQ.LKO.WW[.a_h.........5;@...!.J?;..qc...m...m...n...}..~j..yg..ub..wd..lY..kY..p]..m[..iW..o]..od..mc..n^..o\..s^..u`..u^..u`..s^..pZ..s[..u[..rY..u\.ydN.C>/..pV..wZ..~b..wZ..sY..u\..w\..uh..ol.{ig.u[L.kN?.lN:.hI4.fH4.iL7.................................j`.................wps.dVP............

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.445148554029171
Encrypted:	false
SSDEEP:	384:yezci5tFEgABiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rRs3OazzU89UTTgUL
MD5:	7172BE5DA43C68A8689A86BD7354999D
SHA1:	63D28DACDCC45057D4D20386BE06362F62FED8DB
SHA-256:	EA7C2A7B2DAF69FAD3F646A906CC4C33BABF494689E937292C540C2B111F8640
SHA-512:	2F58A6248F8D3F6937A331CEFE5912A6F8722B3A13ABA5736D5897F613231990EB1D9ECF986A092BDA0D3CB90BD17062841098980F41999071CAA86F7C6BCDA0
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.775138637836195
Encrypted:	false
SSDEEP:	48:7MFp/E2ioyVA4ioy9oWoy1Cwoy1fbKOioy1noy1AYoy1Wioy1hioybioyltoy1nN:7CpjuA4F2RXKQM/Sb9IVXEBodRBkk
MD5:	BB0A3BE20FBDCBB369627ED38714F599
SHA1:	D9AB9717DFFFB832E5B843AC3C55BC2492354B54
SHA-256:	33C935A80C42CDB311FCD5373459E8C07DC1EC463F1E08B98B8CF6EF20E4F412
SHA-512:	ED65C0A1514AFB0AD02B38AFCC7633835A5E136C462AF9D4C0DCA0F638DDEFDEDD7C72823372F5BC1F1BEBC1484D49691A1A800D7F14DA60A5D0939B76A04EBF
Malicious:	false
Reputation:	low
Preview:	.... .c.....i.}1...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Reputation:	low
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	low
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7673182398396405
Encrypted:	false
SSDEEP:	3:kkFkluliN/ltfllXlE/HT8kX1NNX8RolJuRdxLlGB9lQRYwpDdt:kK3UPeT8ANMa8RdWBwRd
MD5:	E25EDE9478AE539ACE11952F9F075590
SHA1:	58E6EAA21CE5EE89D71F18ACB4515A1F5D97B926
SHA-256:	91362C7EB1F1D6B5B9B06D4C65B8922BB9326577284D9A0C1743757C318FF9C8
SHA-512:	1EE2FF9B26F59F3320D77017306948594D481B954E88F2A0D9B19CA58BFD35F2588433F8D5BAD449B234E389A8084E8BF99B1CAF2B3A3BA3E7CA741DCCB49F19
Malicious:	false
Reputation:	low
Preview:	p...... ........])..8?..(....................................................... ..........W....0...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.230795304831838
Encrypted:	false
SSDEEP:	6:kKvNtL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:dtiDImsLNkPlE99SNxAhUe/3
MD5:	7AE2D73BFF98D8A679A511A946C2F3C5
SHA1:	15ACC726A4D1132C62E981305F42D5BBCC5E72C1
SHA-256:	4DDFB7E64BCA923412333E22CC5949B0DEF2F318746B4461DA4CBB174B9B93E0
SHA-512:	12B367FA409C60B1FE3AE7418C9B6CF592DBB87D04ED0C74D252A4AAF39EDA901A86FEF488A36208A16FFBA6543EAF490756EF6EC409150C8A356B20CFAC57F1
Malicious:	false
Reputation:	low
Preview:	p...... ........Hl..8?..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Reputation:	low
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2145
Entropy (8bit):	5.067016064488339
Encrypted:	false
SSDEEP:	48:YFY92sL0/EY0bMSlMtCM5mMOpiMAW0MretMSMmkaMY:SHv/SYtt55V6AWLre6JmkhY
MD5:	613F8763034DB4430B143FEAAECFA945
SHA1:	D0A13852A20E63CD24DE140C8DD80D0666A6BE81
SHA-256:	54445FA734CE299E5B0F386694FD5C3254E56D0523A2F9B6BCB40181F9DBA42F
SHA-512:	2044BBCCE5D7C018C7F691870E9910F9363016BA55302BF265CA17223C09E323AB656943D6C2B5648188BADACB1E9D58323C4CF0AD9960283E02A9FDFAAA76BC
Malicious:	false
Reputation:	low
Preview:	{"all":[{"id":"TESTING","info":{"dg":"DG","sid":"TESTING"},"mimeType":"file","size":4,"ts":1732538984000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"23c88c8acf166d9fda5ae4d83df3db72","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696420889000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d5fa85f4cf271b5fa75367efd1b392fa","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1696420884000},{"id":"DC_FirstMile_Right_Sec_Surface","info":{"dg":"7c2ad79e375e3ea39f82a389e8a5841f","sid":"DC_FirstMile_Right_Sec_Surface"},"mimeType":"file","size":294,"ts":1696420882000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"c3af48ba3dee086edbbf20dff46c7ee0","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1255,"ts":1696333862000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"7101e009d8bf8920d0a3dd3f5dc75ebc","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696333862000},{"id":"DC_Reader_Edit_LHP_Banner"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1869401219873381
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUbSvR9H9vxFGiDIAEkGVvpX:lNVmswUUUUUUUUb+FGSItT
MD5:	E9CAA953C34C1ECFBC1A7977CBCD3CD5
SHA1:	96AB7E7A53577E8F908E99CFD2D21CEFD5B37E8A
SHA-256:	8CE0CA50787754BF9CB73DE70F07F8BA9518EF7FCDA453D849B96CF7C34B2DF3
SHA-512:	9C777C7655469EEDCD57F31E137600742494DAA99BC2D5A24DDAECB295F6930D944E4F0FDEE1924616C1511B59AC8208ED000608031BBC3E74FAA9F540B52F79
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6058998868441499
Encrypted:	false
SSDEEP:	48:7MmKUUUUUUUUUUPvR9H9vxFGiDIAEkGVvxqFl2GL7msY:7qUUUUUUUUUUnFGSIt/KVmsY
MD5:	83213F14C84B418DC2BACA051B6B647D
SHA1:	5EF72C13C7D21B45289C5CFCC3FE33D384196401
SHA-256:	C3A4C4C234556DB352F1F134F7B7D518A846B804E1A9EDF72364463297085B5A
SHA-512:	BCED37EBE2B9428339180715DE8DBC891F2FC1ED4E20960AE7F2E8EA762408207820690A9C6986231625F58564ABBC788A7B1B6FBB28627D63CBB9D1733123A5
Malicious:	false
Reputation:	low
Preview:	.... .c.....R^.f......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgkrniEek7hGNqTfICiNUONKR+NYyu:6a6TZ44ADEkjiEek7hGN6jwNK
MD5:	6FB6E26F4E0F327297D76E736E12C1B7
SHA1:	67290913A23964FBBFCED8B1DCD2683BE71662BE
SHA-256:	8B7ADA40BA1E1F6D3299B067AEB3761F3D2992C761CAE857EBD301845A64A370
SHA-512:	EF4FEDC98525D08D3B100BBA7FED5756C196DE62B565BA347092932375A1370A3F3DC6452328EBE9A45328C1596BF921365244A9AD91DCDAF14CE453EF51DFB0
Malicious:	false
Reputation:	low
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Temp\MSIf0e38.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5309417490522437
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8fpYfMw:Qw946cPbiOxDlbYnuRKwYfB
MD5:	E09FCB7B651F7F5123AE3E99461A4D76
SHA1:	178FEAC1339DA558E15B9FF62064D79C002143E7
SHA-256:	BD9CFBCCF02EA95E1C70D892F34137FEE76F1AFE14B35ED40BE37F47240676A5
SHA-512:	9A8B378B5977F7635D93789DB6C715ECBC8C17F20055BCC705007F625AFB30253B8FC9E0946D58B95B78C5FD93DF92CE18E1C5FAC0B15720DA8A26CCBCABD412
Malicious:	false
Reputation:	low
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.5./.1.1./.2.0.2.4. . .0.7.:.4.9.:.4.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-25 07-49-42-504.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Reputation:	low
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15100
Entropy (8bit):	5.365794976719498
Encrypted:	false
SSDEEP:	384:pXzer/aSJ1qyftTa+L8SgqS3Z3B3839Gi4xl2oXe2saZPj/vj3d5ssPplmlmHqnp:CFsJRMtp
MD5:	646B3CEF404DF64E478299029093DDD2
SHA1:	64F90E262190287CE5F45023711353A2ECAFB16C
SHA-256:	8210B398211ADCDB09736AE70CF61830EEB355AC651010B6F3CACF9092B3F05E
SHA-512:	977059C9C1D736CE564F7243B3F31D65F9AFF6D36BD6B0B34A673228F4F9415074D9CFBE208ACBE9C5B71A8D65A398B4B87FA847EB78793F8C6004F00EA4FF2A
Malicious:	false
Reputation:	low
Preview:	SessionID=f3ec6a1b-3152-44e7-b02d-0a4917819c2a.1732538982535 Timestamp=2024-11-25T07:49:42:535-0500 ThreadID=7772 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=f3ec6a1b-3152-44e7-b02d-0a4917819c2a.1732538982535 Timestamp=2024-11-25T07:49:42:537-0500 ThreadID=7772 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=f3ec6a1b-3152-44e7-b02d-0a4917819c2a.1732538982535 Timestamp=2024-11-25T07:49:42:537-0500 ThreadID=7772 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=f3ec6a1b-3152-44e7-b02d-0a4917819c2a.1732538982535 Timestamp=2024-11-25T07:49:42:537-0500 ThreadID=7772 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=f3ec6a1b-3152-44e7-b02d-0a4917819c2a.1732538982535 Timestamp=2024-11-25T07:49:42:537-0500 ThreadID=7772 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.392148330507279
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2ri:e
MD5:	B83114DB8DEEE1BAAB77FD8055F05E96
SHA1:	ABCCFA15ACF64A6AA629FAD9CD667CD78DDC4B83
SHA-256:	B677917F65C8865ED3326258779F5CA2848D0E29CF464FAE2332AA2ECE8D1330
SHA-512:	2C76C27DF3D202904112FC444E89148C1FDDC49E5ACA87A57DFEDE187D39FF741591A832708F2722669200F25BE489BCFA7A90F0D2033398491EF15F7EB61F86
Malicious:	false
Reputation:	low
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\26e4e930-a39b-4632-b710-125e36abb383.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Reputation:	low
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\550ec0d6-6e70-46f1-b01f-32cc53008714.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xdwYIGNPzWL07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JdwZG5WLxYGZn3mlind9i4ufFXpAXkru
MD5:	8885DC5E10CD37A4F3276ACD66085DF5
SHA1:	C5201B1E3B32098E1648D26B5F1B1C7642701478
SHA-256:	92DB348D9A47331F2DBDBD095B1F9311BECAD72AE16C5B7F9DA7E538946B0512
SHA-512:	4F3FC2B3A8C64E50B92E63A8F689D815088EDE5BBADE20C6F8ACF5ABD1C2361BB577F3DF9522E8B3F560BB6A5CAE6C7EC9F93CF55A2A913B25F5282E74C9263E
Malicious:	false
Reputation:	low
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\985a0f1d-0295-4bae-9376-116c200b2049.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Reputation:	low
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\c65c3507-8c02-4c9b-bc98-02a03249b0a7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Reputation:	low
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\Desktop\cmdline.out

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	4238
Entropy (8bit):	2.8923479636343545
Encrypted:	false
SSDEEP:	48:OXGRos2RnRhCRnRhr6xkbapxRNgPrtZfO15S6IHLiKbawI:OXGR0RnR4RnRCJzEjbO7SPHLiv
MD5:	8B23FF162C1627319D4AED0C840C469A
SHA1:	99A084C2A69C47D0BD6738B925AE54F37A413BFF
SHA-256:	3EFD417AFFE9098ADEB253505CB69727E769966D3C99669908732E80B44DDEB0
SHA-512:	9343201B53CF3FF1D82604F56FE066726B6938D6133C9BAF294412D837295F56619F196C450A15F5000D429BD88F8AE971AC7358503A5609429250C3C2054AE6
Malicious:	false
Reputation:	low
Preview:	--2024-11-25 07:49:29-- https://customers.pressrelations.de/apps/nrx/files/stored_files/F867FA34-FAAA-EF11-84B9-D4F5EF0B30A8..Resolving customers.pressrelations.de (customers.pressrelations.de)... 217.113.45.178..Connecting to customers.pressrelations.de (customers.pressrelations.de)\|217.113.45.178\|:443... connected...HTTP request sent, awaiting response... 200 OK..Length: 2377958 (2.3M) [application/pdf]..Saving to: 'C:/Users/user/Desktop/download/ medienspiegel_25.11.2024.pdf'.... 0K .......... .......... .......... .......... .......... 2% 158K 14s.. 50K .......... .......... .......... .......... .......... 4% 442K 10s.. 100K .......... .......... .......... .......... .......... 6% 414K 8s.. 150K .......... .......... .......... .......... .......... 8% 864K 6s.. 200K .......... .......... .......... .......... .......... 10% 340K 6s.. 250K .......... .......... .......... .......... .......... 12% 1.95M 5s.. 300K .......... .......... .......... ......

C:\Users\user\Desktop\download\ medienspiegel_25.11.2024.pdf

Download File

Process:	C:\Windows\SysWOW64\wget.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	2377958
Entropy (8bit):	7.976761105878812
Encrypted:	false
SSDEEP:	49152:OLe12LBeojhzLLidSN2joNDcQTVECnobd5wtgkv:Oq105B8M5cs44ekv
MD5:	FE17D6D47E29867303C728DEB4B17B8E
SHA1:	E805C36F9CA920BF4BD0E4D09B5CE0D254D1BA60
SHA-256:	810444FE298ECDAA77EF75F6CCEAF9C0F550376F8C8C5C9C734E287BC07ECEC3
SHA-512:	6E952DC6823BF068EDFC9E0D5AD0A68FD1C65CE9A771819967369844A7F5A8048298BB52666C539D735F0875C622653E1490414F39F550D364BE7D2AC6EE28C0
Malicious:	false
Reputation:	low
Preview:	%PDF-1.7.%......6 0 obj.293165.endobj.5 0 obj.<</Type/XObject./Subtype/Image./Width 1190./Height 1683./Filter /DCTDecode/BitsPerComponent 8./ColorSpace /DeviceRGB /Length 6 0 R.>>.stream.......JFIF.............C..............................................!........."$".$.......C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....O......V4..u!...E)...a.%:..B....y6..x....`f...&.......Gi)'..k:..l.+.#.f......s.j...Xcy..QK...2...h..9o.#...2.8..k....B.e8g.1...8?.k..t..;.>.#..#.U'L.....\I{ ..._.zW.m%4.....m.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 13:49:32.246457100 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:32.246551991 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:32.246659040 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:32.248202085 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:32.248245955 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:33.716104984 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:33.716202974 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:33.719010115 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:33.719034910 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:33.719254017 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:33.720335007 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:33.763335943 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.401375055 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.401441097 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.401485920 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.401518106 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.401557922 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.401572943 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.401602983 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.535617113 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.535645962 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.535737991 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.535783052 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.535806894 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.535830021 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.580889940 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.580919981 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.581044912 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.581079960 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.581130028 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.721046925 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.721076012 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.721149921 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.721216917 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.721254110 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.721270084 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.749963045 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.749989986 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.750161886 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.750197887 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.750242949 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.767385006 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.767407894 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.767474890 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.767517090 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.767540932 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.767561913 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.833762884 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.833796024 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.833921909 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.834003925 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.834060907 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.922813892 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.922843933 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.923022032 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.923084021 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.923149109 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.942032099 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.942061901 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.942146063 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.942207098 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.942239046 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.942260981 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.955410004 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.955442905 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.955498934 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.955523014 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.955552101 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.955569029 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.968797922 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.968822956 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.968890905 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.968924999 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.968971014 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.968991041 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.995966911 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.995997906 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.996078014 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:34.996107101 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:34.996145010 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.011729002 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.011759043 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.011815071 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.011848927 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.011862993 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.011883974 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.127118111 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.127187014 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.127276897 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.127326012 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.127346039 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.127362967 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.138658047 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.138717890 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.138798952 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.138822079 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.138861895 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.138874054 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.150621891 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.150666952 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.150728941 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.150743961 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.150789022 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.162508965 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.162556887 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.162580013 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.162604094 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.162619114 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.162641048 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.172674894 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.172724962 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.172760010 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.172786951 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.172804117 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.172821045 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.184257030 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.184304953 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.184346914 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.184365988 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.184389114 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.184406996 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.209193945 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.209244013 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.209312916 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.209336996 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.209352970 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.209376097 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.331898928 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.331967115 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.332005978 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.332034111 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.332077026 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.332103014 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.339612007 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.339668036 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.339703083 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.339720964 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.339750051 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.339765072 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.350281000 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.350308895 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.350382090 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.350395918 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.350431919 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.361332893 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.361360073 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.361426115 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.361439943 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.361474991 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.370215893 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.370237112 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.370292902 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.370306015 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.370330095 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.370351076 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.382608891 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.382631063 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.382698059 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.382709980 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.382745981 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.391199112 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.391222000 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.391266108 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.391275883 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.391305923 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.391326904 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.418755054 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.418783903 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.418869019 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.418879032 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.418915987 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.539684057 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.539751053 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.539810896 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.539843082 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.539856911 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.539880991 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.548563957 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.548615932 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.548667908 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.548688889 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.548718929 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.548736095 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.558438063 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.558489084 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.558537006 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.558557987 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.558588982 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.558604956 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.567919970 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.567964077 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.568010092 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.568027973 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.568069935 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.576433897 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.576479912 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.576524973 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.576543093 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.576565027 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.576586008 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.585195065 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.585244894 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.585279942 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.585300922 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.585340977 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.585355043 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.595200062 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.595220089 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.595287085 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.595307112 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.595345974 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.629388094 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.629416943 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.629507065 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.629528999 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.629573107 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.749953985 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.750042915 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.750097036 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.750132084 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.750155926 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.750169039 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.758563995 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.758616924 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.758651018 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.758692026 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.758713961 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.758727074 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.771236897 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.771284103 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.771331072 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.771363974 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.771392107 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.771405935 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.779552937 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.779608011 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.779645920 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.779676914 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.779695034 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.779711008 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.786962986 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.786987066 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.787033081 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.787056923 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.787075043 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.787089109 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.795481920 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.795507908 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.795583010 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.795603037 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.795639992 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.803723097 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.803741932 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.803873062 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.803893089 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.803929090 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.838910103 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.838946104 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.839027882 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.839051962 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.839095116 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.960417032 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.960453033 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.960560083 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.960597038 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.960649967 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.968928099 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.968959093 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.969085932 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.969093084 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.969201088 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.978604078 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.978630066 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.978734970 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.978744984 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.978784084 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.988189936 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.988224030 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.988323927 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.988332987 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.988374949 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.995752096 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.995783091 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.995949030 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:35.995955944 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:35.996054888 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.005815029 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.005836964 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.005912066 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.005944014 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.005985975 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.013719082 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.013744116 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.013814926 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.013824940 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.013861895 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.049966097 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.050025940 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.050076962 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.050090075 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.050118923 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.050132990 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.172131062 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.172199965 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.172238111 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.172255039 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.172312021 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.179174900 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.179203987 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.179241896 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.179258108 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.179280043 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.179296017 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.188505888 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.188525915 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.188569069 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.188576937 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.188618898 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.188635111 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.197855949 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.197880983 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.197947979 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.197956085 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.197990894 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.206609964 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.206641912 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.206708908 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.206715107 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.206743956 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.206759930 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.216162920 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.216188908 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.216253996 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.216259956 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.216311932 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.224265099 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.224291086 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.224354982 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.224363089 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.224553108 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.260389090 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.260426998 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.260581970 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.260581970 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.260593891 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.260642052 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.381851912 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.381922960 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.381998062 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.382026911 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.382042885 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.382064104 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.390012026 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.390094042 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.390135050 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.390142918 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.390186071 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.390208006 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.399394035 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.399416924 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.399483919 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.399493933 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.399528980 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.408516884 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.408543110 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.408597946 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.408607960 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.408658028 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.416614056 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.416656017 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.416701078 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.416708946 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.416733980 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.416752100 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.427339077 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.427395105 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.427436113 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.427444935 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.427470922 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.427490950 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.434736013 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.434786081 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.434910059 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.434926033 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.435009956 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.470885992 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.470951080 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.471010923 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.471086025 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.471121073 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.471162081 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.592318058 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.592349052 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.592641115 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.592701912 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.592761993 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.600208998 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.600238085 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.600327015 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.600343943 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.600415945 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.609533072 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.609559059 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.609625101 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.609642982 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.609669924 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.609689951 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.618711948 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.618732929 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.618825912 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.618848085 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.618897915 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.628192902 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.628211021 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.628298044 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.628339052 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.628398895 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.636904001 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.636950970 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.637017965 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.637048960 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.637073994 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.637094975 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.645107985 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.645155907 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.645215034 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.645230055 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.645256996 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.645277023 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.682430983 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.682497978 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.682631969 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.682686090 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.682758093 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.682821035 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.802747965 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.802783012 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.802865028 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.802918911 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.802969933 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.812041998 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.812064886 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.812141895 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.812159061 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.812175035 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.812197924 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.820067883 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.820096016 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.820199013 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.820216894 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.820270061 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.829605103 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.829629898 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.829694033 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.829714060 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.829741955 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.829761982 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.837516069 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.837551117 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.837650061 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.837678909 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.837707043 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.837726116 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.847471952 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.847492933 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.847578049 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.847613096 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.847673893 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.855624914 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.855654001 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.855722904 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.855743885 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.855804920 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.891912937 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.891938925 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.892117023 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:36.892168999 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:36.892225027 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.013467073 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.013497114 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.013720036 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.013753891 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.013838053 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.022692919 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.022721052 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.022852898 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.022874117 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.022913933 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.030740023 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.030761957 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.030855894 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.030879021 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.030920029 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.040326118 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.040345907 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.040462017 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.040482998 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.040520906 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.049343109 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.049365997 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.049431086 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.049448967 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.049487114 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.057984114 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.058007002 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.058094978 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.058111906 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.058168888 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.067383051 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.067409039 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.067478895 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.067497015 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.067537069 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.102550030 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.102576971 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.102668047 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.102689028 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.102859974 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.223725080 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.223747969 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.223831892 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.223862886 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.223900080 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.231817961 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.231838942 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.231937885 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.231954098 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.232002020 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.241250992 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.241271019 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.241362095 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.241378069 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.241413116 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.250794888 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.250818014 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.250890017 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.250905037 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.250946045 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.259924889 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.259948015 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.260021925 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.260036945 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.260185003 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.268613100 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.268636942 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.268696070 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.268709898 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.268750906 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.276974916 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.276995897 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.277062893 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.277077913 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.277112007 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.312748909 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.312777996 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.312855959 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.312880039 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.312922955 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.435090065 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.435117006 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.435405970 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.435441971 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.435487032 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.443542004 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.443566084 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.443635941 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.443655014 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.443694115 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.451582909 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.451613903 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.451687098 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.451703072 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.451740980 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.460844994 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.460870981 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.460937023 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.460951090 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.460987091 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.471514940 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.471538067 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.471610069 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.471625090 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.471662998 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.479557991 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.479581118 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.479665995 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.479681015 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.479717016 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.488655090 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.488673925 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.488761902 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.488776922 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.488826036 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.527331114 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.527352095 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.527468920 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.527489901 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.527529955 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.644716024 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.644793987 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.644890070 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.644931078 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.644951105 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.644968033 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.654269934 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.654318094 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.654378891 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.654426098 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.654453039 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.654465914 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.662118912 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.662164927 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.662200928 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.662221909 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.662240982 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.662265062 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.671740055 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.671787024 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.671869993 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.671888113 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.671914101 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.671936989 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.680785894 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.680836916 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.680888891 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.680906057 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.680932045 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.680963039 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.689412117 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.689429045 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.689510107 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.689526081 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.689568996 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.698726892 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.698741913 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.698842049 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.698859930 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.698899984 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.734086037 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.734105110 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.734196901 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:37.734220028 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:37.734261036 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.068531990 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.068558931 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.068600893 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.068794966 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.068795919 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.068864107 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.068906069 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.068964958 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.068985939 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.068996906 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.069019079 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.069048882 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.069231987 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.069279909 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.069303036 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.069324017 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.069353104 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.069447041 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.069484949 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.069519043 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.069534063 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.069575071 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.069607019 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.069655895 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.069667101 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.069685936 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.069719076 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.069866896 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.069905996 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.069945097 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.069960117 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.069983006 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.070451975 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.070971966 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.074953079 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.074996948 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.075064898 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.075090885 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.075120926 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.084439039 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.084489107 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.084539890 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.084561110 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.084606886 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.093643904 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.093684912 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.093790054 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.093802929 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.103053093 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.103105068 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.103138924 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.103148937 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.103189945 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.111680031 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.111695051 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.111782074 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.111793995 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.119720936 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.119740963 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.119816065 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.119827986 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.129096031 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.129112005 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.129184008 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.129201889 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.171859980 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.189232111 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.189249992 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.189333916 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.189347982 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.189387083 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.198443890 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.198467016 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.198533058 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.198545933 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.198580027 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.276401997 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.276424885 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.276525974 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.276551962 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.276623964 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.285446882 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.285470009 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.285619020 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.285649061 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.285741091 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.294915915 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.294935942 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.294994116 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.295032978 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.295077085 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.303145885 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.303165913 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.303247929 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.303277016 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.303332090 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.312448025 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.312469006 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.312539101 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.312567949 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.312608957 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.320734024 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.320763111 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.320844889 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.320873976 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.320918083 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.326889038 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.326909065 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.326987028 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.326997995 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.327035904 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.364216089 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.364245892 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.364365101 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.364394903 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.364428043 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.489459038 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.489486933 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.489612103 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.489644051 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.489741087 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.494225025 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.494242907 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.494318008 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.494337082 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.494375944 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.499998093 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.500025034 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.500066996 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.500083923 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.500108957 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.500123024 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.505821943 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.505852938 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.505924940 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.505944014 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.505986929 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.511702061 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.511728048 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.511864901 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.511883974 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.511962891 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.514008045 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.514070034 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.514085054 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.514106989 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:38.514125109 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.514157057 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.514569998 CET	49730	443	192.168.2.4	217.113.45.178
Nov 25, 2024 13:49:38.514592886 CET	443	49730	217.113.45.178	192.168.2.4
Nov 25, 2024 13:49:49.968600035 CET	49743	443	192.168.2.4	34.193.227.236
Nov 25, 2024 13:49:49.968647957 CET	443	49743	34.193.227.236	192.168.2.4
Nov 25, 2024 13:49:49.969274044 CET	49743	443	192.168.2.4	34.193.227.236
Nov 25, 2024 13:49:49.978662014 CET	49743	443	192.168.2.4	34.193.227.236
Nov 25, 2024 13:49:49.978672981 CET	443	49743	34.193.227.236	192.168.2.4
Nov 25, 2024 13:49:51.445583105 CET	443	49743	34.193.227.236	192.168.2.4
Nov 25, 2024 13:49:51.447755098 CET	49743	443	192.168.2.4	34.193.227.236
Nov 25, 2024 13:49:51.447787046 CET	443	49743	34.193.227.236	192.168.2.4
Nov 25, 2024 13:49:51.448878050 CET	443	49743	34.193.227.236	192.168.2.4
Nov 25, 2024 13:49:51.448940992 CET	49743	443	192.168.2.4	34.193.227.236
Nov 25, 2024 13:49:51.448954105 CET	443	49743	34.193.227.236	192.168.2.4
Nov 25, 2024 13:49:51.449100018 CET	49743	443	192.168.2.4	34.193.227.236
Nov 25, 2024 13:49:51.466375113 CET	49743	443	192.168.2.4	34.193.227.236
Nov 25, 2024 13:49:51.466507912 CET	443	49743	34.193.227.236	192.168.2.4
Nov 25, 2024 13:49:51.466803074 CET	49743	443	192.168.2.4	34.193.227.236
Nov 25, 2024 13:49:51.466814041 CET	443	49743	34.193.227.236	192.168.2.4
Nov 25, 2024 13:49:51.511279106 CET	49743	443	192.168.2.4	34.193.227.236
Nov 25, 2024 13:49:51.511300087 CET	443	49743	34.193.227.236	192.168.2.4
Nov 25, 2024 13:49:51.558048964 CET	49743	443	192.168.2.4	34.193.227.236
Nov 25, 2024 13:49:51.901211977 CET	443	49743	34.193.227.236	192.168.2.4
Nov 25, 2024 13:49:51.901284933 CET	443	49743	34.193.227.236	192.168.2.4
Nov 25, 2024 13:49:51.901489019 CET	49743	443	192.168.2.4	34.193.227.236
Nov 25, 2024 13:49:52.113261938 CET	49743	443	192.168.2.4	34.193.227.236
Nov 25, 2024 13:49:52.113286018 CET	443	49743	34.193.227.236	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 13:49:30.486321926 CET	51928	53	192.168.2.4	1.1.1.1
Nov 25, 2024 13:49:31.484694004 CET	51928	53	192.168.2.4	1.1.1.1
Nov 25, 2024 13:49:32.242216110 CET	53	51928	1.1.1.1	192.168.2.4
Nov 25, 2024 13:49:32.242466927 CET	53	51928	1.1.1.1	192.168.2.4
Nov 25, 2024 13:49:50.331506968 CET	58301	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 25, 2024 13:49:30.486321926 CET	192.168.2.4	1.1.1.1	0x1d3b	Standard query (0)	customers.pressrelations.de	A (IP address)	IN (0x0001)	false
Nov 25, 2024 13:49:31.484694004 CET	192.168.2.4	1.1.1.1	0x1d3b	Standard query (0)	customers.pressrelations.de	A (IP address)	IN (0x0001)	false
Nov 25, 2024 13:49:50.331506968 CET	192.168.2.4	1.1.1.1	0xece2	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 25, 2024 13:49:32.242216110 CET	1.1.1.1	192.168.2.4	0x1d3b	No error (0)	customers.pressrelations.de		217.113.45.178	A (IP address)	IN (0x0001)	false
Nov 25, 2024 13:49:32.242466927 CET	1.1.1.1	192.168.2.4	0x1d3b	No error (0)	customers.pressrelations.de		217.113.45.178	A (IP address)	IN (0x0001)	false
Nov 25, 2024 13:49:50.673175097 CET	1.1.1.1	192.168.2.4	0xece2	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 13:49:50.714519024 CET	1.1.1.1	192.168.2.4	0xb97e	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 25, 2024 13:49:50.714519024 CET	1.1.1.1	192.168.2.4	0xb97e	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

customers.pressrelations.de

https:

p13n.adobe.io

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	217.113.45.178	443	7596	C:\Windows\SysWOW64\wget.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:49:33 UTC	267	OUT	GET /apps/nrx/files/stored_files/F867FA34-FAAA-EF11-84B9-D4F5EF0B30A8 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko Accept: / Accept-Encoding: identity Host: customers.pressrelations.de Connection: Keep-Alive
2024-11-25 12:49:34 UTC	627	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 25 Nov 2024 12:49:34 GMT Content-Type: application/pdf Content-Length: 2377958 Connection: close Cache-Control: private Last-Modified: Mon, 25 Nov 2024 06:55:12 GMT Accept-Ranges: bytes ETag: "67441f50-2448e6" Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Origin: * Content-Disposition: inline; filename=" medienspiegel_25.11.2024.pdf" X-Powered-By: ARR/3.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS Access-Control-Allow-Headers: Accept, Content-Type, Origin
2024-11-25 12:49:34 UTC	15757	IN	Data Raw: 25 50 44 46 2d 31 2e 37 0a 25 e2 e3 cf d3 0d 0a 36 20 30 20 6f 62 6a 0a 32 39 33 31 36 35 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 0a 2f 53 75 62 74 79 70 65 2f 49 6d 61 67 65 0a 2f 57 69 64 74 68 20 31 31 39 30 0a 2f 48 65 69 67 68 74 20 31 36 38 33 0a 2f 46 69 6c 74 65 72 20 2f 44 43 54 44 65 63 6f 64 65 2f 42 69 74 73 50 65 72 43 6f 6d 70 6f 6e 65 6e 74 20 38 0a 2f 43 6f 6c 6f 72 53 70 61 63 65 20 2f 44 65 76 69 63 65 52 47 42 20 2f 4c 65 6e 67 74 68 20 36 20 30 20 52 0a 3e 3e 0a 73 74 72 65 61 6d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 01 00 90 00 90 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0a 0b 09 0c 11 0f 12 12 11 0f 11 10 13 16 1c 17 13 14 1a 15 10 Data Ascii: %PDF-1.7%6 0 obj293165endobj5 0 obj<</Type/XObject/Subtype/Image/Width 1190/Height 1683/Filter /DCTDecode/BitsPerComponent 8/ColorSpace /DeviceRGB /Length 6 0 R>>streamJFIFC
2024-11-25 12:49:34 UTC	16384	IN	Data Raw: e9 51 6a 37 89 6a f2 43 05 9a 66 49 e5 27 72 47 1c 63 2c c7 3f eb 36 8c 7c c7 81 cc 67 86 af 3b f1 ff 00 8b 5f c4 9e 21 be bb 5b 54 10 4d 8b 6b 25 62 4b 5b db a7 08 a3 df 18 24 f7 3f 5a ee 7e 20 6a 87 c3 1e 06 8f 46 42 46 a7 af 20 92 e1 9b 1b a2 b4 56 f9 54 81 f7 7c c6 04 e0 75 09 92 32 4d 79 df 80 74 0b 9f 11 f8 8e de ca 05 cf 9a 71 bb fb a9 9e 4d 7c fa 8b ab 25 04 7b 0e 4a 2b 99 ec 7b 37 c0 5d 0a c2 d3 44 97 57 4b 42 97 33 7e e9 59 b9 c2 0f 4f c4 fe 95 e9 bf 5a ab a5 d8 c1 61 6f 1d 8d b4 61 20 86 35 44 03 d0 01 cd 5a 6a fa aa 14 fd 9d 35 13 e7 ab d4 f6 93 72 10 9a ab 27 fc 7f 91 ff 00 4c 47 fe 84 7f c2 ac d5 52 73 a8 49 e8 22 4f e6 d5 a9 91 21 19 3c 53 d5 7d 69 10 73 9a 90 50 02 81 85 20 55 28 79 bc b8 23 d5 47 e9 57 0b 76 aa 76 df f1 f5 75 fe fa ff 00 Data Ascii: Qj7jCfI'rGc,?6\|g;_![TMk%bK[$?Z~ jFBF VT\|u2MytqM\|%{J+{7]DWKB3~YOZaoa 5DZj5r'LGRsI"O!<S}isP U(y#GWvvu
2024-11-25 12:49:34 UTC	16384	IN	Data Raw: 80 28 a7 37 4a 61 ae 94 8e 61 69 8c 70 29 59 aa 26 3c f5 a7 70 14 f4 a8 5f dc 53 9a 4c 0a 81 98 9e 69 81 a3 61 aa 49 6b 11 b6 96 31 73 6a dc b4 6f db e9 5c df 8a da d0 ea 72 9b 17 90 a1 82 dc 95 71 8d 9f 3c bc 56 89 c1 1c 8a c4 d6 e5 87 fb 49 c7 94 70 b0 db ef 1b b9 6f 9a 6a ce a2 d0 d2 9e e6 b5 d1 c4 b2 7d 7f a9 aa cc dc f7 a9 e7 0d 2d c4 bb 14 80 58 e3 9e 9c 9a 58 e0 45 e6 42 18 8e dd ab 47 b9 99 02 23 c9 d0 1c 7a d4 8b 0a 46 32 ff 00 31 f7 e9 52 cd 30 0b 85 51 ec 3b 0a ae 16 69 ce 15 78 fd 29 5c 76 1c d2 8c ed 5e be d4 c8 a2 79 83 1f 4a b1 1d ac 71 f2 e7 73 7a 76 a7 3b 8c 63 38 02 a5 ca c3 48 8e 3b 68 d4 02 e4 b1 f4 ed 4b 21 51 ed 4c 0e cc 70 aa 4d 23 c6 e0 65 8a d4 dd 95 61 d1 10 ed c0 e3 d6 86 0b e6 6e ce 48 1d 28 88 b3 30 40 40 fa 0a 91 57 17 4a 84 Data Ascii: (7Jaaip)Y&<p_SLiaIk1sjo\rq<VIpoj}-XXEBG#zF21R0Q;ix)\v^yJqszv;c8H;hK!QLpM#eanH(0@@WJ
2024-11-25 12:49:34 UTC	16384	IN	Data Raw: ea 81 cb 13 ce 23 5e 7f bc 45 61 e9 71 c9 ab e8 17 7a 7f 84 00 f0 6f 81 a0 18 d4 f5 bb c7 c4 f7 df ef b0 e4 93 da 24 fc 4f 35 8b 7c c7 4c 52 8a 1f 62 d0 e8 be 22 fb 3e 82 3f e1 3b f8 8b 74 e4 4d 7f 22 f9 d6 ba 7b f7 d9 9e 25 71 fd e3 f2 af 3e 94 9e 65 af 87 7c 4a 42 7f c5 7f f1 22 ee 4c 33 36 6e 2d 6c a5 f7 ff 00 9e ce bc f0 3e 55 fc 29 9a 5b 4b a9 e8 d7 5a 47 c3 e4 5f 0b f8 4a 05 03 55 f1 26 a0 de 5c d7 2b df 2e 39 55 3d a3 4e 4f 19 ef 53 68 37 b3 4f 04 de 15 f8 37 61 25 9d b1 8f 1a a7 89 6e f1 1d c4 89 fc 4c 1f a5 bc 5c 74 e1 8e 4e 7d 28 1d ee 41 ae 36 97 e1 7d 6a 5d 5f c7 17 47 c6 fe 3d 99 81 4d 31 a4 df 6d 66 c7 a7 9c c3 3b 88 ed 12 e0 0e 07 1c 62 3d 76 c5 d2 ee 3f 15 fc 63 d4 a7 b9 bf 9a 3d fa 77 87 ad 98 2c ac 9f c2 0a af 10 45 d3 dc 8c fb d1 e1 db Data Ascii: #^Eaqzo$O5\|LRb">?;tM"{%q>e\|JB"L36n-l>U)[KZG_JU&\+.9U=NOSh7O7a%nL\tN}(A6}j]_G=M1mf;b=v?c=w,E
2024-11-25 12:49:34 UTC	16384	IN	Data Raw: 26 91 a5 af 66 5b 7f 3e 5f fb ee 4d dc fd 00 ac 7d 5b 5d f1 36 ad 84 d5 75 4b eb 98 49 c0 8a 49 08 4f fb e7 a7 e9 5b 26 de d2 de 65 66 74 5e 3d 05 56 bb b8 b4 66 52 bf 39 43 9e 6a 9d 04 b5 6c cd 55 7d 11 9f 67 a5 3c 80 87 23 1d 87 5a d6 d3 b4 84 59 3a 3b 71 83 93 8a af 6d 7d 75 2d d9 8e de d9 d8 b7 dd 0a a5 c9 fc 00 ae 86 d3 c3 3e 2d 99 3e d5 71 61 35 95 b1 1f eb 6e d9 6d 90 0f ab 91 57 cd 4a 0a c2 5e d1 9c 56 a5 a7 59 c5 76 ec e6 28 86 7a f0 2a 95 c5 d6 97 14 4c 3c cd f9 04 0d a0 b5 6b eb 1a 0f 86 a1 bb 91 b5 ef 1e 69 d1 b6 ed de 4e 9f 0c 97 d2 7d 37 2e 13 f5 35 95 fd a5 f0 f2 ca 5d b6 9e 1f d7 b5 d7 e8 24 be bc 5b 58 c9 f5 f2 e3 05 bf 36 15 e7 cb 11 1b b5 14 74 46 8b 6d 36 cf 9b d7 22 43 db 9a db d3 89 da 3d ab 1e 7c 1b b9 8a a6 c0 64 6c 2e 7a 0c 9e 2b Data Ascii: &f[>_M}[]6uKIIO[&eft^=VfR9CjlU}g<#ZY:;qm}u->->qa5nmWJ^VYv(z*L<kiN}7.5]$[X6tFm6"C=\|dl.z+
2024-11-25 12:49:34 UTC	16384	IN	Data Raw: df 81 22 90 00 c9 a3 f0 0f fb f8 ff 00 d9 6b cd 35 bd ad 7c c8 47 dd c7 e7 80 2b cd c5 3b c9 9d 74 17 2a 20 8e 65 20 72 32 7d f9 15 bb e1 c9 55 9a 63 e9 b4 57 31 04 6a f3 91 9c 62 a5 12 5f 5a 9c 59 33 8c 9c be 06 73 8a e6 84 ad 23 79 42 e8 eb e2 c3 12 5b a8 26 b9 56 d6 31 75 3a 34 60 a8 95 f1 cf bd 47 1e ab ab c0 41 71 bf 27 90 c9 81 cd 46 b6 32 31 96 5f 94 92 4b 0c 1e 9c d5 ce a5 d6 82 8c 15 ee 5f b2 d6 ed c4 aa bb 1f 05 80 2d 9e 05 5e d2 fc 3d 25 fb 79 c5 e4 58 87 22 4e 07 d7 f9 9a ab e1 df 0e 4b 7a 5a ee e4 88 6c a2 24 bc ad 80 0e 06 48 19 f4 ee 6b 66 e7 50 9f 56 9e 3d 32 d6 d9 e6 b3 98 79 90 58 c7 27 94 f7 a8 a3 fd 64 b2 1e 21 b7 18 e4 9c 16 00 f6 ac 65 2b ad 4d e9 c3 51 97 7a ba a6 9c ba 36 88 b7 11 59 cb 27 92 65 b3 52 d7 3a 83 f0 3c 9b 61 df a1 dd Data Ascii: "k5\|G+;t* e r2}UcW1jb_ZY3s#yB[&V1u:4`GAq'F21_K_-^=%yX"NKzZl$HkfPV=2yX'd!e+MQz6Y'eR:<a
2024-11-25 12:49:34 UTC	16384	IN	Data Raw: 1d bf 2a 7c f6 a4 5b be 48 fb be 94 72 a5 b2 0b 99 9a a6 b9 ad 8d 4a e5 45 e5 c1 8f cc 3b 41 63 c0 f4 eb 55 a7 b9 bb 71 cb 8e 63 04 10 3b d5 cd 4a 1c de c8 5a 4c 6e c1 e8 3d 05 33 ec e2 46 44 56 91 89 50 30 3f fd 55 48 61 e1 b3 30 9a 77 66 2e cb 1f ca 0f d7 9a e8 a1 60 d0 a3 03 f7 87 15 43 48 d2 e7 8e 4d fe 54 a3 70 2a 06 4e 6b 73 4f f0 fe a7 2a 47 1c 3a 75 c4 a5 b7 15 01 0b 71 9a e0 af 17 cc 77 50 92 e5 33 f7 62 43 92 07 e3 4a ec 33 f7 d7 f3 ae a6 d3 e1 ff 00 88 e5 60 c7 4b 31 03 de 42 ab fd 6b 52 1f 86 7a c1 1b ae 2e 2c ad 87 5e 5c 9f e4 2b 0e 56 6d ed 22 ba 9e 69 ad 95 3a 5d c8 27 aa 0c 11 fe f5 51 d3 12 28 a0 c2 a9 f9 87 2d 8e b5 ea 3a ef 84 3c 39 a5 e8 f7 33 6a fe 29 80 85 43 98 6d c0 79 0f b0 5c e7 f3 15 e6 b0 cf 04 bb 8d ba 48 b1 67 e5 0e 72 c0 76 Data Ascii: \|[HrJE;AcUqc;JZLn=3FDVP0?UHa0wf.`CHMTpNksO*G:uqwP3bCJ3`K1BkRz.,^\+Vm"i:]'Q(-:<93j)Cmy\Hgrv
2024-11-25 12:49:34 UTC	16384	IN	Data Raw: 8d d5 a3 13 87 9b c0 96 80 b0 8f 57 94 2e d1 8d d1 03 93 8f 40 71 fc eb 9f bd f0 fe b1 a6 5e c3 25 b8 79 1b 7e 22 9a 0c 82 0f 6f a5 7b b6 9f e1 fd 01 01 fb 4f 88 62 ba 7e 0e db 6b 39 5b 03 1e ad 81 52 4c de 0a b1 62 02 6a 17 44 75 e1 22 fe 5b bf 9d 34 85 ed 0f 3b d2 2f 35 6b 98 9c 5e 4a ce d1 80 99 20 e4 9f 5f 6a 5d 59 5a 3d 03 53 56 91 9b f7 0d f2 93 d3 22 bb 2b 8d 77 c3 d2 5c c7 f6 78 4d 9d aa 9f de 00 c5 a4 71 c7 ca 1c 82 17 38 ec b9 ae 0f e2 97 8e b5 29 35 3d 4b 44 d1 ec b4 fb 2d 23 60 87 2b 65 1c d2 ba 95 e4 99 99 4b 7a f4 c5 4c af 61 d3 69 b3 8b f0 ed ad c5 e5 ac f0 db 41 2c f2 19 23 3b 23 42 ec 47 d0 73 5e db 69 e1 af 10 4b 12 30 d1 af d4 6d e4 b4 0c 83 f3 60 2b c3 3c 3f ae 78 93 48 82 e5 74 2d 5b 53 d3 e3 9b 6f 9e 2d 2e 1a 20 f8 ce 37 15 23 3d 4d Data Ascii: W.@q^%y~"o{Ob~k9[RLbjDu"[4;/5k^J _j]YZ=SV"+w\xMq8)5=KD-#`+eKzLaiA,#;#BGs^iK0m`+<?xHt-[So-. 7#=M
2024-11-25 12:49:34 UTC	16384	IN	Data Raw: f8 d6 6c de 1c bc b6 89 e5 d5 3c 43 61 62 18 ae c8 a2 97 cf 94 f1 d3 f7 79 00 ff 00 bc c2 b4 7c 41 a1 f8 af 56 5b 79 b5 cb 93 6e 81 46 f7 d5 af d6 20 0f 3f c3 23 64 fe 0b 50 5c e8 fa 0d a2 ef bc f1 24 37 33 22 e0 41 6d 1b c9 d8 e0 6e 6d a0 76 e7 9a d5 b3 22 3f 04 ea b7 da 5c 71 be 9b 63 79 76 81 1a 59 08 73 85 c3 00 78 55 ce 39 1f c4 3a d7 ac f8 4b e2 5e 9f a9 ab db 5d 41 15 9d ca a2 9f 99 41 3c fd 73 fa 7e 35 95 f0 25 ad 96 da d9 63 85 5c 8b 02 5c bb 31 1b 8b 28 20 0e 07 a5 74 1e 2c f0 95 a6 a3 15 c5 c6 8e 21 d2 af 9b 0c 24 86 15 c3 36 7b f1 90 7d c1 ae 88 b9 2d 4e 77 28 49 da 48 ea 2d 26 ba bb 88 c9 1b bc 8a dc a9 5e 54 ff 00 4a f3 7f 12 7c 39 ff 00 84 92 1d 62 f1 2e a3 b2 d4 16 f9 f6 6e 90 04 95 40 00 06 0b 92 3b f3 59 ba 25 f7 c4 0f 0a de b5 a6 b1 15 Data Ascii: l<Caby\|AV[ynF ?#dP\$73"Amnmv"?\qcyvYsxU9:K^]AA<s~5%c\\1( t,!$6{}-Nw(IH-&^TJ\|9b.n@;Y%
2024-11-25 12:49:34 UTC	16384	IN	Data Raw: 35 1f c8 56 06 a5 f1 a3 c7 37 84 f9 de 33 d6 fd 84 73 b2 8f d0 d2 f4 29 b4 7a b7 fc 32 46 b6 49 dd ae d8 a6 7d 11 8f f4 a9 17 f6 48 ba 53 99 fc 4f 6c 9e a4 40 7f c6 bc 22 f7 e2 17 88 2e d8 9b 8f 12 eb d3 7a 86 bc 93 ff 00 8a ac c9 fc 45 34 dc cd 77 7d 29 3d 4b ca 4f f5 ad 6e 65 a3 7b 9e f9 ab fe ce 9e 16 d1 17 76 b3 f1 16 ca d7 d1 7c b5 2c 7e 83 76 7f 4a a3 17 c1 2f 05 cc a1 a0 f1 dd a0 8b bc b7 37 56 f0 2f e5 bc b7 e8 2b c2 1f 51 b7 6e 4c 4e ff 00 ef 10 69 45 ec 3b 41 fb 39 c8 e9 cf 4a 43 b1 ed 7a b7 c3 cf 84 9a 12 e3 53 f8 86 b7 f3 8e 90 e9 ea b2 1c ff 00 bd 9c 0a 8e d7 c1 bf 09 ee e1 f3 9f c5 b1 69 d1 11 ff 00 2f 17 82 59 3f 14 48 f8 ff 00 be ab c5 5a f1 48 1b 60 1d 7a 13 56 be d8 db 4e 22 18 2b c6 4d 08 2c 7b a6 9f e1 9f d9 ee c4 67 51 f1 85 c5 fb 8f Data Ascii: 5V73s)z2FI}HSOl@".zE4w})=KOne{v\|,~vJ/7V/+QnLNiE;A9JCzSi/Y?HZH`zVN"+M,{gQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49743	34.193.227.236	443	7976	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:49:51 UTC	1473	OUT	GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1 Host: p13n.adobe.io Connection: keep-alive sec-ch-ua: "Chromium";v="105" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 x-adobe-uuid: a4ecfc44-3976-4051-8c45-0a7e26b55a37 x-adobe-uuid-type: visitorId x-api-key: AdobeReader9 sec-ch-ua-platform: "Windows" Origin: https://rna-resource.acrobat.com Accept-Language: en-US,en;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://rna-resource.acrobat.com/ Accept-Encoding: gzip, deflate, br
2024-11-25 12:49:51 UTC	617	IN	HTTP/1.1 429 Too Many Requests Server: openresty Date: Mon, 25 Nov 2024 12:49:51 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Headers: Authorization, Content-Type, X-Api-Key, cache-control, User-Agent, If-None-Match, x-adobe-uuid, x-adobe-uuid-type, X-Request-Id Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: x-request-id Retry-After: 1 X-Request-Id: TlApeRxzXmus3bG1aLhkzrwj2i8GUx8x Strict-Transport-Security: max-age=15552000; includeSubDomains
2024-11-25 12:49:51 UTC	65	IN	Data Raw: 33 36 0d 0a 7b 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 22 34 32 39 30 35 30 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 22 7d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 36{"error_code":"429050","message":"Too many requests"}0

Target ID:	0
Start time:	07:49:29
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://customers.pressrelations.de/apps/nrx/files/stored_files/F867FA34-FAAA-EF11-84B9-D4F5EF0B30A8" > cmdline.out 2>&1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:49:29
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:49:29
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\wget.exe
Wow64 process (32bit):	true
Commandline:	wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://customers.pressrelations.de/apps/nrx/files/stored_files/F867FA34-FAAA-EF11-84B9-D4F5EF0B30A8"
Imagebase:	0x400000
File size:	3'895'184 bytes
MD5 hash:	3DADB6E2ECE9C4B3E1E322E617658B60
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:49:38
Start date:	25/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\download\ medienspiegel_25.11.2024.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	07:49:40
Start date:	25/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	07:49:40
Start date:	25/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1616,i,15777726874990857100,5183867942386221178,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://customers.pressrelations.de/apps/nrx/files/stored_files/F867FA34-FAAA-EF11-84B9-D4F5EF0B30A8

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1e9c204a-0b62-4cf8-86c3-d0114ac74de4.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6cc77f8d-62a6-4bee-995f-093f83924f45.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF501b33.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241125124945Z-187.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

C:\Users\user\AppData\Local\Temp\MSIf0e38.LOG

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-25 07-49-42-504.log

Windows Analysis Report
https://customers.pressrelations.de/apps/nrx/files/stored_files/F867FA34-FAAA-EF11-84B9-D4F5EF0B30A8